@llblab/pi-kit 0.38.3 → 0.39.0

package/CHANGELOG.md

@@ -2,6 +2,16 @@
 
 All notable changes to `@llblab/pi-kit` are documented here.
 
+## 0.39.0: Bundled Package Updates (2026-11-08)
+
+- `Exact pins`: `@llblab/pi-actors` 0.55.0 → 0.56.0.
+- `Packaging`: Synchronizes the lockfile, bundle aliases and README inventory. Package membership and resource order remain unchanged; packed validation does not certify extension safety or installed-client behavior.
+
+## 0.38.4: Bundled Package Updates (2026-11-08)
+
+- `Exact pins`: `@llblab/pi-codex-usage` 0.13.2 → 0.13.4.
+- `Packaging`: Synchronizes the lockfile, bundle aliases and README inventory. Package membership and resource order remain unchanged; packed validation does not certify extension safety or installed-client behavior.
+
 ## 0.38.3: Bundled Package Updates (2026-11-01)
 
 - `Exact pins`: `@llblab/pi-state-flow` 0.27.1 → 0.27.4.

package/README.md

@@ -12,10 +12,10 @@ Package links lead to the owning repositories for usage, documentation, issues,
 
 | Package | Version | Purpose |
 | --- | ---: | --- |
-| [`@llblab/pi-actors`](https://github.com/llblab/pi-actors) | `0.55.0` | Inspectable local Runs, reusable Recipes, persistent tools, and delegation Skills |
+| [`@llblab/pi-actors`](https://github.com/llblab/pi-actors) | `0.56.0` | Inspectable local Runs, reusable Recipes, persistent tools, and delegation Skills |
 | [`@llblab/pi-claude-usage`](https://github.com/llblab/pi-claude-usage) | `0.2.5` | Claude subscription quota status and shared per-model Fast toggle for Opus, mirrored in Telegram |
 | [`@llblab/pi-clean-room`](https://github.com/llblab/pi-clean-room) | `0.3.1` | Isolated nested Pi TUI with named npm extensions and compatible model selection |
-| [`@llblab/pi-codex-usage`](https://github.com/llblab/pi-codex-usage) | `0.13.2` | OpenAI/legacy Codex subscription quota and Business credit status, with persistent priority Fast toggle mirrored in Telegram |
+| [`@llblab/pi-codex-usage`](https://github.com/llblab/pi-codex-usage) | `0.13.4` | OpenAI/legacy Codex subscription quota and Business credit status, with persistent priority Fast toggle mirrored in Telegram |
 | [`@llblab/pi-grow-loop`](https://github.com/llblab/pi-grow-loop) | `0.9.0` | Visible continuation scheduling and bounded worker Skills through compiled, manifest-owned resources |
 | [`@llblab/pi-state-flow`](https://github.com/llblab/pi-state-flow) | `0.27.4` | Scoped context/memory compiler with step-independent current memory, stable Passive/Active modes and visible blocked-state status |
 | [`@llblab/pi-telegram`](https://github.com/llblab/pi-telegram) | `0.58.3` | Telegram companion with per-prompt Steer, queued controls, Reroute/Restore, recoverable connections, previews, follower Threads, files, and voice |

package/node_modules/@llblab/pi-actors/AGENTS.md

@@ -9,7 +9,7 @@
 - `BACKLOG.md`: canonical future-only work.
 - `CHANGELOG.md`: completed delivery history.
 
-Do not make normal-use Skills depend on README/docs, do not copy Skill operating manuals into the system prompt, and do not present implementation evidence as the agent operating path. Keep these surfaces distinct and reconcile them after meaningful changes. Every release section, historical or new, keeps at most 8 outcome records of at most 512 characters.
+Do not make normal-use Skills depend on README/docs, do not copy Skill operating manuals into the system prompt, and do not present implementation evidence as the agent operating path. Keep these surfaces distinct and reconcile them after meaningful changes. An explicitly unadopted proposal is not authority to add kernel interfaces, timing/native authority, platform requirements or default activation; honor its approval/evidence gate and keep independently authorized backlog work separate. Every release section, historical or new, keeps at most 8 outcome records of at most 512 characters.
 
 ## Concept
 
@@ -22,11 +22,17 @@ Run = Recipe + Trace + Control
 
 An actor is any runnable local capability, including a script, tool, service, pipeline, or subagent. Recipes define actors' reusable execution. Runs are concrete actor instances and own one generation of execution and evidence. Trace owns observations. Control owns actor-local inputs for services that actually consume them. `register_tool` persists capabilities separately.
 
-Public Run verbs remain `spawn`, `message`, and `inspect`.
+Public Run verbs remain `spawn`, `message`, and `inspect`. Agent Experience (AX) is a project-wide design principle: structured, visible, decision-relevant context that both the agent and the human can read, between raw machine data and unstructured prose. The [AX standard](docs/agent-experience.md) governs presentation across surfaces without changing their data or authority contracts.
+
+The adopted presentation direction is **JSON structured inputs → block-YAML runtime-output metadata + unchanged authored text/Markdown**. This covers tool/launch/status/Control/inspect/error/notification/completion output, not only Actor results. Metadata-only receipts are bare YAML without `---` or a code fence; use opening/closing `---` only when a separate selected text/Markdown body follows. Framing depends on body presence, not synchronous versus asynchronous execution. Keep exactly one visual blank line between host-owned tool invocation header/arguments and response, including errors; this is boundary spacing, not a reason to rewrite selected content, echo private inputs or add YAML delimiters. Do not invent a Markdown-list pseudo-object grammar or serialize runtime objects as JSON strings inside YAML. SDK/Recipe input contracts, machine DTOs/journals/native wire formats and literal source content remain separate. YAML rollout is pending, not a claim that current emitters or a loaded host conform; preserve old saved bytes/codecs, exact content, privacy/generation fences and budgets, and gate service-framing migration on equivalent boundary/correlation/replay evidence.
 
 ## Core Structure
 
-Require Pi ≥1.0.0 for all declared Pi peers. Keep source and packed lifecycle tests aligned with that baseline; do not restore an older host floor independently of those checks. Validation fixtures must use temporary agent directories, never write into the operator's live Recipe registry.
+Consolidate cohesive responsibilities into existing owners before creating another domain. A new domain needs a distinct responsibility and useful boundary; size, filename prefixes or development phases do not justify splitting.
+
+Tests mirror the owning library/module/domain by default: prefer `tests/<module>.test.ts` for `lib/<module>.ts`, with contract/case groups inside that file rather than new files per feature, edge case or development cohort. When a module is consolidated or moved, reconcile its test ownership instead of retaining orphan test-file names. Explicit cross-domain exceptions include invariants, source/packed SDK journeys and their infrastructure fixtures; keep the reason clear and do not turn exceptions into another fragmented suite taxonomy. Consolidation must preserve scenarios, assertions, fixture data, pre-import isolation and teardown guarantees; move tests, never delete coverage to fit the layout. `tests/invariants.test.ts` guards file mirroring with explicit cross-domain/package exceptions, not feature-file exemptions. Serialize environment-changing contract groups; when defaults are captured at import, one isolated agent root must precede production value imports and outlive every group. Preserve native/per-case cleanup and retain uncertain state; root cleanup must not run between awaited groups. Native identity fixtures must establish actual child readiness before expecting a stable readable command identity; spawn notification alone is insufficient. Use the immediate capture owner only at its original birth boundary or an explicit controlled-child ready message, never late retry/reconstruction to promote unproven proof. Retain actual PID/identity/close evidence and require fresh ESRCH for captured child absence; a live host cannot self-certify its own exit.
+
+Require Pi ≥1.0.0 for all declared Pi peers. Keep source and packed lifecycle tests aligned with that baseline; do not restore an older host floor independently of those checks. Validation fixtures must use temporary agent directories, never write into the operator's live Recipe registry. Standard test/preservation/conformance processes preload tests/test-environment.mjs before product imports, forcing a fresh default agent directory even if the operator configured one. Use that preload for direct launcher tests too; retain its directories because test-runner exit alone does not prove inherited Run exit. Direct installed-package tests also require npm_execpath from an actual npm invocation or the pinned real npm CLI; a missing value is caller setup failure, not native product evidence. After editing an executable .mjs fixture, run node --check and its exact owning installed test before broad validation; TypeScript-only checking does not parse that fixture. A syntax failure can prevent child manifest persistence: retain the parent's captured frame and complete stdio/actual close, never claim all planned child frames materialized. Result acceptance is not runner exit: settle captured fixture producers before removing their state, and never treat a denied probe or elapsed wait as exit proof. Same-runtime producer fixtures cannot self-certify host exit: the parent captures the producer PID/frame before awaiting it; child manifests leave producer exit unasserted and settle only workload evidence. Distinguish privileged same-runtime launch composition from ordinary startRun/SDK or caller/worker acceptance. Durable settled receipts alone do not authorize parent cleanup: after validating positive safe captured PIDs, require a fresh ESRCH-only probe immediately before deleting fixture state; live/denied/unknown probes retain state and preserve the primary failure plus exact probe causes. Concurrent fixture workloads may finish in a different order from launch; verify exact generation membership independently of launch order, and rendered row order against the captured inventory. Force byte overflow from actual projected row sizes, not full-source byte sizes; verify each captured generation's exact binding even when content hashes repeat across Runs. Prove row-cap omission with an independent byte upper bound including the omitted minimal row, not merely 64 visible rows. Disclose synthetic legacy companions and controlled fixture timestamps separately from real public producers; they grant no body/native/fan-out authority. Failed-outcome witnesses must distinguish actual command code/canonical acceptance from detached runner exit, compare diagnostic projection/counts to canonical error metadata rather than raw stderr, and scope redaction/fallback assertions to delivered outcomes rather than prior model-owned tool arguments. Preserve the provider's original rejection before SDK error normalization can obscure it with a missing-final-answer assertion.
 
 ```text
 Pi host
@@ -44,24 +50,48 @@ Pi host
      -> README.md / docs/*            human product guidance
 ```
 
-`index.ts` wires Pi ports and must not own domain behavior. Keep the local TypeScript import graph acyclic. For architecture-affecting work, load and follow `.agents/skills/domain-dag/SKILL.md`; its validator is local agent tooling, not an npm, CI, or release gate.
+`index.ts` wires Pi ports and must not own domain behavior. Keep the local TypeScript import graph acyclic. Prefer cohesive existing owners over per-phase or per-iteration modules; file size alone does not justify extraction. Earn new files through a real ownership, dependency, authority or reuse boundary. Colocation must preserve distinct typed admission/privacy contracts, not collapse them into generic helpers or broad facades. For architecture-affecting work, load and follow `.agents/skills/domain-dag/SKILL.md`; its validator is local agent tooling, not an npm, CI, or release gate.
 
 The committed `dist/` tree is required for npm and git package installs. `npm run build` compiles into a temporary candidate and atomically replaces the distributive; `npm run build:check` must reject source/artifact drift without rewriting the working tree.
 
+Unit-owner files may construct real SDK sessions. Under a zero-SDK-session bound, do not use a broad negative `--test-name-pattern` as an execution guard: Node24 matches test ancestors, including `<root>`, and can admit forbidden leaves. Before execution, prove the declaration/import/ancestor closure with explicit positive leaf names and/or supported `--test-skip-pattern` exclusions. If exclusion is unproved, stop. Budget session-only lifecycle constructors separately from public fixture Runs and driver/provider/reopen sessions; passing logs never retroactively authorize excess.
+
+CI fixtures must preserve native path semantics: Windows ESM preloads use file URLs, executable paths obey shell-free quoting, and synthetic absolute model paths are drive-qualified with JSON-escaped reference assertions. Observe actual lifecycle-lock removal in race fixtures: Windows removes directly, POSIX renames before removal; do not key a portable race solely to one syscall. Keep physical fixture paths within platform limits and force encoded-budget overflow through valid data. Fixture watchdogs and CI job budgets do not alter product deadlines or prove native exit/closure.
+
+Windows inventory identity sharing is confined to one synchronous default inventory acquisition under the [adopted fresh-query contract](docs/coordinator-delivery.md#invocation-local-windows-identity-observation). Bind and revalidate original metadata/ownership/physical frames, discard changed admitted rows without fallback rebinding, and never treat missing CIM data as absence. Direct status, snapshot callback bracketing, publication, Control and teardown remain independently fresh; no native map/reader may escape to another invocation or callback. Non-Windows and unsupported legacy readers keep scalar behavior. Pre-query ESRCH may select optional identity acquisition only: never reuse it as assembly liveness/status, and keep original-frame scalar fallback if that PID becomes live.
+
 ## Key Domains
 
-- `extension-runtime.ts`: low-level Pi session lifecycle, tool adaptation, and runtime service composition behind the thin `index.ts` event-registration root.
-- `command-templates.ts`: portable synchronous execution graph.
+For ordinary Run-file investigation, follow the accepted [same-session research contract](docs/run-supervision.md#same-session-file-investigation): Kernel supplies a root-first map to the owning logical Pi session, including resume after restart; the agent uses ordinary file tools without a separate original-producer/publication capability. Bind the actual active Pi session and exact owned Run/generation, not actor text or a caller's owner string. Do not make old process/sessionManager retention or private curated-view verifier admission a prerequisite for that map/read route. This research route does not transfer scope to another logical session, certify raw files as original-private projections, alter automatic curated previews/history, or reconstruct timing/work/native authority. Do not implement or activate it from a documentation-only cohort.
+
+- `extension-runtime.ts`: low-level Pi session lifecycle, tool adaptation, and runtime service composition behind the thin `index.ts` event-registration root. Its kernel-only opt-in supervision epoch pins the original sessionManager object, not a fresh SDK context wrapper or copyable session id. Keep startup readiness/replacement/disposal revocation separate from UI callback failure and busy/idle events. Propagate only the pinned fresh-launch observer through spawn/async tools and review adapters; never serialize it, reconstruct an origin, arm a controller or enable default/public reporting. Known invalidated contexts use cached identity; fresh wrappers may match only the original manager. Host shutdown must precede invalidation: AgentSessionRuntime emits that event, bare AgentSession.dispose does not. Real SDK fixtures must distinguish these paths and settle captured fixture processes before teardown; default parent teardown has its own current-manager/lifetime binding, independent of UI failure and completion-stream opt-in. Consume it before cleanup, recheck replacement around fallible cleanup, and refuse stale/retired/reused-manager lifetimes even when logical ids match. Controlled overlapping-start tests that deliberately reuse a context/manager must clean up through a fresh valid manager lifetime, not weaken shutdown refusal. Track exact owned watcher closure and natural test-process exit; never force exit or unref a leak. This repairs routing, not native closure, crash supervision or PID-bound host ownership.
+- `command-templates.ts`: portable synchronous execution graph and managed stream capture. When canonical stdout persistence completes, its existing settled-attempt callback retains a kernel-only SHA-256 of the observed raw bytes, before memory-tail clipping. Never serialize that raw digest into actor results/manifests or mistake it for UTF-8, privacy, work, native-close or publication authority; partial persistence emits no such digest.
 - `recipes-references.ts`, `recipes-discovery.ts`, `recipe-control.ts`: Recipe resolution, imports, shadowing, and Control declarations.
-- `async-runs.ts`: lifecycle facade.
-- `runs-start.ts`, `runs-status.ts`, `runs-control.ts`, `runs-control-delivery.ts`, `runs-controls.ts`, `runs-trace.ts`, `runs-process.ts`, `runs-retention.ts`, `runs-parent-teardown.ts`: focused Run internals.
-- `execution-sessions.ts`, `trace-projection.ts`, `control-projection.ts`, `session-evidence.ts`: bounded/redacted execution and inspection evidence.
-- `tools-message.ts`: exact Control facade.
-- `tools-inspect.ts`: exact `run:<id>`, `runtime`, `recipes`, and `tool:<name>` inspection.
+- `async-runs.ts`: lifecycle facade. The common startRun return registers fresh launches and compatible singleton attachments only after successful lifecycle release; prepare-only internal calls remain excluded. Catalog refusal is a separate launch-return observation: no rollback/retry/result/Trace rewrite, raw error stays non-enumerable and Kernel-local, and public adapters copy enumerable metadata only. Do not persist that warning/cause as Run truth or infer lasting catalog unreadability from it. Assemble fallible launch metadata (including Recipe context, artifact expansion and transport normalization) before admission handoff, retained-evidence cleanup or capture acquisition, including the no-observer path; invalid preparation must preserve prior evidence and open no captures. Its opt-in kernel `onSupervisionClockCaptured` handoff then runs under ordinary fresh-generation admission before cleanup/publication/spawn; retain the exact origin in the caller process, never serialize it or treat it as a started/work/scope receipt. Ignore ordinary synchronous return values; reject deferred observers without awaiting under the lock. Singleton/legacy reuse and prepare-only paths do not recapture/emit. The existing kernel handoff may also carry the original opaque snapshot-reference reader minted from full prepared metadata, never raw metadata or a serialized privacy flag. No default registry, controller or public policy is enabled. sendRunControl now preserves its exact single surfaced rejection and, if lifecycle release also throws, ordered standard non-enumerable AggregateError errors/cause without coercing or flattening original values. A release-only fault stays exact; no missing id/result is invented and prior handled/delivered facts remain independent. Keep return await and its full endpoint/generation lifecycle-lock interval unchanged: this cause preservation does not implement B2's future unlocked transport protocol, prove release/native closure or recover errors already masked by a lower journal helper.
+- `run-supervision.ts`: supervision policy, stored clocks, runtime-local origins, monotonic timing and bounded deadline wake protocol. Policy/clock decoding stays pure. Capture exact origins at admission; copied/serialized origins or metadata cannot reconstruct continuity or renew allowance. Default performance.now and its module-local epoch are runtime-relative: never mix caller/worker samples or treat timeOrigin/wall alignment or an IPC packet as the original capability. A future live carrier needs reviewed clock-domain/issuer/lifetime proof; delivery time is not first-natural time. Snapshot monotonic fields once, freeze policy and share first clock uncertainty across handles without erasing proven due facts or falling back to wall time. One idempotent, non-restarting controller rechecks exact identity/clock, revokes callback tickets before cancellation and preserves cleanup uncertainty. Disabled deadlines create no timer; due facts grant no stop, closure or delivery authority. Ports stay synchronous/kernel-only, never awaited model/work hooks. Canonical state admission, retaining owner/registration, independent supervisor/recovery, terminal timing and native enforcement remain separate.
+- `runs-supervision.ts`: canonical clock/frame admission and explicit runtime-local supervision owners. Retain exact origins without timers; activate through a cooperative weak same-origin claim shared by participating owners in this module/runtime. Retain optional snapshot references only through the source owner's original private-brand reader bound to exact root/owner/generation; first binding including absence cannot be repaired or replaced. Separate observeReferences consumes that original capability without clock/process sampling, timers, controller claims or body reads. Reentrant revocation discards observations; stop/release/close revoke this owner's consumption, not every separately retained original capability. Missing legacy reference permission stays missing. Reserve before canonical assembly; no takeover until explicit release/close, and failed assembly releases only its own reservation. Pin the origin's first identity/state/frame across owner lifetimes, preserve elapsed allowance and reject copied-state rebinding. Stop is final; release revokes callbacks and removes retention, preserving cancellation uncertainty even after reentrant close. Snapshot reads do no IO/time sampling. Separate observeTime explicitly admits current canonical clock/frame and samples the exact retained origin with basis since_admission; it advances shared monotonic/fault observations, never creates an origin, claims/starts a controller, arms/notifies, proves liveness or freezes terminal duration. Separate captureNaturalTime requires the original active postcommit natural admission and retained origin; its first authorized attempt is final across participating same-origin owners, including unproven failure. Reentrant capture cannot sample again. observeFrozenNaturalTime reads that original fact with fresh owner/clock/frame fences, never current time/native/result evidence; historical acceptance is not current lifecycle. Stop/release/close revoke local consumption without resetting the first frozen fact or allowance. Recheck retention/stop/close/frame before and after source callbacks; discard revoked samples, preserve sticky uncertainty/due facts and leave snapshot() pure. Its unchanged() fences observations without resampling time, not global immutability. Explicit observeSnapshot joins shared canonical facts through this owner's original time/reference methods, checks both source/lifetime fences around pure projection, and substitutes only admitted captured cwd/index, never raw canonical reference fields. Missing/withheld cwd refuses the card; unavailable index stays null. Natural terminals require the original frozen first-natural sample, never live elapsed; absent capture stays timing_unproven. This compositor is readonly, not pure: active admission probes the supported captured PID and may advance original clock observations; returned fences do neither and do not certify future liveness. No default/public route or caller-to-worker timing bridge is implied. No default watcher, exclusivity for distinct origins/modules/processes or low-level unregistered constructors, restart reconstruction, work/stop mutation or native authority.
+- `runs-snapshot.ts`: bounded data-only projection of admitted observation facts and curated references; not evidence admission, clock measurement, reference authorization or native authority. `runs-status.ts` separately admits kernel-local canonical facts via shared identity/index/outcome owners. Its three-argument default remains metadata-only/probe-free and never invents active/terminal timing. Optional fourth kernel port must be the original retained owner's observeTime, never actor configuration or a cached DTO. Explicit active join requires supported captured-PID proof before/after state-bound sampling and exact pending-stop/capture correspondence; unknown proof stays unproven, no legacy flag/age/forced-closure inference. Optional fifth kernel port must be the original owner's observeFrozenNaturalTime, not actor data or a cached DTO; join only the exact canonical natural identity/code/status/completedAt with the previously frozen sample and literal-true synchronous source fences. Natural observation never samples live time. Fact availability is not renderable snapshot or cwd/index visibility/body permission. Keep observation fences/strict input budgets distinct from durable immutability and source-body permission.
+- `runs-index.ts`: existing shared Run-directory discovery/index/rebuild owner. Reuse it for the accepted [navigation catalog](docs/run-supervision.md#shared-run-directory-catalog), not a second registry: logical session → Run → latest-registration-first unique real directories with generation, cooperative locked fresh-read/merge/atomic publication and session-filtered navigation. The private registerRunStateDirectory and rebuild now share that metadata-only writer, admitting actual generation/root observations before publication and rechecking source frames under the lock and before rename. Legacy listRuns fallback remains inventory-only and must never overwrite damaged/unreadable catalog bytes; strict mutation initializes only true absence. Full status/discovery callbacks stay outside the catalog lock. Readonly readRunSessionNavigation filters exact trusted-session rows before directory probes, revalidates generation/root frames and returns a bounded root-first location map, not evidence bodies or a complete cross-session descendant tree. Only explicit runtime/runs verbose inspection delivers that session-wide map. Selected-Run launch locations reuse the same physical role observer through readRunDirectoryNavigation without a catalog/body read; tools-access selects/rechecks the actual current logical session and bounds failures after committed work. Compact response formatting alone never reads/adopts files or turns these DTOs into authority; whole-row/field omission stays explicit under the shared card budget. Terminal reference composition now uses those per-Run observations at fresh current-session admission; default snapshot/status/reporting remain separate open integrations. The user-adopted dual priority reuses already observed failed inventory identities only as ordering data: ordinary projection keeps root-group registration recency with failed child-subtrees first, while explicit status=failed verbose investigation also prioritizes failed root-subtrees without filtering navigation. Match full run/generation/owner/directory to independently admitted map nodes, propagate only through available same-session ancestors, stable-partition peers and preserve ancestor-before-descendant and whole-row budgets. priority.basis=observed_failed_rows is not complete/current terminal or membership truth. Only successful current status-observer returns supply hints; preserve legacy inventory fallback separately without promoting it into ranking. Do not re-read status/bodies/native state for ranking, trust cached catalog status, add a new registry or reorder catalog bytes. Keep the map's scan/probe-free contract separate from legacy inventory/status behavior. Its file_inventory_scope=canonical_starting_locations and per-file format_hint describe navigation coverage/expected layout, never full file inventory, syntax/UTF-8 validation or complete primary output. Select recorded capture details via the mapped execution manifest and ordinary tools; do not eagerly enumerate bodies or create a mandatory custom reader/export gateway. Catalog entries locate directories, not current status: inventory observes each selected directory through the existing status owner before display/filtering, outside catalog locks, and never rewrites registration order or falls back to cached status when that observation fails. Do not infer retained history, change layout or confuse this catalog with per-Run semantic evidence.
+- `runs-context-index.ts`: bounded identity/index admission, canonical role paths and trusted under-lock index persistence; readers remain readonly. Canonical source-read budgets are independent of compact index/output limits. observeRunContextExportLocation admits only fixed compiler roles and exact current Run ownership, then observes physical parent/leaf metadata with retained change fences and no body/index reads or producer key. Semantic-index absence, corruption, pending/unavailable flags or old generation do not gate this ordinary location observation; private index/verifier/publication contracts remain separate. Metadata neither certifies curated role-body privacy nor authorizes curated body exposure or native work. Ordinary same-session file research remains the separate accepted route above; its producer-loss/restart evidence must use actual producer and holder-host exit before a fresh SDK process, not only controlled metadata or a manager replacement. Fork/clone map-isolation evidence must use actual SDK-created session IDs/files, preserve earlier accepted navigation in storage/model history, show empty fresh owned replies under the new context, and keep original saved-session research working afterward. Copied history/paths remain data, not fresh Kernel navigation scope; this is not filesystem denial or permission to erase accepted history.
+- `runs-context-exports.ts`: producer-bound context exports/index assembly, invocation-local primary publication and readonly saved-source admission; delegates session previews to their owner. Static Recipe views select definition/launch/privacy/stored policy only from the bounded original producer-admission snapshot; live metadata still validates current identity, input size and ownership/metadata frames, never renewed selection/privacy. Missing, invalid or over-budget admission cannot borrow later healthy metadata. Preserve captured fences through view commit; this does not change Inspector sources or wire runtime refresh. For producer-backed saved Recipe reads, require complete original-projection/stored-policy correspondence and fresh owned source frames; sanitized view round-tripping, schema/redacted flags, index metadata and path/hash data cannot recreate original privacy. The private readonly readRunRecipeContextView shares pure original projection shaping with the writer, freezes retained decoded data only after whole-data correspondence, and caps both source and complete response. It must not use work/evidence admission locks, native/time sampling, root outcome reads or live privacy repair. The recorded captured_at remains file metadata, not authenticated publication time. Shared original Recipe shaping also requires the original stored-clock started_at string to remain fully private-policy unchanged: otherwise recipe_metadata_redacted refuses the role without a masked clock. The corresponding original reader refuses admission_unavailable before source probes; absent legacy clocks retain their own existing supported absence. This is stored metadata visibility, not new clock sampling/origin/lifetime authority. Such correspondence is not historical file-issuer authentication or ordinary/restart transport. For dynamic saved Trace data, original Recipe privacy alone cannot certify event/header correspondence, and latest-journal comparison may reject a genuine earlier published snapshot after append. A historical whole-view read needs the original producer's retained admitted publication projection, not a sanitized fixed-point check or reconstruction from index/schema/path/hash; missing original binding must remain unavailable. Trace's private readRunTraceContextView now requires both the genuine original producer key and this module's retained successful Trace publication bytes. Retain at most the latest bounded canonical JSONL per producer only after view publication returns successfully; capture/write/release errors, including after replacement, mint no new binding. A returned written/committed value is not by itself successful-release evidence: withRunProducerEvidence deliberately retains cleanup failures separately rather than replacing the factory outcome. Trace/Control/Execution/Result publication setters must check readRunProducerCleanupFailure after publication returns and must not mint/renew binding if a known report exists. Preserve the actual committed writer outcome/bytes and the prior successful historical binding, never clear the report or undo effects. A matching earlier admitted view may remain readable after a report because historical data is not current producer/work/cleanup authority; later producer operations remain fenced. Absence of a report is not cross-process/native lease or exhaustive closure proof. Later index failure does not roll back the committed view/binding. Read exact canonical header/items as frozen historical data under independent owned index/evidence/view frames and source/whole-response bounds; no live journal or root outcome read. Control's private readRunControlContextView uses its own separate producer-scoped successful publication binding and exact canonical JSON, never a Trace binding or current journal/capacity recomputation. Captured run_status/readiness/capacity/counts are historical data, not current Control admission, dispatch, root terminal or closure authority. Execution's private readRunExecutionContextView requires its separate successful publication binding and reads only saved metadata, never the live manifest or capture/session targets. Its writer refuses an original-privacy-changed complete header identity before manifest body reading; never publish a masked or raw unsafe generation as an exact reference. Reported status/active counts/native exits/killed/persistence/session counts are historical reports, not root terminal, exhaustive membership, close or body permission. Execution updated_at and command id/optional started_at/completed_at are typed source facts/references; native_signal is a typed reported token, not an authenticated OS signal. After manifest validation, compare their complete unmodified strings to the same original full privacy used for the header: preserve exact safe facts/tokens or refuse the whole new Execution view with execution_metadata_redacted, never mask/remove a cause/fact field or change root outcome. Failed privacy publication mints no new binding or view replacement; earlier authentic bytes remain historical until independent index replacement or explicit successful safe refresh. Generic/per-call projection stays unchanged. Original data/publication correspondence is not by itself privacy proof for every identity envelope. A safe saved run/generation header says nothing about the separately returned identity.ownerId. Recipe/Trace now check full headers before original projection/journal body, matching the distinct Control/Execution guards. All five producer-backed whole-view readers compare complete returned identity (including optional ownerId) against bounded original Recipe-origin/generic and captured-literal masking after genuine producer/root checks and before filesystem probes; changed identity yields identity_redacted without source read, replacement, repair or masked reference. Safe/absent owners and logical suffixes remain exact. The pure createContextIdentityPrivacyCheck and capturedSecretMask live in recipe-projection.ts, shared by context and session publishers instead of an orchestration-peer import or duplicate policy. They compare already-admitted closed reference data only, reusing one matcher across Control rows, and grant no producer/source/body authority. A full identity check or original data/publication correspondence is not a complete envelope privacy certificate. Original recorded content now uses createRunRecipeBodyRedactor from recipe-projection.ts before the first export clipping/counts: Recipe selected definition/launch data, Trace summary/data, Control input/error, Execution allowlisted text and selected-session assistant text. Decode embedded JSON before generic masking can alter syntax; retain sensitive-key decisions before literal masking of content keys/values, then apply existing display limits. Raw opaque credential spans are checked while their original spelling remains available, before decoded content/generic normalization is projected. If a private raw JSON span cannot survive string decoding or masked-text syntax validation, withhold that entire encoded scalar as the standard display marker; keep public siblings outside it and all sensitive-key decisions on the original parsed data. The masked JSON is a discarded validity probe, never output or a substitute source for key decisions. Do not infer privacy from absence of the old spelling after normalization, or from one decoded occurrence covering another raw occurrence. This complete-source repair does not reconstruct canonical Trace pre-recording loss. Do not infer coverage of other metadata/reference strings from content fields. Original Trace id/ts/kind and Control id/generation/action plus all present queued_at/delivered_at/claimed_at/handled_at/failed_at strings use the same raw full reference privacy comparison as headers/rows: preserve complete safe values or omit whole items/rows within the existing bounded selection before display counts; keep raw journal/capacity/foreign counts independent, never mask facts/routing strings or silently backfill older rows. Private Control overwrites generic timestamp previews only after that full original decision. Also guard the derived raw capacity.oldest_pending_at before encoding: a private capacity timestamp refuses the whole view as control_metadata_redacted, never nulls/masks that fact or recomputes raw counts from visible rows. A safe oldest timestamp permits omission of a different private row while retaining full pending counts. Standalone Inspector defaults remain separate. Issued/reported values are data, not a recreated historical issuer, action delivery or native/time authority. Authentic issued ids/times and recorded command/clock strings can overlap captured literals; their typed source fields follow exact-safe-or-whole-unavailable privacy without claiming actor credential injection, authenticated historical issuance or safe constants. Session selected/peer catalog metadata has its own fixed original selection/actual-emission and partial-effect boundary below, not a renewed peer-body certificate. Other generated observations, derived references and protocol constants retain their separate field/provenance questions; no complete-envelope inference follows. Recipe identity/composition logical_reference is intentionally projected provenance display data, not the canonical source locator or a promised operational reference. The actual context builder uses qualified name or explicit-file basename; maintained lib/scripts consumers do not route a saved label into resolution/dispatch in the inspected closure. Preserve original lossy projection (including private-label masking), never restore a secret merely to make this label resolvable. Canonical returned identity/path and generation-bound source descriptors retain their separate exact-reference contracts. Future consumers must not infer locator/read/work authority from a Recipe display string; this is not a guarantee about arbitrary external/human use. No blanket metadata scrub or whole-envelope certificate. Classify output provenance before applying a raw credential-scan result as authority: compiled schema/coverage/basis/media/reason labels are vocabulary, independently generated capture timestamps are file observations, and source-derived facts/text/usable refs have their own original policies. A compiled-label/timestamp spelling collision is not actor credential flow or a new historical issuer/native-clock fact. The accepted A2 fixed namespace is exactly the nine compiler-owned relative paths from runs-context-index.ts EXPORTS/runContextExportPath, including their exact role-aware index-entry and private response copies; docs/run-supervision.md lists the closed set. An original credential-spelling collision does not redact/refuse these fixed locators. This exception follows the closed field's compiler provenance, not evidence/ prefix matching or string membership on arbitrary original/user data. It grants no role-body/read/admission/lifetime capability, global literal-absence certificate or automatic extension when a new role is added. Preserve all existing variable absolute-root/hash/selection, dynamic Session/source/path, stored-fact and body privacy checks: even a shared fixed prefix inside a variable ref remains under its whole original rule. Do not whitelist absolute index local_path/publication path merely because its basename is constant. Never broaden this exception, mask typed timestamps/refs, invent a marker/carrier or disable valid recovery merely to make a blanket output scan pass. Recipe original semantic correspondence does not cover its saved captured_at: canonical ISO syntax/current-file observation is distinct from original publication bytes or original-literal privacy. The other four whole-role readers bind their own complete historical bytes; never weaken those bindings or promote Recipe's original_producer_projection_match basis into time authenticity. Fixed namespace approval is not variable file-time disclosure permission. Accepted captured_at policy now requires complete original privacy before all five role writers emit a view and before their saved readers return it: exact safe file time or whole-view refusal, never masking/fabrication/repair. Reuse the original pure full matcher without renewing from live values, moving privileged timing anchors or adding a Recipe publication carrier. Writer refusal uses the existing role metadata_redacted family (including trace_metadata_redacted), creates no new view/source/binding and preserves prior history; an explicit index update remains separate. Recipe still admits safe public canonical ISO current-file edits under semantic correspondence, refusing an original-private saved captured_at as view_metadata_redacted. The other four readers must compare complete successful publication bytes before their independent captured_at privacy check, so tamper remains view_mismatch and known-cleanup/admission fences remain intact. Public safe file time is not historical issuance, clock/domain authenticity or lifetime; no complete-envelope inference follows. Internal index local_path/publication paths and raw snapshot facts remain metadata needing their own curated exposure boundary, not fixed-relative namespace values. The pure policy/redaction parameters grant no producer/body/source-completeness authority, accept no actor/configuration carrier and leave generic/per-call projector defaults unchanged. Never repair already-clipped DTOs or renew original policy from live metadata. Separately, the canonical Trace writer slices summary at 1000 code units before export; a stored credential prefix cannot be repaired by full-literal matching over that incomplete record. Complete pre-recording privacy needs its own accepted source/admission versus unavailable/lossy-summary contract before changing raw canonical fields/limits/schema or claiming completeness. Never guess prefixes, borrow another body or mint source-completeness authority from a flag; preserve generic Inspector/raw per-call contracts and keep complete-field repair independent from this gate. Complete reference privacy must also include literal values captured under sensitive metadata keys, not only Recipe origins or generic token patterns. Compare raw scalar identity strings so JSON quoting/escaping cannot hide a literal secret. Detect presence independently of the display mask token (a credential may equal [REDACTED]); removal is private comparison only, never a returned identity/path. Apply raw scalar presence to declaration-inventory target paths as well as snapshot cwd/index before returning a usable reference; never infer secret absence from an unchanged display projection. Public marker spelling without an originally captured secret remains allowed, and a later live secret cannot renew original policy. An artifact operational-path exception is never header/reference identity permission. Result's original-producer context export and first-result publisher now check complete original identity separately: result_identity_redacted refuses the context projection/source, while identity_redacted binds diagnostic unavailability once without changing canonical code or acceptance. Ordinary lifecycle admission may still validate canonical outcome before a private exporter runs; do not claim zero root-authority reads. Result DTO-only saved/outcome reply identity remains unproven for legacy/orphan or older sources without the original key; a new publisher guard or saved privacy_scope label cannot retroactively certify it. Eligible collection discards reading.identity/ownerId, but keeps member generation and the complete diagnostic descriptor, which can reach literal model formatting and captured inventory. Removing only the reader identity cannot close that path. The renderer scopes admission privacy to recorded fields; it is not a whole-envelope certificate and must not scrub/truncate immutable refs or repair sources. The accepted logical-session research contract supplies ordinary file-map/read permission, including restart/resume, without a retained original producer. It does not certify an automatically embedded curated excerpt or reconstruct original publication/privacy from a saved flag. Separate original source selection/privacy plus role data binding, current bounded file observation, and recipient/session emission lifetime; none substitutes for the others. A live producer in another runtime still supplies no original key to the caller, and a self-PID issuer cannot be re-admitted after terminal acceptance. Same-runtime historical reads after result/source loss or cleanup quarantine are not a demonstrated cross-process surviving capability. The optional pre-work snapshot-reference handoff covers curated cwd/index only, not role-body/publication authority; its original manager/readiness epoch is not automatically installed on ordinary collection. Packet parse/freeze/journal reload preserves data, not original issuer/privacy/admission or transfer to a new same-id owner epoch. Already accepted history must not be repaired into a fresh permission; pending serialized phases also do not authenticate missing admission. First-result diagnostics now retain the original full matcher alongside the text policy and compare the complete generated source descriptor (path/generation/hash) after actual field selection/metadata admission but before descriptor counts/budget, source retention or root binding. Original-private refs bind immutable whole diagnostic unavailability source_reference_redacted, not a masked ref, readFailure/I/O failure or changed workload code/acceptance. Preserve not_recorded for no fields without inspecting an unused prospective ref, earlier header/privacy/body-budget precedence, source conflict/error effects and duplicates' no-callback/no-repair rule. This original-issuer guard is separate from later context-export checks, packet/DTO emission authority and older-source certification. Do not introduce global legacy fail-closed or an authenticated original-capability handoff as a prerequisite for same-session file research. Curated automatic excerpt verification remains distinct; this research decision does not recertify older bodies or change their existing publication semantics. Do not promote readRunResultDiagnosticsSource into a whole Result verifier: it checks the complete allowlisted source/preview/count descriptor but deliberately does not read canonical result or bind saved acceptance/code/recorded_at/producer flags/captured_at to original whole-view data. Its recorded_acceptance is a saved label, not independently canonical/terminal truth. The distinct readRunResultDiagnosticOutcome checks the natural canonical first-result diagnostic reference but deliberately does not read the view/index; available results from both paths still do not certify the entire view. An original first-natural receipt freezes code/status/completed date only, not flags/complete view/capture metadata; it is optional and absent for capture-only records. Producer metadata captured before result production cannot recreate those post-work fields. Private readRunResultContextView now requires its own separate genuine-producer/module/root successful Result publication bytes, never a partial diagnostic/root binding or pre-result metadata reconstruction. Retain at most the latest bounded canonical JSON only after view publication/wrapper return and no known cleanup report; unavailable/capture/write/thrown/known-reported release failure mints no new binding, including postreplacement. Preserve actual committed effects and prior historical data; index error is independent. Read exact saved metadata only through owned index/evidence/view frames with complete source/response limits and original identity privacy before filesystem probes. Deep-frozen natural/capture-only/code/flags/diagnostic refs and counts remain historical report data, not live root/body, terminal/cleanup/native/clock authority. Do not reopen/read canonical result, primary/diagnostic sources, targets or journals to justify it; source/root loss/live edits may coexist with matching earlier publication, while explicit successful refresh invalidates older binding observations. Missing selected file refuses without memory-byte fallback. This publication-only correspondence does not authenticate physical issuer, retroactively certify older unsafe bodies or grant ordinary/caller-loss/restart/range permission. Result context now reuses that capture's full original matcher for canonical completedAt/recorded_at after strict snapshot/frame validation and before diagnostic projection. Complete source path/generation/hash refs are compared after source text privacy/independent source budget but before display excerpts/counts, source retention or view encoding. Private typed facts/refs refuse the whole new role as result_metadata_redacted; never mask, omit or rewrite an operational descriptor or canonical first result. Check refs only when diagnostic details will actually be emitted: no-field not_recorded views must not refuse an unused prospective path/hash, while private recorded_at still refuses even without fields. Exact safe facts/refs stay complete despite opposite live metadata. Direct refusal preserves prior view/index/source; index publication is independent and may make old follows unavailable. Explicit safe refresh may restore supported absence and leaves any orphan source untouched. This is context-only: immutable first-result diagnostic binding/unavailability, root0/7/capture truth, original first-natural receipt and DTO-only post-producer contracts stay unchanged. Field/reference privacy is not complete-text, whole-view, issuer or lifetime proof. Controlled issued timestamp overlap is source data, not invented issuer/native-time truth or actor credential injection. admitRunResultProducer itself requires work admission: never late-admit after result/stop to manufacture an original snapshot of just-issued data. Predeclare complete supported sensitive literal/data canaries before normal target publication, verify actual emitted correspondence afterward, and distinguish explicit controlled source edits from real first-result issuance; deterministic expected path/hash data is not a recreated capability. Preserve existing selective curated readers' distinct no-root versus no-view/index contracts and valid diagnostic recovery. Their original-privacy/automatic-emission claims are separate from the accepted same-session ordinary file research route. Do not borrow one role's guard or a safe diagnostic field set as another header/response certificate. readSavedContextViewSource is shared private checked-source observation for Recipe/Trace/Control/Execution/Result, never body permission by itself. Keep this per-role/runtime-local, never a generic registry, live journal refresh or issuer/restart claim. readRunContextIndex fences one metadata observation and exposes no retained unchanged callback; a body reader must own its source fences. Control's generic base projection is not original Recipe privacy admission. Its private context writer must admit bounded original producer privacy before journal body reading and whole input/error projection/clipping, never live/caller fallback or post-clipping repair. Current owned metadata has its own input bound and retained root/marker/metadata frame through publication; it cannot renew original privacy. Keep the standalone Inspector projection's one-argument source contract separate. Private saved Control references are not Inspector text previews: a correct full view header does not certify per-record identifier completeness. Never present clipped identities as exact references or restore privacy-masked raw identities merely for completeness. Private Control checks complete header/row identities against original full privacy before preserving exact safe id/generation fields; omit unsafe whole rows with truthful omission counts, and refuse privacy-changed header identity before journal body reading. Keep raw-journal capacity separate from visible-row omissions and let actual encoded bytes drop whole rows rather than truncate references. A journal change after capture does not prove earlier recorded counts false; do not advertise latest-at-commit freshness without a retained source fence. Trace and Execution keep current canonical evidence but select Recipe privacy from the bounded original producer admission before opening the journal/manifest; never renew privacy from live values. Their shared local metadata-frame observer also serves Recipe, without granting producer/body authority; retain ownership/metadata and source fences through view commit. Execution's reported status/counts/codes/killed metadata never imply root lifecycle/closure or capture/session body permission. Private snapshot-reference readers capture cwd/full secret and Recipe-origin privacy from genuine producer metadata or the original guarded fresh-launch kernel over full prepared own-JSON metadata. The latter is a privileged kernel entry under the held lifecycle lock, not an API authenticating arbitrary saved DTOs: markers, metadata shape and a genuine clock origin are not privacy certificates. Reject accessors/hooks/unsafe or over-budget complete privacy captures without invoking them or falling back to live fields. Mint private-brand readers with no generic registry; owner admission must reject copies/prototypes/raw readings rather than trusting a read-shaped function. Never refresh from live values/visibility/cwd, inherit artifact-origin exceptions, clip paths or turn masked paths into usable references. Readonly original readers fence their construction frame and current owned index metadata, never follow bodies/targets or sample process/time. Serialized readings do not recreate permission; runtime/coordinator transport and public composition remain separate. The primary context binds exact observed result/attempt selection, complete strict-UTF8 capture and immutable admission privacy, then retains fixed generation-specific projected bytes before preview/counts. Capture full original run/generation/optional-owner reference privacy before work; only supported selection consumes it, refusing identity_redacted before capture/source I/O without setting readFailure. Quiet not_selected and unsupported selection retain their own reasons. Artifact inventory preparation similarly rejects changed full identity for nonempty declarations before source/view/index I/O; its retained overflow helper also fences that identity. The legacy artifact view requires bounded original identity before per-target observation, with separate artifact_identity_redacted/artifact_admission_unavailable; declaration absence and independent index effects remain distinct. Never inspect or repair old sources/views/catalogs on explicit identity refusal. A memory tail requires the privately retained attempt digest plus complete persistence, exact saved/observed length, suffix and strict UTF-8 agreement before full capture projection; tail/size agreement or actor-provided digest fields alone cannot bind an unseen prefix. It publishes no session/merged/retried/failure body and no arbitrary path from actor metadata. Result views remain metadata-only: only canonical command/error/failure_reason strings may enter their complete diagnostic source, never output, authored summary, provider/session bodies or actor source/visibility flags. Fix full text privacy to genuine producer admission, project each whole field before clipping, preserve literal scalar-aligned previews without synthetic ellipsis, and record exact code-point counts/decoded-field UTF-8 byte ranges. Complete-text primary/diagnostic privacy must recognize raw captured opaque/encoded scalars before parsing or generic normalization. Parsed-data projection equality is not original raw privacy: returning original spelling can faithfully return an entire private JSON credential, while nested normalization can hide its old spelling but retain decoded content. Source hashes/counts, primary redacted:false or diagnostic redacted:true/producer_admission are observations/labels, never certificates that this class is safe. Preserve original structured sensitive-key decisions before literal key masking, public siblings and exact unchanged public scalar/BOM/whitespace. The existing pure recipe-projection owner now shares its private capturedBodyPolicy between createRunRecipeBodyRedactor and createRunRecipeTextRedactor. Role bodies retain their existing generic/display-limit tail; complete source text consumes the protected encoded-text projection directly, or full unbounded plain-text privacy when not encoded. Never pass the protected serialized JSON through generic text masking again: BOM/string/key syntax may be corrupted, and reparsing may re-expose normalization gaps. Original public JSON/scalar/BOM/whitespace remains exact when projection is unchanged; ambiguous complete quote/escape/numeric/private JSON spans withhold the whole encoded scalar as [REDACTED], not masked JSON syntax. Generic/per-call defaults and original field-key decisions stay separate. Primary, first-result/context diagnostics and inventory scalar privacy use this same text factory; no adapter/reexport shell, new module or permission/carrier. New authorized publication safety never silently reprojects/overwrites fixed old sources or immutable first-result bindings; fixed orphan conflicts preserve exact refusal and bytes. Source-specific selection/complete-text permission and legacy read/emission lifetime remain separate. A result-diagnostics source is not primary text or terminal/scope proof. Runtime diagnostic publishers capture privacy before work but perform source I/O only in the exact active first-result callback. Its kernel-only marker/DTO is not authority: retain an original runtime-local admission key bound to state/producer/frozen allowlisted candidate and revoke it synchronously on every return/throw. This narrow source admission never grants work/root publication or cross-runtime recovery and must not reacquire the already-held lifecycle lock. Snapshot own enumerable data result fields before callbacks, reject serialization hooks/accessors, strip all actor diagnostic references/protocols even without a trusted callback, and bind the source descriptor/unavailability only in the first atomic root result. Require genuine admitted producers for publication and immediately recheck owner/generation/native contradiction after every evidence callback, including prepare, before invoking another source callback. All four completion ports stay synchronous: refuse Promise/then-protocol returns without awaiting or reading custom then/catch hooks, intrinsically settle native rejections, and keep ordinary synchronous prepare returns ignored. A throwing callback preserves its original cause and prior effects, never a repair/retry or synthetic result. Source/result/view/index are distinct effects: never advertise a Result role view before canonical acceptance, repair the first binding from a later healthy export, or invent a fallback workload result after publication/authority refusal. Reject malformed scalar strings and independent 4-MiB source/64-KiB view overflow without changing workload policy. Preflight view size before source creation. Preserve exact source I/O/binding errors (outside generic capture fallback), exclusive fixed bytes, partial/orphan effects and source/result fences through view replacement; source/view/index are separate commits. Diagnostic readonly queries select one own-data allowlisted field, optionally a scalar-aligned decoded-field UTF-8 byte range. Admit exact owned index/result-view/derived source, closed saved schemas and every field/hash/preview/count before returning a frozen selected excerpt; keep recorded natural/capture-only labels distinct from terminal authority. Legacy/not_recorded/foreign view metadata must not follow a healthy orphan source. No raw result/body/process read, live privacy refresh, producer reconstruction, export/repair, ACK or work/lifecycle lock. Refuse oversized complete encoded responses rather than clip; retained-source fences are observations, not durable immutability or cross-file atomicity. Artifact-view overflow may retain a complete admission-bound declaration inventory and publish a bounded reference view/index with exact omission counts. Keep that source fixed to genuine producer-captured declarations/cwd/secret policy; live metadata cannot widen it. Preserve operational path spelling, including explicitly declared Recipe-origin outputs, but null any reference changed by secret masking. Inventory entries report availability not observed, bodies not read and production not asserted; never probe targets to retain it. Bound raw cwd-anchored reference expansion before construction and the complete encoded source at 4 MiB, independently of the 64-KiB view limit; these are observation budgets, not launch/file quotas. Source/view/index remain separate effects with exact errors and retained partial/orphan sources, not a transaction, overwrite/retry, fsync or power-loss claim. Readonly primary reads admit the canonical classification, owner/generation, fixed source identity, digest and exact UTF-8/count metadata without renewing privacy or producer authority. Explicit artifact-inventory follows admit exact owned generation/index/reference-view/derived source, validate the whole strict-UTF8 hash/schema/counts and return frozen half-open declaration ranges within 64 KiB, or refuse the whole selection. Never reproject live privacy/declarations, probe original artifacts/processes, read sibling bodies, recreate a producer, export/repair, ACK or take lifecycle/work locks. Returned change checks cover owner/index/evidence/view/source observations, not durable immutability or multi-file atomicity. Index publication and delivery remain separately owned effects. No public visibility flag, raw private session exposure, live clocks or native authority.
+- `execution-files.ts`: keeps reference observation body-free for captures, sessions and fixed canonical runner streams; explicit kernel-only capture/runner/session text inputs use bounded strict-UTF8 checked descriptors. Capture/runner inputs preserve a UTF-8 BOM; session decoding remains unchanged. Reject layout escapes/symlinks and observed substitutions; close failures cannot advertise success. Neither port admits Run/generation or authorizes raw-body exposure/historical-content claims. Legacy session loading shares reference checks, avoids known aliases and drops observed-changing reads.
+- `runs-execution-evidence.ts`: data-only manifest projection, readonly explicitly recorded capture/session reference admission and fixed canonical runner stream input. Keep reports of status, active/session counts, killed flags and native exits distinct from root lifecycle/closure; preserve saved/observed/unknown capture facts. Reference reads use owned-generation admission, bounded strict manifests and source/target fences; reject saved-size disagreement, never backfill unknown bytes. The separate stream text port is kernel-only, preserves strict UTF-8/BOM and proves neither complete primary capture nor model visibility. Metadata/local paths/change callbacks authorize no body exposure, work or native capability. No discovery, implicit retry or source repair.
+- `runs-session-exports.ts`: fixed assistant-only preview policy, recorded-session preview admission, producer-bound preview/catalog/index commits and readonly selected published-preview admission. Admit owned-generation v3 sessions and last-recorded-branch ancestry, never live model context; omit private roles/thinking/provider payloads and raw paths. Redact before code-point clipping/counts. Fixed assistant-only visibility is not original-admission Recipe privacy: current per-call metadata or a selected preview DTO cannot supply that capability. Producer publication uses its existing bounded original metadata before projection, not repair of a clipped preview. After valid explicit selection and genuine bounded original capture, require full run/generation/optional-owner privacy before manifest/session body reads; session_identity_redacted publishes no preview/catalog and independent index may record refusal. Reuse the pure reference policy from recipe-projection.ts without borrowing producer authority or importing the context-export orchestrator. Keep that projection data internal to admitted publication: the raw three-argument preview must not accept a caller-supplied privacy override or claim original-admission continuity. Selected command_id requires original full privacy before manifest/body observation; admitted source_updated_at requires it before body bytes/projection, while the existing body-free descriptor observation may open/fstat the leaf. Current export hash/path/captured metadata stays exact or refuses session_metadata_redacted before view encoding. Carry only the private capture's pure original-data matcher into the later already-admitted publication stage, never a public capability/actor callback. For retained peers, check bound command_id/export_id after existing contradiction checks but before selected preview commit; those fields survive both available and unavailable observations. Do not pre-refuse stale prior times/paths that actual observation will replace or null. Check all actually emitted peer/current metadata after inspectPreview, before catalog counts/encoding. Private emitted metadata refuses the whole catalog, never masks refs or silently omits mandatory BaseEntry fields. The selected preview may already be committed: preserve that orphan/current file, prior catalog, untouched peers and exact earlier I/O/binding errors, with independent index effects and no implicit retry/rollback. Explicit healthy observations and safe refresh retain valid recovery. Metadata checking does not renew/certify an older peer body's original privacy or grant additional raw/peer discovery. Saved-body follows validate stored bytes without live re-projection or certifying original redaction; keep raw recorded-input and saved-preview contracts distinct. Hash selections, not contents; preserve conflicting evidence, partial commits, explicit unavailable peers and whole-catalog overflow refusal. Selected reads revalidate owner/index coverage/catalog/schema/size/time without raw/sibling body reads, repair or producer reconstruction. No primary retention, full inventory, native authority or privacy/immutability inference from cached metadata.
+- `runs-start.ts`, `runs-status.ts`, `runs-results.ts`, `runs-descendant-launches.ts`, `runs-native-launches.ts`, `runs-outcomes.ts`, `runs-control.ts`, `runs-control-delivery.ts`, `runs-controls.ts`, `runs-trace.ts`, `runs-process.ts`, `runs-retention.ts`, `runs-parent-teardown.ts`: focused Run internals. The results owner separately admits original postcommit first-natural timing observers before Trace, never duplicates or post-stop captures. Its active callback token is distinct from diagnostic admission and cannot be recreated from DTOs. Observer/action failure revokes active use but never undoes an accepted result. The passive acceptance reader is pure historical metadata, not a current-source/lifecycle fence, origin, elapsed sample, lock-release proof or frozen duration; late reads never regain active timing permission.
+- `runs-retention.ts`: single owner of manual archive/prune and startup Run cleanup. Reuse lifecycle locks and ownership/generation/native/descendant/reuse guards; filesystem age is selection only, unknown PID is never absence. Keep candidate observations fenced across lock acquisition; ordinary temp preparation owns no Run deletion. Preserve manual APIs, TTL and evidence schemas. Automatic refusal/unbound retention does not certify positive native closure or add reporting. Manual retirement preserves an exact single surfaced rejection (including undefined/primitive/AggregateError) and ordered original/formatting/failed-evidence/lifecycle-release causes when multiple stages fail. Its journal appender separately preserves append plus release errors. Keep nested original aggregates intact and cause/errors non-enumerable; record failure text once under guard with compiled fallback, never let formatting mask primary. No synthetic missing id, rollback/retry, new public failure DTO or assumption that a pruned Run-local Trace survives. Queued/handled journal writes and filesystem effects remain independently committed observations; lower-layer already-masked faults are not recoverable by this owner.
+- `runs-artifacts.ts`: captured artifact references, body-free metadata observation and explicit hash manifests. Read-model reference observation never hashes file bodies; anchor relative paths to captured cwd without lexical retargeting of symlink/parent semantics.
+- `execution-sessions.ts`, `trace-projection.ts`, `control-projection.ts`, `recipe-projection.ts`, `session-evidence.ts`: shared bounded/redacted evidence owners. Recipe projection also owns pure captured-sensitive literal masking, explicit original recorded-content policy and exact reference comparison; these functions admit no identity/body/runtime authority. Recipe provenance privacy is shared by Recipe and canonical Trace context projection, stripping private origin fields/tokens without corrupting logical references. Trace coverage accounts for read omissions and malformed evidence.
+- `tools-message.ts`: exact Control facade and its implemented flat AX receipt/error projection. Private local field/next helpers preserve multiline value separators and outer indentation without a new presentation domain. Never duplicate run: in a labeled run value; canonical next-action targets and structured/verbose payloads stay unchanged. Queued/delivered does not certify handling, a legacy kill result leaves termination unconfirmed, and public dispatch errors retain exact private cause with no correlation disclosure. Whole-id omission reserves the complete safety/next record under16KiB; transport/admission/lock/native behavior is untouched.
+- `tools-inspect.ts`: exact `run:<id>`, `runtime`, `recipes`, and `tool:<name>` inspection. Fresh non-runtime compact text uses flat AX records, real required/optional argument sequences (including one item), opaque multiline values and whole literal focused-doctor source_location. Run views retain their compact run/view header only, not a new status/snapshot/body route. Structured/verbose details and tool schema JSON stay exact. Select at most the first existing hint; tools-response:formatInspectionHint recognizes only the three closed read-only recipes doctor/imports/summary literals, otherwise returns opaque instruction content without parsing/normalizing/spawning/registering. Full next_actions remains in details. The runtime compact branch also uses AX fields, selecting only its existing status identity/review facts, full exact-owner inventory length or existing triage pressure/attention counts. Keep full inventory independent of bounded verbose navigation and never derive counts from the40display rows. The successful compact branch adds no reads/caps/default snapshot/clock/source/recipient behavior; A1/B1 integration stays gated. Ten locally authored inspect errors now use private formatInspectFailure with exact existing guards, Error construction sites and dependency evaluation order. target_kind names the selector family, not admitted ownership. Supported values are actual sequences. Only missing-tool/schema errors retain their producer-known read-only next; this does not broaden formatInspectionHint's three-string recognizer. Unmarked helper fields must be bounded compiler literals/lists; every selected variable scalar is explicitly omittable. Seed each variable with its shorter complete value or whole-field omission row; reserve fixed facts/safety and an optional complete next, then admit whole values in source order without later shrinkage under existing16KiB minus the public adapter's one leading LF. An unfit action has next_action omission coverage, not a fake next command; counts are fields/actions, never raw/private character lengths. No clipping/character repair, catch-all, error wrapping, new Error metadata/schema or retries. Uncaught dependency/session/scope throws, existing runtime observation fallback and prior discovery/getter/String side effects remain; do not label all refusals effect-free or all errors AX.
+- `file-state.ts`: canonical generic file-mutation locks and atomic JSON/text writers. withFileMutationLock preserves an exact synchronous callback rejection and a later surfaced release fault as ordered non-enumerable standard AggregateError errors/cause, including undefined/primitive/original aggregates; never coerce/flatten, replay callbacks, roll back bytes or interpret returned thenables. A single callback/release-only rejection and normal return remain exact. Atomic replacement separately preserves a single surfaced native-shaped rejection exactly, including null/undefined; retry-code access is null-safe and guarded. If that access throws, ordered private standard AggregateError errors/cause retains original then observation fault without coercion/flattening; no retry follows failed classification. Keep ordinary EPERM/EBUSY 20-attempt / 19×50ms limits, one onBeforeReplace call and already committed bytes unchanged. This is not writer rollback, fsync or cleanup proof. Acquisition, token/reclaim/lock interval and best-effort removal uncertainty stay separate. No async locking, exhaustive cleanup/native closure, public receipt or recovery of already-masked lower writer causes follows. Controlled release-fault fixtures retain their exact owner/frame and assert no workload/host exit.
+- `state-readers.ts`: resilient JSON/JSONL parsing; strict UTF-8 JSON is opt-in; capped strict reads use available nonblocking/nofollow flags, require a regular opened descriptor and reach the complete declared file, never admit a valid prefix after premature EOF. Legacy degradation stays unchanged; bounded ownership-marker admission also selects strict reading. Execution manifest export/reference admission selects it; malformed bytes must not normalize into admitted source metadata.
 - `runtime-identity.ts`, `runtime-triage.ts`: immutable package/schema identity and pure pending/stale Control classification.
-- `tools-spawn.ts`, `tools-register.ts`, `tools-local.ts`, `tools-response.ts`: Run creation, persistent capabilities, Recipe-backed tools, and compact results.
-- `inspector.ts`, `inspector-overlay.ts`, `inspector-command.ts`, `inspector-actions.ts`: actor-instance Recipe/Trace/Control projection, navigation, command wiring, and fenced actions. **Actor Inspector** remains the product and command name, not a separate domain.
-- `observability.ts`, `run-ui-runtime.ts`: Trace attention, terminal reconciliation, and Pi follow-up delivery.
+- `tools-response.ts`: shared response formatting, including the flat launch receipt, two-space opaque Markdown field and typed inspect-next primitives now reused by Control, pure admitted-snapshot text/JSON rendering and the literal-block primitive reused by completion packets. Launches retain every selected fact/reuse distinction, one optional current-session action only without a fully shown direct row, whole literal navigation and shared16KiB bounds including the no-navigation fallback. Never migrate the older formatRunFileNavigationHandoff packet grammar implicitly; completion/version contracts stay independent. Own-data/scalar/schema validation grants no visibility/lifecycle/timing permission. Preserve complete identities/references, CRLF/BOM/Unicode and exact ms; use dynamic literal fences rather than whitespace normalization. Compact JSON retains the same bounded payload; text fence amplification refuses the whole view, never clips or silently changes format. Tool spacing/envelope and combined delivery budgets remain separate, not extra allowance. Synthetic terminal-format fixtures prove no frozen-terminal timing or visual/public acceptance.
+- `tools-spawn.ts`, `tools-register.ts`, `tools-local.ts`: Run creation, persistent capabilities, Recipe-backed tools and compact results. Compact spawn/async-tool launch receipts retain facts, expose actual existing-Run reuse and omit the redundant session-map hint only when the complete direct row is shown; absent/unavailable/omitted rows retain that request. Compact launch metadata uses bare block YAML with nested complete location values; preserve the original JSON details, expert facts, shared bounds and old completion text. Keep one leading result-separator LF for host invocation spacing, outside the pure YAML emitter. Spawn-verbose source selects legacy pretty JSON once after eager compact evaluation, then emits full YAML only from that clone without a new fixed byte/depth cap. Keep original stringify throws outside the projection catch; absent selected JSON, malformed selected keys/strings and recoverable post-selection failures withhold the whole projection with an attributable no-auto-repeat receipt, not repaired values, partial full facts or private causes. Returned details and unrelated JSON helpers stay unchanged; compiled-package and loaded-host adoption remain separate. Do not synthesize routine Run-inspection next actions or unconditional delivery/readiness promises. Preserve existing structured/verbose metadata, expert Inspect access and separately owned targeted diagnostic remediations. Runtime argument-repair guidance is pre-dispatch only: once an executor is entered or arguments are handed to the async launcher, rethrow the exact original value/cause/details even when its text matches validation prefixes. Preparation side effects, dispatch, actuation and closure remain distinct; add no retry and preserve configured execution policy.
+- `inspector.ts`: owned-Run evidence and exact-session/generation-fenced actions through injected canonical control dependencies. `inspector-overlay.ts` and `inspector-command.ts` retain UI/navigation and host command wiring separately. **Actor Inspector** remains the product and command name, not a separate domain.
+- `pi.ts`: Pi SDK envelope boundary. AX completion fallback identity comes from the closed terminal marker for new records or the original headers for retained captures when private details are stripped; keep the original legacy RegExp coercion order, reject noncanonical/indented/broken markers and never acknowledge by body equality; never let authored body labels or Unicode line separators override it. Preserve older header recognition and detailed-envelope precedence. Parsed ids remain hints until exact owned-journal/content admission; they grant no recipient, source or native authority.
+- `observability.ts`, `run-ui-runtime.ts`: Trace attention, terminal reconciliation and Pi delivery. Fresh urgent-steer admission uses formatRunSteerMessage's single canonical AX layout only after the retained run/generation/directory/event lookup. Envelope.content is already frozen presentation: replay it directly without a new journal aspect, source refresh or reformatting. Attention and steer have no presentation selector or alternate new-message formatter; deliverRunAttentionNotifications uses the same canonical AX primitives for new notify/followup output. Saved envelope.content remains the compatibility boundary. The two AX checkpoint/reference helpers now have real ordinary/urgent reuse inside observability; keep ordinary first-eight coverage independent of steer's shared16KiB reservation/refusal loop. No ambient ordinary byte cap, event/detail copy, wake change or regeneration of committed content follows. Fresh attention uses shallow typed block-YAML metadata, bare without a body and delimited before an opaque zero-added-indent body. Preserve scalar-aligned500UTF-16 legacy previews, existing ellipsis and unknown local/upstream loss, original stringify/getter faults, whole reference sequences and first-eight slots before malformed filtering. Ordinary notify/followup remains unbounded; urgent steer validates raw essentials before reference reads and fits the complete final YAML/body with later-group omission coverage under16KiB. Serialization stays local to observability, not a new global formatter allowance; selection/read/acceptance authority stays here. Fresh urgent diagnostics also reuse its opaque field primitive: event/attention/stage records distinguish retryable admission, failed send request with unconfirmed delivery/presentation, and queued recovery with its exact evidence status/reason. Do not infer no effect from an exception or turn checkpoint retry into workload replay. Diagnostic display keeps only240pair-aligned raw message units and authored Markdown, with boundary U+2026/[omitted: unknown] for loss and unavailable for malformed text. This current UI projection is separate from unchanged whitespace-normalized/trimmed4096-unit last_error, original Error/cause and frozen envelope.content; create no saved format/aspect, reader, recovery loop or extra source permission. Fresh locally owned runtime notices now use AX fields too: callback failure preserves the original onCallbackError value and opaque diagnostic; completion recovery preserves evidence status/pending phase/reason with no forced send; idle completion delivery is labeled accepted only after the original durable acceptance; teardown counts/whole literal summary path are explicitly report data, not scope closure. Watcher/retirement messages are forwarded unchanged from observability's new AX producer formatting. Watcher messages reuse the already captured detail/recovery strings: never read Error.message twice, add primitive-error coercion, change raw signatures/IDs/ts/dedup/32suffix/rearm policy or regenerate older diagnostic text. Paths stay whole dynamic literals. Retirement notices preserve optional-notify argument short-circuiting, exact error-message observations, attempted/sendStop/cancel/result/failure behavior including notifier throws, and unconfirmed closure. Stop returned and cancellation reported are not native success; fallback reason is stop path failed because the path also contains notifier execution. Do not repair already-discarded lower causes or rewrite result errors from the display. No new clipping, identities, state reads, notifier timing/levels/dedup, retries, error wrappers or native authority. Fresh completion admission creates canonical AX only after existing owner/location rechecks; an already-admitted batch returns untouched, including every older presentation format. Keep active/idle timing, acceptance, exact generation and source admission authority unchanged; fresh completion-prefix allocation follows the run-delivery contract below. Color terminal status only in `ctx.mode === "tui"`; JSON/print/RPC status must not require an initialized terminal theme or disable mandatory completion delivery. Shared ready-forest selection and ambient candidate checks are metadata-only for primary sources. Read/verify a selected primary source only when collecting eligible completion members, retaining exact source owner/generation and refusing capture promotion or lost-source stdout substitution. Unsupported complete raw-stream selections remain explicit or legacy diagnostics, never fabricated primary output; separately admitted executor-final-response text is not complete raw-stream selection.
+- `run-delivery.ts`: owner-scoped durable packet/phase persistence and bounded projections. Fresh ordinary source admission captures presentation_format=ax_records, own-data result_layout=completion_yaml_core_v1 and frozen text_budget, with no presentation selector/excerpt_format; direct and ordinary UI admission share this path. The separate inactive numbered-stream capture still inherits frontmatter_v2; do not change the private default globally or relabel retained captures. Preserve all stored encodings/absence and exact replay bytes/hints, including headings_shared_kinds and frontmatter_v1/v2; reject mixed/unknown aspects without invoking accessors. Journals store snapshots, not complete text, so neither an unreleased version nor a schema fix permits rewriting old codecs. The second frontmatter capture layout quotes unknown index as YAML "?"; the first keeps its original bytes, including unquoted ?. Fresh headers begin index, run, state, then admitted kind:primary/diagnostic; meaningful metadata and whole source/generation/location references follow. Display index is not member_index or native identity. Raw admitted Markdown follows the closed YAML at the left margin, without #N heading, result:/preview: wrapper, structural list indentation or whole-body literal fence. Known display loss is [N characters omitted] at the cut; no added ellipsis or body clipping flags/counts in YAML. Preserve structured original coverage facts and unknown upstream/fallback completeness/privacy outside metadata; fallback has no primary kind. Visible text is admitted output/final Actor response or error/failure diagnostics, never command metadata or copied command excerpts. Source text_basis remains technical. No routine group windows/status copies, members wrapper, outer counters, Batch caption or standing full-map instruction appears in new model content; captured facts remain journal data. Material whole-result/reference omission, non-done omitted states and a whole inventory reference remain explicit. A single shown row keeps the same shape even when other results were omitted. Complete model content includes all exact references and only the necessary YAML-core packet identity/relative body-marker lengths, without fresh compiler HTML tails, under49152UTF-8 bytes for up to64candidate rows/256captured members. Equal scalar/CRLF-safe text-prefix shares freeze at admission, including service overhead; no redistribution, fixed16KiB result/2KiB preview cap, source recapture or later reallocation. Preserve every saved16KiB/48KiB allowance. Prefix admission must consider full-list/decimal discontinuities rather than miss fitting rows when omission scaffolding shrinks. Whole text has no display-cut marker when complete; known upstream clipping still forbids a full-original-output claim. The source reader selects at most48KiB from the same verified postprivacy observation; source-binding previews stay160code points. Retain chosen packet prefixes, not64independent48KiB copies. Unfit metadata rows keep bounded inventory recovery. Curate/copy/freeze members, arrays, artifacts and bindings; schema DTOs grant no publication permission and phase changes do not mutate member facts. Preserve generation/parent/source identities, exact ranges/hashes and whole references. The completion-only TUI uses independent native Markdown body components and literal Text header/marker/service components, with no global Markdown patch, source/native IO or scheduling authority. Validated compiler header rows alone may hide whole reference/location data in compact view; authored body lookalikes never disappear. Fresh ordinary hints use completion_yaml_core_v1 plus a whole-content digest; validated core lengths derive block positions. Retained completion_frontmatter_v1 hints keep their SHA-256-bound UTF-16 header/body/marker/service blocks and original compiler frames, dense ordered coverage and scalar/CRLF-safe endpoints. Invalid/missing hints and expansion reveal original full Text. These are display/correlation consistency, not authentication/read/action/acceptance/native authority. Malformed frontmatter-shaped stripped history cannot regain identity from a body Batch label or become absence/retry permission; ordinary thematic-break prose retains its legacy path. Retained pre-record codecs keep host rendering; older record/literal codecs keep exact original hints, dynamic fences, count spelling and separators. Fresh ordinary indices remain packet-local; no default stream activation follows. Fresh UI member locations are observed before journal locks after actual current-session selection/recheck, with captured_file_locations and frozen file_navigation. Data-only decoding does not grant current body/source visibility. Location snapshots retain16KiB, outcomes outrank lower-priority references, and each shown record has a whole location row or explicit omission; wholly omitted records stay inventory-covered. Reload/render/phase recovery never refreshes sources or frozen availability. Old absent/current_session_request captures keep their bytes, and optional full-map research stays a separate current-session action. Source/package checks do not prove the loaded host was reloaded.
 - automatic draft/tool review domains: structurally redacted model review, journaled mutation, lineage, recovery, and explicit retry/reset safety.
 
 The bundled Skill Recipe dependency DAG is `artifacts → actors, swarm` and `project-work → actors, artifacts, swarm`; `actors`, `music-player`, `swarm`, and `recipe-memory` have no cross-Skill Recipe dependencies.
@@ -88,7 +118,7 @@ Canonical event:
 {"id":"…","ts":"…","kind":"…","summary":"…","data":{},"level":"info","attention":"notify"}
 ```
 
-Trace is a bounded retained suffix, not an audit archive. Every first-party writer must call `appendRunTraceEvent`; under the canonical token-owned lock it appends within both fixed bounds or atomically retains the newest suffix plus one cumulative warning-only `runtime.trace_compacted` marker. The marker means older history was discarded; terminal/result/execution/artifact files remain authoritative independently. Reads are newline-safe and order equal timestamps by same-source ordinal, fixed source rank, then stable id without exposing ordering metadata. Actor Inspector derives stable source-local row sequences before applying its visible-tail bound, including cumulative compaction offsets for canonical Trace, so appends never renumber retained rows. Never write `trace.jsonl` directly. Generic command lifecycle is Trace-only: `command.done` preserves complete bounded execution evidence but never requests or projects any attention value, and Recipe grammar has no command-completion delivery switch. Semantic attention is explicit: `notify` is visible status, `followup` is an ordinary checkpoint hint, and actor-authored `steer` is durable urgent delivery at Pi's next safe boundary. Never infer attention from status or exit code. Admit steer by exact event and Run generation before `deliverAs: "steer"`; acknowledge only its exact model-bound context envelope, and preserve the later root-terminal completion batch. Sequence, parallel, repeat, and import branches remain internal, while each separately launched Run owns a separate generation.
+Trace is a bounded retained suffix, not an audit archive. Read-time event omissions or malformed evidence also make history incomplete, even without a compaction marker. Every first-party writer must call `appendRunTraceEvent`; under the canonical token-owned lock it appends within both fixed bounds or atomically retains the newest suffix plus one cumulative warning-only `runtime.trace_compacted` marker. The marker means older history was discarded; terminal/result/execution/artifact files remain authoritative independently. Reads are newline-safe and order equal timestamps by same-source ordinal, fixed source rank, then stable id without exposing ordering metadata. Trace projection retains its existing source ordinals, including cumulative compaction offsets for canonical Trace. Actor Inspector list numbers are shared newer-higher chronological ranks from admitted recorded-observation metadata before source/display caps, not view positions, persistent ids or authenticated lifetime offsets. Filtering and scrolling preserve the same rank, including gaps; later older evidence or mutable observations may rerank a new read. Known history loss, unavailable/private/missing metadata, bounded Control retention, index overflow or ambiguous joins/ties show #? with a visible reason, never reversed-window guesses. Keep original projection_sequence in UI detail without mutating Trace items or their public schema; selection uses existing event ids, never display positions. Agent aggregate ordinals are not native per-session identities or a global chronology. Agent Trace ids instead use framed opaque keys from recorded command/file namespace and admitted native session-header/entry/role provenance. Session evidence carries frozen non-JSON Symbol data through existing turn copies, not a new source/capability registry. A single readable safe header plus unique nonempty safe entry id and diagnostic-free bounded source permits entry identity; ambiguous/private/degraded metadata uses admitted-record ordinal fallback, while a privacy-changed namespace uses read-local legacy position. Never hash hidden raw identity values or bodies, invent a missing entry, relax oversized-source refusal or promote these keys into original-private, immutable, lifetime or work authority. Keep canonical ids, ordering, source counters and saved packets unchanged. Session/Execution readers now carry frozen non-JSON pre-tail metadata frames (native entry provenance, stored canonical timestamp, source ordinal and admitted namespace only). Their existing 4MiB session-source bound separately caps each encoded metadata frame and the aggregate frame; overflow/private/degraded/missing-time/source-change cases discard the index, not bodies/work. Available means the admitted recorded-branch/execution metadata is present, never original whole-history, current epoch, issuer or permission proof. Existing source-reference fences cover metadata and bodies together. No global rank or UI numbering follows merely from a frame's presence. The Trace owner now joins source keys/timestamps/ordinals under the existing4MiB Trace bound without additional body projections/probes, checks all/source-filtered legacy presentation orders, then attaches frozen non-JSON recorded-observation ranks. A duplicate id or legacy non-total equal-time ordering that cannot preserve the shared order refuses numbering, not existing rows/order. Inspector alone copies chronology into UI detail; public Trace JSON/canonical schemas, original projection_sequence and id-based selection remain separate. This is scoped presentation, not cross-file atomicity, causality, complete original history or lifecycle/native authority. Never write `trace.jsonl` directly. Generic command lifecycle is Trace-only: `command.done` preserves complete bounded execution evidence but never requests or projects any attention value, and Recipe grammar has no command-completion delivery switch. Its artifact metadata is only the already prepared bounded inventory binding/unavailability, never the raw declaration map: a Trace event quota must not become an artifact/workload quota or falsely turn successful work into failure. A Trace reference is not canonical first-result or target-body/production authority. Semantic attention is explicit: `notify` is visible status, `followup` is an ordinary checkpoint hint, and actor-authored `steer` is durable urgent delivery at Pi's next safe boundary. Never infer attention from status or exit code. Admit steer by exact event and Run generation before `deliverAs: "steer"`; acknowledge only its exact model-bound context envelope, and preserve the later root-terminal completion batch. Sequence, parallel, repeat, and import branches remain internal, while each separately launched Run owns a separate generation.
 
 ### Control
 
@@ -98,9 +128,9 @@ Public shape:
 {"target":"run:<id>","action":"…","input":{},"verbose":false}
 ```
 
-Admit only lowercase ASCII actions of at most 64 characters, serialized JSON input of at most 380 bytes, and complete newline-terminated wire records of at most 512 bytes on both FIFO and named pipe. Invalid envelopes remain outside the journal; persist every admitted Control before transport. Put larger data in a declared artifact/path and send only a bounded reference or instruction through Control. Fence every record and endpoint with immutable `run_instance_id`; controlled services capture that generation at startup. Serialize admission and every compacted atomic journal replacement through token-owned dead-process-reclaiming locks. Reject malformed, oversized, stale-generation, or 64-pending journals before admission with bounded backpressure/integrity details; bound persisted errors to 4 KiB inside the string and retain at most 128 terminal records. First-party services must exact-id claim and finalize through `runs-controls.ts`; admitted nonterminal Controls never expire automatically. Keep transitions expected-state-fenced and monotonic when consumers complete before producer delivery evidence. FIFO and named pipe are transport details, not public concepts; reject partial writes and keep FIFO readers gap-free across writers. Revalidate owner, generation, state, and process identity under the lifecycle lock immediately before delivery.
+Admit only lowercase ASCII actions of at most 64 characters, serialized JSON input of at most 380 bytes, and complete newline-terminated wire records of at most 512 bytes on both FIFO and named pipe. Invalid envelopes remain outside the journal; persist every admitted Control before transport. Put larger data in a declared artifact/path and send only a bounded reference or instruction through Control. Fence every record and endpoint with immutable `run_instance_id`; controlled services capture that generation at startup. Serialize admission and every compacted atomic journal replacement through token-owned dead-process-reclaiming locks. Reject malformed, oversized, stale-generation, or 64-pending journals before admission with bounded backpressure/integrity details; bound persisted errors to 4 KiB inside the string and retain at most 128 terminal records. First-party services must exact-id claim and finalize through `runs-controls.ts`; admitted nonterminal Controls never expire automatically. Keep transitions expected-state-fenced and monotonic when consumers complete before producer delivery evidence. FIFO and named pipe are transport details, not public concepts; reject partial writes and keep FIFO readers gap-free across writers. Revalidate owner, generation, state, and process identity under the lifecycle lock immediately before delivery. Bounded journal reads require an opened regular-file descriptor: size0alone cannot establish a healthy empty journal, and only actual ENOENT is absence.
 
-Keep `controls.jsonl` raw and local for execution fidelity. Every model-facing and Actor Inspector Control surface must use the shared bounded `control-projection.ts` redaction before exposure; never attach a second raw copy in tool details.
+Keep `controls.jsonl` raw and local for execution fidelity. Every automatic model-facing and Actor Inspector Control projection must use the shared bounded `control-projection.ts` redaction before exposure; never attach a second raw copy in tool details. Ordinary same-session file investigation is a separate user-authorized read, not an automatic Control projection or permission to alter the raw journal.
 
 Runtime lifecycle and review actions remain runtime-owned. Runtime kill is the recovery path for a stuck saturated Run; it never consumes actor-local Control capacity or appends a synthetic Control record. Trace/Control quotas do not constrain user-declared artifacts, repositories, media sources, complete captures, or actor-owned workload state.
 
@@ -124,8 +154,14 @@ Never weaken:
 - redaction of secrets and machine-local paths;
 - automatic review admission, CAS, journaling, quarantine, lineage, retry, and reset safety.
 
+Fresh process identity acquisition may retry absent/empty startup argv only through `captureSpawnedRunProcessIdentity` for runners or `captureSpawnedNativeProcessIdentity` for the immediate managed-native observer, synchronously under the launch lifecycle lock with the newly spawned child handle retained. Preserve the first observed birth, abort on contradictions, and never use this launch-only acquisition to repair a missing identity later from a bare PID.
+
 Lifecycle operations fail closed when identity, ownership, or generation cannot be proven. Do not directly signal processes from UI code or edit active Run state to force outcomes.
 
+## Composition Packaging and Host Orchestration
+
+The user-requested JSONL bundle/CodeMode direction is recorded in docs/composition-transport.md; BACKLOG owns unresolved work. Keep it separate from the current UX/AX release and do not treat illustrative bundle syntax or undecided asset scope as implemented/adopted API. Bundle-local ids are container references, not top-level Recipe names or runtime authority. CodeMode is an optional host orchestration plane over existing callable tools: await a launch receipt, never use an abandoned Promise as detachment, preserve partial effects/cancellation uncertainty and leave eventual completion to the existing Run owner. Do not silently add a JavaScript Recipe backend, alter origin/visibility/native authority, require CodeMode for ordinary tools or raise the declared host floor.
+
 ## Registry and Evolution
 
 `~/.pi/agent/recipes/*.json` is executable capability memory. Preserve filename identity, atomic writes, canonical per-path locks with atomic owner publication and non-blocking abandoned staging, explicit operator-gated changes, and transportability.
@@ -136,20 +172,72 @@ Automatic review receives value-free structural projections, not executable cont
 
 ## Output and Observability
 
+The [completion-stream contract](docs/coordinator-delivery.md#completion-streams-adopted-contract) is adopted and under implementation, not active. Keep persistent numbering in the existing delivery owner: no counter reset from missing state, no branch-history reconstruction and no activation before a coupled owner-locked packet/counter/target commit and compatible recovery/presentation. Current packet-local indices and all saved bytes/hints remain unchanged until that integration is validated. The pure whole-capture safe-integer range projection reserves nothing and grants no session/delivery authority. Kernel pending-intent storage requires an existing valid owner journal, not missing-state initialization; it supplies no fresh-session bootstrap or public start action. Never silently fall back to packet-local capture after retaining an intent. Staged numbering facts bind a complete frozen member permutation and exact range/scope or unavailability; projection must not re-sort or infer numbers from body labels/current state. Their compiler-bound technical/footer recognition is consistency/correlation only. Kernel-only captureRunCompletionStreamBatch now requires an existing valid stream journal and atomically commits the full fixed snapshot, advanced counter and pending-target activation under the existing lock. Counters are positive exact next values or explicit unavailability; malformed/missing records, mixed scopes and counters behind numbered packets stay refused. All saved numbers replay even if the current counter becomes unavailable; new packets freeze #? on admitted unavailability or whole-range exhaustion. Packet finalization/receipt rotation never clear stream state. Default runtime stream capture/recovery still requires an admitted internal binding. A trusted kernel-only completionStreamSessionAdmission port opts in only to verified fresh new/fork creation with an original manager/current ticket; an event reason, ID or copied DTO alone is not admission. Fresh wrappers must match that manager/generation; reused managers and old contexts cannot revive after A→B→A. Per-start watcher/reconciliation/timer tickets and a separate async-start ticket fence replacement. Unknown/revoked stream paths neither allocate nor ACK, including post-send replacement, which does not prove no transport effect. Missing metadata never bootstraps or falls back on this opt-in path. Startup/reload/resume, including ambiguous imports, remain refused even if the port returns true. Source/compiled real SDK lifecycle probes use controlled terminal/busy-boundary data and forbid model requests; they are not loaded/native work acceptance. No public command, bootstrap, trusted continuation/import decision or rollback recovery is enabled; direct callers cannot select numbering.
+
+Apply the project-wide [Agent Experience (AX) standard](docs/agent-experience.md) before changing Inspector, public tool output/errors or agent-bound context. AX is a shared semantic projection for both people and agents, not a Telegram theme or raw JSON dump. The adopted default for runtime-owned metadata is YAML 1.2 block mappings/sequences, not Markdown-list key/value pseudo-objects or embedded object JSON; sequence markers represent real sequences only. Preserve authored text/Markdown unindented outside the metadata header, without a YAML output scalar or added wrapper/fence; runtime-owned multiline metadata strings use proper YAML scalars. The old emitters remain current implementation facts until their owned rollout, not a competing default. Display run: demo without a duplicated namespace, preserve canonical tool targets, literal sources and machine schemas, and use only admitted exact/unknown omission facts. New presentation must preserve source/ownership boundaries, full references, uncertainty, budgets and byte-stable old packets. The standard owns detailed syntax, examples, source-owner bindings and acceptance; BACKLOG owns rollout. Do not claim design adoption is implementation or restart Grow Loop/reload/publication by implication.
+
+All Inspector metadata documents (Recipe, Control, every Trace detail and captured Kill fields) share the real yaml.Document block encoder in inspector-overlay.ts. Serialize actual root fields separately for stripe provenance; mappings have no list prefix and sequence markers represent actual members without invented item keys. Preserve native scalar types, safe key/string quoting, empty []/{}, unknown selected fields and the UI-only own-undefined display state. Runtime-owned multiline strings, including process log tails, are YAML scalars with exact decoded values, never guessed Markdown bodies or executable fields. Select own data without invoking accessors/toJSON; no new completion byte/depth ceiling applies. Native terminal soft wrapping preserves graphemes and separators, adds no omission marker and never rewrites source values; a narrow soft-wrapped viewport is not a standalone serialized document. Keep root stripes, existing detail/document scroll, IDs/ranks/source sequences/filters/cache/focus/keyboard/bounds and action/privacy/read fences. Preserve the complete overlay owner in source and installed compiled replay, not just chronology selections; loaded terminal/phone acceptance and reload remain separately authorized.
+
+Control's read-only overview/request-list/YAML-detail stays inside Inspector and reuses the existing declaration, endpoint, capacity, triage and redaction owners. Bind cached observations and selection to exact Run/owner/generation and request ID; existing refresh invalidates the cache, not a new poller. Missing/replaced binding withholds replacement actions/history; malformed, foreign or ambiguous records remain partial/unavailable, never healthy absence. Preserve the20-parsed-record suffix and explicit malformed-line/partial coverage, actual status/timestamps and redacted input/error. Recorded endpoint readiness grants no connection/native/action authority; status age/staleness is not work duration, expiry or retry permission. Enter navigates only: no sending actions, synthetic ACK/stages or actuation. Existing Run-focus Kill and Trace/modal/navigation fences remain unchanged; loaded acceptance is separate.
+
+Inspector agent-turn detail (`source=agent`, `kind=agent.turn`) uses that same metadata encoder and separately renders typed assistant/user/thinking/tool-result text as independent native Markdown. Use zero horizontal/vertical component padding and empty codeBlockIndent; do not add outer body indentation, an output scalar or a whole-body fence, trim/dedent source, or parse authored headers/JSON into fields. Preserve authored list/code indentation and exact selected renderer inputs; native Markdown intentionally transforms visual syntax. Non-text result parts and unknown selected fields remain metadata. A present selected undefined value has an explicit UI-only `{value_state: "undefined"}` display record, distinct from null/literal text/absent fields; never persist it as source availability or a machine schema. Use a private extraction sentinel so body removal cannot delete real undefined slots. Field-path array positions label presentation only, not chronology/identity/action. Keep existing source/privacy/read budgets, native columns, root stripes and navigation/action fences; the completion emitter's execution ceilings are not Inspector allowances. Compiled parity and authorized loaded terminal/phone acceptance remain separate from source/headless checks.
+
+Inspector Kill confirmation is a compact popup composited over the unchanged Inspector, not a replacement screen. Keep at most72terminal columns including borders, center it within the Inspector and derive its height from captured content while leaving parent chrome visible. Never fill the parent height with blank rows. Both popup bodies have a two-column outer left inset and one blank row above/below when space permits; reserve readable text, warnings and choices before decorative blank rows at the lowest heights. Wrap pinned safety without clipping and stack both confirmation choices if the inset leaves too little horizontal space. Reuse keyHints for the parent and both dialogs: accent keys, borderAccent descriptions/frame separators and borderAccent borders. It reuses the existing AX document projection for captured run/state/action, keeping full field text available through read-only PgUp/PgDn when needed. Only descriptive captured fields page; closure: unconfirmed and both Cancel/Kill choices remain pinned, including at width24 and terminal10rows. Default Cancel, arrow/Tab choice, Enter-selected action, y-confirm, Esc/n cancellation and original captured run/generation port call remain. Paging/resize must not actuate, change choice, read new evidence or claim the captured status is current. Clamp/reset the private dialog viewport on render/open; pager numbers are terminal document-line positions, not Trace chronology. Narrow footer labels must stay truthful about Enter picking Cancel by default. Do not widen lifecycle/native authority, require scrolling before confirmation, infer scope closure or rewrite result/exception/feedback behavior from this layout. Lost/normalized180/160-unit feedback remains a separate producer contract; never repair it from hidden causes. Human Inspector docs own key explanations, not the main actors Skill.
+
+Inspector Kill cancellation is silent: Esc/n or Enter on Cancel only closes the dialog; no cancellation feedback or extra dismissal. Successful callbacks already suppress duplicate success text and invalidate the visible Run status. Preserve that behavior and the original ok/getter/error/generation/once-only semantics; failures/refusals/uncertainty stay visible. This is local Inspector feedback policy, not suppression of other delivery surfaces or native-closure proof.
+
+Inspector feedback displays the whole already-selected message directly in a modal popup: no synthetic i: prefix, i command, secondary reader or extra feedback field wrapper. Preserve authored lines/blanks/indentation/backticks opaquely through existing native-column wrapping. Esc closes the notification and clears transient feedback; only unavoidable overflow scrolls in that same popup with arrows/PgUp/PgDn. Other action/navigation keys cannot reach underlying work. A private feedbackFromAction flag comes only from entering the existing confirmKill callback path, never from message text or proof of actuation; only that path pins closure: unconfirmed and No automatic retry outside the scrollable text. Local guards/cancellation do not gain invented uncertainty receipts. Kill and feedback share a bounded rectangle compositor with terminal-default background resets, not customMessageBg or hard-coded black; selected confirmation buttons retain selectedBg. Preserve the underlying document/Trace/selector rows, stripes, focus and scroll. Cache only the last normal Inspector frame as a transient modal underlay; native column resize must not refresh evidence while a modal is open, and closing resumes the existing invalidation path. The underlay is a captured display, never fresh status/ownership/native proof. Ctrl-C retains global close behavior. Never read raw Error/cause, renew authority or reconstruct normalized180/160-unit tails. Fresh producer formatting is now AX through inspector.ts:formatActorInspectorKillFeedback, a pure selected-value formatter with actual domain/overlay reuse; it grants no source/privacy/work authority. Domain bounded retains String(value ?? empty), whitespace normalization/trim and its180-unit rule (179prefix+boundary ellipsis when clipped); overlay catch retains original Error.message versus primitive String selection, replaceAll,160slice and template coercion. Only split-pair boundaries retract one unit; malformed selected text is unavailable/unknown without fake gap or scalar repair. Dynamic selected previews use a legacy basis note and unknown loss when clipped; compiler refusal literals get no invented legacy loss. Shared action/result/state-or-diagnostic/closure records preserve ok, exact calls/getters/String/throws and success suppression, without recovering hidden lower causes. The popup recognizes only the exact anchored first two AX header lines for display color, retaining legacy-prefix compatibility; never parse body labels into actions/identity. The old195-character test bound described only the old prefixed envelope; enforce its180-unit preview allowance independently from new AX scaffolding. No journal aspect/version or saved packet migration for these fresh UI-only results.
+
+Trace table alone now receives actual inner width and projects one physical preview line with native truncateToWidth(..., ellipsis). Its private traceTableLine marks genuine column/CRLF/CR/LF gaps, not source loss, privacy or lifetime counts; full already-projected item/detail remains unchanged. Compact warning fallbacks must retain whole incomplete-history and recorded-not-lifetime/unavailable-rank meaning before optional details, without partial values presented as exact counts. At the24column component floor, Trace incomplete… and # recorded ≠ lifetime / #? unavailable preserve safety; wider captions keep prior wording when it fits. No generic fit/selector/chrome modification, extra banner row, source probe, projection cap/filter/read ordering, source counter/rank/ID or selection/cache/scroll/stripe change. ANSI resets are renderer output: assertion matching uses native stripTerminalSequences rather than assuming ellipsis is the final byte. Never turn display-gap markers into fabricated omitted-character counts or new source-body permission.
+
+Four compiler-owned Control guard errors now use private tools-message.ts:controlGuardText: unsupported runtime action, missing runtime port, unavailable Run generation and undeclared actor-local action. Format only existing caller target/action, fixed result and real supported_actions/available_actions string sequences; no saved status/owner/generation/input/correlation, mutating next or no-effects claim. Keep exact normalizer/access/declaration/dispatch order and original status/getter observations. Preserve the old undeclared join/template evaluation before formatting because its hooks/coercion can throw; its output is not an action parser. Under the shared16KiB including leading LF, whole target and whole option group grow from shorter full-or-omitted seeds, avoiding false overflow from longer omission scaffolds. Counts cover selected fields/list entries, not chars, valid-action proof or private/upstream completeness; malformed selected UTF16 withholds the whole option group without repair. No new catch, Error metadata, cause access, source read, schema or dispatch. Unowned runtime/dependency/session/normalizer/kill/archive/prune errors and awaited-send-only cause boundary remain unchanged. Reuse all14original Control declarations and whole16source/npm owner with exact standard Error/host isError/opaque value/order/budget/legacy-join properties.
+
+Only three local pre-launch spawn guards use tools-spawn.ts:spawnGuardText: unsupported state_dir, as without run: namespace and invalid id spelling. field/value identifies selected caller input, never an admitted Run, generation, launched/no-effects receipt or retry permission. Keep original state_dir/as/startsWith/slice/regexp order, including two as getter reads and target template coercion exactly once on the original error branches. The formatter must not reread input or serialize state_dir values. Whole selected strings and opaque CRLF Markdown fit16KiB including leading LF or have whole-field omission; malformed selected UTF16 is unavailable without repair or char/private-tail counts. Keep all startRun/session/Recipe/draft/navigation/success/verbose/details code outside new catches; the original post-guard launch tail stays byte-equal. Existing tools.test/invocation/SDK native fixtures remain untouched. New tools-spawn.test.ts is the exact library-owner mirror, not a feature-name exception; its two pure-guard properties run in source, explicit conformance and whole installed replay without new native work. Actual host clones arguments and rejects unsupported state_dir by its unchanged schema before execute: do not bypass validation, claim that SDK error is AX, or project direct accessor probes through cloning. Namespace/id guard errors do cross the real host isError boundary. No new module/authority; the earned tools-spawn→limits edge uses the existing shared response cap.
+
+Successful normal register/update-or-persisted receipt text now belongs to private registry.ts:registrationReceiptText, not a tools-register catch or a new presentation domain. Project only original post-activation tool/outcome/source/callable flag, the originally observed optional display boundary, selected required/optional args, warnings and first existing hint. Source references remain whole dynamically fenced literals, template stays a scalar; lists include singletons and opaque CRLF entries. Invocation advice is opaque instruction, never a parsed/trusted call; only the producer's existing unverified tool-status hint becomes typed read-only next. No new active/persisted/validated/default/body fields are added to compact text. Original warning map/join, outcome/boundary and Schema.formatToolArgs/template observations stay ordered before new formatting because faults can follow persistence/activation/notify. Capture the old optional boundary call in place; never query activation again for copy or repair disagreeing compact/details facts from dynamic getters. Everything in transaction/rollback/notify and details stays unchanged. Under16KiB including the old public LF, shorter full/omitted seeds grow monotonically; reserve fitting complete safety warnings before name/source/hint and large arg groups. Counts cover selected fields/list entries/actions, not raw/private chars; malformed/non-text selected values are unavailable without repair or another coercion. Preserve all14original registry declarations/scenarios/assertions/fixtures/cleanup except one approved layout expectation and pre-import test environment; add2properties and whole16installed replay. The unchanged sibling-process fixture's production new URL reference is remapped alongside direct imports, not its fixture/assertion/cleanup code. Its process-lock comparison is not new Actor/native/host readiness proof. Registry list/delete/draft/errors/notifier text remain separately scoped. The earned registry→tools-response/limits edges reuse existing field/fence/inspect and budget owners without new exports or callbacks.
+
+Registry list/deletion returned text stays in registry.ts. List only the original in-memory Map keys after the same sort and conditional map/join; capture old compiler-prefixed rows so rendering never coerces raw keys again. The whole selected name group fits16KiB including public LF or is wholly omitted/unavailable with selected-name coverage; do not invent a page/row/work quota or label a withheld group none. Count current selected names, not active/callable/complete-host/lifetime facts or private chars. Multiline names remain opaque and malformed selected text is not repaired. Deletion keeps original lookup→optional file unlink→map deletion→active-set update→notify order and exact partial-effect exceptions; a map miss does not authorize orphan-file deletion/deactivation. Capture the original name template conversion once at the returned-text site, preserving legacy method-bearing identity behavior without source re-coercion. Keep the exact complete-registry reload note as opaque instruction, never a typed action or permission to reload/retry. Details, notifier text, normal registration/draft/transaction/errors and all original source/npm fixtures remain independently owned.
+
+Draft promotion returned text projects only original selected name/new-update/source=draft/callable display/first hint, not the normal registration receipt's args/warnings/boundary fields or policy. Preserve name→callable→hint template conversions exactly once at their old site after notify, including String-hint coercion, Symbol rejection and primitive/opaque faults after already committed promotion effects. Never Boolean-normalize a legacy zero/object flag display, infer hint kind from its visible value, reread activation or add ordinary-registration rollback/admission. A closed canonical tool-status hint may be typed; invocation/other advice stays opaque instruction. Whole selected scalar/action fields fit16KiB including existing LF or have field/action omission, with malformed strings unavailable without repair; counts are not hidden chars. Source path/defaults/body/args and details stay undisplayed/unchanged, including dynamic activation disagreement. Preserve original source/npm owners and separate direct nonstandard-port probes from actual SDK DTO/host readiness evidence.
+
+Exactly four assertRegisterToolInputModes errors now use fixed AX compiler strings in place: removed values, invalid/empty from, mixed source modes and from args/async inheritance. Do not add a helper/catch, inspect supplied values or change hasOwn/getter/trim/mode-count/outer-lock observations to format these constants. Replacement/reference/source-mode/inherited-field choices are actual lists; original repair advice is opaque instruction, never typed mutating retry or no-effects proof. The same non-empty-from legacy sentence also exists in normalizeFromReference: keep that owner separate and use a unique guard context for edits. SDK clone/coercion/validation stays outside these local refusals: removed values/object-valued from may fail before execute, while numeric from is cloned/coerced to a string and an unnamed request can retain its old listing result. Do not force every wrong-typed host input through the direct guard, spoof schema or infer original caller types from post-validation params. Direct descriptor/getter/fallible-trim failures remain exact. All successful receipts and other registry errors/notices stay independently closed.
+
+Three ordinary executeRegisterToolUnlocked guards now project name/source AX errors only: invalid normalized name (no new raw echo), reserved name (original selected template conversion exactly once) and a new registration missing every source. Preserve all name/has/normalize/reserved-set/resolution/template/authoritative-map/blocker order and exact unowned faults; existing dependency blocker text is not a locally authored constant to restyle. Empty name stays listing and existing-tool update can still reuse its source. Reserved display uses one whole selected scalar within16KiB including old public LF, or field omission/unavailability without repair/char-tail inference; preserve legacy method-bearing identity conversions rather than re-normalizing the display. Missing-source choices are a real list and old repair advice is opaque instruction. No new catch, source/body/activation probe, registry policy, overwrite/retry authority, machine field or operation. Keep successful and other-error branches closed; compare guards against real SDK clone/coercion/schema separately from direct accessors. Both duplicate-registration refusals now reuse private duplicateRegistrationText for only the old selected name display, fixed result and exact opaque Use update=true to overwrite advice. Preserve ordinary authoritative-file/current-Map versus draft current-Map/exists short-circuit predicates, blocker-before-update and original five legacy name normalization/path/display conversions. No body/source/metadata reread, policy merge, update/overwrite/retry permission, blanket catch or no-effects receipt follows. Three template-shape constants now identify template/result: nested Recipe-shaped object with old opaque correction, empty sequence and unsupported type with real string/object/sequence choices. Only strings changed; preserve typeof/Array/key/getter/trim/reference/expand order, both helper call paths and external errors. Front null/empty deletion, undefined inheritance, later authoring null/required checks and host coercion remain distinct. A changing-getter draft probe is direct preservation evidence, not a cloneable two-source SDK contract. Four authored validation constants now identify defaults/description/template with only fixed field/result: non-object defaults, missing command-template description, null at authoring and missing final template. Preserve original args→from→description→defaults→retained-template order and all normalization/caller predicates. No new body/value echo/coercion, global null/source rule or wrapper; front deletion, inherited source, Schema argument diagnostics and observation faults retain their owners. Direct controlled method/getter probes are not SDK DTOs; host may reject defaults before execute and route missing/front-null requests through earlier source/deletion behavior. The delegated-source runtime-owned-default refusal now projects only the original first selected key plus fixed defaults/result and exact old correction as opaque instruction. Object.keys/find and the private eight-name membership stay unchanged; do not list all names, inspect values for copy, optimize rejection before normalizeDefaults finishes, or generalize the guard to command templates. Native keys are finite ASCII so full output is provably bounded without a new helper/quota/omission policy; original copy/accessor faults and command-template later stages remain. Both assertDraftPath refusals now reuse private draftPathFailureText with only the already captured allowed_root or resolved path as a whole literal field; never echo the refused caller path in the root error. Preserve original getRecipeRoot/resolve/relative/equality/dot-prefix/exists order and existing Error/formatter sites; this does not repair containment, add probes or prove absence/native closure. Full scalar references fit16KiB including LF, else whole-reference omission/unavailability without repair/count inference; keep old inspect-summary advice opaque and unchanged, not upgraded into a new listing guarantee. Only the public from-normalization catch wrapper now uses sourceNormalizationFailureText for old displayed source, selected reason, opaque legacy active_skills_summary and opaque doctor instruction. Inner normalizeFromReference errors and catch extent stay unchanged; preserve Error.message.trim versus String(error), source/reason/summary/advice left-to-right template conversions, and both canonical doctor regex/identity conversions. Never repair display/hint disagreement or undefined display, parse summary commas into a complete list, reread metadata/private causes or skip fallible old evaluations to fit budget. Whole fields grow from shorter full/omitted seeds under16KiB including LF; malformed selections unavailable without repair/char-tail inference. Normal-registration candidate-admission refusal now uses candidateAdmissionFailureText only for its two existing requestedSource truthy/falsy branches. Preserve real admitUserRecipe/validated/tool/diagnostics join and pre-Error sourceDiagnostic construction order; a truthy display object rendering empty is not the falsy branch. Joined diagnostics/legacy summary stay opaque, with original4096-UTF16 admission cap and possible malformed clipping unchanged. Fitting diagnostics get budget priority; no new body/cause read, full-list inference, catch/policy/rollback/readiness or automatic retry. Tests must use actual admission results, serialize/restore any targeted join/global Error instrumentation and settle before cleanup; never fabricate results or weaken schema for fixtures. Two draft invalid-Recipe errors now use private draftRecipeFailureText only for old selected raw reason or joined candidate diagnostics; no new path/body. Keep readRawRecipeConfig then diagnoseRawRecipeConfigFailure as separate calls, reason truthiness/once-only coercion and draft Error lookup before join (unlike normal candidate pre-Error construction). Undefined reason stays absent; a truthy object displaying empty remains a present empty reason. Whole opaque value fits16KiB/LF or is omitted/unavailable; candidate4096UTF16 legacy selection stays unchanged. Real fs/metadata faults and actual admission results must remain, with serialized restored builtins/ESM bindings and no normal/draft policy merge. Only outer post-cleanup transaction error text now uses registrationTransactionFailureText for old stage, resolution_generation, legacy active_skills_summary and surfaced error, with original template conversions at the same Error/formatter site. Cleanup/persisted bytes/unlink/Map/reactivation/setActive and their exact failures remain unwrapped; formatting faults can follow all those effects. Resolution generation is not Run/live epoch/correlation. Error.message is not newly trimmed or causes disclosed. Whole opaque values grow from shorter representations within16KiB/LF, prioritizing fitting surfaced error; legacy inner rollback/advice text remains content, not a fresh rollback/readiness/retry guarantee. Three registry notification arguments now use private registryNoticeText for only original report identity/selected name. report means compiler notice, not proved callable/host removal. Keep callback lookup/name interpolation once and callback type/position/post-effect exceptions unchanged; no activation/metadata reread or model16KiB quota. Actual runtime.notify retains hasUI gate, TUI ThemedText→native Text renders literal multiline and RPC forwards message fire-and-forget. Full well-formed values remain unbounded as before; malformed selected name unavailable without repair/hidden char counts. Loaded colored terminal/phone remains separate from native headless width tests. Runtime Recipe watcher warning/refresh messages now use report and opaque instruction constants only. Preserve direct ctx.ui.notify without adding hasUI gating, all dedup/timer/load/callback ordering and exact contained errors; old reported default root is not a freshly verified location. Runtime startup-warning AX projection preserves original classification/filter/map/push/join/template coercion before projecting known compiler warning slots into category sequences. Captured slot ranges are not authored-label parsing; old compiler layout bytes are discarded only after original join/coercion. Reuse unbounded formatMarkdownField for opaque multiline entries; malformed selected warning unavailable without repair/count guesses, doctor advice opaque. Do not add hasUI short-circuit before formatting or reconstruct missing causes/metadata.
+
+Public first-layer UX/AX must serve both audiences from the same facts: understandable progress for the human, compressed decision context for the agent, and only a relevant drill-down when needed. Do not substitute a raw dump, add blanket fields/hints, coerce status objects into text, or promise later delivery that is not established. Delivery is not handling; a legacy kill attempt is not full-scope closure. Keep raw detail explicit and recipient-scoped at every level, including details/verbose; an identity-change refusal must not publish the replacement's status. Preserve original action/refusal facts and underlying uncertainty; separate presentation/curation fixes from lifecycle/native authority. Actor-local delivery_failed may coexist with recorded handled state; retirement exceptions may follow a move/removal. Missing Trace/correlation proves no inaction. Preserve causal/correlation evidence in its existing owner before public failure projection; do not build one generic recovery/receipt domain or release a transport-spanning lifecycle lock without equivalent generation/endpoint fencing. runs-control-delivery now retains surfaced primary failures in standard non-enumerable cause and combines later failed-status recording in ordered AggregateError.errors with only genuinely returned admitted control id/generation. Endpoint-not-ready, post-send delivered-record failure and unprintable failure text retain their distinct causes. FIFO write/close faults preserve both failures and already-written bytes, not rollback. Raw chains stay Kernel-local; ordinary serialization does not publish them. After actor-local dispatch, tools-message wraps any rejection in a bounded conservative Error, preserving the exact thrown value in non-enumerable cause without coercing it. Keep the original request target/action only (whole target or explicit omission under 16 KiB), report delivery/handling/effects uncertainty and no automatic replay, and point to fresh owned inventory. Captured admission ids/generation are deliberately not copied into that public error, including verbose: an old context or error DTO does not prove current reply scope. Do not add a second lifetime registry or weaken error semantics to publish correlation. Admission or lower-owner/facade release failures without a returned record must not gain invented correlation. The selected delivery/facade/retirement/locked-mutation/replacement boundaries preserve surfaced original/later faults; that does not recover errors already discarded below them or close B2's separate awaited-transport gate.
+
+Agent-facing informational/completion text excerpts must disclose truncation and an exact omitted Unicode code-point count when that count is known. Fresh completion bodies use [N characters omitted] at the cut, outside YAML and without a new ellipsis; saved direct-field/other count spellings remain exact. Inline omission annotations retain their square brackets. Count only already-authorized privacy-projected text before clipping; do not count hidden secrets, treat UTF-16 units/bytes as characters, guess lost original lengths or widen source retention. Legacy unknown counts must be explicitly unknown, never fabricated. Apply the approved display direction to new captures/formats without rewriting already-admitted immutable packets or clipping actionable references. Every new completion admission captures canonical AX and admitted tracked primary/diagnostic counters. excerpt_format=bracketed_omissions_v1 is retained-read data only, not a generic default or selectable presentation. Saved aspect absence and every captured version preserve their exact earlier formatting. This is presentation data only, never source/visibility/work authority. Do not apply that aspect flag to unrelated legacy summaries/body clipping or infer their original counts. Fresh explicit agent Trace display counts only normalized retained turn text after existing session privacy, keeps its160-UTF-16 preview scalar-aligned and appends boundary U+2026 plus [omitted: N chars] from normalized retained turn; upstream [omitted: unknown]. This is a current read-time summary leaf, not an authored body, saved packet or new source/capture aspect. Canonical-only projectRunTraceJournal and stored/detail bytes remain unchanged; never retrofit journal/session strings or infer discarded4000-unit source counts. Malformed retained text has only an unknown-count diagnostic, without a fabricated gap/number. Malformed retained text yields an unknown-count summary, never an exact scalar count or repaired source. This changes neither saved packet formats nor the canonical-only Trace export path. Legacy outbox body500 and steer diagnostic240 lack a retained original privacy projection admitting safe exact tail counts: disclose unknown counts rather than counting raw secrets, keep source previews scalar-aligned within their original allowance, and withhold malformed visible previews without source repair. Actor redacted flags are not projection authority. This is disclosure only, not newly certified body/error privacy or broader retention; journal last_error4096 and its incomplete original-cause scope remain unchanged.
+
 Tool result/error text contributes exactly one leading line break. Keep model-facing responses compact and state-backed. Preserve complete byte-exact command streams in bounded spill files while returning bounded tails; never feed truncated tails into pipeline stdin.
 
-File watchers accelerate reconciliation; a bounded interval recovers missed terminal and retained-attention events. Canonical attention observation uses stable retained ids and bounds seen memory to the current suffix across compaction; only allowlisted legacy outbox fallback uses line offsets. Ordinary `notify` and `followup` hints prime at startup without replay and require durable state or artifacts for recovery. Explicit `steer` instead re-enters through the owner journal until exact presentation records its newer generation-fenced Trace marker.
+Complete primary command stdout is selected before formatting through its original kernel-only invocation port, never a Recipe/actor flag. A separate onFinalResponseSelected port selects the successful executor\'s actual final stdout before display formatting, not its command, raw session history or failed-root stderr. Original producer/captured privacy and the4MiB input cap remain mandatory. text_basis=actor_response plus upstream_truncated distinguish retained response text from complete raw stdout; count only the projected retained response and disclose observed prior clipping separately as unknown. Direct Pi text-print stdout is eligible; JSON/RPC/interactive output is withheld. Do not replace complete output or heal privacy/capture/publication failures through this response path; response selection is one-shot. Code0 degraded responses may retain reported killed flags without becoming native truth or failure-primary permission. Producer admission privately pins metadata; copied producers, mutated caller metadata and live same-generation metadata cannot refresh its privacy capture. The primary owner applies full captured-origin/secret projection without the default display clipping, commits immutable exported bytes, then produces bounded code-point/UTF-8 range metadata. Only the synchronous result-publication port may attach a curated descriptor or explicit unavailability; raw result `output` fields grant no publication authority. First accepted bindings, including unavailability, are immutable. Source/result/index/delivery remain separate effects. Preserve export errors and first temp-cleanup cause; source I/O is not a workload exit. Authority refusal and failed terminal publication must not retry into a synthetic failure record. No producer/work reconstruction, source scanning/substitution or native closure follows from a saved descriptor. Runner artifact preparation similarly precedes work and first canonical result visibility: retain metadata-only declaration source/view/index without probing targets, then capture `artifact_inventory` descriptor/unavailability through a separate synchronous kernel callback. Strip actor-provided inventory/protocol fields. Duplicate results never invoke either callback, and result identity is revalidated after both. Native Promise rejection is settled without awaiting; own/inherited/custom thenable completions and accessors refuse without invocation. Ordinary evidence I/O retains its exact local failure and binds explicit unavailability without changing workload policy/codes; typed source/view-binding or producer-authority refusals remain fail-closed, never synthetic workload failures. Source/view/index/result are separate effects; no retry/rollback or current file/production/primary-body claim. Natural failures and post-stop captures may retain declaration metadata without gaining terminal/native or failure-primary authority.
+
+Natural Run result writers bind the current process to kernel-published owner/generation metadata under the lifecycle lock before executing work, then publish through `runs-results.ts` instead of writing `result.json` directly. Keep producer revalidation, first-result capture, and synchronous evidence updates under that lock, never workload execution or inference. Reject proven native identity contradictions before protocol upgrade/admission and publication; unavailable native proof retains the existing exact-self-PID legacy binding, never forced-stop authority. Async command preparation and every native attempt/retry use runtime-local `withRunWorkAdmission` authority under the same lock; the executor's `admitSpawn` port is kernel-only, not a Recipe field. Its single-use factory prepares captures before native spawn and attaches stream/exit/error handling before synchronous `onAttemptManaged` inside admission. A managed handle can still have no native PID; it is not birth/identity proof and must never enter actor values or serialized tool details. Observer/admission failure after managed spawn retains streams and the first error until that process settles, then rejects without retry; do not orphan a native child or synthesize a workload exit. Revoke the factory when admission returns/throws. Capture-write errors must latch, keep draining with bounded tails, and mark receipts incomplete: physical saved bytes (null if unavailable) are not bytes observed; never publish partial persistence as complete output. An error on a known-PID managed handle is not native exit; keep its management until close. Never hold the lock for an awaited workload/inference or reuse serialized producer data as local work authority. Settled-attempt receipts are immutable observations; persist their capture/native-exit facts and command interruption through runtime-local `withRunProducerEvidence` before the next attempt or Run publication. Recording evidence may continue while stopping but must preserve the supplied root status, never reopen work or regress accepted natural status. Unwind active accounting in `finally` and preserve the primary execution rejection when evidence recording also fails; never invent an exit for unadmitted/unobserved work. Native fingerprints belong to `runs-process.ts`. Private `withRunNativeLaunchAdmission` retains intent through `runs-native-launches.ts` before invoking a factory; a throwing factory cannot erase intent or prove no birth. Lifecycle cleanup may still fail afterward: preserve the exact factory return/throw, expose runtime-local `readRunProducerCleanupFailure`, and fence further operations by that producer. Diagnostic absence is not proof of released locks; never report a stranded/unproven lock as released. Only `bindRunNativeLaunchProcess` inside the exact active native admission may add a write-once observed birth: its runtime-local managed context must match the single-use executor admission captured before spawn, not a nested/retroactive factory, copy, or late callback. Failed acquisition/persistence stays uncertain and cannot be retried into authority through that admission. Birth timestamps are diagnostic; an observed birth is not current liveness, complete membership, or terminal authority. Raw native identities/handles remain local, never actor values or tool details. A write-once direct-member settlement requires its retained birth binding plus the exact callback-scoped native-close receipt; validate that capability before taking a lifecycle lock; rejected input must not consume the subsequent genuine receipt. Consume only a valid close/member correspondence before evidence admission, then revalidate owner/generation and unchanged birth under the evidence lock. An admitted recording failure stays one-shot, not an implicit persistence retry. Record real exit code or signal separately from normalized command failure; null native exit must never normalize to success. `killed` remains executor-actuation metadata, not a synthesized Run kill cause. Settlement evidence may persist while stopping or after natural acceptance without changing root truth. Serialized records cannot reconstruct runtime authority. Private `recoverRunNativeMemberExit` may record `verified_absence` only after captured producer exit plus captured member ESRCH under the canonical lock, revalidating exact owner/generation/fingerprint and birth; it never recaptures missing identity from a bare PID. This recovery records no exit code/signal and changes no root result, cause, progress, or budget. Live, denied, unsupported, mismatched, or legacy-unbound evidence remains unproven; accepted member settlement is immutable and idempotently reused. All recorded members settling still does not establish whole-scope closure or reconstruct an unobserved native close. Any retained, malformed, nonregular, foreign, or unreadable intent/birth journal blocks generation replacement and archive/prune before metadata or evidence mutation; runner exit and natural result acceptance are not scope-closure proof. Preserve compatible live singleton attachment to the same generation and clock. No guard may erase the journal or treat an empty intent list as closure. Ordinary runner wiring still requires positive scope recovery/closure and live birth/member proof. `runs-outcomes.ts` owns cooperating outcome/primary/artifact data schemas and durable stop records; only `runs-control.ts` admits requests. An earlier accepted natural result wins, otherwise a pending claim keeps later results as nonterminal captures with no terminal Trace or handled marker. Pending/unproven scope blocks reuse even after runner exit. A request, signal, or natural result is not forced whole-scope termination proof. `readProcessGroupLiveness` observes only POSIX group presence/absence, never membership completeness or ownership. Native-resource emptiness is not closure of the originally owned descendants while workload-controlled membership changes can move processes outside it; establish scope identity and the membership/escape authority boundary before using empty resources as whole-scope proof. Parent-session teardown selects exact session owners; delivery ancestry and the discovery index are not cross-owner kill authority or a complete descendant ledger.
+
+Private `withRunDescendantIntentAdmission` reuses the real runtime-local parent producer and the same work/stop lifecycle lock to retain a declared child Run/generation/optional owner/location before synchronous kernel preparation. `runs-descendant-launches.ts` owns this intent journal, not actual child birth, filesystem ownership, or authenticated spawning-member authority. A serialized target or stored intent is never a child-start/control capability. Preparation failure retains uncertainty; the descendant journal is fenced before replacement/archive/prune just like the native journal, even after producer exit or natural acceptance. Do not wire ordinary child starts until authenticated exact-generation membership, sealed admission, and positive scope closure are established.
+
+Kernel-only `prepareDescendantRunGeneration` shares ordinary `startRun` metadata creation but requires fresh state and stages `prepared-run.json`, never canonical `run.json`/progress, native spawn, captures, Recipe launch usage, `run.start`, or a started-Run receipt. Unstarted preparation must not become a normal Run status or terminal candidate. Hold parent then child lifecycle admission, forbid parent/self aliases and live singleton substitution, revalidate the genuine parent in its current callback and exact staged child metadata before recording preparation, and retain `descendant-preparation.json` before the parent prepared fact. Any retained staged metadata/marker or parent journal stays fenced after partial writes; no implicit retry, old-evidence replacement, or resumption. Child-release failure preserves the original return/throw, quarantines the genuine parent producer, and latches the first cleanup cause; diagnostic absence is still not lock-release proof. Prepared metadata is not native birth, authenticated workload-spawner membership, or native-start permission.
+
+`runs-outcomes.ts` owns regular-file result snapshots, generation-bound natural/capture classification and the pure primary/artifact/diagnostic binding data schemas. Decoding those schemas grants no body, producer, work or native authority. Status, control and producer evidence share outcome classification. Status priority and displayed result must use the same parsed snapshot, never a second file read after contention/replacement. Accepted natural truth outranks later stop records without projecting a stopping cause or mutating files; invalid/captured/unbound data cannot gain that priority. Stop-request ACKs apply natural priority only after exact generation/owner/protocol validation and before reading later stop evidence; pending captures stay nonterminal. Legacy display compatibility is not accepted-natural or native-scope authority.
 
-Ordinary terminals retain inherited delivery lineage from each nested Actor process to the top-level coordinator. Only that root coordinator schedules completion delivery; descendant sessions stay quiet and wait for their complete containing top-level tree. A completed active `turn_end` snapshots the ready forest into one immutable batch, preserves earlier boundary entries, and returns one visible custom-message entry plus one continuation, never a native steering/follow-up enqueue. Aborted/error boundaries and pending native input defer projection. Already-idle Pi retains debounced follow-up delivery. The same batch renders as one operator card and one model prompt, fenced by owner and generation and bounded at 256 durable members, 64 model-facing rows, 16 KiB of context, and a 1 MiB journal.
+Private `reconcileRunDescendantPreparation` requires a genuine same-runtime producer and parent-then-child evidence admission. It may append a missing prepared fact or monotonically add it to the exact declared intent without replacing id/time/target; accepted facts are reused without child probes. New markers retain the originally admitted producer PID and captured fingerprint (explicit null if unavailable); never refresh that binding from actor values or changed metadata. New facts require that exact producer binding, reciprocal records, unpublished staged metadata, and parent revalidation after child-lock contention. Legacy markers without binding stay reference-only, never a source for backfill or new facts. It changes no work permission, root outcome, clock, child data, or scope fence and never retries implicitly. Loss of the runtime producer is not repaired from serialized data; restart reconciliation needs a retained producer binding and supported fresh proof.
+
+Private `recoverRunDescendantPreparation` is controller-owned metadata admission after producer loss, not a reconstructed producer capability. Bind exact parent/child owner/generation/state, retained original PID/fingerprint and supported saved native identity, then require fresh captured-producer ESRCH before a new parent fact. Hold parent then child lifecycle locks and revalidate after contention and observations; reject replacement, published child state and changed evidence. Accepted facts are immutable reads without child/native probes. Never invent native exits, launch/resume work, change root outcome/clock, or release scope guards. Preserve exact outcomes across cleanup; latch the first release failure and fence only that recovery scope in this runtime. That quarantine is not durable recovery or proof that a lock was released.
+
+File watchers accelerate reconciliation; a bounded interval recovers missed terminal and retained-attention events. Canonical attention observation uses stable retained ids and bounds seen memory to the current suffix across compaction; only allowlisted legacy outbox fallback uses line offsets. Ordinary `notify` and `followup` hints prime at startup without replay and require durable state or artifacts for recovery. Explicit `steer` instead re-enters through the owner journal until exact presentation records its newer generation-fenced Trace marker. New steer formatting belongs to observability, not a runtime whole-string cutter: retain the canonical checkpoint prefix, select at most eight whole references per group inside the shared 16 KiB cap, reserve later groups' omission coverage and never normalize/replace reference spelling. Fresh ordinary and urgent attention share the AX opaque checkpoint/body and literal-reference group primitives inside observability, not duplicated source/privacy logic. Attention and steer use one canonical new-message formatter without selectors; replay saved envelope.content before formatting, preserving every earlier captured grammar. Ordinary notify/followup still has no new shared16KiB cap/reservation, and its unchanged sink sends a visible notification plus only followup's non-displayed checkpoint context. Do not rewrite committed strings or turn body next/tool labels into actions. Omit malformed references, never repair them. Overlarge/malformed essential text remains pre-admission retryable unavailability through existing diagnostics, not a partially delivered checkpoint. Runtime must reuse an exact run/generation/directory/event's admitted envelope before formatting again, including old clipped content; formatter changes are not authority to rewrite history.
+
+Ordinary terminals retain inherited delivery lineage from each nested Actor process to the top-level coordinator. Only that root coordinator schedules completion delivery; descendant sessions stay quiet and wait for their complete containing top-level tree. A completed active `turn_end` snapshots the ready forest into one immutable batch, preserves earlier boundary entries, and returns one visible custom-message entry plus one continuation, never a native steering/follow-up enqueue. Aborted/error boundaries and pending native input defer projection. Already-idle Pi retains debounced follow-up delivery. The same batch renders as one operator card and one model prompt, fenced by owner and generation and bounded at 256 durable members, 64 model-facing rows, 48 KiB of context for fresh shared-result captures (16 KiB for retained formats), and a 1 MiB journal. `run-delivery.ts` retains a selected-batch captured-member inventory before journal admission only when whole rows would be omitted. Copy identities/status/lineage and already admitted primary/artifact/diagnostic references/unavailability, excluding diagnostic excerpts, never private member locations, summaries, legacy bodies, original declaration lists or owner/steer data. Add captured artifact/diagnostic binding inventory tags only when members carry those fields so older inventory payload hashes remain unchanged. Its full source reference consumes the shared model budget before rows. Source and journal are separate effects: preflight known journal overflow before exclusive source creation; preserve exact I/O errors and unpublished partial/orphan files without overwrite, reuse, rollback, implicit repair or ACK. Reload/phases/rendering bind the exact captured metadata without source-body reads or availability refresh. File existence/hash/path is not producer, body-publication, native or durable-immutability authority. Artifact markers are ambient metadata hints only. Eligible collection admits one exact natural result binding, verifies the full retained inventory and matching status, then copies descriptor/unavailability into the packet. Preserve accepted unavailability without source reads/repair. Suppress legacy artifact path maps for every inventory-aware member, including source loss; packet parsing rejects competing legacy paths. Shared Markdown retains literal full source/counts and metadata-only provenance, stays quiet for not_declared, and never rereads result/index/source or refreshes availability during phase/render operations. Diagnostic markers are likewise ambient hints only: eligible admission checks one exact canonical natural result and matching expected terminal status before following its deterministic source, preserves saved unavailability without reads/repair, and validates the complete closed source/field set/hash. Share source decoding with the readonly saved-role reader but require/create no Result role view/index. Select error, else failure_reason, else command, retaining at most 1000 literal code points plus exact decoded-field UTF-8/counts and full metadata reference; disclose other recorded fields as not shown. Curate/deep-freeze excerpt data through the shared data schema, not a primary DTO. Reject legacy output on every diagnostic-aware member, including unavailable bindings, and detached excerpts. Raw result.error/stdout is never fallback. Packet reload/phases/rendering do no source IO, freshness repair or ACK. Metadata-only scope is visible; not_recorded stays quiet. Native closure and all-body/summary permission remain separate.
 
 Returning a boundary draft is not acceptance: keep it pending until exact model context or bounded active-session parent-chain evidence proves the committed entry. Successful idle `sendMessage()` acceptance finalizes immediately; durable queued phase also proves acceptance. Only proven absence permits retry; incomplete or conflicting pending evidence stays pending with diagnostics. Exact acceptance authorizes generation-fenced terminal handled markers and releases later epochs without depending on one context callback. Retry duplicates collapse before presentation, malformed envelopes fail closed, and automatic review waits behind an active completion batch.
 
 When deferred Run results gate the next step, wait for their completion batch. Inspect early only for operator request, meaningful attention, or diagnosis of an overdue Run.
 
+Operator-owned staging may change concurrently through the UI. Do not gate work on index-only stage/unstage changes or treat them as source drift. Do not stage, unstage, reset or restore the index without explicit authority; validate relevant retained file contents and preserve unrelated work. Actual conflicting content/history changes remain separate concerns.
+
 ## Documentation and Release Discipline
 
 - Keep published text portable: use `~`, `<repo>`, or relative paths.
-- Update `skills/actors/SKILL.md` when durable operating mechanics change.
+- Agent-facing delivery is not complete with docs/backlog changes alone. Before final acceptance, update the actual owning Skills and their operational references for every implemented behavior or approved guidance change: actors for generic mechanics, swarm for multi-actor methodology, and other capability owners only where affected. Reconcile examples, limits, failure/cancellation behavior and current-versus-proposed status; do not describe an unimplemented proposal as available. Update skills/actors/SKILL.md when durable operating mechanics change and validate affected Skills/journeys plus installed-package parity.
 - For registration or agent-instruction changes, use `tests/registration-truth.test.ts` for resolution/admission/activation truth and `tests/agent-journeys.test.ts` for public agent journeys, then check installed-package parity at the affected boundary. Fresh-agent operating evidence must use the active Skills and public tools rather than repository source or copied helper contracts.
 - Keep `skills/swarm/SKILL.md` focused on multi-agent methodology rather than kernel internals.
 - Recipe `description` is optional. Skill Recipe QA recursively validates direct filesystem-owned components and capability semantics with zero diagnostics or warnings; it does not enforce aesthetics or architecture policy.