@plurnk/plurnk-agui 3.0.0 → 4.0.0

package/SPEC.md

@@ -13,88 +13,155 @@ does not recompute them.
   listener ({§http-host}, {§module-http-mounts}) and owns no socket. Its setup
   registers the `agui` message scheme, and its start seam is `AguiPort`, the slice of
   {§application-port} it calls. A daemon without a listener leaves it out.
+- §agui-client-types **A client's contracts are runtime-neutral.** `@plurnk/plurnk-agui/client` exports,
+  types only, what a client of this interface consumes: the state its `STATE_SNAPSHOT` and
+  `STATE_DELTA` events carry (`AguiPlusState` and its parts, {§agui-state-patches}) and the outcome a
+  management action reports (`ActionOutcome`). A browser type-checks it with DOM libraries and no Node
+  globals ({§runtime-neutral-root}); lint checks its whole source graph that way
+  (`tsconfig.browser.json`). The package root is the server module.
 - §agui-listener-admission **Bound is not ready.** The socket is core's
   ({§startup-listener-admission}): bound before durable-state admission and answering a
   retryable `503 service-starting` until daemon activation admits it after every module has
   started ({§module-http-mounts}). This module mounts `/agui` at `start`, so no
   request reaches it before its port is installed; from `stop` it answers `503
   service-stopping`.
-- §agui-thread-binding **A PLURNK workspace is the world; an AG-UI thread is a conversation over it**
-  — the lifecycle vocabulary is defined by service {§lifecycle-terms}. PLURNK's machine model ({§machine-processes}) splits the world (a workspace: one
-  curated workspace) from the CONVERSATION (a worker: a history over that world). AG-UI's workspace
-  concept is the workspace, selected by name, VERBATIM, via `forwardedProps.plurnk.workspace`
-  (attach if it exists, create with exactly that name otherwise — no prefix, no forging). The
-  workspace is REQUIRED: a worker has no existence without a world, so its absence is a contract
-  violation the module rejects (400) - never a workspace forged from the `threadId`. The
-  `threadId` is the conversation over that world, and the name is the identity at
-  BOTH levels: `threadId` == the workspace name binds the workspace's model worker (the default
-  conversation, `ensureModelWorker` — its durable default-conversation role identifies it,
-  never a name parse or root ordering); a DISTINCT
-  `threadId` names its own conversation worker — found by name among model-origin workers if
-  it exists (forks and prior conversations are addressable as threads; a client connection's
-  worker or the runtime actor `_plurnk` is never a conversation, and a thread named after one
-  fails at minting rather than binding), minted via `createConversationWorker`
-  if it doesn't. A name the daemon no longer holds (a fresh database, a deleted worker) is minted
-  anew with no history under the same name; the run-start status gauge then reports `loopId: null`
-  where the previous run's reported a loop, which is how a client tells a new conversation from a
-  resumed one. The core workspace envelope carries only the workspace and selected client
-  actor ({§methods-rebind}); AG-UI owns the separate per-thread conversation binding.
-  Process-local bindings use the complete `(workspace, threadId)` identity; equal thread names
+- §agui-thread-binding **An AG-UI thread represents a worker; workspace selection is a Plurnk extension.**
+  AG-UI itself defines no workspace. Without a workspace selection, an opaque thread string
+  resolves through core's `agui` worker reference ({§worker-external-reference}). Its first
+  worker-creating Run allocates one ordinary folderless workspace and model worker atomically;
+  subsequent Runs reuse that durable association, across reconnects, workspace rename, and daemon
+  restart. Inspection, resume and workspace actions alone never allocate an opaque conversation;
+  an unknown thread is `404 thread-not-found`. Neither names nor approval owners are lookup keys.
+  Qualified thread addresses resolve directly under {§agui-thread-address}.
+  An explicit `forwardedProps.plurnk.workspace` selects a workspace by exact name: attach if it exists, create with that name
+  otherwise when the Run permits creation. An earlier binding serves only while the workspace
+  still carries that name. After a rename, the old name resolves afresh and the new one reaches
+  the renamed workspace. Under this binding, `threadId` names a worker by its immutable name and is never
+  compared with the workspace's name. A rename preserves workers and their names; subsequent
+  requests must select the workspace's new name. The worker name resolves among model-origin workers only (forks and earlier workers are
+  addressable as threads; the runtime actor `_plurnk` is never bound). A worker comes into being by an act addressed to it or by its owner's session attaching
+  to it ({§agui-action-binding}): the first such Run creates the worker the thread names via
+  `createWorker`, and a thread named after the runtime actor fails at minting. Reading it,
+  watching it passively, or acting on the workspace never creates one. A client that names no particular worker supplies its own default name. A name the
+  daemon no longer holds (a fresh database, a deleted
+  worker) is minted anew by the next act addressed to it, with no history; the run-start status
+  gauge then reports `loopId: null` where the previous run's reported a loop, which is how a
+  client tells a new worker from a resumed one. The core workspace envelope carries only the workspace ({§methods-rebind}); AG-UI owns
+  the per-thread worker binding.
+  Process-local bindings key on the workspace's identity and the `threadId`; equal thread names
   in different workspaces never share an envelope, Worker, replay, state, or active Run.
-  Concurrent first requests acquire one envelope and conversation binding. Workspace
+  `workspace.create` selects its `name` literally under the same acquisition rule; a workspace
+  label resembling a qualified thread address is still a label, not an instruction to attach by ID.
+  Concurrent first requests acquire one envelope and worker binding. Workspace
   acquisition is serialized across threads, retaining each request's create/attach contract;
-  the creating request supplies settings, and other threads acquire their own
-  client actors in that world. Failed acquisitions retain their cause and leave no failed
+  the creating request supplies settings, and other threads attach that workspace. Failed acquisitions retain their cause and leave no failed
   cache entry preventing a later retry. Explicit Core creation retains its name-conflict
   semantics; protocol binding is not a second creation request.
-  `loop.inject`, `loop.cancel`, and `run.fork` operate on the THREAD's conversation.
-  `loop.inject` and `loop.cancel` steer a loop already running in a world, so they attach only:
-  a workspace name that does not exist is the client's error, answered 404
-  `workspace-not-found` with nothing created — never a second world minted after the name
-  and answered there. Every other request may bring the world into being.
+  `loop.inject`, `loop.cancel`, and `run.fork` operate on the THREAD's worker.
+  A Run that may create its worker, or that binds none, may create the workspace; every
+  other Run attaches only ({§agui-action-binding}): a workspace name that does not exist is the
+  client's error, answered 404 `workspace-not-found` with nothing created — never a second workspace
+  minted after the name and answered there.
   `log.read` and `entry.read` default there and may explicitly select another workspace worker.
   Extended context persists across AG-UI Runs because the worker's log does.
+  A reply to any retained thread reference of the bound worker, its qualified address, or its
+  explicit workspace-selected name is speech in that worker's conversation. This changes neither
+  the recorded message address nor its approval owner. Arrivals from another thread spelling keep
+  their log-coordinate identities and source labels ({§agui-snapshot}).
 - §agui-run-authority **AG-UI owns the client lifecycle** — `threadId`, `runId`,
   `RUN_STARTED`, `RUN_FINISHED`, `RUN_ERROR`, interrupt outcomes, and `RunAgentInput.resume`
   follow the official `@ag-ui/core` schemas. PLURNK does not maintain a parallel client
   lifecycle dialect. PLURNK owns the internal worker/loop/turn topology and projects it
   through standard events plus namespaced `plurnk.*` extensions.
 
+§agui-thread-address A qualified thread is `<workspace ID>#<worker name>`: a canonical positive,
+safe decimal integer and a native model-worker name. A string beginning with decimal digits then
+`#` reserves this grammar; leading zeroes, an out-of-range ID or an invalid worker name receive
+`400 thread-address-invalid`, not opaque-thread allocation. Other strings remain opaque, including
+Unicode and `#` in a nonnumeric prefix. Qualified IDs always select the immutable workspace ID,
+independently of forwarded workspace labels or target existence. An absent workspace is 404;
+an absent worker may be created only by a worker-creating Run ({§agui-action-binding}).
+
 ## §agui-worker-owner Approval ownership
 
-An owning conversation is `agui://anonymous/threads/<encoded threadId>`, scoped by
-workspace. It is not a socket, Run, or client bookkeeping worker. `RunAgentInput.tools`
-declares its supported client-tool names, and `forwardedProps.plurnk.interactive` (a boolean)
-states whether a person attends it; unstated, nobody does. Control attachment registers that
-capability set and claims only runtime-owned work under {§worker-ownership}; observation does
-neither. Capabilities survive disconnection and a later declaration replaces them for future
-requests.
+An owner is its thread's address, `agui://<principal>/threads/<encoded threadId>` ({§agui-run-source}),
+scoped by workspace. Resolving another thread spelling to the same worker recognizes its retained
+owner only when the principal is identical and the owner's thread is a reference to that worker
+({§agui-thread-address}). It neither rewrites ownership nor grants a different principal or another
+worker's observer its approvals. An owner is not a socket, a Run, or a worker. `RunAgentInput.tools`
+declares the client tools it implements, and `forwardedProps.plurnk.interactive` (a boolean)
+states whether a person attends it; unstated, nobody does. Every AG-UI owner reviews, because a gate
+is answered by a standard interrupt resume ({§agui-proposal-resolve}): the module registers core's
+review capability, `request_approval` ({§worker-ownership}), beside the declared tools, and a client
+declares no tool for it. Control attachment registers that capability set and claims only
+runtime-owned work under {§worker-ownership}; observation does neither. Capabilities survive
+disconnection and a later declaration replaces them for future requests.
 
 | Request | Ownership effect |
 |---|---|
-| Prompt, interrupt resume, or client operation | Control attachment for this conversation and its administrative actor. |
+| A new message ({§agui-run-input}) or an interrupt resume | Control attachment for the worker the Run binds, if any ({§agui-action-binding}). |
 | Synchronization / connection with `forwardedProps.plurnk.control = true` | Explicit control attachment without inference. |
-| Passive synchronization / connection; other management reads | No claim and no capability replacement. |
+| Passive synchronization / connection; a client operation ({§agui-client-operation}); other management Runs | No claim and no capability replacement. |
+
+§agui-owner-activation **An owner's arrival activates its workspace.** A control attachment starts the
+workspace's Functionality activation ({§methods-workspace-activate}) and does not wait for it: the Run
+proceeds, and a first prompt waits only for what remains of that activation. Observation activates
+nothing. Shutdown cancellation of that background demand is expected; other activation and
+cleanup failures remain diagnostics. Core owns and joins the preparation, not the connected Run
+({§functionality-preparation-cancellation}).
 
 Approval delivery matches the recorded owner; interaction delivery matches its recorded
 recipient. No connected-ancestor fallback or topology-based authority exists. An owner may
 review an independently active child while its own worker is idle. Concurrent connections
-to one owner can see the same gate; Core settles it at most once. A matching worker's Run
-receives its own gate; only when none is connected does delivery use the owner's conversation
-Runs. Unrelated operation Runs do not receive it.
-Resurfacing a gate preserves its originating Run's continuation. Successful resume emits
-the standard `TOOL_CALL_RESULT` for each settled interrupt before continuing; this acknowledges
-the decision, not completion of the approved operation.
+to one owner can see the same gate; Core settles it at most once. The owner's Runs are the Runs
+on its thread, a passive observation included: claiming is not presenting. A matching worker's Run
+receives its own gate; only when none is connected does delivery use the owner's Runs that
+observe its worker. An operation or other management Run never receives one.
+Each presentation of a gate retains its own Run continuation. A resumed client interaction is
+acknowledged with the standard `TOOL_CALL_RESULT` of its call before the Run continues; a decision
+on a proposal is no result of its own, since the operation's settlement answers its call
+({§agui-proposal-resolve}).
 Server approval policy belongs to Core.
 
+## §agui-run-disconnect Run lifetime
+
+Approval ownership does not confer responsibility for cancelling running work.
+
+| Connection | Unexpected disconnect |
+|---|---|
+| Message Run | Cancel its bound worker with `client_disconnected`. |
+| Resume of a message Run's interrupt | Retain the same cancellation responsibility and worker binding. |
+| Executing `op.exec` / `op.parse` Run | Cancel exactly its operation with `client_disconnected` ({§methods-loop-cancel}): its dispatch, and the executions it started that still run; once its dispatch opens the operation's loop if it disconnected before. |
+| Observation, including approval of independently started work | Detach; do not cancel work. |
+| Other management Run | Detach. |
+
+An authored terminal or interrupt ends the connection normally without cancellation.
+The disconnect handler is installed before asynchronous Run preparation; a disconnected
+request must not subsequently start work. Interrupt continuations are adapter-owned,
+not worker ownership or a second core lifecycle. Rediscovery, including after module
+restart, presents a fresh observer continuation rather than inferring a prior connection's
+cancellation responsibility.
+
 ## §agui-owner-connection Persistent observation
 
-`POST /agui/connect` accepts the standard `RunAgentInput`, without messages, actions, or
-resumes. It uses the same snapshots, events, and interrupt representation as synchronization
-({§agui-conversation-sync}), but waits when the worker is idle. New work, including owner-addressed
+`POST /agui/connect` accepts a standard `RunAgentInput` that submits nothing ({§agui-run-input}): its messages are
+the client's copy, and one that carries a new message, an action or a resume is refused, 400 `invalid-connect-input`.
+It binds as synchronization does: an owner's control connection creates the worker the
+thread names when there is none, and a passive one creates nothing. It uses the same snapshots,
+events, and interrupt representation
+({§agui-sync}), but waits when the worker is idle. New work, including owner-addressed
 child gates, is delivered without client polling or fabricated prompts. A terminal or interrupt
 ends that observation Run; the client reconnects after handling it. Detaching never cancels work.
-This is the transport implementation of the AG-UI `connect()` extension, not another event protocol.
+This is the transport implementation of the AG-UI `connect()` extension, not another event protocol: `HttpAgent`
+leaves `connect()` to its subclasses, and a client without one reattaches by running with nothing new.
+
+§agui-shutdown **Shutdown releases every remaining Run.** Module `stop` refuses new
+requests while admitted Runs retain terminal-event delivery. In `close`, after core
+settlement ({§module-shutdown-order}), each still-open Run receives `service-stopping`
+as a `RUN_ERROR` carrying that Problem ({§agui-plurnk-metadata}), then its response and heartbeat end. This
+ends the transport Run, not a worker obligation. Already-ended Runs receive nothing
+further; repeated closure is inert. Preparation finishing after closure cannot open
+a new stream. Clients need not disconnect for the daemon to stop.
 
 ## §agui-projection The projection
 
@@ -103,24 +170,29 @@ One accepted Run or daemon notification produces zero-or-more AG-UI events:
 | plurnk wire                                | AG-UI events |
 | ------------------------------------------ | ------------ |
 | schema-valid `RunAgentInput`               | `RUN_STARTED` + initial `STATE_SNAPSHOT` |
-| `forwardedProps.plurnk.mode = "sync"`      | Durable conversation `MESSAGES_SNAPSHOT`, then pending interrupt, live observation, or `RUN_FINISHED` {§agui-conversation-sync} |
+| A Run that carries nothing new ({§agui-run-input}) | Durable `MESSAGES_SNAPSHOT` of the bound worker, then pending interrupt, live observation, or `RUN_FINISHED` {§agui-sync} |
 | `log/entry` advancing to a newer turn      | `STEP_FINISHED` + `STEP_STARTED` (`turn-<id>`); late updates to earlier receipts retain their row identity without rewinding the step or clearing delivered reasoning. |
-| `log/entry` WAIT (model) | A WAIT that carries a body speaks it: `TEXT_MESSAGE_START/CONTENT/END` with the body as written, then `CUSTOM plurnk.send` with the actual wait result; a bodiless WAIT is `CUSTOM plurnk.send` alone. No invented plan, no invented speech (#1003). |
-| Successful SEND replying to this conversation, including an addressed reply delivered from another worker | Optional readable-reasoning sequence {§agui-readable-reasoning}, then `TEXT_MESSAGE_START/CONTENT/END` + `CUSTOM plurnk.send` (signal/status) |
+| `log/entry` WAIT (model) | A WAIT that carries a body speaks it: `TEXT_MESSAGE_START/CONTENT/END` with the body as written, its receipt in the speech's metadata ({§agui-plurnk-metadata}); a bodiless WAIT is an operation like any other, `TOOL_CALL_START/ARGS/END` + its receipt. No invented plan, no invented speech (#1003). |
+| Successful SEND replying to this thread, including an addressed reply delivered from another worker | Optional readable-reasoning sequence {§agui-readable-reasoning}, then `TEXT_MESSAGE_START/CONTENT/END`, the row's signal and status in its metadata ({§agui-plurnk-metadata}) |
 | Other directed or unsuccessful SEND | Ordinary tool-call operation events; never assistant speech |
-| `log/entry` other op (model)               | `TOOL_CALL_START/ARGS/END` (+ `TOOL_CALL_RESULT` when rx exists) |
-| `log/entry` actionless `kind=emissionAttempt` | Forensic row only; no assistant speech or reasoning replay. |
+| `log/entry` other op (model)               | The turn's readable-reasoning sequence when the row carries it {§agui-readable-reasoning}, then `TOOL_CALL_START/ARGS/END` + `TOOL_CALL_RESULT` carrying its receipt, except for a call that opened an obligation, which what discharges it answers {§agui-call-result}, and a gated call the Run's client already holds, which its settlement updates and answers ({§agui-proposal-resolve}) |
+| §agui-call-result `log/entry` that discharges an obligation, naming its invocation ({§methods-invocation}) | `TOOL_CALL_RESULT` answering the call that opened it, under the discharging row's own coordinate, with what the worker received: a stream observation's result (the output's first page, terminal status and exit code, {§exec-stream}), a child's conclusion, or a completion reply's words. A call whose row opened an obligation (a receipt below 400 with `attrs.stream` or `attrs.message`, {§worker-obligations}) is answered only by what discharges it, whenever that lands, one result per observed channel of a stream; its receipt rides the row. Never `plurnk.ambient`. |
+| `log/entry` actionless `kind=emissionAttempt` | `CUSTOM plurnk.ambient` ({§agui-ambient}); no assistant speech or reasoning replay. |
+| §agui-parse-refusal `log/entry` model `error` row, a parse refusal | The call the worker attempted ({§parse-attempt}): `TOOL_CALL_START` named by the attempt's verb, its arguments `{ text }` the statement as written, then `TOOL_CALL_RESULT` with the refusal, its status the failure; a refusal that names no attempt is no call and rides `CUSTOM plurnk.ambient` ({§agui-ambient}) |
 | `log/entry` READ of `reasoning://<worker>/…` or `ops://<worker>/…` | An ordinary operation receipt, not a reasoning stream. Standard reasoning delivery and replay retain original provider evidence under {§agui-readable-reasoning}. |
-| `log/entry` origin≠model                   | `CUSTOM plurnk.ambient` (foists, deltas, narrations) |
-| client-owned `loop/proposal`               | `TOOL_CALL_START/ARGS/END`, `STEP_FINISHED` when a turn step is active, then `RUN_FINISHED` with an interrupt outcome; its resume Run reopens the continued turn with `STEP_STARTED` after `RUN_STARTED` and initial state |
+| `log/entry` arrival (`_plurnk` SEND, `kind=message`) | A user `TEXT_MESSAGE_START/CONTENT/END`, as on replay ({§agui-snapshot}): a message a client on this thread sent keeps its message id, and the Run that submitted it, which already holds it, receives only `TEXT_MESSAGE_START/END` carrying its row's facts ({§agui-plurnk-metadata}); any other is named by its source |
+| §agui-progress-reply `log/entry` reply reporting progress on a message this worker's operation sent ({§methods-answering}) | A user `TEXT_MESSAGE_START/CONTENT/END` named by its source, as on replay; a reply that completes the message answers its call instead ({§agui-call-result}), and one to a message this worker did not send rides `CUSTOM plurnk.ambient` |
+| `log/entry` other origin≠model             | `CUSTOM plurnk.ambient` (foists, deltas, narrations, {§agui-ambient}) |
+| `log/entry` and `loop/terminated` of a subagent's loop | Its subagent run's projection ({§agui-subagents}): the rows above in its worker's namespace, each event attributed by `subagentRunId`, its segment bounded by `SUBAGENT_STARTED` and its conclusion |
+| client-owned `loop/proposal`               | The gated operation's own call, unless the Run's client holds it or the Run holds no conversation of its worker ({§agui-proposal-resolve}), `STEP_FINISHED` when a turn step is active, then `RUN_FINISHED` with an interrupt outcome; its resume Run reopens the continued turn with `STEP_STARTED` after `RUN_STARTED` and initial state |
 | `loop/packet`                              | `STATE_DELTA` replacing the bound thread's loop id, lifecycle, and exact packet count |
-| `loop/terminated`                          | `STATE_DELTA` (latest-turn gauge only) + `CUSTOM plurnk.terminated` (the complete daemon terminal, including physical-request accounting and top-level attribution) + `RAW` (the provider's opaque metadata bag, `source: provider`, §475) + `RUN_FINISHED` (`result.status === 200`) or `RUN_ERROR` (otherwise, from the exact RFC 9457 Problem Details) |
-| transport failure after SSE opens          | `CUSTOM plurnk.problem` (exact Problem Details) + `RUN_ERROR` (`code` = Problem `type`, `message` = Problem `detail`) |
-| `notice/event`                             | `CUSTOM plurnk.notice`; routine derivation lifecycle uses only `STATE /plurnk/status/activity`, and the drain's lifecycle beat ({§loop-status-notice}) only `STATE /plurnk/status/lifecycle` and `waitUntil`, while warnings/errors also retain their diagnostic Notice. Client discovery and passive synchronization also emit startup configuration Notices ({§configuration-repair-path}) without requiring a working model. An unavailable provider catalog is omitted from the state snapshot and reported as `CUSTOM plurnk.problem`; it does not terminate attachment or pretend the catalog is empty. |
-| `workspace/preparation` | `STATE_DELTA /plurnk/status/preparation`, scoped to attached conversations in that workspace; no chat or diagnostic duplication. |
+| §agui-run-outcome `loop/terminated`        | `STATE_DELTA` (latest-turn gauge only) + `RAW` (the provider's opaque metadata bag, `source: provider`, §475), then the Run's end: a loop that completed (below 400) is `RUN_FINISHED` with `outcome: success` and its exact terminal result as `result`; one stopped without failing (499) is `RUN_FINISHED` with `outcome: cancelled`; any other is `RUN_ERROR`, from the exact RFC 9457 Problem Details. The Run's end, finished or failed, carries its loop's token `usage`: AG-UI's own AI SDK mapping and per-model aggregation of the counts each physical request reported, absent when none did ({§agui-cost-evidence}). It also carries the complete daemon terminal record as its metadata, physical-request accounting and top-level attribution included ({§agui-plurnk-metadata}). |
+| transport failure after SSE opens          | `RUN_ERROR` (`code` = Problem `type`, `message` = Problem `detail`, the exact Problem Details as its metadata, {§agui-plurnk-metadata}) |
+| `notice/event`                             | `CUSTOM plurnk.notice`; routine derivation lifecycle uses only `STATE /plurnk/workspace/activity`, and the drain's lifecycle beat ({§loop-status-notice}) only `STATE /plurnk/status/lifecycle` and `waitUntil`, while warnings/errors also retain their diagnostic Notice. Client discovery and passive synchronization also emit startup configuration Notices ({§configuration-repair-path}) without requiring a working model. An unavailable provider catalog is omitted from the state snapshot and reported as `CUSTOM plurnk.problem`; it does not terminate attachment or pretend the catalog is empty. |
+| `workspace/preparation` | `STATE_DELTA /plurnk/workspace/preparation`, scoped to the Runs attached to that workspace; no chat or diagnostic duplication. |
 | `reasoning/event`                          | Standard live `REASONING_START` → `REASONING_MESSAGE_START` → one or more `REASONING_MESSAGE_CONTENT` → `REASONING_MESSAGE_END` → `REASONING_END` {§agui-readable-reasoning} |
 | §agui-outside-text `outside/event`          | `CUSTOM plurnk.outside` with `{ coordinate, text, tokens }` exactly as core stored and weighed it ({§notifications-outside-event}): the thread's model worker's text outside every operation, once per admitted emission, after the turn's `STEP_STARTED`. Never assistant speech, reasoning or a NOTE; a foreign worker's text never enters the thread. |
-| `stream/event` + `stream/concluded`        | `CUSTOM plurnk.stream` + `ACTIVITY_SNAPSHOT` (the standard background-activity channel: `activityType` = the scheme, replace-snapshot, §475). A conclusion preserves its exact universal `result`, including RFC 9457 Problem Details; AG-UI does not reconstruct failure from a status or summary. |
+| `stream/event` + `stream/concluded`        | `CUSTOM plurnk.stream` alone: execution metadata, the stream's progress and its exact universal `result`, including RFC 9457 Problem Details, as they happen. Never a conversation message; the execution's result reaches the conversation through its observation {§agui-call-result}. AG-UI does not reconstruct failure from a status or summary. |
 
 §agui-lifecycle-projection **Lifecycle, memory and speech remain distinct.** Live
 events, replay and `log.read` preserve literal native bodies. No task inventory
@@ -129,10 +201,10 @@ or ACP plan is inferred from prose.
 | Projection | Standard representation |
 | ---------- | ----------------------- |
 | NOTE | Ordinary tool-call operation and durable row, not assistant speech or a substitute reasoning stream |
-| WAIT | Durable row and lifecycle signal; its text does not become a response |
+| WAIT | Ordinary tool-call operation and durable row, its receipt the result; a WAIT that carries a body speaks it instead ({§agui-projection}) and never becomes a response |
 | SEND response | Assistant message through {§loop-response-messages}; delivery and completion remain independent |
 | Completion | Standard run lifecycle without an invented message |
-| Replay | Delivered messages in chronological order |
+| Replay | The live projection's messages, in log order {§agui-snapshot} |
 
 §agui-readable-reasoning **Readable provider reasoning uses AG-UI's standard
 reasoning channel.** A core `{§notifications-reasoning-event}` for the thread's
@@ -140,60 +212,96 @@ model worker projects each exact delta immediately through a balanced standard
 reasoning lifecycle identified by its durable model-call id and physical-request
 sequence. A retried request gets a new reasoning message instead of appending to
 the failed request's partial reasoning. Foreign-worker and BARE reasoning never
-enter the thread. Failed or rejected requests may therefore leave honest
-transient reasoning that is not replayed.
-
-Core also derives optional complete `reasoning` on admitted SEND, NOTE and disposition
-rows from their durable packet ({§methods-readable-reasoning}). When that value
-was not already delivered by the completed live stream, projection emits it
-atomically before the turn's first corresponding row under `<OP identity>/reasoning`.
-Subsequent rows in the same turn do not repeat it. A standard interrupt may divide one durable Loop across consecutive
+stream into the thread; a subagent's arrives with its rows, attributed to its run
+({§agui-subagents}). Failed or rejected requests may therefore leave honest
+transient reasoning that is not replayed. A Run ended before its request, revoked
+({§agui-oauth-revocation}), stopped ({§agui-shutdown}) or failed, closes the reasoning message and
+span it opened before its `RUN_ERROR`; the request streams on to every Run still observing it. A Run
+that joins after a request's reasoning began presents none of that request's deltas.
+
+Core also derives a turn's optional complete `reasoning` onto its first model operation
+row from the durable packet ({§methods-readable-reasoning}). When that value was not
+already delivered by the completed live stream, projection emits it atomically before
+that row under the identity of the request that streamed it, `model-call-<call>/request-<n>/reasoning`
+({§methods-readable-reasoning}); history a FORK inherited, which no request of this worker streamed,
+is `<coordinate>/reasoning`. A standard interrupt may divide one durable Loop across consecutive
 AG-UI Runs; the Run B projection inherits Run A's delivered-reasoning evidence
-before the stopped operation is released. Reattach replaces transient attempt presentation with the durable
-accepted `ReasoningMessage` once per turn in
-`MESSAGES_SNAPSHOT`. Empty evidence emits nothing, NOTE never substitutes for
+before the stopped operation is released. The accepted request's reasoning keeps its live identity in
+`MESSAGES_SNAPSHOT`, once per turn, so a snapshot leaves it where the live stream put it and drops only the
+transient reasoning of failed or rejected requests. Empty evidence emits nothing, NOTE never substitutes for
 reasoning ({§agui-lifecycle-projection}), and a response row still precedes its text
 sequence.
 
-- **An op row IS a tool call** — its `coordinate` is the `toolCallId`, its tx the args (one
-  delta: a dispatched plurnk op is atomic), its rx the result. The log-shaped richness the
-  core vocabulary can't hold (curation metadata, tags, coordinates) stays on the row inside
-  `plurnk.ambient`/`TOOL_CALL_RESULT` payloads.
+- **An op row IS a tool call** — its coordinate `L/T/S`, from the row's ordinals
+  ({§methods-log-coordinate}), is the `toolCallId`; its durable statement is the args, every
+  operand exactly as parsed (host, scope, pattern, aside, both COPY/MOVE selections) without the
+  verb that is the tool's name or its source position, in one delta because a dispatched plurnk op
+  is atomic; its rx is the result, except for a call that opened an obligation, whose discharge
+  is ({§agui-call-result}). The row's facts ride the call's metadata ({§agui-plurnk-metadata}).
 - §agui-encrypted-reasoning **The encrypted-reasoning interface is not implemented.**
   AG-UI defines encrypted-reasoning events and message values; plurnk emits none and
   stores none ({§provider-open-reasoning}). Implementing a transport for bytes the
   service cannot read would add surface without adding capability. Readable reasoning
-  streams and conversation replay remain {§agui-readable-reasoning}.
+  streams and snapshot replay remain {§agui-readable-reasoning}.
 - §agui-custom-namespace **The custom namespace** — plurnk-specific metadata rides
-  `CUSTOM` events named `plurnk.*` (`plurnk.send`, `plurnk.ambient`,
-  `plurnk.notice`, `plurnk.outside`, `plurnk.stream`, `plurnk.terminated` — the full loop
-  outcome and {§provider-accounting} the gauge `STATE_DELTA` cannot represent). Generic frontends skip unknown customs; plurnk-aware frontends render
-  them richly. Nothing plurnk-specific ever masquerades as a core event.
+  `CUSTOM` events named `plurnk.*` (`plurnk.ambient`, `plurnk.notice`, `plurnk.outside`, `plurnk.stream`,
+  `plurnk.descendant` for a descendant outside any subagent, and `plurnk.problem` for a Problem that ends no
+  Run, such as an unavailable provider catalog): facts with no standard subject. Generic frontends skip unknown
+  customs; plurnk-aware frontends render them richly. Nothing plurnk-specific ever masquerades as a core event.
+- §agui-plurnk-metadata **plurnk facts ride standard metadata.** A plurnk fact about something the
+  standard conversation or Run holds rides that thing's `metadata` under the one key `plurnk`, on the event
+  that builds it and on its snapshot message alike, so the official reducer folds the same metadata live and
+  on refresh. A fact with no standard subject stays a declared `CUSTOM plurnk.*` extension
+  ({§agui-custom-namespace}).
+
+  | Carrier | `metadata.plurnk` |
+  |---|---|
+  | `RUN_FINISHED` or `RUN_ERROR` that the bound Loop's terminal ends | `terminal`: the Loop's complete terminal record ({§notifications-loop-terminated}) with its `workspaceId`, numbers verbatim ({§agui-numbers-passthrough}): the full loop outcome and {§provider-accounting} the gauge `STATE_DELTA` cannot represent |
+  | `RUN_ERROR` of a Run that fails without its Loop's terminal | `problem`: the exact RFC 9457 Problem Details |
+  | What a row builds: a tool call (`TOOL_CALL_START`, folded onto the call), its result (`TOOL_CALL_RESULT`, onto the tool message), speech or an arrival (`TEXT_MESSAGE_START`, onto the message), and the same parts of a snapshot | The row's facts: `{ id, coordinate, worker, origin, op, source, address, signal, status, attrs, state }`, its durable id, log coordinate `L/T/S` ({§methods-log-coordinate}), worker, origin, operation, causal source, the address it recorded (`scheme://host[:port]path[?query][#fragment]`, or a file's bare path), signal, receipt status (the failure flag), attributes and lifecycle state ({§methods-log-entry-wire}). A gated call's settlement folds its settled facts onto the call ({§agui-proposal-resolve}). Speech, which holds only its body, also carries its heading's `aside` and the row's `receipt` |
+  | A proposal's `Interrupt` ({§agui-proposal-resolve}) | `proposal`: Core's `ProposalProjection` ({§proposal-projection}), what the reviewer reviews |
+  | `SUBAGENT_STARTED` of a subagent run ({§agui-subagents}) | Its worker's identity and generation, `{ workerId, name, parentWorkerId, depth }` ({§agui-delegation-observation}) |
+
+  An action Run's `RUN_FINISHED.result` is the action's whole outcome, `{ kind, ok, result | problem }`.
 
 §agui-status-children **Children are counted by the daemon, never inferred.** `status.children`
 is the bound Worker's alive direct children — `queued`, `running`, or `parked` under
 {§loop-lifecycle-vocabulary}; a parked child still owes a result and is exactly the one a user
 hops to. The module computes it from `ApplicationPort.listWorkers({ parentWorkerId })` for every
-snapshot and whole-gauge replacement, and republishes `STATE_DELTA /plurnk/status/children` only
-when the count changes: after another worker's `loop/terminated` or `loop/packet`, or after the
-bound Worker's own `WORK`, `FORK`, or `KILL` row lands. Clients render the number as their child
+snapshot and whole-gauge replacement, and reads it again after another worker's `loop/terminated` or
+`loop/packet`, after any `turn_generated` notice, or after the bound Worker's own `WORK`, `FORK`, or
+`KILL` row lands. It republishes `STATE_DELTA /plurnk/status/children` only when the count
+differs from the one the Run's client holds (its snapshot's, its latest whole-gauge replacement's,
+then each delta's), and never before the snapshot: a change that raced the snapshot is published
+after it. Clients render the number as their child
 indicator and never poll the directory to keep it honest. Topology is navigation: the client
 hops to a child to speak to it; watching a child's rows is the delegation observation a Run
 asks for ({§agui-delegation-observation}).
 
-§agui-status-descendants **The descendants' spend is the daemon's, republished, never promoted.**
-`status.descendants` is `{ requests, usage, knownUsage, costUsd, knownCostUsd }`: the daemon's {§provider-accounting}
-projection over the bound Worker's descendant tree on this delegation
-({§methods-worker-descendants}), without its request list — `requests` counts them, so zero
+§agui-status-spend **The spend is the daemon's, from the Worker's beginning, republished, never promoted.**
+`status.spend` is `{ requests, usage, knownUsage, costUsd, knownCostUsd }`: the daemon's {§provider-accounting}
+projection over every settled request the bound Worker and its descendants have made since the Worker
+began ({§methods-worker-accounting}), without its request list — `requests` counts them, so zero
 requests reads as nothing spent rather than unknown, and all totals and known subtotals pass through
-verbatim ({§agui-numbers-passthrough}). The module reads it beside `children` for every snapshot
-and whole-gauge replacement, and republishes `STATE_DELTA /plurnk/status/descendants` only when
-the projection changes: after another worker's `loop/packet` or `loop/terminated`, after another
-worker's `turn_generated` notice (a descendant's spend just settled), or after the bound Worker's
-own `WORK`, `FORK` or `KILL` row. Descendant notices, packets and terminals themselves are not
-promoted ({§agui-delegation-observation}); the parent's own `turn_generated` and
-`plurnk.terminated` accounting keep their meaning. With the lifecycle beat
-({§loop-status-notice}) a parked parent's clock and its children's cost both move.
+verbatim ({§agui-numbers-passthrough}). A fresh observer therefore starts from the Worker's spend so far.
+The module reads it beside `children`, at the same moments, and republishes `STATE_DELTA
+/plurnk/status/spend` under the same rule ({§agui-status-children}): only when the projection differs
+from the one the Run's client holds, never before the snapshot; a `turn_generated` notice is the moment
+a turn's spend settles. Descendant notices, packets and terminals themselves
+are not promoted ({§agui-delegation-observation}); one loop's own `turn_generated` and terminal-record
+accounting keep their meaning. With the lifecycle beat ({§loop-status-notice}) a parked parent's clock
+and its children's cost both move.
+
+§agui-status-timing **A Loop's timing is the daemon's, and it travels with the Loop's identity.**
+`status.claimedAt` is when the latest Loop first ran ({§loop-claim-latency}) and `status.terminatedAt`
+when it concluded, both Unix milliseconds like `waitUntil` and null until they happen. A snapshot
+reads them from `ApplicationPort.listWorkerLoops` ({§application-loop-observation}); live, they arrive
+with the events that change the Loop. A lifecycle beat ({§loop-status-notice}) replaces `lifecycle`,
+`loopId`, `packetCount`, `waitUntil`, `claimedAt` and `terminatedAt` in one delta, and the terminal
+({§notifications-loop-terminated}) replaces `lifecycle`, `loopId` and `terminatedAt` in one delta
+before the Run's own terminal. A connected observer therefore never holds one Loop's stamp beside
+another Loop's number, and a fresh observer measures a running Loop's elapsed time from
+`claimedAt`, never from its own attachment.
 
 §agui-numbers-passthrough **Gauge numbers pass through verbatim.** The module
 never recomputes the daemon's gauge or promotes accounting into application
@@ -201,78 +309,120 @@ state paths that could be mistaken for standard AG-UI fields.
 
 §agui-state-patches Each Run's `STATE_SNAPSHOT` precedes its `STATE_DELTA`s.
 Deltas use RFC 6902 `replace` on existing snapshot paths; replay yields the
-current gauge without clients inventing missing fields.
+current gauge without clients inventing missing fields. `plurnk.status` and `budget` are the
+bound Worker's gauge and ride only a Run that binds one ({§agui-action-binding}).
 
 | AG-UI state location                        | Daemon source                            | Meaning |
 |:--------------------------------------------|:-----------------------------------------|:--------|
+| §agui-provider-routes `snapshot.plurnk.providers[*]` | `providers.list.aliases[*]` | Each declared alias as the route a worker seeded from it gets: `alias`, `provider`, `model` and, when the model has an effort dimension, the alias's configured `effort` with `effortSource: "default"`, which is what that worker reads back ({§worker-effort}); then `active` and `inputCapacity`. A client presents the active alias's route for a worker no act has created yet, and creates nothing to learn it. |
 | `snapshot.plurnk.providers[*].inputCapacity` | `providers.list.aliases[*]`                | Each provider alias's derived physical input capacity, or `null` when unknown. |
 | `snapshot.plurnk.status.model`               | `ApplicationPort.readWorkerModel`          | The bound Worker's durable resolved model route, including its alias when selected. |
 | `snapshot.plurnk.status.loopId`              | representative `ApplicationLoopProjection.id` | Selected under {§application-worker-observation}: live work precedes terminal history; `null` when none exists. Maintenance-only loops are excluded by Core under {§application-loop-observation}. |
 | `snapshot.plurnk.status.packetCount`         | latest `ApplicationLoopProjection.packetCount` | Exact packet-bearing Turn count; packetless Turns and provider retries do not contribute. |
-| §agui-status-preparation `snapshot.plurnk.status.preparation` | `ApplicationPort.workspacePreparationStatus(workspaceId)` | Current workspace capability preparation ({§functionality-preparation-visibility}), also sent as `STATE_DELTA /plurnk/status/preparation`. Initial and reattachment snapshots carry the same state. An empty array clears it; no polling or model inference is required. |
 | `snapshot.plurnk.status.lifecycle` | latest `ApplicationLoopProjection.status` | Queued `100` is `queued`, not executing or WAITing. Running `102`, parked `202`, and terminal states retain their ordinary lifecycle meanings. |
 | §agui-status-wait `snapshot.plurnk.status.waitUntil` | `ApplicationLoopProjection.waitUntil` | Absolute Unix-millisecond observation deadline while parked, otherwise `null`. The lifecycle beat replaces it atomically with lifecycle; waking or concluding clears it. Clients may render the remaining time locally without polling, guessing from WAIT receipts, or implying work will finish at that time. |
 | `STATE_DELTA /plurnk/status/lifecycle` | `loop/packet` (running), `loop/terminated` (completed, failed), and the drain's lifecycle beat ({§loop-status-notice}: running on claim, parked on park, queued on wake) | A parked delegation and its wake reach the client the moment the daemon decides them; a client never infers parked from a WAIT row. |
-| `snapshot.plurnk.status.children` | `ApplicationPort.listWorkers({ parentWorkerId })` | The bound Worker's alive direct children — `queued`, `running`, or `parked` under {§loop-lifecycle-vocabulary}; a parked child still owes a result. Computed by the daemon for every snapshot and whole-gauge replacement, and republished as `STATE_DELTA /plurnk/status/children` only when it changes: after another worker's `loop/terminated` or `loop/packet` (it may be a child), or after the bound Worker's own `WORK`, `FORK`, or `KILL` row lands (it spawned or killed one). Clients render the number and never poll the directory for it ({§agui-status-children}). |
-| `snapshot.plurnk.status.descendants` | `ApplicationPort.descendantAccounting({ workspaceId, workerId, loopId })` | `{ requests, usage, knownUsage, costUsd, knownCostUsd }`: the daemon's {§provider-accounting} projection of the bound Worker's descendants' settled spend on this delegation, without the request list. Computed for every snapshot and whole-gauge replacement, republished as `STATE_DELTA /plurnk/status/descendants` only when it changes ({§agui-status-descendants}). |
-| `STATE_DELTA /plurnk/status/*`               | packet, termination, and derivation events | Replaceable lifecycle, packet chronology, and transient activity. Reattachment snapshots carry current derivation activity through the same projection, without polling or duplicate routine Notices. Clients never reconstruct packet count from row or STEP traffic. |
-| `snapshot.budget`                            | Run initialization                         | Creates all four gauge fields as `null`, so subsequent RFC 6902 `replace` operations always address existing values. |
+| `snapshot.plurnk.status.children` | `ApplicationPort.listWorkers({ parentWorkerId })` | The bound Worker's alive direct children — `queued`, `running`, or `parked` under {§loop-lifecycle-vocabulary}; a parked child still owes a result. Computed for every snapshot and whole-gauge replacement, republished as `STATE_DELTA /plurnk/status/children` only when it differs from what the Run's client holds, never before its snapshot ({§agui-status-children}). Clients render the number and never poll the directory for it. |
+| §agui-workspace-state `snapshot.plurnk.workspace` | the Run's client envelope | `{ id, name, projectRoot, projectLabel, preparation, activity }`: the bound workspace, its folder and the folder's label as the daemon spells it ({§workspace-label}), both null without a folder, and the activity that belongs to the workspace rather than to a Worker. Every Run bound to a workspace carries it, whether or not it binds a Worker. Clients display the label and never derive one. |
+| `snapshot.plurnk.workspace.preparation` | `ApplicationPort.workspacePreparationStatus(workspaceId)` | Current workspace capability preparation ({§functionality-preparation-visibility}), also sent as `STATE_DELTA /plurnk/workspace/preparation`. Initial and reattachment snapshots carry the same state. An empty array clears it; no polling or model inference is required. |
+| `snapshot.plurnk.workspace.activity` | `ApplicationPort.workspaceDerivationStatus(workspaceId)` | Current workspace derivation: phase, counts, percent and message while preparing, indexing or failed, and `null` when none is under way or the last pass completed. Live `search_progress` Notices replace it as `STATE_DELTA /plurnk/workspace/activity`; a Loop's terminal leaves it as derivation last reported it. Reattachment snapshots carry the current derivation through the same projection, without polling or duplicate routine Notices. |
+| `snapshot.plurnk.status.claimedAt`, `.terminatedAt` | latest `ApplicationLoopProjection.claimedAt`, `.terminatedAt` | When the latest Loop first ran and when it concluded, Unix milliseconds, null until they happen; live, the lifecycle beat and the terminal replace them in the same delta as the Loop's identity ({§agui-status-timing}). |
+| `snapshot.plurnk.status.spend` | `ApplicationPort.workerAccounting({ workspaceId, workerId })` | `{ requests, usage, knownUsage, costUsd, knownCostUsd }`: the daemon's {§provider-accounting} projection of the bound Worker's and its descendants' settled spend since the Worker began, without the request list. Computed for every snapshot and whole-gauge replacement, republished as `STATE_DELTA /plurnk/status/spend` only when it differs from what the Run's client holds, never before its snapshot ({§agui-status-spend}). |
+| `STATE_DELTA /plurnk/status/*`               | packet, termination, and lifecycle events | The bound Worker's replaceable lifecycle and packet chronology. Clients never reconstruct packet count from row or STEP traffic. |
+| `snapshot.budget`                            | initialization of a Run that binds a Worker | Creates all four gauge fields as `null`, so subsequent RFC 6902 `replace` operations always address existing values. |
 | `STATE_DELTA /budget/curationWeight`         | `loop/terminated.usage.curationWeight`    | Latest assembled packet's model-independent curation weight, or `null` when no packet exists. |
 | `STATE_DELTA /budget/curationBudget`         | `loop/terminated.usage.curationBudget`    | Latest turn's provider-derived curation calibration, or `null` when capacity is unknown. |
 | `STATE_DELTA /budget/contextTokens`          | `loop/terminated.usage.contextTokens`     | Latest emission call's last physical request input occupancy, or `null` when that call issued none or reported none. |
 | `STATE_DELTA /budget/contextCapacity`        | `loop/terminated.usage.contextCapacity`   | That same latest emission call's request-shaped physical input capacity, or `null` when unknown. |
 
-§agui-cost-evidence AG-UI defines lifecycle, messages, tools, state transport,
-`RAW`, and `CUSTOM`, but no standard token-usage or monetary-accounting event.
-`plurnk.terminated.usage.accounting` therefore preserves the daemon's complete
+§agui-cost-evidence AG-UI carries token usage on `RUN_FINISHED` ({§agui-run-outcome}), but it defines
+no monetary accounting and no per-request record. The terminal record's `usage.accounting` ({§agui-plurnk-metadata}) therefore
+preserves the daemon's complete
 {§provider-accounting} verbatim: ordered physical request records, conventional
 input/output totals with cache/reasoning details, and exact-decimal nullable
-`costUsd`. The custom event distinguishes charged, Models.dev-estimated,
+`costUsd`. The terminal record distinguishes charged, Models.dev-estimated,
 unknown, and exact-zero evidence without fabricating a value. Generic clients
-ignore the extension; PLURNK clients consume the same contracts-owned shape as
+ignore the metadata; PLURNK clients consume the same contracts-owned shape as
 every other daemon surface.
 
-- §agui-row-channel **The row channel** — every log row ALSO rides `CUSTOM plurnk.row`
-  carrying the complete client-facing row (curation metadata, durable tags, coordinate)
-  alongside its core projection. An emission row ({§emission-row}) rides it like any other; the
-  operations it announces arrive as their own rows, so a client that renders operations omits it. Literal bodies follow {§agui-lifecycle-projection}; rich clients
-  never receive the internal Plan extension. Generic clients ignore this metadata
-  channel.
-- **The gauge starts true** — `RUN_STARTED` is followed by a `STATE_SNAPSHOT` carrying the
-  daemon's provider, bound-Worker model, latest Loop, and exact packet-count truth, then
-  `STATE_DELTA`s. A dropped SSE stream cancels the loop (`loop.cancel`) — the frontend hanging
-  up IS the abort signal; no worker is orphaned unwatched.
+- §agui-ambient **A row outside the conversation rides whole** — a row that builds no part of the
+  conversation rides `CUSTOM plurnk.ambient` carrying the complete client-facing row: a foist, delta or
+  narration, another worker's row, a descendant's row outside any subagent ({§agui-subagents}), an
+  emission the daemon rejected, and a parse refusal that names no attempt ({§agui-parse-refusal}). An emission row ({§emission-row}) rides it like any other; the operations
+  it announces arrive as their own parts, so a client that renders operations omits it. Literal bodies
+  follow {§agui-lifecycle-projection}; rich clients never receive the internal Plan extension. Generic
+  clients ignore this channel.
+- §agui-run-start **The gauge starts true** — `RUN_STARTED` is followed by a `STATE_SNAPSHOT`
+  carrying the daemon's providers, the bound workspace and, when the Run binds a Worker, that
+  Worker's model, latest Loop, and exact packet-count truth, then `STATE_DELTA`s. Nothing precedes them: what reaches a Run while its snapshot is read
+  follows them, in the order it arrived; a Run that ends first ends with its terminal alone.
 
 - §agui-replay **Unoriented reattach replays once** — a rediscovered thread (the module restarted, a second
   frontend arrived) whose Run input carries none of the log's durable assistant identities attaches
-  to its existing workspace by name→id and opens ORIENTED: durable
-  arrival rows replay as user messages, named by their source when another actor caused them ({§message-causal-source}), the model worker's SEND speech
-  replays chronologically, and the one validated current Run user message follows them under a
-  Run-owned identity in the authoritative `MESSAGES_SNAPSHOT`. Client-claimed earlier history is not
-  imported. A client already carrying any durable assistant identity receives no repeated snapshot.
-  Everything else stays
-  reachable via live `plurnk.row`. Pending proposals and client interactions remain durable while
-  their operation owners are live and are presented as interrupts when the owning conversation is
+  through its durable reference or explicit address and opens ORIENTED: the authoritative `MESSAGES_SNAPSHOT`
+  carries the bound worker's messages ({§agui-snapshot}) and then the Run's new message ({§agui-run-input})
+  under a Run-owned identity. Client-claimed earlier history is not imported. A client already
+  carrying any durable assistant identity receives no repeated snapshot. Pending proposals and client interactions remain durable while
+  their operation owners are live and are presented as interrupts when the owning thread is
   resumed; a days-old question is discoverable, never converted into a mystery hang.
 
-- §agui-conversation-sync **Conversation synchronization is an inference-free AG-UI Run.**
-  `forwardedProps.plurnk.mode = "sync"` on the existing Run endpoint accepts no messages,
-  management action, or interrupt resume. It binds the named workspace and conversation,
+- §agui-sync **Synchronization is an inference-free AG-UI Run.**
+  A Run that carries no new message, action or interrupt resume synchronizes ({§agui-run-input}); its messages
+  are the client's copy. A passive observation (`forwardedProps.plurnk.control`
+  absent or false) resolves an existing worker under {§agui-thread-binding}, creates
+  nothing and claims nothing. An owner's control observation is the owner's session
+  attaching: it binds, creates and claims as a message Run does ({§agui-action-binding}). It
   emits the normal `RUN_STARTED` and initial `STATE_SNAPSHOT`, then emits an authoritative
-  `MESSAGES_SNAPSHOT` from the daemon-owned log. A durable pending interrupt is re-presented
-  through the standard terminate-resume contract; an active Loop remains observed through its
-  terminal; an idle conversation emits `RUN_FINISHED`. Synchronization admits no prompt,
+  `MESSAGES_SNAPSHOT` of the daemon-owned log ({§agui-snapshot}). What reaches the Run while its log is
+  read follows that snapshot, in the order it arrived, except the parts of a row the snapshot already
+  holds as it arrived, which are not built a second time; of a row it holds at an earlier version, only
+  the later facts folded onto the call it holds, a repeated `TOOL_CALL_START` and `TOOL_CALL_END`, and
+  its result follow. A durable pending gate addressed to the
+  Run's thread ({§agui-worker-owner}) is re-presented through the standard terminate-resume contract,
+  passive or not; an active Loop remains observed through its
+  terminal; an idle worker emits `RUN_FINISHED`. Synchronization admits no prompt,
   creates no turn, and performs no model inference. Disconnecting this observer never cancels
   independently-owned work.
 
+§agui-snapshot **A snapshot is the messages the live projection built**, in log order, under
+the live identities and with the same metadata ({§agui-plurnk-metadata}), each tool result after its call where the official reducer puts one that arrives
+live, so a client that applies it keeps every message it built live and a reloaded
+client rebuilds them. It is built from the bound worker's whole log, read page by page
+({§methods-log-read}), and each subagent run's under {§agui-subagents}, because AG-UI defines a snapshot as the
+complete set:
+
+| Durable row | Snapshot messages |
+|---|---|
+| Arrival | `user`: a message a client on this thread sent, under its message id as that client sent it; any other, identified by its coordinate and named by its source ({§message-causal-source}) |
+| A turn's first model operation, carrying the turn's reasoning | `reasoning` under the identity of the request that streamed it, or `<coordinate>/reasoning` for history a FORK inherited, before that row's own messages ({§agui-readable-reasoning}) |
+| SEND or KILL replying to this thread; a model WAIT that carries a body | `assistant` speech identified by the coordinate |
+| Any other model operation, a bodiless WAIT and a parse refusal's attempt included ({§agui-parse-refusal}) | `assistant` with one tool call, both identified by the coordinate, then `tool` `<coordinate>/result` carrying the receipt; a call that opened an obligation carries none ({§agui-call-result}), nor does a proposal awaiting its decision ({§agui-proposal-resolve}) |
+| A row that discharges an obligation | `tool` identified by its coordinate, answering the call it names: after that call and the results already beside it, or last when the call is not in view ({§agui-call-result}) |
+| A reply reporting progress on a message this worker sent | `user` identified by its coordinate and named by its source ({§agui-progress-reply}) |
+| Emission attempt, a parse refusal that names no attempt, ambient row | No message of its own |
+
+Interrupts are not snapshot messages: a pending gate is re-presented as an interrupt naming the call
+the snapshot holds, and a settled one's evidence is its operation's call and result. Transient reasoning of failed or rejected
+requests is not retained ({§agui-readable-reasoning}).
+
 ## §agui-first-party-client-conformance First-party client conformance
 
 §agui-official-client-conformance The ordinary integration gate runs the official
-`@ag-ui/client` 0.0.59 against the real daemon and a deterministic HTTP model fixture.
+`@ag-ui/client` against the real daemon and a deterministic HTTP model fixture.
 Its verifier and message builder exercise lifecycle, state, streaming reasoning,
-assistant speech, and provider refusals. The optional real-model test adds provider
-evidence; it does not substitute for the deterministic gate. Wire shapes derive
+assistant speech, and provider refusals. The explicit real-model tier adds provider
+evidence through the shared service live runner; it does not substitute for the
+deterministic gate. Wire shapes derive
 from the installed `@ag-ui/core` schemas ({§agui-run-authority}).
+Deterministic daemon fixtures use the isolated mock-tier bootstrap
+({§operator-config-real-model-profile}); operator configuration must not start
+external resources during the integration gate.
+
+An independent stock `HttpAgent` witness supplies no Plurnk forwarded properties or metadata
+handling. It exercises first contact, continuation, replay, accepted-message retry, independent
+thread isolation, concurrent first contact, restart and rename continuity, and standard tool-call
+interrupt/resume. Unknown-thread inspection creates nothing. Qualified-address witnesses supply
+only the standard `threadId` field; test-host inspection is not client protocol participation.
 
 The one-shot CLI and interactive terminal consume one AG-UI+
 semantic contract. Each surface verifies the contracts-owned conformance corpus
@@ -304,23 +454,45 @@ explicit path fails rather than falling back or skipping conformance.
 
 ## §agui-proposal-resolve Client-owned stop-the-world interactions
 
-Every client-owned daemon proposal—file edits and `[300]` operator questions—and
-every contracts-owned client interaction emits an AG-UI tool call and terminates AG-UI Run A with
-`RUN_FINISHED.outcome.type = "interrupt"`. The durable loop remains paused indefinitely
-by default; absence is not an answer. AG-UI Run B on the same thread supplies standard
-`RunAgentInput.resume` entries. Each entry correlates through `interruptId = toolCallId`, using
-`prop:<logEntryId>` for proposals and `int:<interactionId>` for client interactions. The module
+A client-owned gate, a proposal its owner reviews ({§worker-owner-resolution}) or a contracts-owned
+client interaction, terminates AG-UI Run A with `RUN_FINISHED.outcome.type = "interrupt"`. The
+durable loop remains paused until the decision, indefinitely unless the operator sets a decision
+deadline, which a proposal's interrupt carries as `expiresAt` ({§proposal-projection}); absence is
+not an answer. AG-UI Run B on the same thread supplies standard `RunAgentInput.resume` entries, each
+echoing the opaque `Interrupt.id` it answers.
+
+| Gate | What Run A presents before its interrupt | The interrupt |
+|---|---|---|
+| A proposal of the Run's bound worker | The operation's own call, `TOOL_CALL_START/ARGS/END` as its row builds it, unanswered, unless the Run's client holds it | `toolCallId` its coordinate |
+| A proposal of a worker whose subagent segment the Run has open ({§agui-subagents}) | That call in the subagent's namespace | `toolCallId` the namespaced coordinate, and `subagentRunId` |
+| A proposal of any other worker the owner reviews | Nothing: the Run holds no conversation of that worker | No `toolCallId` |
+| A client interaction | Its request's tool call, `int:<interactionId>`, with the request's exact `toolName` and `arguments` | `toolCallId` that call, and the request's `message` and `responseSchema` |
+
+A proposal's interrupt carries `reason: "tool_call"`, a review `message`, the `responseSchema` of its
+decision and Core's `ProposalProjection` as `metadata.plurnk.proposal` ({§proposal-projection}), what
+the reviewer reviews, whether or not it names a call. The call it names is the operation itself: no other call stands for its approval, and
+the decision is no result of its own. The operation's settlement answers it: the Run that holds the
+call receives a repeated `TOOL_CALL_START` and `TOOL_CALL_END` under the call's id carrying the settled
+facts, which the official reducer folds onto the call it holds, its arguments untouched, then the
+call's result, unless the operation opened an obligation, which what discharges it answers
+({§agui-call-result}). A snapshot holds a pending proposal as its call without a result
+({§agui-snapshot}), so a client that resumed holds exactly what a refreshed one builds. Separate
+presentations of one gate have separate interrupt IDs, so an observer cannot inherit another Run's
+cancellation responsibility ({§agui-run-disconnect}). Unknown presentations require
+rediscovery; pending proposals and interactions remain durable in Core. The module
 resolves the complete pending interrupt set for one worker, restores the thread's live projection
 state, and only then releases it. The pending Worker's persisted Worker and Loop remain the exact
-resolution identity. When that Worker is a descendant without its own live Run, its nearest live
-ancestor conversation is the controlling Run: Run A presents the descendant gate and Run B remains
-bound to the ancestor conversation while releasing the exact descendant. Reconnect discovers the
-same descendant set from Core's authoritative Worker topology. A terminal published after a
+resolution identity. Owner-addressed gates route under {§agui-worker-owner}: when an owner's
+thread presents another worker's gate, its resume stays bound to that thread while
+releasing the exact requesting worker. Reconnect discovers pending gates from Core by recorded
+owner, not inferred ancestry. A terminal published after a
 descendant gate remains ordered behind that gate's topology resolution and presentation; it cannot
 settle Run A before the interrupt is emitted. Concurrent descendant gates are
 presented one Worker at a time; resolving one re-surfaces the next without admitting a new prompt.
-Sibling and unrelated conversations never receive one another's gates. A resume containing foreign, partial, unknown, duplicate, or multi-worker
-interrupt sets fails before any stopped operation is released.
+Sibling and unrelated threads never receive one another's gates. A resume containing foreign, partial, unknown, duplicate, or multi-worker
+interrupt sets fails before any stopped operation is released. Mixing presentations or
+threads produces `interrupt-binding-invalid`; a connection closed before validated
+resolution produces `connection-closed` without releasing the stopped work.
 Loop terminals received while a resume is being validated or resolved are held:
 successful resolution delivers the bound Loop's terminal once; rejected resolution
 emits its exact `RUN_ERROR`, never success from the previously interrupted Loop.
@@ -344,19 +516,16 @@ initial state, and a new `STEP_STARTED` for that same durable turn before releas
 operation. The continued loop later closes that Run B step normally. No AG-UI Run may finish
 while a step remains active.
 
-Proposal tool-call arguments and resume payloads retain the proposal review contract.
-Resolved proposal payloads carry `decision`, optional edited `body`, and optional string
-`outcome`; a cancelled entry may also carry `payload.outcome`. The outcome reaches Core
+A proposal's resume payload carries the review contract: a resolved one carries `decision`,
+optional edited `body`, and optional string `outcome`; a cancelled entry may also carry `payload.outcome`. The outcome reaches Core
 unchanged under {§proposal-outcome-terse-error}; invalid outcome types refuse the resume
 before any proposal is released. An omitted outcome leaves Core's existing default intact.
-Client-interaction tool calls use the request's exact `toolName` and `arguments`; their standard
-interrupt carries its optional `message` and `responseSchema`. A resolved resume payload becomes
-the generic resolved payload, while AG-UI cancellation becomes interaction cancellation. AG-UI
+An interaction's resolved resume payload becomes the generic resolved payload, while AG-UI cancellation becomes interaction cancellation. AG-UI
 never sees or reconstructs an upstream protocol's continuation state.
 
 §agui-proposal-disposition AG-UI consumes Core's `ProposalProjection` identically
-for live delivery and reconnect. A `review` disposition becomes a tool call and
-standard interrupt only for the matching owner. `accept` and `reject` remain
+for live delivery and reconnect. A `review` disposition becomes a standard interrupt
+only for the matching owner. `accept` and `reject` remain
 Core's automatic settlements and never become client review work. Operation,
 attrs and stale-target facts remain evidence, not authority inputs.
 
@@ -368,32 +537,34 @@ selection.
 
 ## §agui-management-plane The action surface
 
-PLURNK has three inputs through the one AG-UI Run endpoint. A normal user message
-and a standard interrupt resume are not management actions.
+A Run's input ({§agui-run-input}) is one of three, and a Run that carries none of them synchronizes. A new user
+message and a standard interrupt resume are not management actions.
 
 ```mermaid
 flowchart LR
     client["AG-UI client"] --> run["POST RunAgentInput"]
-    run --> classify{"Input form"}
-    classify -->|"textual user message"| loop["ApplicationPort.runLoop"]
+    run --> classify{"What the conversation doesn't hold"}
+    classify -->|"new user message"| loop["ApplicationPort.runLoop"]
     classify -->|"RunAgentInput.resume"| resume["ApplicationPort proposal / interaction resolution"]
     classify -->|"forwardedProps.plurnk.action"| actions{"AG-UI action registry"}
+    classify -->|"none of them"| sync["Synchronization"]
     actions --> builtIn["Advertised schema admission<br/>and typed ApplicationPort call"]
     actions --> extension["Scoped ApplicationPort.invokeModuleAction"]
     loop --> events["Core event source"]
     resume --> events
+    sync --> events
     builtIn --> events
     events --> projection["AG-UI projection"]
-    extension --> result["plurnk.action.result"]
+    extension --> result["RUN_FINISHED result"]
     projection --> client
     result --> client
 ```
 
 A management-action Run carries
-`forwardedProps.plurnk.action = { kind, ...params }`. Once settled, it returns
-one `CUSTOM plurnk.action.result` shaped as `{ kind, ok, result | problem }`,
-followed by `RUN_FINISHED`. A proposal-gated action may first end with an
-interrupt and deliver that settled result on the standard resume Run. A failed
+`forwardedProps.plurnk.action = { kind, ...params }`. Once settled, the Run that asked finishes with
+`RUN_FINISHED` whose `result` is the outcome, shaped as `{ kind, ok, result | problem }`
+({§agui-plurnk-metadata}); no action presents an
+interrupt ({§agui-client-operation}). A failed
 action preserves exact RFC 9457 Problem Details and is the result of a
 successfully transported management Run; it does not turn the Run into
 `RUN_ERROR` or invent a parallel error string. Unknown kinds return an honest
@@ -401,37 +572,66 @@ successfully transported management Run; it does not turn the Run into
 
 | Public action            | Scope     | Parameters                                           | Owner / effect                                                                                                     |
 |--------------------------|-----------|------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------|
-| `ping`                   | Worldless | none                                                 | AG-UI-local liveness; returns `{}`.                                                                                |
-| `discover`               | Worldless | none                                                 | AG-UI-local public membership manifest ({§discovery}).                                                             |
-| `providers.list`         | Worldless | none                                                 | `ApplicationPort.listProviders`.                                                                                          |
-| `models.list`            | Worldless | `provider?`, `search?`, `availability?`, `offset?`, `limit?` | Returns one bounded {§model-catalog-wire} page from `ApplicationPort.listModels` under {§model-catalog}. |
-| `workspace.list`         | Worldless | none                                                 | `ApplicationPort.listWorkspaces`.                                                                                         |
-| `workspace.create`       | Worldless | `name?`, `projectRoot?`, `settings?`                 | Creates or attaches the exact named world, or asks core to create an automatically named world.                    |
-| `workspace.attach`       | Worldless | `id`, `workerId?`                                    | `ApplicationPort.attachWorkspace`; returns the selected envelope.                                                         |
+| `ping`                   | Daemon | none                                                 | AG-UI-local liveness; returns `{}`.                                                                                |
+| `discover`               | Daemon | none                                                 | AG-UI-local public membership manifest ({§discovery}).                                                             |
+| `providers.list`         | Daemon | none                                                 | `ApplicationPort.listProviders`: each alias as the route a worker seeded from it gets ({§agui-provider-routes}).            |
+| `models.list`            | Daemon | `provider?`, `search?`, `availability?`, `offset?`, `limit?` | Returns one bounded {§model-catalog-wire} page from `ApplicationPort.listModels` under {§model-catalog}. |
+| `workspace.list`         | Daemon | none                                                 | `ApplicationPort.listWorkspaces`: each workspace with its folder and the folder's label ({§workspace-label}).                |
+| `workspace.create`       | Daemon | `name?`, `projectRoot?`, `settings?`                 | Creates or attaches the exact named workspace, or asks core to name it ({§workspace-name}): the folder-derived default, selected when it exists, else a generated name ({§workspace-auto-name}). |
+| `workspace.attach`       | Daemon | exactly one of `id`, `name`, `projectRoot`              | Read-only selection under {§methods-workspace-attach}; returns `{ id, name }`, creates nothing and rebinds no thread. `name` is literal; `projectRoot` selects the daemon's folder-derived default name. |
 | `workspace.workers`      | Workspace | `id?`                                                | `ApplicationPort.listWorkers`; an explicit id overrides the bound workspace.                                              |
-| `log.read`               | Workspace | `workerId?`, log-coordinate filters                  | `ApplicationPort.readLog`; defaults to the thread's conversation worker.                                                  |
-| `loop.inject`            | Workspace | `prompt`                                             | `ApplicationPort.runLoop` on the thread's conversation worker; folds into live work or enqueues a loop.                   |
-| `loop.cancel`            | Workspace | `reason?`                                            | `ApplicationPort.cancelDrain` on the thread's conversation worker.                                                        |
-| `workspace.prompts`      | Workspace | `workerId?`, `limit?`                                | `ApplicationPort.listPrompts` scoped like `log.read`: the thread's conversation worker unless `workerId` pins another.    |
+| `log.read`               | Workspace | `workerId?`, log-coordinate filters                  | `ApplicationPort.readLog`; defaults to the thread's bound worker.                                                  |
+| `loop.inject`            | Workspace | `prompt`                                             | `ApplicationPort.runLoop` on the thread's bound worker; folds into live work or enqueues a loop.                   |
+| `loop.cancel`            | Workspace | `reason?`                                            | `ApplicationPort.cancelDrain` on the thread's bound worker.                                                        |
+| `workspace.prompts`      | Workspace | `workerId?`, `limit?`                                | `ApplicationPort.listPrompts` scoped like `log.read`: the thread's bound worker unless `workerId` pins another.    |
 | `workspace.rename`       | Workspace | `name`                                               | `ApplicationPort.renameWorkspace`.                                                                                        |
 | `workspace.share`        | Workspace | `folder`                                             | `ApplicationPort.shareWorkspace` shares the bound workspace ({§share}) into an absolute `folder` on the service host; returns `{ folder }`. |
-| `entry.read`             | Workspace | `target`, `workerId?`, `channel?`, `offset?`         | Calls `ApplicationPort.readEntry` from the explicit worker perspective or the thread conversation by default, preserving validated {§entry-read-result}. |
-| `op.exec`                | Workspace | `command`                                            | Constructs one execution statement on the default `sh` runtime and calls `ApplicationPort.dispatchClientAction` on the client worker, attached to the conversation Worker (`conversationWorkerId`, else the workspace's model worker) for Functionality.                      |
+| `workspace.rollback`     | Workspace | `to`, `workerId?`                                    | `ApplicationPort.rollback` ({§rollback}) reverses the settled file mutations after log coordinate `to` of the thread's bound worker (or `workerId`), latest first, as one client operation of the thread's owner ({§agui-client-operation}); returns the `RollbackReport`. |
+| `entry.read`             | Workspace | `target`, `workerId?`, `channel?`, `offset?`         | Calls `ApplicationPort.readEntry` from the explicit worker perspective or the thread's bound worker by default, preserving validated {§entry-read-result}. |
+| `op.exec`                | Workspace | `command`                                            | Constructs one execution statement on the default `sh` runtime and dispatches it as one client operation ({§agui-client-operation}). |
 | `op.parse`               | Workspace | `text`                                               | Parses and projects PLURNK text under {§agui-op-parse}.                                                            |
-| `op.look`                | Workspace | `text`, `workerId?`                                  | Admits one LOOK under {§agui-op-look}, rewrites it to READ, and calls core's no-log `look` projection as the conversation worker. |
-| `run.fork`               | Workspace | `name?`                                              | `ApplicationPort.forkWorker` from the thread's conversation worker.                                                       |
-| `worker.model.get`       | Workspace | none                                                 | `ApplicationPort.readWorkerModel` on the thread's conversation worker; returns `{ model, spawnModel }` as resolved specs or `null`. |
-| `worker.model.set`       | Workspace | `selector`                                           | `ApplicationPort.setWorkerModel` on the thread's conversation worker; persists the resolved selection and returns it.        |
-| `worker.child.set`       | Workspace | `selector`                                           | `ApplicationPort.setWorkerSpawnModel` on the thread's conversation worker; persists the override (`null` means inherit) and returns it. |
-| `worker.effort.get`   | Workspace | none                                                 | `ApplicationPort.readWorkerEffort` on the thread's conversation worker; returns its durable policy and the policies supported by both its model and optional spawn model. |
-| `worker.effort.set`   | Workspace | `policy`                                             | `ApplicationPort.setWorkerEffort` on the thread's conversation worker; validates and persists the policy between loops. |
-| `workspace.capabilities.get` | Workspace | none                                                | `ApplicationPort.readWorkspaceCapabilities` on the bound workspace, without creating a conversation worker; returns the complete resolver-owned projection {§capability-policy-projection}. |
+| `run.fork`               | Workspace | `name?`                                              | `ApplicationPort.forkWorker` from the thread's bound worker.                                                       |
+| `worker.model.get`       | Workspace | none                                                 | `ApplicationPort.readWorkerModel` on the thread's bound worker; returns `{ model, spawnModel }` as resolved specs or `null`. |
+| `worker.model.set`       | Workspace | `selector`                                           | `ApplicationPort.setWorkerModel` on the thread's bound worker; persists the resolved selection and returns it.        |
+| `worker.child.set`       | Workspace | `selector`                                           | `ApplicationPort.setWorkerSpawnModel` on the thread's bound worker; persists the override (`null` means inherit) and returns it. |
+| `worker.effort.get`   | Workspace | none                                                 | `ApplicationPort.readWorkerEffort` on the thread's bound worker; returns its durable policy and the policies supported by both its model and optional spawn model. |
+| `worker.effort.set`   | Workspace | `policy`                                             | `ApplicationPort.setWorkerEffort` on the thread's bound worker; validates and persists the policy between loops. |
+| `workspace.capabilities.get` | Workspace | none                                                | `ApplicationPort.readWorkspaceCapabilities` on the bound workspace, without creating a worker; returns the complete resolver-owned projection {§capability-policy-projection}. |
 | `workspace.capabilities.set` | Workspace | `policy`                                            | `ApplicationPort.setWorkspaceCapabilities` replaces the workspace policy and returns the complete resolver-owned projection {§capability-policy-projection}. |
-| Registered module action | Owner-declared | owner-defined | `ApplicationPort.invokeModuleAction`; AG-UI enforces the owner's input/output schemas and passes a worldless, bound-workspace, or bound-conversation-Worker context outside supplied params. The owner retains semantic validation and the effect. |
+| Registered module action | Owner-declared | owner-defined | `ApplicationPort.invokeModuleAction`; AG-UI enforces the owner's input/output schemas and passes a daemon, bound-workspace, or bound-Worker context outside supplied params. The owner retains semantic validation and the effect. |
+
+§agui-action-binding **What a Run binds.** A message Run and an action addressed to the thread's
+worker resolve the thread's worker ({§agui-thread-binding}); a workspace-level action
+binds none. Opaque threads allocate only for worker-creating Runs. Qualified addresses always
+require their workspace to exist. For explicit workspace selection, only a Run that may create its
+worker, or binds none, may create the workspace:
+
+| The thread's worker | The workspace | Runs and actions |
+|---|---|---|
+| Created when the workspace has none by that name | Created when absent | message Run; an owner's control observation ({§agui-sync}, {§agui-owner-connection}); `worker.model.set`, `worker.child.set`, `worker.effort.set` |
+| Required: 404 `worker-not-found` when there is none | Attached only | passive observation ({§agui-sync}); `loop.inject`, `loop.cancel`, `run.fork`, `worker.model.get`, `worker.effort.get`, worker-scoped module actions; `log.read`, `entry.read`, `workspace.prompts` and `workspace.rollback` unless `workerId` names another worker |
+| The one the interrupted Run bound, if it bound one | Attached only | interrupt resume ({§agui-proposal-resolve}) |
+| Not bound | Created when absent | `workspace.workers`, `workspace.rename`, `workspace.share`, `workspace.capabilities.get`, `workspace.capabilities.set`, `op.exec`, `op.parse`, workspace-scoped module actions |
+| Not bound | Attached only | `log.read`, `entry.read`, `workspace.prompts` and `workspace.rollback` naming a `workerId` |
+
+A daemon action ({§agui-module-action-scope}), and an action the module does not register or
+whose input its schema refuses, binds neither: it is answered on the control path, the refusal in
+its result. A Run that binds a worker carries that worker's gauge, `plurnk.status` and `budget`, and
+its deltas ({§agui-state-patches}); one that binds none carries neither. Every Run bound to a
+workspace carries that workspace's state ({§agui-workspace-state}).
+
+§agui-client-operation **`op.exec` and `op.parse` are the thread owner's client operations.** Each
+dispatches one client operation ({§connection-lifecycle}) as the thread's owner address
+({§agui-worker-owner}), acting for the model worker the thread names when one exists
+({§actor-boundary-client-operations}) and never creating it. The Run binds no worker, claims nothing and
+declares no capability set; it observes the operation's loop from the moment the dispatch opens it
+({§agui-broadcast-fan}), and a disconnect cancels exactly that operation ({§agui-run-disconnect}). A
+person's operation is never routed for review ({§proposal-disposition}), so its Run presents no
+interrupt. `workspace.rollback`'s compensations are such an operation too, without an observing Run.
 
 §agui-worker-model-actions **Worker model selection is server-backed.**
 `worker.model.get`, `worker.model.set`, and `worker.child.set` operate on the
-thread's bound conversation worker under {§worker-model-selection}. They are
+thread's bound worker under {§worker-model-selection}. They are
 the client's durable `/model` and `/child`; a client must not reassert a
 model on every loop. The get action returns the worker's resolved durable
 model and spawn override (`null` for an unset worker or inherit); the set
@@ -449,19 +649,19 @@ loop is active or parked.
 §agui-module-action-scope **An extension action uses the same management plane,
 not a private endpoint.** `ApplicationPort.listModuleActions()` returns its exact
 `{ name, scope, inputSchema, outputSchema }` descriptors under
-{§agui-discovery-contract}. A worldless action follows the control path and
+{§agui-discovery-contract}. A daemon action follows the control path and
 cannot establish a workspace. A workspace action follows ordinary thread
 binding, resolves the client envelope first, and invokes core with
 `{ scope: "workspace", workspaceId: envelope.workspaceId }`; an `id`,
 `workspaceId`, or similarly named owner parameter cannot override that
-identity. A Worker action additionally receives the thread's bound conversation
+identity. A Worker action additionally receives the thread's bound
 Worker as `{ scope: "worker", workspaceId, workerId }`; client parameters cannot
 select either authority coordinate. `discover.actions` advertises all three
 kinds without importing the extension owner.
 
 ### §agui-op-parse Parsed-operation projection
 
-`op.parse` dispatches all trusted-prefix statements as one client action and
+`op.parse` dispatches all trusted-prefix statements as one client operation ({§agui-client-operation}) and
 preserves the parser's source order in its `results` array:
 
 | Parser output                                  | AG-UI result                                                                                                                                         |
@@ -474,29 +674,6 @@ No statement at or beyond the tail boundary is dispatched. Every parse failure
 uses `stage: "parsing"` and `retryable: false`. Outside text is ignored by the
 parser under {§whitespace-contract} and produces no result.
 
-### §agui-op-look Single-statement observation admission
-
-`op.look` admits a parser result only when it contains exactly one LOOK
-statement, no other item, and no `unparsedTail`. Outside text and whitespace
-produce no item under {§whitespace-contract}. The action never selects a trusted prefix or silently discards
-a parser fact.
-
-| Parser result                                       | AG-UI outcome                                                                                                                      |
-|-----------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------|
-| First positioned diagnostic                         | 400 `agui/action/parse-failed`, preserving parser detail, line, column, source, and severity                                       |
-| No diagnostic, with `unparsedTail`                  | 400 `agui/action/parse-failed`, preserving its reason and position with `source: "grammar"` and `severity: "error"`                |
-| Zero or multiple statements, or non-LOOK            | 400 `agui/action/invalid-action-parameters` naming the observed admission fact                                                     |
-| Exactly one LOOK and no other parser fact           | Change only `op` to READ and call `ApplicationPort.look` under {§op-look}; return its exact `OperationResult` through the action envelope |
-
-Parser failures use `stage: "parsing"`; action-shape failures use
-`stage: "action-validation"`. Both are non-retryable.
-
-The observation resolves `log:///` as the thread's conversation worker; `workerId`
-pins another workspace worker. Explicit resource authorities retain their identity
-under {§turn-source-resources}. The closed observation segment stays on the connection's own
-worker: a look never adds a loop to the conversation, so its lifecycle, packet count, and
-history are unchanged by inspection.
-
 §agui-module-actions **One public action namespace.** Core rejects empty and
 duplicate extension registrations ({§module-action-registration}). At module
 startup AG-UI rejects any extension name colliding with a built-in before it
@@ -515,7 +692,7 @@ The `discover` action returns the complete schema-bearing
 type Discovery = {
     schemaVersion: 1;
     actions: Record<string, {
-        scope: "worldless" | "workspace" | "worker";
+        scope: "daemon" | "workspace" | "worker";
         inputSchema: JsonSchema;
         outputSchema: JsonSchema;
     }>;
@@ -553,16 +730,15 @@ contract.
 
 §agui-stream-producer Stream updates route to `workerId`, the initiating
 Worker. Resource reads use the canonical workspace address, not a separate
-read perspective. Shared resources neither broadcast to unrelated conversations
+read perspective. Shared resources neither broadcast to unrelated workers
 nor hide updates from the producer ({§notifications-stream-event-on-channel-change}).
 
 `loop.inject`'s steered effect streams on the original worker's open SSE.
 `loop.cancel` is its counterpart: the addressable spelling of the SSE-hangup
 abort. An action that opens a stream remains one live AG-UI Run; its result is
 held until every observed stream emits `stream/concluded`, then the result and
-`RUN_FINISHED` close that Run. A client disconnect before settlement cancels
-the action worker with reason `client_disconnected`; it never silently converts
-the action into detached background work.
+`RUN_FINISHED` close that Run. An executing operation Run retains its cancellation
+responsibility under {§agui-run-disconnect}.
 
 ## §agui-topology-scope Topology scope
 
@@ -574,19 +750,39 @@ lineage or commons attention ({§actor-boundary}), or under the delegation
 observation the Run asked for ({§agui-delegation-observation}). AG-UI does not
 synthesize a second topology by rebroadcasting sibling rows.
 
-§agui-delegation-observation **A conversation Run may observe its delegation.** A
-conversation Run whose `forwardedProps.plurnk.descendants` is `true` also receives the
+§agui-delegation-observation **A message Run may observe its delegation.** A
+message Run whose `forwardedProps.plurnk.descendants` is `true` also receives the
 rows (`log/entry`) and stream events (`stream/event`, `stream/concluded`) of every Worker
-beneath its bound Worker in Core's authoritative topology, as foreign rows only: `CUSTOM
-plurnk.row` and `plurnk.ambient`, `plurnk.stream` and its activity snapshot, never the core
-vocabulary, a step, reasoning, or this Run's terminal. The first event of each descendant is
-preceded once by `CUSTOM plurnk.descendant` `{workerId, name, parentWorkerId, depth}`, depth
-counted from the bound Worker, so a client renders identity and generation without a second
-directory read. Descendants' events are ordered among themselves on the workspace's delivery
-chain; the bound Worker's own events keep their own order. A descendant's terminal reaches the
-Run as its parent's collect row, never as a terminal; a descendant's open stream never defers
-this Run's settlement; a sibling or unrelated Worker's events never arrive. Without the
-request, the Run observes its bound Worker alone.
+beneath its bound Worker in Core's authoritative topology. A row of a loop that a call in view
+opened is its subagent run's ({§agui-subagents}); every other descendant row is a foreign row,
+`CUSTOM plurnk.ambient` ({§agui-ambient}), and every descendant stream event is `plurnk.stream`.
+None enters the bound Worker's own steps or reasoning. Each descendant is introduced once with its
+identity and generation `{workerId, name, parentWorkerId, depth}`, depth counted from the bound Worker,
+so a client renders them without a second directory read: by the metadata of its subagent's
+`SUBAGENT_STARTED` ({§agui-subagents}), or, when its first event belongs to no subagent, by a
+`CUSTOM plurnk.descendant` before that event. A workspace's events reach the Run in the order the daemon published them:
+while a descendant's topology or loop is being read, every later event waits for it. A
+descendant's terminal never settles this Run, and its conclusion reaches the bound Worker as its
+parent's collect row; a descendant's open stream never defers this Run's settlement; a sibling or
+unrelated Worker's events never arrive. Without the request, the Run observes its bound Worker
+alone.
+
+§agui-subagents **An observed delegation is a subagent run of the call that opened it.** Under
+{§agui-delegation-observation}, a descendant loop is a subagent of the Run when a call in view
+opened it ({§methods-worker-loops}): a call of the bound Worker, or one a subagent of the Run
+made. The Run judges each loop once, from the daemon's record of its opener, for its live
+projection and its snapshot alike.
+
+| Subagent run | AG-UI |
+|---|---|
+| Identity | `subagentRunId` is its loop's address `ops://<worker>/<loop>` ({§worker-loop-result}); `name` is its worker's name |
+| Its rows | Its own worker's projection ({§agui-projection}, {§agui-snapshot}): each message and tool-call id is a coordinate in that worker's namespace, `worker://<name>#L/T/S`, and every event and message is attributed by `subagentRunId`, its `CUSTOM` metadata included, except the Run-scoped `RUN_STARTED`, `RUN_FINISHED`, `RUN_ERROR` and `MESSAGES_SNAPSHOT` |
+| Start | `SUBAGENT_STARTED` the first time the Run presents its work, a live row or a snapshot that holds its messages, after its parent subagent's: `parentToolCallId` is the opening call's id, and `parentSubagentRunId` names the subagent that made it |
+| Conclusion | Its loop's conclusion ends the segment once its step closes, in the order the daemon published it: below 400, `SUBAGENT_FINISHED` with `outcome: success` and the exact terminal result as `result`; any other, a stop included, `SUBAGENT_ERROR` with the Problem's `detail` as `message` and `type` as `code`. A loop that concluded before the Run could see it ends as it starts. |
+| The Run's end | Before `RUN_FINISHED`, whether the bound Loop's terminal, an idle synchronization's or an interrupt's, each segment still open ends `SUBAGENT_FINISHED` with `outcome: suspended`: the work goes on, and a later Run presents it again. `RUN_ERROR` ends the stream as it stands. |
+
+A snapshot is one conversation in log order, the bound Worker's messages and each subagent's, and is
+followed by each subagent run it holds, presented parents first.
 
 ## §agui-broadcast-fan Event fan and AG-UI Run settlement
 
@@ -597,9 +793,8 @@ interrupt-resume Run restores its predecessor's projection and notification
 scope. A same-worker interrupt remains bound to the pending item's Worker and
 Loop. A foreign-worker interrupt preserves the owner's controlling Run binding,
 using the pending item's Worker and Loop only as its release identity. Only the
-controlling Run's bound Loop terminal may emit
-`plurnk.terminated` and close the SSE.
-The custom event preserves the daemon's exact universal `result`; failures use
+controlling Run's bound Loop terminal may end the Run with its terminal record and close the SSE.
+The terminal record preserves the daemon's exact universal `result`; failures use
 the Problem `type` as the AG-UI error code and `detail` as its message. The
 module never reconstructs a failure from a status, summary, or exception text.
 Gate routing follows {§agui-worker-owner}; topology does not confer authority.
@@ -611,8 +806,8 @@ this Run.
 
 | AG-UI Run | Core notifications admitted | Settlement owner |
 | ---------- | --------------------------- | ---------------- |
-| Message or interrupt-resume | Bound Worker; exact Loop once known. Workspace derivation progress may carry no Worker. Under {§agui-delegation-observation}, descendants' rows and streams as foreign rows. | Exact Loop terminal or interrupt. |
-| `op.exec` / `op.parse` | Client-operation Worker's log and stream events. A proposal resume retains this scope. | This action result, deferred through its owned streams. |
+| Message or interrupt-resume | Bound Worker; exact Loop once known. Workspace derivation progress may carry no Worker. Under {§agui-delegation-observation}, descendants' rows and streams: a subagent's ({§agui-subagents}) or foreign. | Exact Loop terminal or interrupt. |
+| `op.exec` / `op.parse` | Its operation's Loop in the runtime Worker, from the moment the dispatch opens it: that Loop's rows and notices, and the streams those rows announce. Workspace derivation progress may carry no Worker. | This action result, deferred through its owned streams; never the Loop's terminal. |
 | Every other action | None; the Run carries only its direct state snapshot and action result. | This action result. |
 
 An operation Run owns an execution from the row that announces it: a started or
@@ -621,12 +816,138 @@ proposed address opens no stream. An admitted address stays open for the Run
 until its `stream/concluded`, so the action result is deferred even when the
 command writes late or never (a `stream/event` is a race the result must not
 win). A detached execution (`<-1>`) is nobody's obligation and never defers the
-result.
+result. The runtime Worker hosts every person's operations and the daemon's own work, so an
+operation Run never owns a stream its Loop did not announce. Stream activity of that Worker
+which no row of the Run's Loop has announced yet is held for it: the row that announces the
+address delivers the latest progress and then any conclusion, so a stream that concluded
+before its row defers nothing; activity no row of its Loop ever announces never reaches it.
 
 `workerId` (or `entry.worker_id`) is the actor owner; `loopId` (or
 `entry.loop_id`) refines it wherever the event is loop-scoped. Opening a
 read-only management Run can therefore never replay reasoning, operation rows,
-or turn disposition from an active conversation.
+or turn disposition from an active worker.
+
+## §agui-oauth Authentication
+
+AG-UI is the OAuth 2.1 authorization server of the daemon's one credential authority
+({§credential-authority}): it issues every credential the listener admits and verifies them for
+`/agui` ({§agui-http-authorization}). The daemon authenticates under the shared `PLURNK_AUTH=1`
+({§operator-config-shared-keys}), the shipped posture, and never by inference from what else is
+set: then the module publishes the authority's face at setup and serves the endpoints below. Under
+`PLURNK_AUTH=0` it publishes nothing, serves none of them, and every resource admits anonymously.
+
+§agui-oauth-authority **One authority, scoped by resource.** A credential carries the scopes of the
+resources it may reach; `agui` names the client interface and `a2a` the hosted A2A exposure
+({§a2a-hosted-credentials}), and a mounted resource admits only a token carrying its own scope. Grants are authorization code with PKCE (`S256`, required) for public
+clients, `client_credentials` for confidential clients, and `refresh_token`; no password or implicit
+grant exists (RFC 9700). Nothing about a credential is interpreted by a consumer: every answer about
+one comes from the authority.
+
+§agui-oauth-endpoints **The endpoints live on the daemon's listener, under the issuer.** The issuer
+is `PLURNK_AGUI_ISSUER`, or, when that is empty, the origin each request reached the daemon at
+({§http-request-origin}), answered from setup: the host has bound its listener by then ({§http-host}). The module claims and
+mounts them beside `/agui` ({§module-http-mounts}):
+
+| Path | Standard | Contract |
+|---|---|---|
+| `/.well-known/oauth-authorization-server` | RFC 8414 | The issuer, its endpoints, `code` as the response type, the three grant types, `S256`, the client authentication methods (`client_secret_basic`, `client_secret_post`, `none`) and the scopes. |
+| `/.well-known/oauth-protected-resource` | RFC 9728 | The resource `<issuer>/agui`, this issuer as its authorization server, its scopes and `header` as the bearer method; every 401 from `/agui` names this document. |
+| `GET`/`POST /oauth/authorize` | RFC 6749 §4.1, RFC 7636 | The sign-in page ({§agui-oauth-login}) and the authorization code: sixty seconds, bound to the client, the redirect, the challenge, the scopes and a family, the browser session's for a module's own client and a fresh one for any other ({§agui-oauth-session}), spent by its first presentation whatever the outcome. |
+| `POST /oauth/token` | RFC 6749 §5, RFC 8707 | The grants; `resource`, when present, must be `<issuer>/agui`. Errors use the §5.2 JSON (`invalid_request`, `invalid_client` as 401 with a `Basic` challenge when Basic was used, `invalid_grant`, `unauthorized_client`, `unsupported_grant_type`, `invalid_scope`, `invalid_target`). |
+| `POST /oauth/revoke` | RFC 7009 | Revokes the family of a live token the authenticated client owns; any other token answers 200 and revokes nothing. |
+| `POST /oauth/register` | RFC 7591 | Registers a public client (`token_endpoint_auth_method: none`) with absolute http(s) redirect URIs; a confidential client is declared, never registered. |
+| `GET`/`POST /oauth/session` | — | The browser's standing ({§agui-oauth-session}): `GET` says whether this browser holds a session; `POST` with `action=end` revokes it and clears the cookie. |
+
+Every response is uncacheable; OPTIONS answers 204 and the CORS headers follow {§agui-cors}. A redirect
+URI must match a registered one exactly, except that a registered public client's loopback redirect
+may change its port (RFC 8252 §7.3). A module's own client is answered only at the issuer followed
+by a path it registered ({§credential-module-client}), with no exception: under a configured issuer
+no other origin is its address. A request naming an unregistered client or redirect is answered to the person,
+never redirected; any other malformed request is redirected with its `error` and `state`.
+
+§agui-oauth-clients **Four kinds of client.** The operator's own client, `operator`, is confidential:
+its secret is the authority's operator secret ({§credential-authority}), the shared `PLURNK_SECRET`
+when set and otherwise the one the daemon mints at boot into the file beside its database, and it
+holds every scope; the terminal client, scripts and the bench exchange it for access tokens with
+`client_credentials`. An authority without an operator secret has no `operator` client, and the
+operator's tools have no way in but the sign-in. A declared client,
+`PLURNK_AGUI_CLIENT_<id>={"secret":"…","scopes":[…]}`, is confidential too and holds only the scopes
+declared; its tokens name it as their subject, and removing its line and restarting revokes them. A
+registered client is public and holds nothing to keep: it authenticates by its id alone, uses only
+the code grant with PKCE and refresh, and its tokens name the operator who signed in. A public client
+may not use `client_credentials` (`unauthorized_client`). A module's own client is the one a module
+of this daemon registered on the authority ({§credential-module-client}): confidential, as RFC 10017
+§6.2.3.1 requires of a backend that holds tokens for a page, authenticated by `client_secret_basic`
+or `client_secret_post` with the secret the authority minted and checks, using the code grant with
+PKCE and refresh, its tokens naming the operator who authorized it. It may not use
+`client_credentials` (`unauthorized_client`): it stands for the operator, never for itself. A scope
+it registered that this server does not issue is the module's fault and fails the request as a
+server error, never as a narrowed grant; a declared client may not take a module client's id.
+
+§agui-oauth-session **A browser is the operator only once it signs in.**
+The browser's standing is a `session` credential of the authority ({§credential-authority}),
+presented as the cookie `plurnk_session` (`HttpOnly`, `SameSite=Lax`, `Path=/oauth`, `Secure` under
+an https issuer), living as long as a refresh token and revoked by `POST /oauth/session` with
+`action=end`, which also clears the cookie; a session is never a bearer. Signing in with
+`PLURNK_PASS` ({§agui-oauth-login}) is the only way a session is established, wherever the browser
+runs: while it is empty, every browser is told so, and where to set it, at 503 and no session
+exists. A module's own client ({§agui-oauth-clients}) is this daemon's by
+registration, and the operator's session authorizes it silently; having no standing apart from that
+sign-in, its grant joins the session's family, so revoking the family from either side, by
+`/oauth/session` or by the module's own sign-out, ends the browser's standing here and the module's
+credentials together, and a code not yet exchanged ends with them; the next visit after a sign-out
+meets the sign-in form. Any other client, wherever its
+redirect points, is shown a consent page naming it and its scopes, and only a `POST` carrying the session that preceded the
+request issues the code (`consent=allow`) or declines it (`consent=deny`, `access_denied` to the
+redirect), so a page elsewhere, whose cross-site POST carries no cookie and whose top-level GET
+cannot click, obtains nothing. Every request under the authorization server's paths must name this
+daemon: a `Host` that is neither loopback nor the issuer's host is refused at 421 before any route,
+so a name a page rebinds to the loopback address reaches nothing. Every page it serves carries
+`frame-ancestors 'none'`.
+
+§agui-oauth-documents **The authorization server's documents are plain semantic HTML.** Every page it
+shows a person (sign-in, a refused password, too many attempts, no password, consent, a refused
+request, and the session page) is HTML with no script and no class: a `main` holding one `article`
+whose `header` carries the `h1`, paragraphs, and native form controls each named by its `label`; a
+page that reports a fault puts a warning glyph (`role="img"`, `aria-label="Warning"`) in its heading,
+and a refused password is an alert (`role="alert"`). A page carries its own small inline style,
+readable alone in either color scheme. On a request whose `client_id` names a module client that
+registered a stylesheet ({§credential-module-client}), the page links that stylesheet in place of its
+own style, and its policy admits same-origin styles only (`style-src 'self'`); the session page takes
+an optional `client_id` for the same purpose and carries it through its sign-out. A request can name a
+registered client and nothing else: no page links a stylesheet a request supplies, and a client that
+is unknown, not a module's or registered none gets the standalone page.
+`authorizationDocumentSpecimens()` renders every one of these documents, for a consumer whose
+production CSS pruning must keep the selectors they use.
+
+§agui-oauth-login **The operator signs in at the authorization endpoint.** The sign-in page is plain
+HTML with no script: it names the client and the scopes it asks for and posts the operator's
+shared password, `PLURNK_PASS`, compared in constant time; a wrong password re-presents the form at
+401; the right one establishes the browser's session ({§agui-oauth-session}) and redirects with the
+code and the `state`. There is one local operator: the password selects no account, and the
+session's subject is the operator's whatever the password is, so changing it changes who can sign
+in, never who they are or what they own. `PLURNK_PASS` ships empty: while it is empty, every
+browser is told so, and the operator's configuration file to set it in, at 503 and issued nothing,
+and client credentials are unaffected. The daemon does not throttle failed attempts: limiting
+requests by their real source is the job of a front such as the example nginx configuration
+({§nginx-example}), which sees addresses a proxied daemon cannot.
+
+§agui-oauth-tokens **Credentials are opaque and bounded.** An access token lives
+`PLURNK_AGUI_ACCESS_TTL_SEC`, a refresh token `PLURNK_AGUI_REFRESH_TTL_SEC`; both are random strings the
+authority holds in memory, so a daemon restart revokes every credential and a client simply
+acquires again. A refresh token rotates: each use consumes it and answers a new access token and a
+new refresh token of the same family, with the same or a narrower scope; a consumed refresh token
+presented again is reuse, and reuse revokes the whole family (RFC 9700 §4.14). A code grant and a
+refresh grant answer a refresh token; `client_credentials` answers an access token alone, renewed
+with the secret.
+
+§agui-oauth-revocation **Revocation reaches what is open.** Revoking a family, by the revocation
+endpoint, by refresh-token reuse, by a code presented twice or by ending a browser's session, which
+for a module's own client is the same family ({§agui-oauth-session}), ends every Run admitted under that
+family with the 401 `credential-revoked` Problem and `RUN_ERROR`, exactly as shutdown ends a Run
+({§agui-shutdown}); the loops those Runs observed continue, because a revoked observer is not a
+cancelling one ({§agui-run-disconnect}). Expiry is checked at admission only: an admitted stream
+outlives its token's expiry and is never cut by it.
 
 ## §agui-configuration Module configuration
 
@@ -639,28 +960,51 @@ address is the daemon's.
 | Input                              | Owner   | Empty or absent                        | Accepted value                      | Effect |
 | ---------------------------------- | ------- | -------------------------------------- | ----------------------------------- | ------ |
 | `PLURNK_HOST` / `PLURNK_PORT`      | Service | Invalid at service boot                | Service-valid host and port         | The daemon's one listener ({§http-host}); AG-UI reads neither. |
-| `PLURNK_AGUI_TOKEN`                | AG-UI   | No module-level bearer requirement     | Any string                          | A non-empty value requires the exact bearer on every non-preflight request. |
+| `PLURNK_AUTH`                      | Shared  | Invalid; the shared panel is required  | `1` or `0`                          | The daemon's posture ({§credential-authority}, {§operator-config-shared-keys}): authenticate, or admit anonymously. |
+| `PLURNK_SECRET`                    | Shared  | The daemon mints one at boot           | Any non-empty string                | The operator's client secret ({§agui-oauth-clients}), what the operator's own tools exchange for access tokens. |
+| `PLURNK_AGUI_ISSUER`               | AG-UI   | The origin each request reached ({§http-request-origin}) | An absolute http(s) origin          | The authorization server's issuer, the public origin clients reach ({§agui-oauth-endpoints}). |
+| `PLURNK_PASS`                      | Shared  | Empty: no browser signs in until it is set ({§agui-oauth-session}) | Any string             | The operator's browser sign-in password ({§agui-oauth-login}). |
+| `PLURNK_AGUI_ACCESS_TTL_SEC` / `PLURNK_AGUI_REFRESH_TTL_SEC` | AG-UI | Invalid; the package floor is required | Positive safe integers | Credential lifetimes ({§agui-oauth-tokens}). |
+| `PLURNK_AGUI_CLIENT_<id>`          | AG-UI   | No declared clients                    | `{"secret": "…", "scopes": ["agui"]}` | One confidential client per line ({§agui-oauth-clients}); `operator` is reserved. |
 | `PLURNK_AGUI_ALLOW_ORIGIN`         | AG-UI   | Empty: no CORS headers; absent: invalid | `*` or one origin                   | The origin whose pages a browser lets read replies ({§agui-cors}). |
 | `PLURNK_AGUI_MAX_TURNS`            | AG-UI   | No module-level default                | `-1` or a non-negative safe integer | Supplies `maxTurns` only when the Run does not carry its own value. |
 | `PLURNK_AGUI_HEARTBEAT_MS`         | AG-UI   | Invalid; the package floor is required | Integer `0` through `2147483647`    | SSE comment-frame cadence in milliseconds; `0` disables it. |
 
 ## §agui-run-endpoint The AG-UI Run endpoint
 
-`POST /agui` accepts a schema-valid AG-UI `RunAgentInput`: the last textual
-`user` message becomes the
-`ApplicationPort.runLoop` prompt (`maxTurns` from
-the forwarded PLURNK properties); the response is `text/event-stream`,
-one `data:` line per event, ending after `RUN_FINISHED`/`RUN_ERROR`. Multimodal user content
-is rejected until the model-loop seam supports it deliberately. Proposal
-disposition remains Core policy; this module routes review to the worker's owner.
+`POST /agui` accepts a schema-valid AG-UI `RunAgentInput`; the response is `text/event-stream`, one `data:` line
+per event, ending after `RUN_FINISHED`/`RUN_ERROR`. Proposal disposition remains Core policy; this module routes
+review to the worker's owner.
+
+§agui-run-input **A Run's input is what its conversation doesn't hold.** A Run's `messages` are the client's copy of
+the conversation its thread names, which the official `HttpAgent` sends whole on every Run. Its last message is new
+when it is a user message of that conversation (no `subagentRunId`) that is neither one the daemon presented, its id a
+coordinate the worker's log holds ({§agui-snapshot}), nor one a client already sent: its address is an idempotency key
+core decides ({§message-idempotency}), so the same words attach to what that message started. Every other message is
+the client's copy, never imported ({§agui-replay}). Each check is one keyed read. The Run is decided before it binds
+anything, and a refused Run binds, creates and claims nothing:
+
+| The Run carries | It |
+|---|---|
+| An interrupt resume | Resolves its interrupts ({§agui-proposal-resolve}) |
+| `forwardedProps.plurnk.action` | Acts ({§agui-management-plane}) |
+| A new message | Submits it: its text is the `ApplicationPort.runLoop` prompt, `maxTurns` from the forwarded PLURNK properties |
+| None of them | Synchronizes ({§agui-sync}) |
+| More than one of them | Is refused, 400 `ambiguous-run-input` |
+
+A new message that is not non-empty text is refused, 400 `user-message-text-required`: multimodal content waits until
+the model-loop seam supports it deliberately. A client's address that core holds with other words is core's refusal,
+422 `message-address-reused`. A connection submits nothing ({§agui-owner-connection}).
 
 §agui-run-source The run's user message is the causal actor behind its inbound SEND
 ({§message-causal-source}). The module supplies its canonical address as the loop's `source`:
 `agui://<principal>/threads/<threadId>/messages/<messageId>`, every segment
-URI-encoded, the principal `anonymous` until the authorization layer names one. The frontend's
+URI-encoded, the principal being the admitted credential's subject ({§agui-http-authorization}):
+`operator` for the operator's own credentials, a declared client's id for its own, and `anonymous`
+when the listener authenticates nothing. The frontend's
 self-identification never enters the address ({§client-metadata}). The arrival row renders that
 source, so a model tells an operator's message from a worker's or a schedule's by address
-rather than by absence. Message identity belongs to the conversation, not a transport run;
+rather than by absence. Message identity belongs to the thread, not a transport run;
 the run ID remains envelope provenance. Accepted text remains available through ordinary
 READ, FIND and COPY after log curation, run conclusion, disconnect and daemon restart.
 `loop.inject` normalizes its prompt into a user message with a server-generated message ID
@@ -670,32 +1014,39 @@ SEND to this exact address answers this message under {§send-response-receipt};
 not create another inbound request. Standard AG-UI assistant messages and history replay
 carry the reply, independently of whether the loop can yet conclude.
 
-§agui-http-authorization When `PLURNK_AGUI_TOKEN` is non-empty, every
-non-preflight request must carry that exact value as an
-`authorization: Bearer <token>` header. Authorization precedes request-body
-reading. A missing or mismatched credential returns the stable 401
-`bearer-token-required` Problem. A fresh install **mints its own** into the
-operator's file ({§operator-config-discovery}), which every client reads
-through the same cascade, so the shipped posture is authenticated: the empty
-value that means *no check* is an operator's deliberate choice, never a
-default. This is the perimeter because a daemon is one trust domain and on
-loopback the operator's browser is inside it — any page they visit can reach
-the port, and only the bearer tells the two apart.
+§agui-http-authorization **`/agui` is a protected resource of the daemon's authority.** When the
+daemon authenticates ({§agui-oauth}), every non-preflight request carries an access token the daemon
+issued as `authorization: Bearer <token>`, and admission precedes request-body reading. The principal of the admitted request is the credential's subject ({§agui-run-source}).
+Each refusal is an RFC 6750 challenge, a `WWW-Authenticate: Bearer` header naming the realm and the
+RFC 9728 resource metadata, beside its Problem: no bearer at all is 401 `bearer-token-required`; a
+token that is unknown, expired, consumed, revoked or not an access token is 401
+`bearer-token-invalid` with `error="invalid_token"`; an access token without the scope `agui` is 403
+`bearer-scope-insufficient` with `error="insufficient_scope"`. The shipped posture is authenticated
+with nothing configured: the daemon **mints its operator secret at every boot** into the file beside
+its database ({§credential-authority}), which the operator's own tools read, and the seeded operator
+file ({§operator-config-discovery}) teaches the keys without setting one. A daemon under
+`PLURNK_AUTH=0` serves no authorization server and admits every request as `anonymous`: that posture
+is the operator's deliberate configuration, never a default. This is the perimeter because a daemon is one trust
+domain and on loopback the operator's browser is inside it — any page they visit can reach the
+port, and only the credential tells the two apart. The secret itself is never a bearer: presented
+directly, it is an unknown token.
 
 §agui-cors Every response carries `access-control-allow-origin` with the value
 of `PLURNK_AGUI_ALLOW_ORIGIN`, and allows the `content-type` and
 `authorization` request headers; an empty value sends neither header, so no
-browser page can read a reply. CORS narrows which pages may *read*; it does
+page of another origin can read a reply, while a page the daemon itself serves
+reads its own origin's replies as any same-origin page does. CORS narrows which
+other origins' pages may *read*; it does
 not authenticate a request and is no substitute for the bearer
 ({§agui-http-authorization}). A preflight is answered `204` before
 authorization.
 
 §agui-http-failure Failures before SSE headers are sent use
 `application/problem+json` with exact
-RFC 9457 Problem Details. Once SSE has opened, `CUSTOM plurnk.problem` preserves
-that same object and `RUN_ERROR` maps it to the standard AG-UI fields. The custom
-event and `plurnk.terminated.result.problem` are lossless; `RUN_ERROR.code` and
-`message` are the required standard projection, not a second failure object.
+RFC 9457 Problem Details. Once SSE has opened, `RUN_ERROR` maps that same object to the standard AG-UI fields
+and carries it whole as its metadata ({§agui-plurnk-metadata}). That metadata and the terminal record's
+`result.problem` are lossless; `RUN_ERROR.code` and `message` are the required standard projection, not a second
+failure object.
 Consumers preserve the exact Problem from the lossless surface and never
 reconstruct one from `RUN_ERROR`.
 
@@ -704,22 +1055,31 @@ reconstruct one from `RUN_ERROR`.
 | code | status | contract |
 |---|---:|---|
 | `parse-failed` | 400 | A client-authored block did not parse; the detail is the parser's own diagnostic, verbatim, with its line, column and source ({§agui-outside-text}). |
+| `bearer-token-required` | 401 | The request did not provide a bearer token. Recovery: Present an access token issued by this daemon as `Authorization: Bearer <token>`. |
+| `bearer-token-invalid` | 401 | The access token is unknown, expired or revoked. Recovery: Obtain a new access token from this daemon's token endpoint. |
+| `bearer-scope-insufficient` | 403 | The access token does not carry the scope *scope*. Recovery: Obtain an access token with the scope *scope*. |
+| `credential-revoked` | 401 | The credential this stream was admitted under has been revoked. |
 | `service-stopping` | 503 | The service is shutting down. New requests are refused while existing runs retain terminal-event delivery until observer closure ({§module-shutdown-order}). |
 | `route-not-found` | 404 | The requested HTTP route does not exist. |
 | `request-failed` | 500 | The AG-UI request failed unexpectedly. |
 | `workspace-required` | 400 | forwardedProps.plurnk.workspace must name a workspace. Recovery: Provide a non-empty workspace name. |
+| `thread-not-found` | 404 | The thread has no conversation. |
+| `thread-address-invalid` | 400 | The qualified thread address is not `<workspace ID>#<worker name>`. |
 | `interrupt-duplicate` | 400 | The resume contains the same interrupt more than once. Recovery: Include each pending interrupt exactly once. |
 | `interrupt-invalid` | 400 | The resume contains an invalid client interrupt. Recovery: Resume with the interrupt IDs and response shapes supplied by the pending tool calls. |
-| `interrupt-not-pending` | 409 | The resume addresses an interrupt that is not pending. Recovery: Refresh pending interrupts before resuming. |
+| `interrupt-not-pending` | 409 | The resume addresses an interrupt that is not pending, or an unknown interrupt presentation. Recovery: Refresh pending interrupts before resuming. |
+| `interrupt-binding-invalid` | 400 | The resume combines interrupts from different Runs, or does not match its interrupt's binding. |
+| `connection-closed` | 499 | The connection closed before the interrupt was resolved. |
 | `worker-scope-invalid` | 400 | One resume must address interrupts for exactly one worker. Recovery: Resume each worker separately. |
 | `interrupt-set-incomplete` | 409 | The resume does not address every pending interrupt for worker *id*. Recovery: Resolve every pending interrupt for this worker in one resume. |
 | `invalid-json` | 400 | The request body is not valid JSON. |
 | `invalid-run-input` | 400 | The request body does not satisfy the AG-UI RunAgentInput contract. |
 | `control-invalid` | 400 | control must be a boolean. |
 | `interactive-invalid` | 400 | interactive must be a boolean. |
-| `unsupported-run-mode` | 400 | forwardedProps.plurnk.mode must be "sync" when present. |
-| `invalid-sync-input` | 400 | Conversation synchronization cannot include messages, an action, or an interrupt resume. |
-| `user-message-required` | 400 | A new AG-UI Run requires a non-empty textual user message. Recovery: Provide a non-empty user message. |
+| `invalid-connect-input` | 400 | A connection cannot include a new message, an action, or an interrupt resume. |
+| `ambiguous-run-input` | 400 | The Run carries more than one of a new message, an action, and an interrupt resume. Recovery: Send each in its own Run. |
+| `worker-not-found` | 404 | No model worker named *name* exists in workspace *workspace*. Recovery: Name an existing model worker, or create one by sending it a message. |
+| `user-message-text-required` | 400 | A new user message must be non-empty text. Recovery: Send the message as non-empty text. |
 | `run-failed` | 500 | The AG-UI Run failed unexpectedly. |
 
 §pinned-wording-agui **Pinned wording.** Verbatim sentences tests pin: each is contract, and a change here is a change of contract.
@@ -728,5 +1088,4 @@ reconstruct one from `RUN_ERROR`.
 |---|---|
 | Action '*name*' is not registered. Recovery: Use an action advertised by discover. | an action call naming no registered action |
 | Action '*name*' rejected parameters. *schema path*: *reason*. | an action call whose parameters fail the action's schema |
-| *action* parsed *n* statements; exactly one *OP* statement is required. | a client op action whose block holds other than one statement |
 | The action failed unexpectedly. | an action handler that threw |