@plurnk/plurnk-service 1.17.0 → 1.18.0

package/SPEC.md

@@ -2,6 +2,34 @@
 
 Canonical contracts plurnk-service exposes, architecture it implements, promises it makes to the constellation (`plurnk-contracts`, `plurnk-providers`, `plurnk-schemes`, `plurnk-mimetypes`, `plurnk-execs`, the user-facing `plurnk` CLI). `AGENTS.md` covers process; this file covers contract.
 
+## Contents
+
+- [Glossary](#glossary-glossary)
+- [Architecture](#arch-architecture)
+- [Workers and workspace boundaries](#actor-boundary-workers-and-workspace-boundaries)
+- [File membership and project roots](#membership-file-membership-and-project-roots)
+- [Loop scheduling and lifecycle](#worker-loop-lifecycle-loop-scheduling-and-lifecycle)
+- [Provider Contract](#provider-provider-contract)
+- [Scheme Contract](#scheme-scheme-contract)
+- [Mimetype Contract](#mimetype-mimetype-contract)
+- [Search indexing](#persistent-search-index-search-indexing)
+- [Channel Topology](#channels-channel-topology)
+- [Op Surface](#op-op-surface)
+- [Proposals and client interactions](#proposal-proposals-and-client-interactions)
+- [Stream Model](#stream-stream-model)
+- [Storage Model](#storage-storage-model)
+- [Plugin composition](#core-plugin-composition-plugin-composition)
+- [Bundled Set](#bundled-set-bundled-set)
+- [Grammar Dependency](#grammar-grammar-dependency)
+- [Operator Configuration](#operator-config-operator-configuration)
+- [Module seam](#rpc-module-seam)
+- [Workspace Functionality](#functionality-workspace-functionality)
+- [Application interface](#methods-application-interface)
+- [Packet assembly](#packet-assembly-packet-assembly)
+- [Packet shape](#packet-packet-shape)
+- [Matcher selection and text regions](#matcher-matcher-selection-and-text-regions)
+- [Testing and evidence](#test-taxonomy-testing-and-evidence)
+
 ---
 
 ## §glossary Glossary
@@ -23,13 +51,13 @@ flowchart LR
 
 | Term              | Layer                 | Meaning |
 |-------------------|-----------------------|---------|
-| **agent**         | PLURNK                | The plurnk runtime. Acts in-workspace as the reserved `plurnk` worker ({§actor-boundary} self-hosting), never a privileged singleton owning its own entries ({§entry-owner}, {§machine-processes}). |
+| **agent**         | PLURNK                | The plurnk runtime. Acts in-workspace as the `_plurnk` worker ({§actor-boundary} self-hosting), never a privileged singleton owning its own entries ({§entry-owner}, {§machine-processes}). |
 | **workspace**     | Core                  | Durable user-named shared world. Persists across workers and process restarts. Identity: `workspaces.id` + unique `workspaces.name`. |
 | **worker**        | Core                  | Durable actor and history over one workspace. Owns its loops and log rows, may carry a `parent_worker_id`, and has one process-local cancellation scope while active. |
 | **loop**          | Core                  | Queued-to-terminal unit of model or client work within a worker. Status ∈ {100 pending · 102 running · 200 done · 202 waiting (blocked on a live obligation, {§send}) · 413 input-capacity failure · 429 model-turn ceiling · 499 cancelled · 500 failed · 504 execution timeout ({§operator-config-loop-timeout}) · 508 runaway}. Many loops may belong to one worker. |
 | **turn**          | Core                  | One durable, producer-neutral batch of ordered operations. A turn may be authored by a model, client, plugin, or `_plurnk`; only a model turn assembles a packet and owns an emission call. Many turns may belong to one loop. Identity: `(loop_id, sequence)`. |
 | **model call**    | Core/provider         | One logical `provider.generate` invocation. Emission attempts and BARE inferences share this durable accounting owner; provider retries remain cardinal physical requests beneath it. Identity: `(turn_id, sequence)`. |
-| **op**            | Producer/core         | One DSL operation a producer submits, parsed into a `PlurnkStatement`. One admitted source-backed turn produces an ordered disposition-ended program. |
+| **op**            | Producer/core         | One DSL operation a producer submits, parsed into a `PlurnkStatement`. Admission follows {§turn-ops-admission-path}. |
 | **statement**     | Model/core            | A parsed op: the `PlurnkStatement` AST from `@plurnk/plurnk-contracts`. |
 | **action**        | Core                  | One executed op. Execution normally produces a `log_entries` row at `log:///<L>/<T>/<S>/<op>`; an engine rail may instead record an `op='error'` row ({§operation-results}). A source artifact carries no fabricated operation. |
 | **dispatch**      | Core                  | Routing a statement to its scheme's op handler. |
@@ -38,55 +66,13 @@ flowchart LR
 | **`--run`**       | Client compatibility  | A compatibility-sensitive client spelling, not an internal entity. |
 | **session**       | Retired/unqualified   | Not a PLURNK lifecycle noun. Use the actual core noun; a third-party standard may use only its explicitly qualified protocol term. <!-- lexicon-allow: this row defines the retired noun --> |
 
-### §turn-record Producer-neutral turn record
-
-A turn is the durable container for one producer's ordered operations. Packet
-and provider fields are optional evidence belonging only to model inference;
-their absence never makes a client, plugin, or `_plurnk` turn exceptional.
-
-| Field | Contract |
-|---|---|
-| `producer` | Required actor class: `model`, `client`, `plugin`, or `_plurnk`. |
-| `kind` | Required purpose: `inference`, `initialization`, `operation`, or `maintenance`. Model iff inference; initialization and maintenance require `_plurnk`. Producer and kind are immutable. A maintenance turn's successful rows are packet-suppressed — a receipt answers an asker, and maintenance has none ({§actor-boundary-doc-injection}). |
-| `status`, `completed_at` | A new turn is open at status 102 with `completed_at=NULL`. Completion records the exact turn disposition/operation disposition and timestamp; a completed 102 is therefore distinct from an open 102. |
-| Operations | Ordered by `(turn_id, sequence)` on one exact worker/loop/turn chain. Each row's `origin` is the turn producer or `_plurnk` making a system observation; the observation does not impersonate the producer. |
-| Program source | Every admitted source-backed turn preserves its exact program before dispatch in `turn_sources`, independently of log receipts, under {§turn-ops-entry}. |
-| Inference evidence | Model calls, `packet`, model, finish reason, and provider metadata belong only to model/inference turns. Turn fields are nullable until recorded and remain NULL for every other kind. |
-
-One lifecycle owner opens, optionally records inference evidence, and completes
-every turn. Initialization, maintenance, client dispatch, and model
-inference use that same path. `plugin` is the producer identity for
-plugin-authored operation turns; exposing that path must not introduce a
-parallel record or lifecycle. Producer and kind never change. Process-restart
-recovery completes any turn whose producer vanished.
-
-§turn-ops-admission-path **Source acquisition varies; admitted-turn execution does not.**
-A provider response, deterministic `_plurnk` program, or future client/plugin
-program crosses one admission boundary into the same executor. That executor
-parses once, dispatches the admitted statements in order, records their ordinary
-outcomes, and completes the turn from its TASK ruling. Exact source is retained before dispatch.
-Provider attempts, grammar recovery, reasoning, and accounting end before this
-shared seam. A programmatic operation batch that supplied no Plurnk source does
-not fabricate verbatim source.
-
-§turn-ops-selection-snapshot **An admitted program cannot select log rows it emits while executing.**
-Immediately before statement dispatch, the shared executor captures that worker's
-append-only log high-water mark. Every log-targeted KILL in the program resolves
-row membership at or below that same boundary, while prior curation effects still
-compose normally. Prompt and other pre-program rows already present in the turn
-remain selectable; preceding and later operation rows cannot be captured by
-their own program. A directly dispatched
-single operation captures the equivalent boundary before dispatch. This limits
-only log-row selection: operation phasing and same-turn resource effects retain
-their ordinary contracts.
-
 ### §storage-terms Storage terms
 
 | Term | Meaning |
 |---|---|
 | **entry** | The unit of canonical state. Identity: `(workspace_id, scheme, authority, pathname)` ({§entry-identity-no-null}). Holds one or more `channels` of content plus scheme-private `attributes`. |
 | **channel** | A named content buffer on an entry. Examples: `body`, `stdout`, `stderr`, `headers`, `symbols`. Each channel has `content`, `mimetype`, curation `weight`, and lifecycle `state`. |
-| **scheme** | An addressed capability family + handler. Built-ins include `worker`, `prompt`, `log`, and bare/file paths; discovered schemes and executor-runtime tags extend that set. Internal `exec` routes the EXEC op but is not an addressable model namespace. Consumption surface {§scheme-surface}; author contract: [plurnk-schemes](../plurnk-schemes/SPEC.md). |
+| **scheme** | An addressed capability family + handler. Built-ins include `worker`, `prompt`, `log`, and bare/file paths; discovered schemes and executor-runtime tags extend that set. Internal `exec` routes executions but is not an addressable model namespace. Consumption surface {§scheme-surface}; author contract: [plurnk-schemes](../plurnk-schemes/SPEC.md). |
 | **mimetype** | A channel's content type. Drives the handler that produces the structural projections (`symbols`, `deepJson`, `deepXml`). Consumption surface {§mimetype-surface}; author contract: [plurnk-mimetypes](../plurnk-mimetypes/SPEC.md). |
 | **provider** | An LLM transport implementing the `@plurnk/plurnk-providers` `Provider` interface. Core supplies an assembled request and generation context; the provider owns endpoint adaptation and normalized response evidence. Consumption surface {§provider}; author contract: [plurnk-providers](../plurnk-providers/SPEC.md). |
 
@@ -98,7 +84,7 @@ Independent axes on entries and channels. Confusion across them is a recurring s
 |---|---|---|
 | **status** | HTTP int | Outcome of an operation. Carried on `log_entries.status_rx`, returned from op handlers. Per the catalogue ({§send-dispatch}). |
 | **channel state** | `static \| active \| closed \| errored` | Streaming lifecycle of a channel's content. Metadata, not gating — engine renders content regardless of state. |
-| **entry state** | `proposed \| resolved \| failed \| cancelled` | Proposal lifecycle (`log_entries.state`). `proposed` = pending client accept; `resolved` = accepted, side effect happened; `failed` = rejected (no effect); `cancelled` = the proposal was cancelled (loop abandoning). Distinct from channel state. |
+| **proposal state** | `proposed \| resolved \| failed \| cancelled` | Proposal lifecycle (`log_entries.state`) under {§proposal}; distinct from entry identity and channel state. |
 | **outcome** | `string \| null` | Short reason for `failed`/`cancelled` (`"permission:403"`, `"aborted"`, `"not_found"`). Opaque to most callers. |
 
 ### §authority-terms Writer / authority
@@ -109,117 +95,15 @@ Independent axes on entries and channels. Confusion across them is a recurring s
 | **origin** | Synonym for writer in log_entries (`log_entries.origin`). Historical naming; treat as equivalent. |
 | **writable_by** | The set of writers a scheme accepts. Subset of `{model, client, _plurnk, plugin}`. Engine rejects writes outside the set with 403; the rejection is logged as the action-entry ({§subscriptions} action-entry-as-outcome). |
 
-### §engine-rails Engine rails
-
-After each admitted turn, one inline verdict decides whether the loop continues.
-An admitted turn contributes at most one strike, even when several sources fire.
-These are the complete strike sources:
-
-| Strike source       | Exact trigger                                                                                                    | Model-visible occurrence                                      |
-|---------------------|------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------|
-| Hard result         | An admitted non-`EXEC` operation or bounded parse-error status is `>= 400`, except the soft set `404`, `409`, `416`, `425`, `501`. | The originating failure row.                                  |
-| Inventory steering  | A refused completion at 409 sets the turn's steering ruling ({§send}); an empty TASK is a soft 409 receipt, never a strike. | The TASK receipt. |
-| Cycle               | The executed operations and their observed results repeat under {§engine-cycle-evidence}.                         | None; cycle detection itself is private engine accounting.    |
-
-`EXEC` results remain exact model-visible evidence but are always soft: an
-executor error is not a PLURNK contract violation. Cycle and terminal steering
-remain independent strike sources.
-
-A `425` not-ready result describes unfinished work, not a contract violation.
-It retains its exact receipt, without scheduling side effects ({§join-blocking-collect});
-other violations in the same turn still strike normally.
-
-§engine-cycle-evidence Cycle identity contains the ordered executed operations
-and their dispatch results, including complete operands, scopes, bodies, and
-scheme metadata, including the complete TASK inventory and SEND bodies. Source
-positions and asides are excluded. Engine-assigned
-Problem `instance` addresses are excluded from results. Object member order is
-irrelevant; operation and array order are preserved. Only the configured
-`MIN_CYCLES × MAX_CYCLE_PERIOD` history window is retained. Repeated addresses
-alone are not a cycle: changing inputs or observations distinguish activity.
-This is an exact-repetition backstop, not a semantic judgment of task progress;
-new asynchronous invocation identities do not prove repetition of their eventual
-effects. Ordinary contract strikes and operator budgets remain independent.
-
-§provider-recovery **A recoverable provider failure never ends a loop.** When a model
-call fails with a network failure, rate limit, deadline, or interrupted resource after
-the provider's own retries, the turn records the exact Problem as a `_plurnk` row,
-notices the client (`engine:provider` / `provider_unavailable`), waits with
-exponential backoff (`PLURNK_SERVICE_PROVIDER_RECOVERY_BACKOFF`, doubling, capped at
-twelve times itself), and re-issues the same call against the exact frozen model
-messages whose response is still outstanding. Each reissue remains a distinct logical
-model call with complete physical-request accounting, but the active turn's newly
-recorded provider Problems do not recursively enter that request; they surface normally
-only in a later genuinely new packet. No emission attempt is consumed and no strike is
-scored. Every recovery checkpoint broadcasts live, while the model-facing Notice buffer
-retains only the current provider state; the next completed exchange notices
-`provider_recovered`. Recovery is bounded by `PLURNK_SERVICE_PROVIDER_RECOVERY`; when it
-is spent the turn completes as `202` and the loop parks exactly like a
-TASK wait ({§worker-lifecycle-wake-requeue-not-terminal}), resuming on the
-next prompt or wake with its log intact. Only a client cancel, the execution allowance
-({§operator-config-loop-timeout}), or a non-recoverable provider Problem (refusal,
-authorization, quota, an invalid response) settles a loop on a provider failure.
-
-**Contract Strikes** (operator mandate, 2026-09-01): *Every turn with one or
-more contract violations earns a strike. A turn without any contract violations
-clears the strikes. Three (not four) strikes and you're out, by default.*
-The streak counts consecutive violating turns; `MAX_STRIKES` (default 3) is the
-threshold, crossed ON the third strike; the crossing turn terminates at **508
-Loop Detected** when cycle-detected, otherwise **500**. Retrieval-only completion
-may instead be admitted on that attempt under {§send-final-strike-retrieval}.
-
-The contracts, and the violation of each that strikes:
-
-| Contract | Violation that strikes |
-|---|---|
-| operation contract | a hard operation failure (status ≥ 400) in an admitted turn — soft statuses below excluded |
-| review contract | a refused completion (turntrieval steer); every other TASK 409 — empty inventory, already-terminal loop — is soft |
-| progress contract | a detected operation cycle (`MIN_CYCLES` × period), or an admitted turn with no operation ({§empty-turn}) |
-| frame contract | emission attempts exhausted with no admissible turn |
-| provider response contract | the provider returned an invalid response |
-
-Errors and issues are NOT contract violations. Each keeps its own disposition
-and never strikes: exploration misses (404, 416) and unsupported capability
-(501) are how discovery works; raw 409 outcomes are soft (the review ruling is
-steer's alone); EXEC outcomes and `executor/*` problem rows are world evidence;
-provider weather (rate limit, network failure, deadline, interruption) recovers
-({§provider-recovery}); provider capacity has its own packet recovery and
-terminal ({§provider-capacity-failure}); request rejection
-({§provider-request-rejection}), authorization and quota failures
-terminate immediately (configuration, not behavior); rejected private emission
-attempts are forensic evidence beneath their turn ({§emission-admission}) —
-only their exhaustion surfaces, as one frame-contract violation. The
-independent turn ceiling terminates at **429** ({§loop-terminals}). The streak
-and cycle verdict are absent from model packets; only the concrete occurrences
-in the table are shown. The current streak may ride first-party provider
-metadata ({§strikes-first-party-metadata}), which does not make it
-model-facing.
-
-§loop-rail-continuity Rail state belongs to the durable loop, not its execution
-segment. The strike streak and bounded cycle history survive driver cleanup and
-restart; curation of log evidence cannot alter them.
-
-| Boundary | Strike streak | Cycle history |
-|---|---|---|
-| Assessed turn with a violation | Increment once. | Include its exact activity. |
-| Clean assessed turn | Reset to zero. | Include its exact activity. |
-| Actual park, including an immediate wake/reclaim in the same drain | Preserve the assessed streak. | Close the window; the next turn starts a new one. |
-| Recoverable provider outage | No assessment; preserve the streak. | Preserve until an actual park. |
-| New loop | Start at zero. | Start empty. |
-
-The turn belongs to the wait revision under which it began. A rejected waiting TASK or
-one resolved without parking does not close a window. Periodic observations
-separated by actual waits are not an uninterrupted cycle; cumulative turn and
-execution allowances remain independent bounds. A committed terminal result
-cannot be replaced by a later rail assessment ({§worker-lifecycle-state-machine}).
+### §execution-terms Execution terms
 
 | Term                         | Meaning |
 |------------------------------|---|
-| **verdict**                  | The end-of-turn ruling computed inline in `Engine.runLoop` from the strike rail and independent loop terminals. No filter chain. |
-| **strike**                   | One admitted turn matching at least one source above. |
-| **emission attempt**         | One completed provider exchange beneath an engine turn. ANTLR admits it when at least one source operation has a trustworthy effective envelope and no boundary-destroying tail. A hard error inside that envelope becomes a failed operation in the admitted turn; a rejected attempt is forensic evidence, not another turn or an engine strike. |
+| **verdict**                  | The end-of-turn ruling from the strike rail and independent loop terminals ({§loop-terminals}). |
+| **strike**                   | One admitted turn matching at least one source under {§engine-rails}. |
+| **emission attempt**         | One completed provider exchange beneath an engine turn, admitted or rejected under {§emission-admission}. |
 | **BARE inference**           | One isolated child-provider model call whose response becomes an ordinary BARE log result. It has no worker, packet, tools, output grammar, or persistent child state ({§bare-inference}). |
-| **cycle**                    | A repeated turn fingerprint across consecutive turns. Detection strikes silently under the rule above. |
+| **cycle**                    | Repeated operational inputs and observed results under {§engine-cycle-evidence}. |
 | **capability policy**        | A purely subtractive `only`/`deny` selector layer over routed operation demands. Service and workspace layers compose without granting authority. |
 | **loop policy**              | One immutable `review`, `accept`, or `reject` proposal disposition. |
 | **proposal**                 | A deferred side-effecting action. State machine: `proposed → resolved` (accept), `→ failed` (reject), or `→ cancelled` (cancel). Its core-owned disposition says whether the client or loop owns resolution ({§proposal-disposition}). |
@@ -231,83 +115,19 @@ cannot be replaced by a later rail assessment ({§worker-lifecycle-state-machine
 | ---------- | ------- |
 | **packet** | A Turn's optional model-exchange record: measured request `sections`, extended with `assistant` and `assistantRaw` only when an emission is admitted. `NULL` means no model request was assembled. |
 | **log**    | The `log` section. Chronological list of `log_entries` in scope this turn. |
-| **render** | The act of computing the packet from current DB state at turn boundaries. Mimetype handlers fire at render time. |
-
-### §test-taxonomy Test taxonomy
-
-| Tier | Location | LLM | Substrate |
-|---|---|---|---|
-| **unit** | `src/**/*.test.ts` | No | Isolated logic, mocked boundaries |
-| **intg** | `test/intg/` | No (mock provider) | Real file-backed SqlRite (per-test DB under `test/intg/.tmp/`), real engine |
-| **live** | `test/live/` | Real | Wire-level assertions |
-| **demo** | `test/demo/` | Real | Holistic outcome assertions |
-
-§service-worker-composition The service launcher and the live/demo workspace
-helper share one registration of default worker-facing modules: MCP and outbound
-A2A. Their management families and readable reference documents are present even
-with no enabled attachments. Workspace capability policy controls every actor's
-surface; registering a family does not enable a remote attachment. Client and
-inbound-A2A listeners and host hooks remain launcher-owned.
-
-§live-harness-deadline The live and demo tiers use `PLURNK_SERVICE_LIVE_TIMEOUT`
-as one whole-specimen deadline, including multi-prompt stories. The test's abort
-signal reaches the loop wait and invokes ordinary scope cancellation before
-teardown. The runner joins the test body's cleanup before starting the next
-specimen. The shared workspace and story helpers cover setup, inference and
-oracle failures, preserve the primary failure when their cleanup also fails,
-and attempt every registered disposal.
-Provider attempt/recovery limits remain independent; a harness cancellation is
-not evidence that the provider's own deadline expired.
-
-§provider-conformance-matrix **Every configured model alias is exercised through a
-real PLURNK loop: the production packet, a model-selected operation, its
-materialized result, and completion.** Transport-only completions are not
-conformance evidence. Provider-exposed reasoning must survive in the durable
-assistant packet and digest; a provider with no private reasoning is valid when
-the observable operation cycle succeeds. One package-owned runner executes the
-full tier or exactly one registered specimen (`npm run test:live:specimen --
-<exact test name>` in plurnk-core), rejecting absent and duplicate names before
-execution. The ledger and classification taxonomy live in
-`plurnk-providers/README.md` and report authorization/credential failures
-distinct from model failures and repeated stochastic failures separately from
-stable ones, never with weakened assertions.
-
-§test-artifact-retention **File-backed test databases use lane-local current-run
-retention.** Each workspace's normal intg runner clears its own
-`test/intg/.tmp/` once before the suite, reports that forensic directory, and
-retains every artifact the current run creates; a direct `node --test <file>` run bypasses that
-runner, so each test process prunes artifacts older than a day once, and never the current run's. A cross-package test may reuse
-Core's migration fixture only by passing a path inside the caller's artifact
-directory; independently scheduled lanes never share a reset target. A failed
-suite therefore leaves its own evidence intact, and the next normal run of that
-lane removes it before creating anything. Direct `node --test` invocations
-bypass the runner boundary and must invoke the same cleanup procedure
-explicitly when isolation matters. Live/demo run directories are benchmark
-artifacts outside `.tmp` and retain their separate lifecycle.
+| **render** | Computing the packet from current state under {§packet-assembly} and {§packet-markdown}. |
 
 ---
 
 ## §arch Architecture
 
-The ecosystem and the in-process shape ({§ecosystem}–{§in-process}), then the two invariants the rest of the spec rests on: isolation by worker ({§actor-boundary}) and the workspace/worker/fork ownership model ({§machine-processes}).
+Daemon composition and startup. Worker attention and workspace state follow
+{§actor-boundary} and {§machine-processes}.
 
 ### §ecosystem Ecosystem
 
 The root [`ARCHITECTURE.md`](../ARCHITECTURE.md) owns the platform process and
-package map. The daemon, contracts, AG-UI module, and bundled capability
-families are independently published npm workspaces in this monorepo; the CLI,
-TUI, and editor clients are separate repositories.
-
-```mermaid
-flowchart LR
-    contracts["plurnk-contracts<br/>language + shared wire"] --> frameworks["providers / schemes<br/>mimetypes / executors"]
-    meta["plurnk-meta<br/>discovery + teaching corpus"] --> frameworks
-    contracts --> core["plurnk-core<br/>@plurnk/plurnk-service"]
-    frameworks --> core
-    meta --> core
-    core --> agui["plurnk-agui<br/>external protocol"]
-    agui --> clients["CLI / TUI / editor clients"]
-```
+package map. The default installed composition is specified in {§bundled-set}.
 
 §ecosystem-composed-host Core is the composed runtime: it owns persistence,
 scheduling, packet assembly, dispatch, and cross-capability orchestration while
@@ -319,18 +139,6 @@ clients render and submit actions but contain no engine logic.
 
 OpenTelemetry may observe PLURNK; it never becomes product state, failure transport, scheduler input, model teaching, or client protocol. Domain and client activity remain on AG-UI. Reusable packages depend on the OTel API only; the daemon constructs only the explicitly configured trace and metric providers. An unconfigured or standards-valid disabled process loads no SDK or exporter implementation and keeps the API's no-op behavior with bounded overhead. OTel Logs have no provider or initialization path.
 
-### §standards-discernment Standards discernment
-
-Seven principles govern which exterior standards Plurnk conforms to (#299):
-
-1. **UVP first.** Never conform away what users chose Plurnk for; the OP grammar, curated log, packet, and worker graph are the product, not a compatibility gap.
-2. **Right-fit.** Hobbyist-first: an enterprise-grade feature is acceptable only when its cost lands on the party that wants it, never on general adoption.
-3. **Traction.** Count running counterparties today; integration horizon must be shorter than the standard's expected half-life. Sockets stay configurable with no default until a candidate earns it.
-4. **POSIX app identity.** Decades-stable host-ecosystem conventions (XDG, NO_COLOR, man, completions, service units) outrank months-stable AI-pipeline fashions.
-5. **Faces, never organs.** A standard adopts as one adapter or projection behind an existing seam; if it cannot, that is the alarm, and it goes to a design gate.
-6. **Deletion is the price of admission.** A standard earns adoption by deleting bespoke surface (the ACP Plan object deleted the Markdown plan microformat); parallel representations, second discovery paths, and compatibility grammars are refused.
-7. **Two arbiters.** Model-facing surfaces change only on measured model evidence; human-facing surfaces follow host-ecosystem convention without ceremony. Standards bodies get a vote on neither.
-
 Configuration uses the standard `OTEL_*` environment: `OTEL_TRACES_EXPORTER` / `OTEL_METRICS_EXPORTER` select `otlp` or `console` per signal (a missing or `none` value keeps that signal off; no SDK default selects an exporter), `OTEL_SERVICE_NAME` names the service (default `plurnk-service`), case-insensitive `true` in `OTEL_SDK_DISABLED` turns the boundary off, and OTLP exporters honor `OTEL_EXPORTER_OTLP_*`. An unknown exporter name fails daemon boot; a typo never silently disables observation. OTel Logs and direct draft semantic-convention use are excluded. HTTP spans carry only an AG-UI-owned bounded route class, never an input pathname or query. Spans otherwise carry high-cardinality identifiers; metric labels stay low-cardinality. Prompts, reasoning, file bodies, arbitrary URLs, secrets, and plugin payloads are never recorded as attributes or metric values by default. Exporter failure cannot change product results or client lifecycle. Daemon, telemetry, and database teardown are independent reverse-ownership phases; every phase runs and aggregate failure preserves every cause.
 
 §observability-genai-conventions **GenAI convention projection.** Provider
@@ -346,6 +154,18 @@ boundary is unchanged — no prompts, reasoning, bodies, or URLs. This is the
 sanctioned exception to the blanket draft-convention exclusion; no other
 draft convention is projected.
 
+### §standards-discernment Standards discernment
+
+Seven principles govern which exterior standards Plurnk conforms to (#299):
+
+1. **UVP first.** Never conform away what users chose Plurnk for; the OP grammar, curated log, packet, and worker graph are the product, not a compatibility gap.
+2. **Right-fit.** Hobbyist-first: an enterprise-grade feature is acceptable only when its cost lands on the party that wants it, never on general adoption.
+3. **Traction.** Count running counterparties today; integration horizon must be shorter than the standard's expected half-life. Sockets stay configurable with no default until a candidate earns it.
+4. **POSIX app identity.** Decades-stable host-ecosystem conventions (XDG, NO_COLOR, man, completions, service units) outrank months-stable AI-pipeline fashions.
+5. **Faces, never organs.** A standard adopts as one adapter or projection behind an existing seam; if it cannot, that is the alarm, and it goes to a design gate.
+6. **Deletion is the price of admission.** A standard earns adoption by deleting bespoke surface (the ACP Plan object deleted the Markdown plan microformat); parallel representations, second discovery paths, and compatibility grammars are refused.
+7. **Two arbiters.** Model-facing surfaces change only on measured model evidence; human-facing surfaces follow host-ecosystem convention without ceremony. Standards bodies get a vote on neither.
+
 ### §in-process In-process architecture
 
 Composed daemon internals + admin CLI. Four plug points:
@@ -353,7 +173,7 @@ Composed daemon internals + admin CLI. Four plug points:
 - **Providers** ({§provider}) — LLM transports. Engine sends a turn's messages, receives raw content + usage; engine parses the content into `PlurnkStatement[]`.
 - **Schemes** ({§scheme}) — addressed capabilities. A scheme handler interprets targets under its prefix and owns its storage substrate.
 - **Mimetypes** ({§mimetype}) — content interpretation. Render-time handlers consume channel content; framework owns the dispatch.
-- **Executors** ({§exec} / {§bundled-set}) — EXEC runtime dispatch for subprocess, data, and pure-computation runtimes; web discovery rides the ordinary MCP surface.
+- **Executors** ({§exec} / {§bundled-set}) — execution dispatch for subprocess, data, and pure-computation runtimes; web discovery rides the ordinary MCP surface.
 
 Core's internal owners compose without becoming new package or public seams:
 
@@ -372,6 +192,13 @@ The contracts package (`@plurnk/plurnk-contracts`) owns the parser and AST contr
 
 Server posture: this package is the one long-running runtime process. `plurnk-agui` exposes its external protocol; user-facing clients run separately and do not call core's in-process seam directly.
 
+§service-worker-composition The service launcher and the live/demo workspace
+helper share one registration of default worker-facing modules: MCP and outbound
+A2A. Their management families and readable reference documents are present even
+with no enabled attachments. Workspace capability policy controls every actor's
+surface; registering a family does not enable a remote attachment. Client and
+inbound-A2A listeners and host hooks remain launcher-owned.
+
 ### §service-package-exports Package export surface
 
 | Export path                           | Current contract                                                                                                                                                        |
@@ -410,7 +237,7 @@ before provider or capability initialization can perform external work. Every
 later startup failure closes resources in reverse ownership order while
 preserving the originating failure: daemon, observability, database, listener.
 
-### §actor-boundary The actor boundary: per-worker attention, two doors, self-hosting
+## §actor-boundary Workers and workspace boundaries
 
 ```mermaid
 flowchart LR
@@ -475,13 +302,13 @@ never wake; they queue until another cause produces a turn ({§env-delta}). The
 obligation edge is continuation control, not a third door through which
 arbitrary workspace state can enter.
 
-§actor-boundary-self-hosting **Use the actor path when the work has an operation; retain irreducible rails in the kernel.** The workspace has one reserved `plurnk` Worker. `DispatchAsPlurnk` opens ordinary administrative loops and turns for its work. Generated references are shared entries; the runtime actor has no privileged scratch access.
+§actor-boundary-self-hosting **Use the actor path when the work has an operation; retain irreducible rails in the kernel.** The workspace has one runtime Worker, `_plurnk` (origin `_plurnk`), a name `WORKER_NAME` never admits, so no model or client can mint or resume it ({§worker-name-minting}). `DispatchAsPlurnk` opens ordinary administrative loops and turns for its work. Generated references are shared entries; the runtime actor has no privileged scratch access.
 
 | Work                                    | Owning path                                                         | Why                                                                                 |
 | --------------------------------------- | ------------------------------------------------------------------- | ----------------------------------------------------------------------------------- |
 | Workspace reference documents | Runtime actor; `_plurnk` EDIT through engine dispatch. | Maintaining generated workspace scratch is an ordinary operation. |
 | Git membership and disk materialization | Kernel `GitMembership` / entry CRUD.                                | Ingesting existing disk state is not a model-authored EDIT.                         |
-| Disk-divergence narration               | Kernel writes an EDIT-shaped `source=file` row to the `plurnk` log. | It reports an environment event honestly; no operation is fabricated as having run. |
+| Disk-divergence narration               | Kernel writes an EDIT-shaped `source=file` row to the `_plurnk` log. | It reports an environment event honestly; no operation is fabricated as having run. |
 | Search derivation and catalog render    | Kernel.                                                             | They are indexes and read-only projections, not entry operations.                   |
 | Packet assembly and budget rails        | Kernel.                                                             | They are the execution substrate on which actor operations depend.                  |
 
@@ -496,7 +323,7 @@ file: no entry, no stunt, nothing 404s. The global XDG configuration `AGENTS.md`
 remains system-prompt policy ({§policy-sections}); the stunt carries only
 local repo guidance.
 
-§actor-boundary-doc-injection **Generated documents use the actor path.** Workspace references and projected project instructions are materialized in `worker:///_plurnk/` through the reserved actor's ordinary maintenance turns. Their exact programs and operation evidence remain durable in that actor's log; generation is not a hidden database write.
+§actor-boundary-doc-injection **Generated documents use the actor path.** Workspace references and projected project instructions are materialized in `worker:///_plurnk/` through the runtime actor's ordinary maintenance turns. Their exact programs and operation evidence remain durable in that actor's log; generation is not a hidden database write.
 
 Maintenance turns create neither lineage nor commons broadcasts. Their loops are not work-lifecycle observations ({§application-worker-observation}, {§application-loop-observation}); `work_loops` excludes loops whose turns are all maintenance, but retains empty queued loops and loops containing any other purpose. Scheduling and forensic history remain intact.
 
@@ -537,7 +364,7 @@ log already renders in present mode.
 
 §worker-initialization-entry **Model-worker initialization is a real `_plurnk` turn.** A model worker's first loop begins with one packetless `{ producer="_plurnk", kind="initialization" }` turn submitted through {§turn-ops-admission-path}. Its program is stored before execution and dispatches the orienting READ/FIND surveys, the reasoning and program READs in {§reasoning-initial-read}, and the final TASK (in {§op-execution-order}). The prompt is not READ here: its `prompt` row in the first model turn is the one publication of every prompt ({§prompt-entry}), so the body never appears twice. The full `<1,-1>` READ of its own `ops:///<loop>/<turn>` source supplies the worked program example; no actionless source row or simulated READ is added. Every orienting row is structurally classified `_plurnk` and `init`. The program archives nothing: the prompt entry ({§prompt-entry}) is the durable, addressable copy of every prompt, so no scratch archive of it is written. The three namespace surveys carry asides that name what each space is — `project root member files`, `shared worker Extended Context`, `private worker Extended Context` — and, because the program echo shows them verbatim, those asides are the model's map of its spaces. TASK hands off with one {§plan-value} entry: `{"content":"Address the prompt.","status":"in_progress"}`. The first model request occupies the following turn and therefore begins at database/log turn sequence 2; “turn zero” is the initialization phase's model-facing label, not a zero-based database coordinate. Client and `_plurnk` administrative workers execute operation turns and do not receive model initialization.
 
-### §machine-processes The machine and its processes: workspace, worker, fork
+### §machine-processes Workspace and worker state
 
 A workspace owns every entry; a worker owns its history and active work.
 
@@ -627,7 +454,7 @@ shared entries, and membership remain live and uncopied.
 histories over one workspace are worker forks. A divergent project filesystem
 or membership overlay requires a new workspace.
 
-### §worker-scheme The worker:// scheme — the knowledgebase (commons, own space, named spaces) and worker control (spawn, irc, fork, terminate, cap, collect)
+### §worker-scheme Worker resources and control
 
 §worker-authority-carving **Authority is a literal namespace, not a principal.** `worker:///notes.md` is shared scratch; `worker://alice/draft.md` is named scratch. Both belong directly to the workspace ({§entry-owner}). Entry addresses require no namesake Worker row and survive its deletion; only pathless worker controls resolve an actor. The caller never alters an address, and `~` has no alias semantics.
 
@@ -638,9 +465,8 @@ continues to decompose other authorities without treating them as mintable.
 
 | Candidate                                      | Minting result                                                        |
 | ---------------------------------------------- | --------------------------------------------------------------------- |
-| `WORKER_NAME` match, not reserved              | Admitted as the exact literal worker name.                            |
-| `plurnk` (any case variant) | Refused as reserved before lookup or insertion.                       |
-| Any other spelling                             | Refused as `name-invalid` before lookup, insertion, or child startup. |
+| `WORKER_NAME` match                            | Admitted as the exact literal worker name; `plurnk` is one.           |
+| `_plurnk`, or any other spelling               | Refused as `name-invalid` before lookup, insertion, or child startup. |
 | Automatic name                                 | Generated, then admitted through the same predicate.                  |
 
 §worker-read-scope **Scratch is workspace-readable.** Any actor reads and searches any named or shared scratch address. Parentage and writer identity do not change resolution. Scratch namespaces do not require a namesake Worker. A pathless actor address requires a named Worker; an unknown actor returns 404.
@@ -649,7 +475,7 @@ continues to decompose other authorities without treating them as mintable.
 
 §worker-generated-subtree **Generated documents share `worker:///_plurnk/`.** Project instructions (`agents.md` and subtree-scoped `instructions/**`), scheme/runtime references (`plurnk/**`), tool details (`tools/**`), and family catalogs are workspace resources. Agent Skills retain their own trees at `skill://<name>/` ({§skills-resources}).
 
-The subtree has ordinary scratch access, not an ACL. Runtime maintenance reconciles it from workspace Functionality through the reserved actor's ordinary turns ({§actor-boundary-doc-injection}); reconciliation may replace manual edits. There are no per-Worker copies or fork rederivation. A runtime's `resourcesPath` is relative to this root ({§tools-resource-materialization}).
+The subtree has ordinary scratch access, not an ACL. Runtime maintenance reconciles it from workspace Functionality through the runtime actor's ordinary turns ({§actor-boundary-doc-injection}); reconciliation may replace manual edits. There are no per-Worker copies or fork rederivation. A runtime's `resourcesPath` is relative to this root ({§tools-resource-materialization}).
 
 §worker-control-addressing **Explicit worker control addresses are authority-only.**
 WORK and FORK may omit their address to allocate one ({§worker-auto-name}).
@@ -702,17 +528,19 @@ Every admitted authority is a literal `workers.name`; self-addressing uses the c
 - §worker-scheme-fork-scratch **Forked scratch.** Named scratch and evidence are copied under the new name through {§machine-processes-entry-inheritance}. Parent and branch can edit either scratch namespace; their copies diverge independently.
 - §worker-spawn-no-branch **WORK and FORK take a worker path and a prompt, nothing else.** Branch
 delegation was removed outright (#396). A model manages git branches through ordinary
-EXEC git — never engine machinery.
+the `git` runtime — never engine machinery.
 - §worker-delegation-inherits-policy **Fresh delegated loops inherit proposal disposition.** WORK, FORK, and SEND to an idle Worker carry the sender's proposal disposition. SEND into an active or parked loop leaves its immutable policy untouched. All workers share live workspace capability policy; delegation creates no capability snapshot or bound.
 - §worker-lifecycle-wake-requeue-not-terminal **A wake re-queue is not a terminal.** A conclusion-wake resumes a 202-blocked loop by re-queueing it (202 → 100); when that lands while the loop's own live drain is between turns, the drain **re-claims and continues** (atomic 100 → 102; the injected prompt is already the next turn). The internal re-queue is never reported as an outward terminal.
 
 - §worker-scheme-collect **Collect** — a worker's loop reaching a terminal status
   surfaces to its direct parent as an ambient delta ({§env-delta}): a `SEND` from
-  `worker://<name>` carrying the loop's exact terminal operation result. A
-  **2xx deliverable is born visible** (its body
-  materialized into the parent's packet, not body-suppressed): a child's
-  success must reach the parent visible and awakening, never a bodyless row. An
-  non-2xx result surfaces body-suppressed; a failure retains its exact status and Problem. Every death-path is stamped uniformly —
+  `worker://<name>` carrying the loop's exact terminal operation result. **Every
+  conclusion is born visible** (its body materialized into the parent's packet,
+  not body-suppressed): a child's last message must reach the parent visible and
+  awakening whatever the status, never a bodyless row, because a failure's
+  explanation is its deliverable (operator, 2026-09-14: fail is completed with a
+  frowny face); a failure retains its exact status and Problem beside that
+  message. Every death-path is stamped uniformly —
   including a spawn that dies before its first turn — so no child termination is
   silent to its owner; collection is lineage
   supervision, never a
@@ -758,32 +586,227 @@ EXEC git — never engine machinery.
 
 Worker control rides the daemon's inject seam (active→fold, idle→enqueue+drain), so the handler creates/branches the worker and hands off; the daemon owns provider + system prompt. FORK/WORK carry the seed task in the body and are their own ops, dispatched to worker control — never the entry-copy path.
 
-### §worker-loop-lifecycle Worker and loop lifecycle: drain, reap, and passive wake
-
-- §join-blocking-collect **Collection and scheduling are independent.** A path-absent ```` ```READ (worker://<running-child>) ```` returns **425** (Too Early), without a strike or scheduler side effect. TASK with waiting intent joins live obligations; an `in_progress` inventory keeps working. A child reaching any terminal status wakes a waiting parent with its result, including completion racing the park boundary. Children retain their own limits; TASK timing may additionally bound the parent's wait. Collection never arms an implicit disposition override.
+## §membership File membership and project roots
 
-A worker is a **log plus a cancellation scope** — one `AbortController` per worker, reused while live and replaced only once aborted, so a cancel ends the worker as a unit and a later `runLoop` request is never born cancelled. A worker's queued loops are advanced by a **drain**: a single per-worker drain that claims loops atomically (status 100→102) and runs each under the worker's scope. A loop may spawn **streams** (execs) that outlive it; each is a row in the subscription registry ({§subscriptions}) — the durable record of what the worker holds open. Cancellation and conclusion are defined against these structures, never wall-clock timing.
+The project-file path has two explicit reconciliation gates. Internal entries do
+not participate in this disk loop.
 
 ```mermaid
-stateDiagram-v2
-    [*] --> Queued: runLoop request
-    Queued --> Running: due task claimed by drain
-    Running --> Parked: wait with live obligations
-    Parked --> Queued: obligation settles or arrival
-    Running --> Terminal: conclude or fail
-    Parked --> Terminal: cancel
-    Queued --> Terminal: cancel
-    Terminal --> [*]
+flowchart LR
+    git["Git tracked"] --> resolve["Resolve workspace membership"]
+    include["include"] --> resolve
+    exclude["exclude"] -->|subtract| resolve
+    resolve --> materialize["Pre-turn materialize<br/>disk → file snapshot"]
+    materialize --> read["READ snapshot"]
+    materialize --> edit["EDIT against snapshot"]
+    edit --> proposal["Proposal"]
+    proposal -->|"client accepts or loop auto"| cas["synced_sig compare-and-swap"]
+    cas -->|"file snapshot → disk"| project["Project file"]
+    project --> materialize
 ```
 
-§worker-lifecycle-state-machine The lifecycle store admits only the guarded transitions shown above: `100 → 102`, `102 → 202`, `202 → 100`, and any unresolved state (`100`, `102`, `202`) to a terminal status. Terminal state is immutable. `DrainSupervisor` owns claim, wake, and cancellation; the dispatcher owns model-requested park/conclusion; the daemon owns boot-recovery orchestration; and the engine owns policy terminals. A racing transition that loses observes the durable winner; it does not overwrite it or report the requested state as fact.
-
-§worker-lifecycle-live **Worker liveness is existential, not latest-state.** A
-Worker is live while ANY of its loops is unresolved (`100`, `102`, or `202`). A
-newer terminal loop cannot mask older queued, running, or parked work. Name
-collision, workspace worker caps, child obligations, orientation, and recovery
-all use that one definition.
-
+| Concern            | Owner and representation                                                                                                                    |
+| ------------------ | ------------------------------------------------------------------------------------------------------------------------------------------- |
+| Workspace identity | `workspaces.project_root`; null is headless. There is no separate project entity.                                                           |
+| File visibility    | Workspace-tier resolved membership: `(tracked files ∪ include) − exclude` ({§membership-baseline}). Every worker sees the same result. |
+| File reads         | READ returns the materialized file snapshot stored in the entry body channel; it does not read disk directly.                               |
+| File writes        | EDIT proposes against that snapshot. Only accepted resolution with the captured `synced_sig` writes the project file.                       |
+| Internal entries   | Workspace or worker entries are canonical store state. Writing one never implies a project-file write.                                      |
+| Authority          | Service flags set the membership ceiling; the `members` family's definitions include and exclude within it; client or loop auto resolves proposals. `origin` is attribution. |
+
+§web-search-retrieval **Web discovery is an ordinary MCP concern; retrieval is a first-class composition.** PLURNK owns no search runtime: a search-capable MCP server (e.g. Brave Search) participates through the ordinary MCP contract — admission, read-effect classification, tool documentation, and packet projection are identical to every other MCP tool ({§mcp-tool-presentation}). An executor that wants to materialize discovered pages uses the generic `content: null` `entry()` request ({§exec-entry-sink}): the guarded `WebFetcher` sink fetches candidates in parallel, off the write-serialization chain, and materializes successful bodies as ordinary HTTP entries. Every candidate whose `entry()` call rejects, regardless of failure reason, is mechanically omitted from the model-facing result directory; survivors retain upstream order. Without an entry sink the executor cannot test materialization and omits the verdict.
+
+Search prefetch and direct HTTP READ materialize the same resource contract:
+protocol + canonical authority (including a non-default port) + path + serialized
+query is the absolute identity ({§scheme-address-network}); the sanitized
+readable projection is the fragmentless default, while faithful DOM, origin
+media type, and projection identity remain explicit auxiliary evidence. A
+normal
+```` ```READ (https://host/path?query) ```` therefore publishes only the sanitized body
+under that exact URL—never raw HTML, response headers, or a channel-selection
+lesson. FIND consumes the addressed stored channel representation
+and never re-fetch a match.
+
+§web-retrieval-live Coverage protects the composition at distinct seams: HTTP unit tests pin fragmentless-body publication and explicit auxiliary selection; integration tests pin materialize→FIND and persistence/publication separation. A live positive-control demo requires a materialized HTTPS body and a substantive answer from a real sanitized page; live discovery demos remain diagnostic and may expose model judgment failures without weakening these assertions.
+
+**Git is the substrate and the repository is the boundary:**
+
+- §membership-baseline **The baseline contract — chiseled (#400).** To a workspace a
+  project file is exactly one of three things: **invisible**, **added**, or **tracked
+  by git**. There is no fourth category. Membership — what the model can READ and
+  FIND, what is materialized into the store, what a packet can ship to a provider — is
+  the allowlist `(tracked ∪ include) − exclude` and nothing else. No file is a member because
+  it exists on disk, because git does not ignore it, or because a model would find it
+  convenient: ambient admission of untracked files is prohibited, so a workspace rooted
+  in a home directory or a monorepo exposes exactly what was committed or added (the
+  non-member rule, {§fs-write-nonmember}: no read, no leak, no overwrite). Every
+  exception is a named clause in the register ({§membership-model-universe}), admits
+  files by an exact creation record with recorded provenance, and never by `git add`.
+  Changing this clause, the register, or the composition is an operator ruling recorded
+  on the issue that lands it — never an implementation convenience, never a side effect
+  of making a file visible to solve the problem at hand. The 2026-07-12 – 2026-08-27
+  "untracked-but-not-ignored" ambient admission is retired.
+- §membership-model-universe **The exception register — files in the model's universe.**
+  Admitted by exact creation records (`source: "create"`, origin `constraint`), never
+  staged: (1) a file an accepted EDIT creates; (2) a COPY/MOVE destination
+  ({§membership-create-parents}). Admitted by a published standard as projected
+  instruction documents — never as members: (3) the project's `AGENTS.md` and nested
+  `AGENTS.md` files ({§turn0-agents-stunt}, #346), read from disk regardless of git status
+  and materialized as `worker:///_plurnk/agents.md` and
+  `worker:///_plurnk/instructions/<subtree>/AGENTS.md`; the file itself is a member
+  only when tracked or added, and the standard never overrides the operator's
+  exclusions — an `AGENTS.md` the repository ignores or an exclusion matches
+  is not projected. (4) A definition the model proposes through the `members`
+  family ({§members-functionality}), admitted only under the operator's ceiling
+  `PLURNK_SERVICE_MEMBERS_MODEL_SCOPE` (shipped `namespace`), projected with source
+  `model`, and never admitted past the repository's ignore rules or an exclusion.
+  Nothing else.
+- §membership-git-membership The workspace owns the Git repository containing
+  `project_root`. Its tracked files (`git ls-files` semantics) are members with
+  no explicit overlay; when the root is a package inside a monorepo, the
+  repository's other packages are members at root-relative paths. An unrelated
+  or nested independent repository is not discovered or managed by this
+  workspace. When Git is absent there is no filesystem walk; member definitions are
+  then the sole source.
+- §git-native-default **Core Git reads use native Git.** Membership and status
+  execute the installed Git binary. An absent or failed binary yields no
+  automatic Git membership or status; core has no alternate implementation or
+  fallback.
+- §membership-git-hermetic Native Git runs with ambient `GIT_*` and
+  global/system config scrubbed, and with the repository's own program-running
+  keys pinned off at the highest precedence (`core.fsmonitor=false`,
+  `core.hooksPath=/dev/null`), so repository identity follows `project_root`,
+  never the daemon's launch environment, and inspecting a supplied repository
+  never runs a program its `.git/config` names. Other repository-local
+  configuration is still read (#568). The one program no key can pin off is a
+  `filter.<name>.clean` / `filter.<name>.process` driver, which `git status`
+  index refresh may run: automatic inspection asks the repository's own config
+  first (`git config --get-regexp`, no program runs) and, when any such key is
+  declared, refuses the repository as a warning-and-skip — Git status and
+  automatic Git membership answer exactly as for a non-repository, and one
+  `engine:membership` / `git_inspection_refused` notice names the key, once per
+  workspace until it changes or clears. User- and model-requested Git commands
+  stay on their explicit execution path.
+- §membership-edit-membership-gate **Membership-gated edits.** EDIT is bounded by membership exactly as READ is. An existing **member**'s baseline is its entry snapshot — the body channel the model READ, not a fresh disk read — so the diff is naive against the view the model saw, never empty (the write-side CAS, {§membership-edit-write-cas}, prevents the silent overwrite of out-of-band drift). An existing **non-member** is refused (403) *before* any read or write: the model never reads a file it can't see (no leak into the proposal) and never overwrites one (no wiping a gitignored `.env` it never added). A **new path** crosses the creation matrix in {§fs-write-surface}; proposal acceptance cannot bypass its scope, exclusion, or incorporation rules. Shell execution reaches beyond file membership; the file scheme does not.
+- §membership-create-parents **Parent-complete creation.** An accepted File creation—whether authored as EDIT or as a COPY/MOVE destination—recursively creates missing parent directories before writing and registering the new member.
+
+**The overlay — `include | exclude`.** `workspace_constraints` holds the `members` family's projected definitions and the engine's creation records ({§members-projection}). Resolved membership is `(project repository files ∪ include) − exclude`.
+
+- §membership-auto-add **Auto-add** — the project repository's ambient membership is its tracked `ls-files`, with `git` origin; an untracked file is never an ambient member ({§membership-baseline}). An accepted creation is incorporated by an exact creation record, never by `git add` ({§membership-model-universe}); a record that cannot be written fails the creation transaction, never an orphan ({§file-create-no-orphans}).
+- §membership-overlay-include **`include`** — admit a file Git misses through a targeted pattern scan (files only), with `constraint` origin. `source: "members"` is a projected human definition, `source: "model"` a projected model definition, `source: "create"` the exact durable record of an accepted creation. Only `members` inclusions override active Git ignore. In a Git-absent root, inclusions are the sole file-membership source.
+- §membership-overlay-exclude **`exclude`** — a `!glob` definition removes a tracked or included file: resolution drops matches (`node:path.matchesGlob`) and reconciles so the entry set *equals* the member set. The lever to exclude a committed-but-oversized or sensitive tracked file; exclusions mask creation records without deleting their provenance ({§fs-create-masked}).
+- §membership-reconcile-sets **Reconciliation is two set statements.** Once the desired set is composed — `(git ls-files ∪ include) − exclude`, glob evaluation and Git shell-outs being the process's own — it lands as one `INSERT … SELECT FROM json_each` with the same idempotent provenance update as a single registration, and every overlay-owned member outside it leaves in one `DELETE … WHERE pathname NOT IN (json_each) RETURNING`, its prior body riding out of the statement. A path that also left disk truth (no longer a candidate at all) becomes a divergence from that prior content; an exclusion is silent. No per-path statement, no set difference outside the database.
+- §membership-glob-in-sql **A constraint is evaluated where it lives.** `glob_match(pathname, glob)` is `node:path.matchesGlob` registered into SQLite (`src/core/glob_match.ts`, deterministic), the one matcher every overlay decision uses, so a lookup that asks the constraints table a question — which exclusion covers this key, whether a members definition includes it, which inclusion owns each untracked path — is one statement over `workspace_constraints`, never a listing filtered in the process. Transient inputs the process already holds (a `git ls-files` listing against the exclude globs) stay filtered in the process; the function exists so the database's own rows can be asked, not so process data makes a round trip.
+
+**File ops act on the entry, not the disk; the two reconcile only at gates.** A `file:///` member is a row whose body channel holds its *materialized model-readable snapshot*. READ returns that channel; EDIT diffs against editable text snapshots — neither reaches the filesystem directly. Entry and disk reconcile at exactly two gates: the **pre-turn materialize** (disk → entry, below) and the **accept-time write-back** (entry → disk, {§proposal}). Between the gates the entry is the truth the model curates against, and `synced_sig` — the member's last-synced disk stat (`mtime:size`) — is the version token both gates compare on.
+
+§membership-source-projection Binary acquisition is transient and bounded by
+{§mimetype-binary-input}; durable entry channels remain Unicode text. Core-private
+`sourceProjection` attributes preserve the source mimetype, opaque projection
+identity, and terminal disposition without exposing raw bytes or a base64 lane.
+
+| Disk source                        | Durable body                                         | Operation effect                                                                 |
+| ---------------------------------- | ---------------------------------------------------- | -------------------------------------------------------------------------------- |
+| Text                               | Verbatim Unicode under the detected textual mimetype | READ and EDIT use the snapshot.                                                  |
+| Binary with readable projection    | Derived Unicode as `text/markdown`                   | READ uses the projection; source-aware EDIT remains 415.                         |
+| Binary without projection/over cap | Empty marker under the source binary mimetype        | READ and EDIT return 415; private metadata distinguishes unavailable from limit. |
+
+§membership-materialization-limit **A pathological member degrades, never the
+workspace.** `PLURNK_SERVICE_FILE_MATERIALIZE_MAX_BYTES` is a required positive
+byte ceiling over one disk source before Core reads it into the canonical file
+snapshot. Its valid range is `1..104857600`, bounded by the channel storage
+contract, and it ships at that 100 MiB maximum. An oversized path remains a real member
+with an empty body channel carrying a durable 413 producer result; no diagnostic
+sentinel impersonates file content. READ therefore names the path, observed bytes,
+ceiling, and recovery through the ordinary result contract, while EDIT returns the
+same 413 instead of diffing against a fictitious empty baseline. Core records the
+materialization disposition and ceiling privately, so an unchanged disk member is
+reconsidered when the operator changes the policy and otherwise remains a stat-only
+no-op. The file write gate independently stats the source against the same ceiling,
+so safety does not depend on a background warm winning a client-operation race.
+
+§derivation-dedup-parallel **The index dedups then parallelizes.** The derivation identity hashes the exact READ channel representation, mimetype, reader behavior, and applicable search exclusion. A channel or log projection attaches the immutable artifact only after it is complete; identical projections therefore share one FTS row and one symbol graph without copying. The identity hashes the representation's own SHA-256 ({§tokenomics-content-hash-identity}), never its body, so a maintenance pass judges an entry channel from its stored `content_hash` without the body crossing into the process; a body is acquired only for a derivation that runs, under that same identity (a representation that moved on since it was judged returns nothing and is judged again next pass), or for a channel with no stored identity, an open or streamed channel, which must be read to be judged. Log rows and turn sources still arrive whole. The pass reports the bytes it acquired beside the derivations it ran, and an unchanged workspace acquires none of its channel bodies at any concurrency. Distinct artifacts run with bounded producer concurrency (`PLURNK_SERVICE_DERIVE_CONCURRENCY`). Pending artifacts sort by readable content length before entering that pool, so small resources start first while every outlier still derives fully. Unset uses a host-relative square-root fan-out; a positive integer is an exact operator budget and `-1` claims every core. Graph persistence writes at most `PLURNK_SERVICE_DERIVE_STORE_BATCH` definitions or references per SQLite statement. Every launched worker settles before the maintenance pass reports success or failure, so one failed artifact cannot orphan sibling derivations. Every representation completed by a successful pass attaches a terminal classified artifact, identically at concurrency 1 and N. A changed pass emits one immediate `preparing` state, intermediate `indexing` heartbeats at `PLURNK_SERVICE_DERIVE_PROGRESS_HEARTBEAT_MS`, and one immediate `complete` or `failed` state. A no-op pass emits no lifecycle, an indexing heartbeat never claims 100%, and the model-facing Notice buffer retains only the current derivation state while live clients observe each heartbeat.
+
+The artifact also retains a positive `{§mimetype-parse-issues}` count and the
+full normalized `{§mimetype-summary}` when the exact parsed channel reported
+either. Both remain advisory alongside a normally completed search
+disposition; zero, empty, and unavailable evidence persist as absence. Catalog
+projection attaches either only to that channel, never to a sibling whose
+content the artifact does not describe.
+
+Every completed artifact records one terminal disposition: `indexed`, `excluded`
+(the configured search-exclusion table), `unsearchable` (empty or binary), or
+`failed` (a typed {§mimetype-error-policy} invalid-source failure, or the
+handler's own defect on that one member — {§derivation-member-failure}).
+
+§derivation-member-failure **One member's derivation failure never ends the
+pass or the model's turn.** A handler defect on one member — a
+`MimetypeDerivationError` under {§mimetype-derivation-evidence}, the exception
+being a cancellation — is that member's terminal `failed` disposition, whose
+`reason` is the handler's invocation context followed by the exact original
+cause (`Mimetype derivation failed for "/x.js" ("text/javascript").
+RuntimeError: …`). The pass continues, attaches every other member, and
+completes; its terminal `search_progress` notice is `complete` at `level: warn`,
+naming the first failed member and carrying the count. A failed member is
+terminal for that exact content, handler revision, and configuration identity
+({§derivation-dedup-parallel}); a change to any of those derives it again.
+Everything that is not a handler's derivation of one member stays fatal to the
+pass exactly as before: a grammar that is not installed, an index-persistence
+or contract failure, and cancellation, each leaving the artifact `building` for
+retry.
+Cancellation and implementation, loading, database and index-persistence failures
+remain `building`, unattached, and retryable; Core never guesses that an arbitrary
+projection exception is bad content. The digest reports exceptional dispositions
+with their reasons. Successful optional projection degradations continue indexing
+and surface their framework Notice once per identical observation in a maintenance
+pass.
+
+§membership-change-gated-sync **Sync is idempotent and change-gated.** Per turn, membership materializes every member's model-readable snapshot into its entry. Text with an unchanged disk signature and materialization policy is a stat-only no-op. The version token is either the observed `mtime:size` or the explicit `absent` state; an observed deletion removes the stale readable channels, and a later reappearance is therefore a new divergence rather than a first-sight materialization. Binary sources additionally compare the cached per-mimetype projection identity; unchanged bytes are never reacquired, while changed reader behavior rematerializes without fabricating a filesystem-divergence event. Coverage is exhaustive across the project repository while work is proportional to source or projection change. After a pass every member carries the current representation defined by {§membership-source-projection} and {§membership-materialization-limit}.
+
+§membership-emi-divergence-signal **EMI divergence evidence.** The detector that gates the work *is* the one that records this — one mechanism, not a second full read. When change detection finds a member moved out-of-band, the runtime actor records an `EDIT`-shaped row naming the file with `source="file"`; it does not broadcast that workspace change into unrelated workers' logs ({§env-delta-filesystem-narration}). The model's own edits are write-through (the entry equals disk after a File write), so the scan never mis-attributes them as external divergence. The current file remains ordinarily addressable. A stale anchored edit rejects under {§line-anchors}; a disk race after proposal rejects under {§membership-edit-write-cas}.
+
+§membership-edit-write-cas **The write-back is a compare-and-swap — never a clobber, never a clever merge.** EDIT is *naive against the editable text snapshot*: it diffs the model's change onto the entry's body channel — the exact Unicode the model READ — and the proposal carries the `synced_sig` that snapshot was taken at. Binary sources are refused before this path ({§membership-source-projection}). At accept, `applyResolution` re-stats disk and lands the proposed content only if that signature still matches. If disk moved out-of-band in the propose→accept window — a sibling worker, the user's editor, a build step — the write is **refused** with the same neutral `edit-collision` as {§edit-collision}, and **nothing is written**. The engine neither blind-writes over the ambient change (a *clobber*) nor silently re-diffs the model's edit against a state it never saw (getting *clever*) — both would bury a stale-view contract violation under a fallback. The collision surfaces instead: a ≥400 apply downgrades to a reject ({§proposal}), so the model sees that EDIT **did not occur** (400; the `edit_collision` outcome is forensics-only). Reconciliation aligns the current file projection and records the `source=file` evidence in the runtime log ({§membership-emi-divergence-signal}); the model re-reads and re-proposes against the fresh snapshot.
+
+The version travels *with the proposal*, never re-read from the entry at accept: a sibling worker in the same workspace may reconcile while this proposal sits paused, advancing the entry's `synced_sig` to the drifted disk — comparing against the *current* entry sig would wave that clobber through, so the comparison is always against the sig the proposal was computed at. A proposal that assumed an **absent** path (a create) conflicts only if a file has since appeared; a member with **no recorded snapshot** (an un-materialized entry, null `synced_sig`) has no baseline to guard and writes through — the two are told apart by the proposal's `existed` flag, not by a null sig alone. On a clean landing the entry refreshes to the written content and `synced_sig` is **restamped** to it, so the next reconcile recognizes the model's own write (not an external divergence) and a second same-turn edit bases on the landed bytes, not a stale sig. This is the write-side twin of the read-side change-gate ({§membership-change-gated-sync}): one `synced_sig`, gating both the re-read and the write.
+
+The CAS is the **hard backstop**, at the moment of writing, on every accept path. It composes with the model-facing {§line-anchors}: an anchor rejects a target whose relevant neighborhood changed before dispatch, while the CAS refuses to write against a snapshot disk left after proposal. An unanchored edit deliberately claims no pre-dispatch stale-view guarantee.
+
+§membership-git-flags **Permission flags.** Service-wide Git admission comes from {§operator-config-git-ceiling}. `PLURNK_SERVICE_GIT_AUTO=1` (default) includes the repository containing `project_root`; `=0` disables automatic Git membership, leaving member definitions as the only membership source. `ALLOWED` gates `AUTO`.
+
+**Rationale.** Workspace is the right scope unit and the containing Git repository is its ordinary development boundary. Membership curation is tiered: Git bounds it by tracking, the client supersedes by overlay, and the model curates its render by READ/KILL. Supporting several independent repositories as one world would require Plurnk-owned topology, synchronization, and model teaching that Git already solves cleanly by treating them as separate workspaces.
+
+**Schema.** The version-1 baseline stores the normalized {§inference-ledger},
+its model-response evidence, emission admission, and cardinal
+physical requests. Its constraints distinguish pending calls, response
+evidence, and response-less errors while monetary classification remains
+explicit.
+
+## §worker-loop-lifecycle Loop scheduling and lifecycle
+
+- §join-blocking-collect **Collection and scheduling are independent.** A path-absent ```` ```READ (worker://<running-child>) ```` returns **425** (Too Early), without a strike or scheduler side effect. TASK with waiting intent joins live obligations; an `in_progress` inventory keeps working. A child reaching any terminal status wakes a waiting parent with its result, including completion racing the park boundary. Children retain their own limits; TASK timing may additionally bound the parent's wait. Collection never arms an implicit disposition override.
+
+A worker is a **log plus a cancellation scope** — one `AbortController` per worker, reused while live and replaced only once aborted, so a cancel ends the worker as a unit and a later `runLoop` request is never born cancelled. A worker's queued loops are advanced by a **drain**: a single per-worker drain that claims loops atomically (status 100→102) and runs each under the worker's scope. A loop may spawn **streams** (execs) that outlive it; each is a row in the subscription registry ({§subscriptions}) — the durable record of what the worker holds open. Cancellation and conclusion are defined against these structures, never wall-clock timing.
+
+```mermaid
+stateDiagram-v2
+    [*] --> Queued: runLoop request
+    Queued --> Running: due task claimed by drain
+    Running --> Parked: wait with live obligations
+    Parked --> Queued: obligation settles or arrival
+    Running --> Terminal: conclude or fail
+    Parked --> Terminal: cancel
+    Queued --> Terminal: cancel
+    Terminal --> [*]
+```
+
+§worker-lifecycle-state-machine The lifecycle store admits only the guarded transitions shown above: `100 → 102`, `102 → 202`, `202 → 100`, and any unresolved state (`100`, `102`, `202`) to a terminal status. Terminal state is immutable. `DrainSupervisor` owns claim, wake, and cancellation; the dispatcher owns model-requested park/conclusion; the daemon owns boot-recovery orchestration; and the engine owns policy terminals. A racing transition that loses observes the durable winner; it does not overwrite it or report the requested state as fact.
+
+§worker-lifecycle-live **Worker liveness is existential, not latest-state.** A
+Worker is live while ANY of its loops is unresolved (`100`, `102`, or `202`). A
+newer terminal loop cannot mask older queued, running, or parked work. Name
+collision, workspace worker caps, child obligations, orientation, and recovery
+all use that one definition.
+
 ### §worker-scheduled-send Scheduled worker tasks
 
 A numeric scope on `SEND (worker://name)` queues a new task with the authored
@@ -954,7 +977,7 @@ stateDiagram-v2
 Polling observes a still-open stream; it never changes ownership or manufactures
 completion. Closure is always a wake edge regardless of polling mode.
 
-| §worker-lifecycle-poll-matrix EXEC poll marker | While open | On closure |
+| §worker-lifecycle-poll-matrix execution poll marker | While open | On closure |
 |------------------------------------------------|---|---|
 | omitted                                        | exponential-backoff observation wakes | resume once with terminal observation |
 | positive `P`                                   | fixed-cadence observation wakes every `P` minutes | cancel cadence; resume once |
@@ -962,7 +985,7 @@ completion. Closure is always a wake edge regardless of polling mode.
 | turn-scoped `<0>`                              | reap at the next pre-turn boundary | surface the terminal outcome |
 
 The structured-concurrency sequence is identical whether a child performs an
-EXEC, retrieval, or pure inference. Intermediate child status is private to the
+execution, retrieval, or pure inference. Intermediate child status is private to the
 child. Only the child's terminal loop result crosses the parent edge.
 
 ```mermaid
@@ -972,7 +995,7 @@ sequenceDiagram
     participant S as Child stream
     P->>C: WORK or FORK
     P->>P: TASK waiting parks on live child
-    C->>S: EXEC opens subscription
+    C->>S: execution opens subscription
     C->>C: TASK waiting parks on live stream
     loop backoff, fixed cadence, or explicit arrival
         S-->>C: optional progress observation
@@ -1011,49 +1034,194 @@ it is the parked lifecycle state, not a terminal. No product surface may infer o
 reconstruct a result from that projection. Active rows have no terminal result;
 terminal rows must have one, and database triggers enforce both directions.
 
-```mermaid
-flowchart TD
-    W[Worker cancellation] --> L[Terminalize unresolved loops]
-    W --> C[Cancel descendants]
-    W --> S[Enumerate durable open subscriptions]
-    S --> H[Invoke each live cancellation handle]
-    H --> T[Persist terminal channel and subscription state]
-    T --> N[Publish conclusion without resurrection]
-    C --> L
-```
+```mermaid
+flowchart TD
+    W[Worker cancellation] --> L[Terminalize unresolved loops]
+    W --> C[Cancel descendants]
+    W --> S[Enumerate durable open subscriptions]
+    S --> H[Invoke each live cancellation handle]
+    H --> T[Persist terminal channel and subscription state]
+    T --> N[Publish conclusion without resurrection]
+    C --> L
+```
+
+Restart applies the same ownership rule: accepted queued loops are reclaimable;
+in-flight provider calls and subscriptions belonged to the vanished process and
+become explicit failures. A park whose child remains live stays parked; a park
+whose obligations settled during reconciliation is requeued in place so it can
+observe their terminal results. No effect is replayed across an unknown
+boundary.
+
+- §worker-lifecycle-single-drain **One drain advances a worker.** At most one drain is registered for a worker at any instant: a `runLoop` request or wake on a worker with a live drain folds in (active→next-turn) or enqueues a loop that drain claims, never a second parallel drain. A drain's start and its empty-queue teardown relinquish the worker under one per-worker lock, so the teardown's re-claim cannot race a concurrent start into a double-drain. Fresh-loop sequence allocation and insertion are one mutation under that same lock; concurrent accepted prompts remain distinct ordered queue items.
+- §worker-lifecycle-total-reap **Cancellation is recursive and reaps every held stream.** `loop.cancel`, worker `KILL`, and a failed TASK terminalize every unresolved loop in the cancelled worker subtree and iterate each worker's durable open-subscription rows, invoking each exact callable owner from the process-local live registry. The durable rows answer *what is held*; the live registry answers *how this process tears it down*; the abort signal is a fast-path optimization. There is no implicit detachment. Shutdown reaps process-local streams while preserving parked work under {§worker-lifecycle-durable-disposition}. Before shutdown awaits drains, it cancels every process-local proposal waiter through {§proposal-cancel-aborts} with outcome `daemon_stopping`, so a stopped-world dispatch cannot hold teardown open. A stream that is running, mid-spawn (its row written before it is killable), or spawned after the cancel is reaped alike. The teardown abort is bounded: the executor sends a polite signal then SIGKILL after a consumer-set grace (`PLURNK_SERVICE_EXEC_KILL_GRACE_MS`). A model ```` ```KILL [code] ```` on one live stream instead delivers exactly that signal once (bare KILL uses the executor's SIGHUP default; ```` ```KILL [9] ```` uses SIGKILL).
+- §worker-lifecycle-exec-epoch-bound **A stream's kill binds to the scope it captured at spawn.** A stream captures the worker's cancellation scope as it registers and wires its kill to it, re-checking `aborted` AFTER wiring — no check-then-listen gap can drop an abort that lands mid-registration. Because the scope is replaced only once aborted, a captured-then-replaced scope is necessarily already aborted, so replacement never strands a live stream.
+- §worker-lifecycle-no-resurrection **Cancelled work does not revive its scope.** A cancelled worker cannot be woken by its torn-down streams, stale timers, or cancelled undelivered prompt frames. The evidence remains readable. A `499` result from cancelling only one stream is still a completion owed to a live waiting worker: result status is not proof of worker cancellation. Only an explicit new arrival admits new work after scope cancellation; terminal loops themselves remain immutable.
+- §worker-cancel-trigger **A cancellation is one bound statement.** `lifecycle_cancel_workers` writes the causal cutoff and the cancellation Problem onto every worker of the scope; `workers_cancel_live_loops` (an `INIT` process trigger beside the lifecycle statements, {§db-process-triggers}) retires each worker's live loops inside that statement — 499, waits cleared, the delivered response kept as the result's `content`, the Problem instanced `loop:///<id>`, `terminated_by = 'cancel'` — so cutoff and cancellation cannot land apart and no value is string-interpolated. Execution consumption is measured by the process-local monotonic timers ({§loop-execution-allowance}) and lands first through `lifecycle_checkpoint_executions`; a wall clock cannot stand in for it, so the timer stays outside the database by design.
+- §worker-causal-admission **Admission and cancellation have one ordering.** DrainSupervisor serializes message admission, prompt promotion, and subtree cancellation within the workspace, taking the worker queue lock inside that control boundary. No provider, tool, fork-history copying, or stream reap holds it. WORK, FORK, and directed SEND identify their originating loop; admission requires that task still running. An accepted message to an independent recipient is a committed effect, not retroactively withdrawn by cancelling its sender.
+
+  | Boundary outcome | Durable consequence |
+  |---|---|
+  | Admission before cancellation | Owned work is included in cancellation. |
+  | Recurring success during cancellation | Its successor is cancelled and reported from the durable cutoff, not a previously sampled task list. |
+  | Cancellation before admission | The cancelled task cannot deliver further messages or start children. Created identities and evidence are retained. |
+  | Cancellation with unread prompts on completed tasks | Atomically record each worker's greatest admitted loop sequence as `cancelled_through_sequence` and cancel unresolved tasks. Prompt promotion, including boot recovery, excludes sources at or below that cutoff; completed results and prompt evidence are unchanged. |
+  | Independent arrival after cancellation | Admit a new loop above the cutoff using the ordinary worker policy. |
+  | Slow stream teardown after new admission | Reap only subscription identities captured by cancellation; late old-scope spawns follow {§worker-lifecycle-exec-epoch-bound}. |
+
+- §worker-lifecycle-wake-liveness **A stream conclusion always reaches its worker.** The stream first persists its terminal state. A worker **blocked on a 202 wait** for that stream ({§wait-obligation-matrix}) then **awakens that loop in place** — the blocked loop *is* the continuation, so there is no fresh loop and no summary-as-prompt fiction. An already-active worker needs no injected prompt or second wake because its next packet reads the durable terminal state. A concluded worker receives no synthetic loop from ambient stream closure. The result remains available in the stream's own state under every case.
+- §worker-lifecycle-child-wake **Each child task completion notifies its parent.** Terminal-task publication, including failure and cancellation of a parked task, notifies the direct parent without injecting a prompt. Other unfinished tasks or streams in that child remain independent obligations; they cannot suppress notification. The parent's eligible waits requeue in place under {§loop-wake-identity} and the bounded {§worker-optimistic-settlement} opportunity. Durable revisioning covers completion-before-park and restart; drain teardown and whole-worker quiescence are not completion identities.
+- §worker-optimistic-settlement **Asynchronous settlement receives one bounded worker-local opportunity before model dispatch.** An initiating turn lets only the streams it started settle before its turn disposition; separately, a stream or direct-child conclusion persists and publishes immediately but holds eligible parked loops' `202→100` requeues while another stream or direct child remains live. Both use `PLURNK_SERVICE_OPTIMISTIC_WAIT_MS`, shipped at five seconds; zero disables the opportunity. The wake hold ends as soon as no sibling obligation remains, never extends its original deadline, and coalesces conclusions within that window into at most one requeue per eligible loop. With no sibling obligation the wake is immediate; at the deadline, surviving work follows the ordinary monitored lifecycle. A conclusion that lands after provider dispatch begins retains its next wake, while poll, park-deadline, prompt, and operator wakes never open this hold. Only packet/provider dispatch waits: terminal state, client events, cancellation, and child execution do not. One redaction-safe span records elapsed time, quiescence versus deadline, and conclusion count without entering the packet.
+- §worker-lifecycle-idle-is-concluded **No implicit completion.** A waiting inventory without a finite deadline, positive poll or live obligation continues under {§wait-obligation-matrix}. Only a terminal inventory with at least one completed task claims success. A concluded worker retains durable history; a later addressed arrival starts a new loop.
+- §worker-lifecycle-no-lost-loop **A loop is never stranded by a drain's exit.** A drain relinquishes its registry slot only after a lock-held re-claim confirms the queue is empty; a loop enqueued during that teardown is either re-claimed by the exiting drain or claimed by a fresh drain that a later inject starts. The relinquish and the start are serialized, so neither the lost-loop hang nor a transient double-drain can occur.
+- §worker-lifecycle-durable-disposition **Durable disposition wins cancellation races.** At a turn boundary, the engine reads the loop's durable status before interpreting a process-local abort. A committed `202` park survives a later daemon-shutdown signal; only a loop still durably running at `102` can be terminalized by that cancellation. Wake selection rechecks shutdown and worker cancellation before requeuing each parked loop.
+- §worker-lifecycle-restart-recovery **Restart is owner-loss reconciliation, not replay.** Before opening client transports, the service holds an exclusive database-adjacent daemon lock; a second live owner fails before touching SQLite, while a dead-PID crash claim is replaced atomically without a timeout lease. Boot preserves accepted `100` loops and restores their drains. A `102` loop belonged to a vanished drain/provider call, so it settles `500` with the interruption on its durable row—never replayed across an unknown effect boundary. Every pending physical provider request first settles as an error with absent usage and explicitly unknown cost; then its logical model call closes. Recovery never fabricates zero evidence. Every durable proposed operation likewise lost its process-local resolution waiter and settles as a visible `500 owner_vanished` occurrence rather than an unresolvable interrupt ({§proposal-list}). A pending client interaction also lost its exact awaiting operation, so boot removes the orphan instead of replaying work or inventing a response ({§client-interactions}). Every durable-open subscription belonged to a vanished callable: active channels become errored and its row closes `500`. A `202` continuation preserves its requested deadline and observation interval. An unseen completion requeues it; an untimed join whose obligations vanished also requeues. Otherwise a future timed wait remains parked and an expired due time wakes it through the same guarded scheduler. Child terminalization wakes its parked parent on every outcome, including provider exceptions, cancellation, and restart interruption, recursively through the durable parent edges. These operations are idempotent, so an interrupted recovery safely repeats.
+
+---
+
+### §turn-record Producer-neutral turn record
+
+A turn is the durable container for one producer's ordered operations. Packet
+and provider fields are optional evidence belonging only to model inference;
+their absence never makes a client, plugin, or `_plurnk` turn exceptional.
+
+| Field | Contract |
+|---|---|
+| `producer` | Required actor class: `model`, `client`, `plugin`, or `_plurnk`. |
+| `kind` | Required purpose: `inference`, `initialization`, `operation`, or `maintenance`. Model iff inference; initialization and maintenance require `_plurnk`. Producer and kind are immutable. A maintenance turn's successful rows are packet-suppressed — a receipt answers an asker, and maintenance has none ({§actor-boundary-doc-injection}). |
+| `status`, `completed_at` | A new turn is open at status 102 with `completed_at=NULL`. Completion records the exact turn disposition/operation disposition and timestamp; a completed 102 is therefore distinct from an open 102. |
+| Operations | Ordered by `(turn_id, sequence)` on one exact worker/loop/turn chain. Each row's `origin` is the turn producer or `_plurnk` making a system observation; the observation does not impersonate the producer. |
+| Program source | Every admitted source-backed turn preserves its exact program before dispatch in `turn_sources`, independently of log receipts, under {§turn-ops-entry}. |
+| Inference evidence | Model calls, `packet`, model, finish reason, and provider metadata belong only to model/inference turns. Turn fields are nullable until recorded and remain NULL for every other kind. |
+
+One lifecycle owner opens, optionally records inference evidence, and completes
+every turn. Initialization, maintenance, client dispatch, and model
+inference use that same path. `plugin` is the producer identity for
+plugin-authored operation turns; exposing that path must not introduce a
+parallel record or lifecycle. Producer and kind never change. Process-restart
+recovery completes any turn whose producer vanished.
+
+§turn-ops-admission-path **Source acquisition varies; admitted-turn execution does not.**
+A provider response, deterministic `_plurnk` program, or future client/plugin
+program crosses one admission boundary into the same executor. That executor
+parses once, dispatches the admitted statements in order, records their ordinary
+outcomes, and completes the turn from its TASK ruling. Exact source is retained before dispatch.
+Provider attempts, grammar recovery, reasoning, and accounting end before this
+shared seam. A programmatic operation batch that supplied no Plurnk source does
+not fabricate verbatim source.
+
+§turn-ops-selection-snapshot **An admitted program cannot select log rows it emits while executing.**
+Immediately before statement dispatch, the shared executor captures that worker's
+append-only log high-water mark. Every log-targeted KILL in the program resolves
+row membership at or below that same boundary, while prior curation effects still
+compose normally. Prompt and other pre-program rows already present in the turn
+remain selectable; preceding and later operation rows cannot be captured by
+their own program. A directly dispatched
+single operation captures the equivalent boundary before dispatch. This limits
+only log-row selection: operation phasing and same-turn resource effects retain
+their ordinary contracts.
+
+### §engine-rails Engine rails
+
+After each admitted turn, one inline verdict decides whether the loop continues.
+An admitted turn contributes at most one strike, even when several sources fire.
+These are the complete strike sources:
+
+| Strike source       | Exact trigger                                                                                                    | Model-visible occurrence                                      |
+|---------------------|------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------|
+| Hard result         | An admitted non-execution operation or bounded parse-error status is `>= 400`, except the soft set `404`, `409`, `416`, `425`, `501`. | The originating failure row.                                  |
+| Inventory steering  | Retired (2026-09-14): a completion claimed over live work joins it ({§completion-joins-live-work}) and one over settled results defers ({§completion-defers-to-results}); every answer to a TASK claim, an empty inventory's soft 409 included, is a receipt and never a strike; a malformed TASK (`400 wait-timing-invalid`) is a hard result like any other operation's. | The TASK receipt. |
+| Cycle               | The executed operations and their observed results repeat under {§engine-cycle-evidence}.                         | None; cycle detection itself is private engine accounting.    |
+
+Execution results remain exact model-visible evidence but are always soft: an
+executor error is not a PLURNK contract violation. Cycle detection remains an
+independent strike source.
+
+A `425` not-ready result describes unfinished work, not a contract violation.
+It retains its exact receipt, without scheduling side effects ({§join-blocking-collect});
+other violations in the same turn still strike normally.
+
+§engine-cycle-evidence Cycle identity contains the ordered executed operations
+and their dispatch results, including complete operands, scopes, bodies, and
+scheme metadata, including the complete TASK inventory and SEND bodies. Source
+positions and asides are excluded. Engine-assigned
+Problem `instance` addresses are excluded from results. Object member order is
+irrelevant; operation and array order are preserved. Only the configured
+`MIN_CYCLES × MAX_CYCLE_PERIOD` history window is retained. Repeated addresses
+alone are not a cycle: changing inputs or observations distinguish activity.
+This is an exact-repetition backstop, not a semantic judgment of task progress;
+new asynchronous invocation identities do not prove repetition of their eventual
+effects. Ordinary contract strikes and operator budgets remain independent.
+
+§provider-recovery **A recoverable provider failure never ends a loop.** When a model
+call fails with a network failure, rate limit, deadline, or interrupted resource after
+the provider's own retries, the turn records the exact Problem as a `_plurnk` row,
+notices the client (`engine:provider` / `provider_unavailable`), waits with
+exponential backoff (`PLURNK_SERVICE_PROVIDER_RECOVERY_BACKOFF`, doubling, capped at
+twelve times itself), and re-issues the same call against the exact frozen model
+messages whose response is still outstanding. Each reissue remains a distinct logical
+model call with complete physical-request accounting, but the active turn's newly
+recorded provider Problems do not recursively enter that request; they surface normally
+only in a later genuinely new packet. No emission attempt is consumed and no strike is
+scored. Every recovery checkpoint broadcasts live, while the model-facing Notice buffer
+retains only the current provider state; the next completed exchange notices
+`provider_recovered`. Recovery is bounded by `PLURNK_SERVICE_PROVIDER_RECOVERY`; when it
+is spent the turn completes as `202` and the loop parks exactly like a
+TASK wait ({§worker-lifecycle-wake-requeue-not-terminal}), resuming on the
+next prompt or wake with its log intact. Only a client cancel, the execution allowance
+({§operator-config-loop-timeout}), or a non-recoverable provider Problem (refusal,
+authorization, quota, an invalid response) settles a loop on a provider failure.
+
+**Contract Strikes** (operator mandate, 2026-09-01): *Every turn with one or
+more contract violations earns a strike. A turn without any contract violations
+clears the strikes. Three (not four) strikes and you're out, by default.*
+The streak counts consecutive violating turns; `MAX_STRIKES` (default 3) is the
+threshold, crossed ON the third strike; the crossing turn terminates at **508
+Loop Detected** when cycle-detected, otherwise **500**.
 
-Restart applies the same ownership rule: accepted queued loops are reclaimable;
-in-flight provider calls and subscriptions belonged to the vanished process and
-become explicit failures. A park whose child remains live stays parked; a park
-whose obligations settled during reconciliation is requeued in place so it can
-observe their terminal results. No effect is replayed across an unknown
-boundary.
+The contracts, and the violation of each that strikes:
 
-- §worker-lifecycle-single-drain **One drain advances a worker.** At most one drain is registered for a worker at any instant: a `runLoop` request or wake on a worker with a live drain folds in (active→next-turn) or enqueues a loop that drain claims, never a second parallel drain. A drain's start and its empty-queue teardown relinquish the worker under one per-worker lock, so the teardown's re-claim cannot race a concurrent start into a double-drain. Fresh-loop sequence allocation and insertion are one mutation under that same lock; concurrent accepted prompts remain distinct ordered queue items.
-- §worker-lifecycle-total-reap **Cancellation is recursive and reaps every held stream.** `loop.cancel`, worker `KILL`, and a failed TASK terminalize every unresolved loop in the cancelled worker subtree and iterate each worker's durable open-subscription rows, invoking each exact callable owner from the process-local live registry. The durable rows answer *what is held*; the live registry answers *how this process tears it down*; the abort signal is a fast-path optimization. There is no implicit detachment. Shutdown reaps process-local streams while preserving parked work under {§worker-lifecycle-durable-disposition}. Before shutdown awaits drains, it cancels every process-local proposal waiter through {§proposal-cancel-aborts} with outcome `daemon_stopping`, so a stopped-world dispatch cannot hold teardown open. A stream that is running, mid-spawn (its row written before it is killable), or spawned after the cancel is reaped alike. The teardown abort is bounded: the executor sends a polite signal then SIGKILL after a consumer-set grace (`PLURNK_SERVICE_EXEC_KILL_GRACE_MS`). A model ```` ```KILL [code] ```` on one live stream instead delivers exactly that signal once (bare KILL uses the executor's SIGHUP default; ```` ```KILL [9] ```` uses SIGKILL).
-- §worker-lifecycle-exec-epoch-bound **A stream's kill binds to the scope it captured at spawn.** A stream captures the worker's cancellation scope as it registers and wires its kill to it, re-checking `aborted` AFTER wiring — no check-then-listen gap can drop an abort that lands mid-registration. Because the scope is replaced only once aborted, a captured-then-replaced scope is necessarily already aborted, so replacement never strands a live stream.
-- §worker-lifecycle-no-resurrection **Cancelled work does not revive its scope.** A cancelled worker cannot be woken by its torn-down streams, stale timers, or cancelled undelivered prompt frames. The evidence remains readable. A `499` result from cancelling only one stream is still a completion owed to a live waiting worker: result status is not proof of worker cancellation. Only an explicit new arrival admits new work after scope cancellation; terminal loops themselves remain immutable.
-- §worker-cancel-trigger **A cancellation is one bound statement.** `lifecycle_cancel_workers` writes the causal cutoff and the cancellation Problem onto every worker of the scope; `workers_cancel_live_loops` (an `INIT` process trigger beside the lifecycle statements, {§db-process-triggers}) retires each worker's live loops inside that statement — 499, waits cleared, the delivered response kept as the result's `content`, the Problem instanced `loop:///<id>`, `terminated_by = 'cancel'` — so cutoff and cancellation cannot land apart and no value is string-interpolated. Execution consumption is measured by the process-local monotonic timers ({§loop-execution-allowance}) and lands first through `lifecycle_checkpoint_executions`; a wall clock cannot stand in for it, so the timer stays outside the database by design.
-- §worker-causal-admission **Admission and cancellation have one ordering.** DrainSupervisor serializes message admission, prompt promotion, and subtree cancellation within the workspace, taking the worker queue lock inside that control boundary. No provider, tool, fork-history copying, or stream reap holds it. WORK, FORK, and directed SEND identify their originating loop; admission requires that task still running. An accepted message to an independent recipient is a committed effect, not retroactively withdrawn by cancelling its sender.
+| Contract | Violation that strikes |
+|---|---|
+| operation contract | a hard operation failure (status ≥ 400) in an admitted turn — soft statuses below excluded |
+| review contract | none since 2026-09-14: a completion claimed over live work joins it ({§completion-joins-live-work}), one over settled results defers ({§completion-defers-to-results}), and an empty inventory or an already-terminal loop is a soft receipt |
+| progress contract | a detected operation cycle (`MIN_CYCLES` × period), or an admitted turn with no operation ({§empty-turn}) |
+| frame contract | emission attempts exhausted with no admissible turn |
+| provider response contract | the provider returned an invalid response |
 
-  | Boundary outcome | Durable consequence |
-  |---|---|
-  | Admission before cancellation | Owned work is included in cancellation. |
-  | Recurring success during cancellation | Its successor is cancelled and reported from the durable cutoff, not a previously sampled task list. |
-  | Cancellation before admission | The cancelled task cannot deliver further messages or start children. Created identities and evidence are retained. |
-  | Cancellation with unread prompts on completed tasks | Atomically record each worker's greatest admitted loop sequence as `cancelled_through_sequence` and cancel unresolved tasks. Prompt promotion, including boot recovery, excludes sources at or below that cutoff; completed results and prompt evidence are unchanged. |
-  | Independent arrival after cancellation | Admit a new loop above the cutoff using the ordinary worker policy. |
-  | Slow stream teardown after new admission | Reap only subscription identities captured by cancellation; late old-scope spawns follow {§worker-lifecycle-exec-epoch-bound}. |
+Errors and issues are NOT contract violations. Each keeps its own disposition
+and never strikes: exploration misses (404, 416) and unsupported capability
+(501) are how discovery works; raw 409 outcomes are soft (the review ruling is
+steer's alone); execution outcomes and `executor/*` problem rows are world evidence;
+provider weather (rate limit, network failure, deadline, interruption) recovers
+({§provider-recovery}); provider capacity has its own packet recovery and
+terminal ({§provider-capacity-failure}); request rejection
+({§provider-request-rejection}), authorization and quota failures
+terminate immediately (configuration, not behavior); rejected private emission
+attempts are forensic evidence beneath their turn ({§emission-admission}) —
+only their exhaustion surfaces, as one frame-contract violation. The
+independent turn ceiling terminates at **429** ({§loop-terminals}). The streak
+and cycle verdict are absent from model packets; only the concrete occurrences
+in the table are shown. The current streak may ride first-party provider
+metadata ({§strikes-first-party-metadata}), which does not make it
+model-facing.
 
-- §worker-lifecycle-wake-liveness **A stream conclusion always reaches its worker.** The stream first persists its terminal state. A worker **blocked on a 202 wait** for that stream ({§wait-obligation-matrix}) then **awakens that loop in place** — the blocked loop *is* the continuation, so there is no fresh loop and no summary-as-prompt fiction. An already-active worker needs no injected prompt or second wake because its next packet reads the durable terminal state. A concluded worker receives no synthetic loop from ambient stream closure. The result remains available in the stream's own state under every case.
-- §worker-lifecycle-child-wake **Each child task completion notifies its parent.** Terminal-task publication, including failure and cancellation of a parked task, notifies the direct parent without injecting a prompt. Other unfinished tasks or streams in that child remain independent obligations; they cannot suppress notification. The parent's eligible waits requeue in place under {§loop-wake-identity} and the bounded {§worker-optimistic-settlement} opportunity. Durable revisioning covers completion-before-park and restart; drain teardown and whole-worker quiescence are not completion identities.
-- §worker-optimistic-settlement **Asynchronous settlement receives one bounded worker-local opportunity before model dispatch.** An initiating turn lets only the streams it started settle before its turn disposition; separately, a stream or direct-child conclusion persists and publishes immediately but holds eligible parked loops' `202→100` requeues while another stream or direct child remains live. Both use `PLURNK_SERVICE_OPTIMISTIC_WAIT_MS`, shipped at five seconds; zero disables the opportunity. The wake hold ends as soon as no sibling obligation remains, never extends its original deadline, and coalesces conclusions within that window into at most one requeue per eligible loop. With no sibling obligation the wake is immediate; at the deadline, surviving work follows the ordinary monitored lifecycle. A conclusion that lands after provider dispatch begins retains its next wake, while poll, park-deadline, prompt, and operator wakes never open this hold. Only packet/provider dispatch waits: terminal state, client events, cancellation, and child execution do not. One redaction-safe span records elapsed time, quiescence versus deadline, and conclusion count without entering the packet.
-- §worker-lifecycle-idle-is-concluded **No implicit completion.** A waiting inventory without a finite deadline, positive poll or live obligation continues under {§wait-obligation-matrix}. Only a terminal inventory with at least one completed task claims success. A concluded worker retains durable history; a later addressed arrival starts a new loop.
-- §worker-lifecycle-no-lost-loop **A loop is never stranded by a drain's exit.** A drain relinquishes its registry slot only after a lock-held re-claim confirms the queue is empty; a loop enqueued during that teardown is either re-claimed by the exiting drain or claimed by a fresh drain that a later inject starts. The relinquish and the start are serialized, so neither the lost-loop hang nor a transient double-drain can occur.
-- §worker-lifecycle-durable-disposition **Durable disposition wins cancellation races.** At a turn boundary, the engine reads the loop's durable status before interpreting a process-local abort. A committed `202` park survives a later daemon-shutdown signal; only a loop still durably running at `102` can be terminalized by that cancellation. Wake selection rechecks shutdown and worker cancellation before requeuing each parked loop.
-- §worker-lifecycle-restart-recovery **Restart is owner-loss reconciliation, not replay.** Before opening client transports, the service holds an exclusive database-adjacent daemon lock; a second live owner fails before touching SQLite, while a dead-PID crash claim is replaced atomically without a timeout lease. Boot preserves accepted `100` loops and restores their drains. A `102` loop belonged to a vanished drain/provider call, so it settles `500` with the interruption on its durable row—never replayed across an unknown effect boundary. Every pending physical provider request first settles as an error with absent usage and explicitly unknown cost; then its logical model call closes. Recovery never fabricates zero evidence. Every durable proposed operation likewise lost its process-local resolution waiter and settles as a visible `500 owner_vanished` occurrence rather than an unresolvable interrupt ({§proposal-list}). A pending client interaction also lost its exact awaiting operation, so boot removes the orphan instead of replaying work or inventing a response ({§client-interactions}). Every durable-open subscription belonged to a vanished callable: active channels become errored and its row closes `500`. A `202` continuation preserves its requested deadline and observation interval. An unseen completion requeues it; an untimed join whose obligations vanished also requeues. Otherwise a future timed wait remains parked and an expired due time wakes it through the same guarded scheduler. Child terminalization wakes its parked parent on every outcome, including provider exceptions, cancellation, and restart interruption, recursively through the durable parent edges. These operations are idempotent, so an interrupted recovery safely repeats.
+§loop-rail-continuity Rail state belongs to the durable loop, not its execution
+segment. The strike streak and bounded cycle history survive driver cleanup and
+restart; curation of log evidence cannot alter them.
 
----
+| Boundary | Strike streak | Cycle history |
+|---|---|---|
+| Assessed turn with a violation | Increment once. | Include its exact activity. |
+| Clean assessed turn | Reset to zero. | Include its exact activity. |
+| Actual park, including an immediate wake/reclaim in the same drain | Preserve the assessed streak. | Close the window; the next turn starts a new one. |
+| Recoverable provider outage | No assessment; preserve the streak. | Preserve until an actual park. |
+| New loop | Start at zero. | Start empty. |
+
+The turn belongs to the wait revision under which it began. A rejected waiting TASK or
+one resolved without parking does not close a window. Periodic observations
+separated by actual waits are not an uninterrupted cycle; cumulative turn and
+execution allowances remain independent bounds. A committed terminal result
+cannot be replaced by a later rail assessment ({§worker-lifecycle-state-machine}).
 
 ## §provider Provider Contract
 
@@ -1069,7 +1237,7 @@ Three current entry points:
 
 §provider-surface-identity Provider capacity and identity are immutable for one instance. `contextWindow`, `maxInputTokens`, and `maxOutputTokens` carry known model limits; `outputBudget` is the total generation envelope, optional `reasoningBudget` is its strict subset, and `inputCapacity` is the stable intersection of known input constraints ({§tokenomics}). Unknown facts remain `null`. `model` identifies persisted turn/provider evidence. Local GBNF admission also consumes `constrainsOutput` ({§grammar-configuration-admission}).
 
-§inference-ledger **Logical inference is provider-neutral and physical requests have one ledger.** Every `inference_calls` identity belongs to a workspace and a model/inference turn, records its ordered kind and request model, and has a forward-only lifecycle. Its `model_calls` specialization owns normalized response/failure and capacity evidence. Only an `emission` has `turn_attempts` admission evidence; `bare` calls retain independent results. Every physical request is an ordered `provider_requests` child opened before I/O and settled once. Calls contribute to turn, loop, worker, and workspace accounting; only an emission supplies the latest context gauge.
+§inference-ledger **Logical inference is provider-neutral and physical requests have one ledger.** Every `inference_calls` identity belongs to a workspace and a model/inference turn, records its ordered kind and request model, and has a forward-only lifecycle. Its `model_calls` specialization owns normalized failure and capacity evidence; the response body is `model_call_responses`, present or retired under {§retention-policy}; one observation view records evidence, body and close together, and a settled call refuses a second observation. Only an `emission` has `turn_attempts` admission evidence; `bare` calls retain independent results. Every physical request is an ordered `provider_requests` child opened before I/O and settled once. Calls contribute to turn, loop, worker, and workspace accounting; only an emission supplies the latest context gauge.
 
 §meta-passthrough **Metadata passthrough (provider → client).** `generate` may return an open `meta: Record<string, unknown>` bag. The service stores it unenforced per turn (`turns.meta`, `json_valid` only — no schema) and forwards the latest turn's blob in `loop/terminated.usage` ({§notifications}). The service never reads a field within it. Providers own their metadata shapes; monetary values carry an explicit amount and currency rather than an implied unit. Absent → `{}`. The mirror direction (client → provider, the self-identified `client` id) rides `generate({client})` ({§attribution}).
 
@@ -1365,9 +1533,9 @@ Registration precedes loop affinity:
 | Provider | Exactly the loop's WORK/FORK child provider; durable inherit policy falls back to the parent. |
 | Execution | A contiguous group's prompt acquisition precedes model-call creation; interrupted acquisition leaves no unstarted inference records. Admitted calls acquire identities in authored order and launch concurrently under the loop cancellation signal. Core awaits the group and records results and notifications in authored order, regardless of completion order. An intervening operation is an execution boundary. |
 | Failure | A source/admission/provider failure affects its own operation, not successful siblings. Accounting or persistence failure is internal and fails hard. |
-| Observation | Responses are unseen retrieval work: submit an unfinished TASK inventory; same-turn completion is refused until the next packet presents them. |
+| Observation | Responses are unseen retrieval work; completion follows {§send-premature-terminate}. |
 
-- §op-synchronous **Decisive operations settle before the next operation.** The dispatcher awaits each operation and its proposal resolution. Work remains in flight only when the operation's contract deliberately creates concurrency: FORK, WORK, stream-producing EXEC, and streaming READ after acquisition. Such a READ first establishes its durable subscription and returns `102`; a later operation may address that live owner. Dispatching EXEC before KILL does not wait for the process to finish using a resource. KILL of a worker synchronously ends its live loops before disposition checks the pending set; physical scope cleanup remains asynchronous.
+- §op-synchronous **Decisive operations settle before the next operation.** The dispatcher awaits each operation and its proposal resolution. Work remains in flight only when the operation's contract deliberately creates concurrency: FORK, WORK, a stream-producing execution, and streaming READ after acquisition. Such a READ first establishes its durable subscription and returns `102`; a later operation may address that live owner. Dispatching an execution before KILL does not wait for the process to finish using a resource. KILL of a worker synchronously ends its live loops before disposition checks the pending set; physical scope cleanup remains asynchronous.
 - §edit-execution **One authored EDIT is one mutation.** Each EDIT resolves against current resource state when dispatch reaches it, owns its proposal when gated, and records its own resulting revision. No later EDIT is prepared or applied in advance. Numeric scopes address current coordinates; an earlier EDIT may change what those numbers select. Rejection applies only to that operation, not its successful siblings.
 - §edit-anchor-continuity **Own EDITs preserve untouched hash targets within one program.** Core carries an anchor through exact, successfully applied EDIT splices when its line survives unchanged, even if its ordinal or neighborhood changes. Scoped entry KILL uses the same deletion path. Target-line replacement or deletion invalidates that binding. Continuity is private to the admitted program and canonical resource/channel; it is not a new published anchor format. The complete normalized line content must match the expected result of the preceding recorded EDIT, otherwise retained bindings are discarded and ordinary current-state validation applies. Reviewer replacement and results without an applied EDIT receipt do not carry bindings forward. Normalization is the same line-content representation used by READ and line hashing; file-write revision checks remain independent. No approximate text matching is used. Lowered coordinates retain a current-anchor precondition at the mutation owner; ambiguous matches and concurrent changes remain collisions.
 - §edit-batch **One compound operation may require atomic splices.** The scheme's `editBatch` primitive validates all supplied numeric edits against one snapshot and commits one revision or none. Core supplies one statement for an authored EDIT; same-resource MOVE can supply multiple splices as one operation. This primitive does not group separate authored operations. Its replacement, insertion, conflict, and receipt rules remain owned by the shared Slicer.
@@ -1376,29 +1544,11 @@ Registration precedes loop affinity:
 
 ### §orchestration Cross-scheme orchestration
 
-COPY and MOVE independently resolve a source and destination resource
-selection. Each selection contains one scheme resource, one channel (URI
-fragment or scheme default), and an optional text scope.
-
-```mermaid
-flowchart LR
-    A[resolve source selection] --> B[read selected source channel]
-    B --> C[apply optional source text scope]
-    C --> D[resolve destination selection]
-    D --> E{destination scoped?}
-    E -->|yes| F[destination editBatch]
-    E -->|no| G[write selected destination channel]
-    F --> H{MOVE?}
-    G --> H
-    H -->|no| I[complete COPY]
-    H -->|yes| J[remove selected source region or channel]
-```
-
-The same orchestrator covers same- and cross-scheme resources. A same-channel
-regional MOVE lowers both replacements into one `editBatch` against one source
-snapshot. Cross-resource MOVE is ordered destination-then-source and cannot be
-globally atomic; if source removal fails after destination success, its Problem
-Details state `destinationWritten: true` and identify the destination.
+Core owns same- and cross-scheme transfers under {§copy} and {§move}; handlers
+provide the underlying resource operations. Each operand independently selects
+a resource, channel, and optional text scope ({§transfer-resource-selections}).
+Source acquisition follows {§universal-read-composition}; landed mutation
+effects follow {§edit-result-copy-move-effects}.
 
 ### §send-dispatch SEND dispatch (a message to a recipient)
 
@@ -1407,60 +1557,17 @@ A recipient SEND (non-null path — {§turn-disposition}) routes to the scheme's
 message, a worker's next prompt. TASK never reaches a scheme: it controls the
 turn ({§send}). Cancelling a stream and deleting an entry are KILL ({§stream}, {§move}).
 
-- §log-uniform-query **Log speaks the universal query contract** — ```` ```FIND (log://…) ```` works like every scheme's FIND. Candidates are worker rows scoped by the coordinate hierarchy ({§log-coordinate-hierarchy}) and projected exactly as READ shows them. Content dialects use `Matcher.matchCandidates`; `~` full-text and `&graph` use the same persistent derivation artifacts and candidate rankers as entries. Broad results are one-channel catalog groups whose `[0].path` is `log:///loop/turn/seq/OP`; exact matcher results are flat locations ({§find-result-projection}). Log remains the core event ledger rather than duplicating rows into `entries`; its core-private storage adapter supplies one complete channel representation to the same READ projector. That adapter is not a plugin seam and grants no protocol scheme an alternate READ path.
-- §find-source-agnostic **The content matcher is source-agnostic** — `Matcher.matchCandidates(body, candidates, mimetypes)` applies a content matcher (regex/jsonpath/xpath/glob) to candidates from ANY source, keyed by the caller's own identity (a pathname for entries, a `loop/turn/seq` coordinate for log). The matcher never cares what table the content came from, so FIND works uniformly across schemes by construction: `EntryFind` and `Log.find` run the one shared primitive rather than re-implementing it per scheme. Log stays its own event stream, but its rows are candidates the shared matcher covers like any entry's content.
-- §find-candidate-containment **One candidate's crash is that candidate's problem** — arbitrary member content can crash a mimetype handler mid-match (an unbalanced template partial crashed Readability and killed a 1,916-file FIND as a blank 500, #449). `Matcher.matchCandidates` contains a per-candidate handler throw: the candidate drops out exactly like unsupported content, the cause goes to daemon stderr, and only a FIND whose every candidate crashed reports a 415 whose Problem names the first crashing member and handler. The operation's other candidates always answer.
-- §readable-channel **A readable projection is a channel, never a hidden matching surface.**
-  When an entry's source channel lands — an EDIT that creates or changes it, a COPY or MOVE
-  landing, a member materialized from disk — and its mimetype handler owns a readable
-  projection that differs from the source ({§mimetype-content}), that projection lands beside
-  it as the `readable` channel, `text/markdown`, in its own line coordinates; a source without
-  a projection keeps no sibling, and a source channel's deletion takes the sibling with it. A
-  scheme that supplies `readable` in its own write owns it — a fetched page's curated Markdown
-  arrives with its producer outcome ({§html-materialization} in the http scheme) — and core
-  derives the sibling only for a write that supplies none.
-  Worker and file entries declare `readable`. Every operation addresses the channel it names
-  and matches in that channel's own text ({§mimetype-content-query}): a regex or glob on
-  `page.html` sees the markup and reports the markup's lines, on `page.html#readable` it sees
-  the Markdown and reports the Markdown's lines; FIND lists both channels per path
-  ({§channel-selection-visibility}) and full-text search indexes each. The projection is
-  derived, so no operation writes it: EDIT of `#readable`, a COPY or MOVE landing on it, and a
-  MOVE out of it are 400 `channel-derived`; COPY from it is an ordinary read. Binary sources
-  keep {§membership-source-projection}, where the source is not text and the projection is the
-  body; a fetched web page keeps its scheme's own two channels ({§html-materialization}).
-- §channel-selection-visibility **Channel selection is decision-time information, not a guess** — every multi-channel resource presents its channels with extents wherever FIND presents the resource: broad results list each channel's path, projection `mimetype`, tokens, and lines (default channel first), and matcher locations name the channel their line coordinates address. A READ of a multi-channel resource names its other channels with their tokens in `channels`, keyed by the fragment the model appends (`{"#readable": 812}`), so first contact — a fetched page, a stream's stdout — carries the same choice without a listing; a single-channel resource names none. When the default channel is a readable projection of a differently typed source, it also names `sourceMimetype` once; this is representation evidence, not a different READ workflow. The packet never presents channels as equal and indistinguishable; extents derive from the stored channels by construction. Budget enforcement stays with {§context-output-admission} — this is information, not a second guard.
-
-- §matcher-selection-signal **Matching carries navigation evidence** - a matcher is a boolean resource predicate. Internally, each selected resource carries `matches: MatchEvidence[]`, where `MatchEvidence` is `{channel?,locator?,region?}`; `channel` names the entry channel the finding was located in and is absent for channel-less resources such as log rows, so line coordinates cannot be mis-attributed across channels of the same resource ({§channel-selection-visibility}). `locator` preserves a structural address without overloading the resource row's `path`; `region` is a complete four-coordinate `TextRegion` only when the finding maps honestly into the exact text the model can READ. Exact duplicate evidence deduplicates. Relation findings map their indexed source spans through the same readable text coordinate index. FIND alone decides whether that grouped selection projects as resource rows or flat locations ({§find-result-projection}); the engine never fabricates a region or guesses which surgical READ the model wants.
-
 §send-dispatch-entry-schemes-501 An entry-bearing scheme carries no messages: a recipient SEND aimed at one returns 501.
 
 Null-path SEND is broadcast ({§send}), engine-handled.
 
 ### §scheme-surface Consumption surface
 
-Per-call context (`src/core/scheme-types.ts`):
-
-```ts
-interface PlurnkSchemeContext {
-    readonly db: Db;
-    readonly workspaceId: number;
-    readonly workerId: number;
-    readonly loopId: number;
-    readonly turnId: number;
-    readonly writer: "model" | "client" | "_plurnk" | "plugin"; // WriterTier
-    readonly signal: AbortSignal | undefined;
-    readonly streamEventNotify?: StreamEventNotify;
-    readonly wakeWorkerNotify?: WakeWorkerNotify;
-    readonly injectWorker?: InjectWorkerNotify;            // worker:// spawn/fork/irc loop-start (§worker-scheme)
-    readonly mimetypes?: Mimetypes;
-    readonly executors?: ExecutorRegistry;           // boot-discovered EXEC runtimes (§exec)
-    readonly tokenize?: (text: string) => number;    // write-time tokenizer (§tokenomics)
-    readonly defaultChannelFor?: (scheme: string) => string;
-    readonly pushNotice?: (notice: Notice) => void; // → next packet Notices + notice/event (§operation-results)
-}
-```
-
-The optional engine-/daemon-populated capabilities (the notifiers, `injectWorker`, `executors`, `tokenize`, `defaultChannelFor`, `pushNotice`) are absent in bare test fixtures; a handler that needs one **fail-hards** rather than silently degrading (no default runtime, no silent zero-token write).
+Every public handler receives `SchemeCtx` under {§capability-ctx} and
+{§scheme-ctx-lifetime}. Core's private `PlurnkSchemeContext`
+([`scheme-types.ts`](src/core/scheme-types.ts)) is not an extension API; core
+projects it into those public capabilities before invocation. Bundled adapters
+receive any additional daemon collaborators separately, under the same contract.
 
 Engine → scheme guarantees:
 
@@ -1503,14 +1610,6 @@ Author-facing contract: [`@plurnk/plurnk-mimetypes`](../plurnk-mimetypes/SPEC.md
 
 §mimetype-schemes-do-not-invoke-handlers **Firing semantics.** Scheme writes are verbatim: the source channel lands exactly as authored, and the one handler call a write makes is the readable projection that lands beside it as `readable` ({§readable-channel}); no write invokes a handler's query or structural projections. `SearchIndex.maintain` processes the current readable projections before model execution and attaches complete search artifacts. Catalog rendering independently asks handlers for extents. Fetch-time materialization is earlier still: the web-fetch sink converts guarded HTTP HTML or supported binary input into derived Unicode that READ serves and search indexes, retaining faithful DOM and origin/projection evidence only in explicit auxiliary channels. An authored workspace HTML file remains verbatim; its markup is data, and its Markdown rides beside it as `#readable`.
 
-### §mimetype-manifest Manifest
-
-Per the author contract, a package declares `kind: "mimetype"` and one or more
-handler entries with a name plus optional glyph and extensions. Discovery
-injects that metadata into one handler instance per declared mimetype.
-Discovery order and collisions follow {§mimetype-discovery}; resolution
-failures follow {§mimetype-error-policy}.
-
 ### §mimetype-methods Methods
 
 The author contract is owned by plurnk-mimetypes. Core and its sibling adapters
@@ -1529,26 +1628,11 @@ dialects pass to `Mimetypes.query` without reclassification. Mimetype handlers
 own content-to-structure interpretation. Core owns candidate-set composition
 and the persistent full-text/graph relation indexes.
 
-Cross-cutting promises service relies on:
-
-- Storage writes do not implicitly project; query, indexing, and presentation
-  invoke the exact public surface they need.
-- Handler projections are deterministic for a given `(content, mimetype, projection identity)` tuple.
-- Validation errors propagate (fail-hard).
-- Degraded projection (a `grammarMissing` marker) rather than throw when a grammar is absent.
-
-### §handler-bounds What handlers do NOT do
-
-- **Tokenization** — outside the mimetype projection pipeline; core owns packet and stored-weight accounting ({§tokenomics-agnostic-ruler}).
-- **Storage** — handlers receive content values and own no entry persistence.
-- **Streaming** — handlers see whatever content is current; subscription registry lives between schemes and {§stream}.
-
-### §handler-bundling Bundled vs sibling handlers
-
-No format handler ships inside `@plurnk/plurnk-service`; the framework and
-format handlers are sibling workspaces and independently published packages.
-The service manifest, not the framework manifest, owns the dependency edges
-that compose the default install ({§bundled-set}).
+Handler authority, discovery, projection identity, and failures follow
+{§mimetype-handler-authority}, {§mimetype-discovery},
+{§mimetype-projection-identity}, and {§mimetype-error-policy}. Core owns
+persistence, packet accounting ({§tokenomics-agnostic-ruler}), and subscriptions
+({§subscriptions}); handlers do not.
 
 ### §mimetype-surface Consumption surface
 
@@ -1573,12 +1657,6 @@ internal contract failure, never a reason to substitute the pure heuristic.
 | READ/EDIT and COPY/MOVE scope | Admit text regions or return 415.                                         |
 | Search derivation             | Build graph/FTS artifacts or mark unsearchable.                     |
 
-The default service installation includes its structured, document and image
-handlers and all registered tree-sitter grammar leaves through the service
-manifest. Exact tokenizer vocabularies and third-party handlers remain independently
-installable and resolve from the same consumer-visible package graph under
-trust-gated discovery ({§mimetype-discovery}).
-
 **Token accounting.** The daemon injects no tokenizer into `Mimetypes`; content
 projection is independent of packet budgeting. Core uses the stable
 model-independent ruler for stored/catalog weights and the model-facing curation budget
@@ -1586,7 +1664,11 @@ model-independent ruler for stored/catalog weights and the model-facing curation
 confined to provider-owned physical capacity assessment
 ({§tokenomics-context-envelope-admission}).
 
-§persistent-search-index **Persistent search index.** `SearchIndex.maintain` is the pre-model engine pass. Every addressable entry channel supplies the exact readable representation its READ exposes; `LogBody` resolves each log row's canonical full body from its durable tx/rx envelope. Acquisition schemes project remote source material before storing addressable channels; search never introduces a second hidden text projection. The channel content, mimetype, resolved text/binary classification, mimetype projection identity, and applicable search exclusion form a content hash. Complete artifacts own FTS, symbol definitions, and references; each `entry_channels` row or log row holds only its own attachment hash. Binary, empty, and excluded derivations do not invoke handler projections and therefore use one fixed no-projection identity.
+**Conformance.** Mimetype-specific behavioral tests live in each handler's own surface. plurnk-service intg covers integration: the engine routes through `Mimetypes.process` with the right hint and the catalog reflects `totalLines`; tests use auto-discovery (production handler set); a custom-handler test injects a stub `BaseHandler` via `loader + discovery`.
+
+## §persistent-search-index Search indexing
+
+`SearchIndex.maintain` is the pre-model engine pass. Every addressable entry channel supplies the exact readable representation its READ exposes; `LogBody` resolves each log row's canonical full body from its durable tx/rx envelope. Acquisition schemes project remote source material before storing addressable channels; search never introduces a second hidden text projection. The channel content, mimetype, resolved text/binary classification, mimetype projection identity, and applicable search exclusion form a content hash. Complete artifacts own FTS, symbol definitions, and references; each `entry_channels` row or log row holds only its own attachment hash. Binary, empty, and excluded derivations do not invoke handler projections and therefore use one fixed no-projection identity.
 
 §search-exclusion **File-search eligibility is Core policy.**
 `PLURNK_SERVICE_SEARCH_EXCLUDE` is a comma-separated table of anchored
@@ -1628,8 +1710,6 @@ rescan. Progress exposes `preparing`, `indexing`, `complete`, or `failed` throug
 `search_progress` Notices. Producer concurrency and heartbeat interval are
 operator knobs in `.env.defaults`. Search indexing performs no inference.
 
-**Conformance.** Mimetype-specific behavioral tests live in each handler's own surface. plurnk-service intg covers integration: the engine routes through `Mimetypes.process` with the right hint and the catalog reflects `totalLines`; tests use auto-discovery (production handler set); a custom-handler test injects a stub `BaseHandler` via `loader + discovery`.
-
 ---
 
 ## §channels Channel Topology
@@ -1668,7 +1748,7 @@ Rules:
 2. §channel-selection-fragment-selects-named-channel Paths with a fragment target the named channel.
 3. §channel-selection-missing READ, FIND, EDIT, COPY, and MOVE report unknown channel selections as `404 channel-not-found`. READ and transfer source selection also report 404 when a declared channel is absent on the entry; this does not prohibit creating a permitted destination channel. These Problems name `requestedChannel` and `availableChannels`: existing exposed channels when a representation was read, otherwise the scheme's declared names, including its default. A channel miss is a discovery miss under {§engine-rails}, not malformed syntax. Object prototype properties are not channels. The error never invents another intended resource or claims the containing entry is absent.
 4. Schemes without `defaultChannel` reject fragment-less EDIT/READ.
-   - §log-channel-miss-names-stream A channel READ on a log EXEC item is such a miss, and the receipt resolves it: the item's recorded stream link (`attrs.stream`, `<runtime>:///<loop>/<turn>/<item>/<runtime>`) rides as representation data, so the 404 names `<stream>#<channel>` in its detail and `recovery` and carries it as `stream`. The log item and the stream share their coordinate, which is exactly why the model conflates them (#502).
+   - §log-channel-miss-names-stream A channel READ on a log execution item is such a miss, and the receipt resolves it: the item's recorded stream link (`attrs.stream`, `<runtime>:///<claim>` per {§execution-output-identity}) rides as representation data, so the 404 names `<stream>#<channel>` in its detail and `recovery` and carries it as `stream`. The log item's coordinate and the stream's claim address name the same execution, which is exactly why the model conflates them (#502).
 5. §channel-selection-fragment-on-nonexistent-404 Non-default channel EDIT requires entry to exist (404 if absent); default-channel EDIT creates.
 | URI                                  | Channel                              |
 | ------------------------------------ | ------------------------------------ |
@@ -1687,6 +1767,26 @@ Client-interface target parameters carry fragments inline (`{ target: "sh:///1/1
 
 **Wire rendering: default channel is path-only.** A rendered target omits `#channel` when channel matches `defaultChannel`. Single-channel entries render path-only; multi-channel entries render the default path-only and only non-default carries `#name`.
 
+- §readable-channel **A readable projection is a channel, never a hidden matching surface.**
+  When an entry's source channel lands — an EDIT that creates or changes it, a COPY or MOVE
+  landing, a member materialized from disk — and its mimetype handler owns a readable
+  projection that differs from the source ({§mimetype-content}), that projection lands beside
+  it as the `readable` channel, `text/markdown`, in its own line coordinates; a source without
+  a projection keeps no sibling, and a source channel's deletion takes the sibling with it. A
+  scheme that supplies `readable` in its own write owns it — a fetched page's curated Markdown
+  arrives with its producer outcome ({§html-materialization} in the http scheme) — and core
+  derives the sibling only for a write that supplies none.
+  Worker and file entries declare `readable`. Every operation addresses the channel it names
+  and matches in that channel's own text ({§mimetype-content-query}): a regex or glob on
+  `page.html` sees the markup and reports the markup's lines, on `page.html#readable` it sees
+  the Markdown and reports the Markdown's lines; FIND lists both channels per path
+  ({§channel-selection-visibility}) and full-text search indexes each. The projection is
+  derived, so no operation writes it: EDIT of `#readable`, a COPY or MOVE landing on it, and a
+  MOVE out of it are 400 `channel-derived`; COPY from it is an ordinary read. Binary sources
+  keep {§membership-source-projection}, where the source is not text and the projection is the
+  body; a fetched web page keeps its scheme's own two channels ({§html-materialization}).
+- §channel-selection-visibility **Channel selection is decision-time information, not a guess** — every multi-channel resource presents its channels with extents wherever FIND presents the resource: broad results list each channel's path, projection `mimetype`, tokens, and lines (default channel first), and matcher locations name the channel their line coordinates address. A READ of a multi-channel resource names its other channels with their tokens in `channels`, keyed by the fragment the model appends (`{"#readable": 812}`), so first contact — a fetched page, a stream's stdout — carries the same choice without a listing; a single-channel resource names none. When the default channel is a readable projection of a differently typed source, it also names `sourceMimetype` once; this is representation evidence, not a different READ workflow. The packet never presents channels as equal and indistinguishable; extents derive from the stored channels by construction. Budget enforcement stays with {§context-output-admission} — this is information, not a second guard.
+
 ### §channel-state Channel state — metadata, not gating
 
 §channel-state-state-is-metadata Each channel has `state ∈ {static, active, closed, errored}`. Metadata only, not an engine gate.
@@ -1870,6 +1970,9 @@ READ is the one fan-out core performs ({§read-fan-out}).
   scope, matcher and aside ({§read-selection-projection}, {§read-pattern}), one
   receipt row per path in the FIND's order, so every rendered line keeps its path,
   physical ordinal and anchor and remains a coordinate source for EDIT and KILL.
+  Each such row carries `attrs.fanout` (`target`, the authored glob; `matched`, the
+  survey's matching path count; `index`; `count`), so a client presents the authored
+  statement once and folds the paths beneath it without inferring the group.
   Without a scope each path renders its ordinary `<1,16>` preview; with a pattern
   only the matching lines, `grep -n` style. The authored statement contributes
   `rowsWritten`, the receipt count, to its turn's sequence. No path is one 204
@@ -1888,7 +1991,7 @@ READ is the one fan-out core performs ({§read-fan-out}).
   anchors do not exist there (400). Bytes are read from the source at READ time, sized
   then windowed, never stored: `file:` supplies them from the member on disk, and a
   scheme that keeps no bytes answers 501 `bytes-unavailable` for `#bytes` and 415 for a
-  binary channel, as before. An EXEC whose target is a file member already runs the
+  binary channel, as before. An execution whose target is a file member already runs the
   bytes on disk. Byte selection affects only this hexadecimal projection: when the
   resource also qualifies for a native attachment, a successful ranged byte READ carries
   the complete source attachment independently under {§packet-attachment-parts}.
@@ -2096,7 +2199,7 @@ ordinary bounded bodies expose their displayed and complete chunk extents there.
 
 §rejected-emission-entry A rejected provider response is not `turnOps`: it never became an admitted turn program. The one bounded invalid-emission recovery item under {§emission-admission} has `attrs.kind="emissionAttempt"`, `origin="model"`, the canonical model-facing `/attempt` leaf, and the exact latest rejected response. The packet does not duplicate that identity as `kind` metadata. It is born durably body-suppressed and projected visibly only in the informed recovery packet; every other rejected attempt remains forensic-only.
 
-- §log-coordinate-hierarchy **Log coordinates are a hierarchical prefix; the trailing slash is optional** — a coordinate is `loop/turn/sequence`, and a PARTIAL coordinate selects its descendants: `log:///1` = loop 1's rows, `log:///1/2` = turn 1/2's rows, `log:///1/2/3` = the one row. A full coordinate is always three parts, so a one- or two-part path is unambiguously a prefix — the trailing slash is an optional alias (`log:///1/2` ≡ `log:///1/2/`), uniform with ```` ```READ (worker:///docs/) ````. A complete `[start-end]` segment in any numeric coordinate slot selects that inclusive decimal interval; brackets elsewhere retain ordinary path-glob meaning. Every rendered row appends one canonical model-facing leaf: the native operation name or invoked executor name, `/attempt` for a rejected emission. An executor leaf is derived from the durable submitted statement (`executor`, default `sh`), never the internal `EXEC` dispatch type or the current tool registry. Digits and punctuation in executor names remain part of the leaf. The leaf names identity rather than adding a resource level. Exact consumers tolerate the unsuffixed three-part shorthand; when supplied, the case-insensitive leaf is authoritative and a disagreement resolves 404. READ anchors use the canonical suffixed identity even when addressed by shorthand. Typed entry materialization therefore resolves as `/READ` while retaining its durable `EDIT` event ({§exec-entry-sink}). `log:///1/2/*` still selects the turn's item rows, while `log:///**/READ`, `log:///**/python3`, and `log:///**/attempt` deliberately filter canonical leaves. An executor's output stream lives at that same item address under its runtime scheme — `sh:///1/2/3/sh#stdout` — so one `loop/turn/item/invocation` schema addresses log rows and streams. Error pointers, Problem instances, source attribution, and search use this same identity; client stream coordinates retain the numeric triple. Within a turn, sequence is arrival order, and the turn's prompt rows arrive first: the prompt publication row and any injected prompt rows are materialized before the program runs, so a turn that received a prompt holds it at `log:///L/T/1/prompt` (further prompts follow, oldest first) and the model's own operations come after — a contract, not an accident of dispatch order ({§packet-current-turn} names `L/T`).
+- §log-coordinate-hierarchy **Log coordinates are a hierarchical prefix; the trailing slash is optional** — a coordinate is `loop/turn/sequence`, and a PARTIAL coordinate selects its descendants: `log:///1` = loop 1's rows, `log:///1/2` = turn 1/2's rows, `log:///1/2/3` = the one row. A full coordinate is always three parts, so a one- or two-part path is unambiguously a prefix — the trailing slash is an optional alias (`log:///1/2` ≡ `log:///1/2/`), uniform with ```` ```READ (worker:///docs/) ````. A complete `[start-end]` segment in any numeric coordinate slot selects that inclusive decimal interval; brackets elsewhere retain ordinary path-glob meaning. Every rendered row appends one canonical model-facing leaf: the native operation name or invoked executor name, `/attempt` for a rejected emission. An executor leaf is derived from the durable submitted statement (its `runtime`), never an internal dispatch type or the current tool registry. Digits and punctuation in executor names remain part of the leaf. The leaf names identity rather than adding a resource level. Exact consumers tolerate the unsuffixed three-part shorthand; when supplied, the case-insensitive leaf is authoritative and a disagreement resolves 404. READ anchors use the canonical suffixed identity even when addressed by shorthand. Typed entry materialization therefore resolves as `/READ` while retaining its durable `EDIT` event ({§exec-entry-sink}). `log:///1/2/*` still selects the turn's item rows, while `log:///**/READ`, `log:///**/python3`, and `log:///**/attempt` deliberately filter canonical leaves. An executor's output stream lives at that same item address under its runtime scheme — `sh:///1/2/3/sh#stdout` — so one `loop/turn/item/invocation` schema addresses log rows and streams. Error pointers, Problem instances, source attribution, and search use this same identity; client stream coordinates retain the numeric triple. Within a turn, sequence is arrival order, and the turn's prompt rows arrive first: the prompt publication row and any injected prompt rows are materialized before the program runs, so a turn that received a prompt holds it at `log:///L/T/1/prompt` (further prompts follow, oldest first) and the model's own operations come after — a contract, not an accident of dispatch order ({§packet-current-turn} names `L/T`).
 - §log-curation-folder-idiom **Log curation speaks the folder idiom; a zero-match sweep is a no-op success** — KILL takes a concrete coordinate or a path-glob, and a **trailing slash or a partial coordinate means "the contents"** ({§log-coordinate-hierarchy}), like a folder-scoped FIND: ```` ```KILL (log:///1/2) <1,-1> ```` suppresses turn 1/2's bodies. A **well-formed selection that matches nothing is 204 with `matched: 0`**; a successful sweep's rx carries `matched: N`. A targetless KILL is 400.
 - §log-curation-set-selection **Row selection and body scope are independent** — target/glob and an optional heading pattern (```` ```KILL (log:///**) [{"pattern": "~stale"}] ````, every dialect a FIND over rows accepts) compose by intersection into the affected row set. An optional `<L>` or `<SL,EL>` then intersects each selected canonical body; it never paginates or changes the selected set. Thus ```` ```KILL (log:///**/READ) <17,-1> ```` may change long READs and no-op on short ones while reporting every selected row in `matched`.
 
@@ -2122,19 +2225,122 @@ Ordinary operation rows store a normalized statement projection, not exact
 provider evidence. This is a structural credential-slot rule, not general
 secret detection.
 
-| Surface                             | Durable rule                                                                                                                                                                                                                                    |
-| ----------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Operation target                    | Each non-null URL username or password becomes `__redacted__`; `raw` is rebuilt from that pure projected target.                                                                                                                                |
-| Scheme metadata modifier            | Every present block becomes `__redacted__` wholesale; only ordered block count and represented-slot presence survive ({§scheme-metadata-modifier}).                                                                                              |
-| COPY/MOVE destination               | The nested destination target receives the identical URL-credential projection. URI component columns derive from the projected primary target, so columns and `tx` cannot disagree.                                                            |
-| Query and authored body             | Preserved exactly; they are authored content and URI identity, not structurally identifiable credential slots.                                                                                                                                  |
-| Parser failure                      | Preserves the structural diagnosis and source position without quoting scheme-metadata contents ({§scheme-metadata-modifier}).                                                                                                                  |
-| Client, fork, packet, and digest    | Consume the stored projection; none owns a second redaction policy.                                                                                                                                                                             |
-| Model-call evidence and source artifacts | `model_calls.response` under {§emission-admission}, `turnOps` under {§turn-ops-log-curation}, and `emissionAttempt` under {§rejected-emission-entry} remain exact forensic evidence and are the explicit exception.                                                               |
+| Surface                             | Durable rule                                                                                                                                                                                                                                    |
+| ----------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Operation target                    | Each non-null URL username or password becomes `__redacted__`; `raw` is rebuilt from that pure projected target.                                                                                                                                |
+| Scheme metadata modifier            | Every present block becomes `__redacted__` wholesale; only ordered block count and represented-slot presence survive ({§scheme-metadata-modifier}).                                                                                              |
+| COPY/MOVE destination               | The nested destination target receives the identical URL-credential projection. URI component columns derive from the projected primary target, so columns and `tx` cannot disagree.                                                            |
+| Query and authored body             | Preserved exactly; they are authored content and URI identity, not structurally identifiable credential slots.                                                                                                                                  |
+| Parser failure                      | Preserves the structural diagnosis and source position without quoting scheme-metadata contents ({§scheme-metadata-modifier}).                                                                                                                  |
+| Client, fork, packet, and digest    | Consume the stored projection; none owns a second redaction policy.                                                                                                                                                                             |
+| Model-call evidence and source artifacts | `model_call_responses.response` under {§emission-admission}, `turnOps` under {§turn-ops-log-curation}, and `emissionAttempt` under {§rejected-emission-entry} remain exact forensic evidence and are the explicit exception.                                                               |
+
+### §edit-result-render Mutation log rows render truthful effects
+
+A mutation row keeps request and outcome separate: `tx` is the admitted
+statement; `rx` is its resolved result. Only state that actually landed may
+appear there as an effect.
+
+```mermaid
+flowchart LR
+    authored["Authored EDIT / scoped entry KILL / COPY / MOVE"] --> snapshot["Resolve addressed channel(s)<br/>against pre-mutation snapshots"]
+    snapshot --> apply["Apply synchronously<br/>or settle proposal"]
+    apply --> landed{"Did state land?"}
+    landed -->|no| rx["Persist structured rx"]
+    landed -->|yes| kind{"Operation?"}
+    kind -->|EDIT / scoped entry KILL| receipt["Project one EDIT receipt<br/>for this authored row"]
+    kind -->|COPY / MOVE| effects["Compose ordered effects<br/>after application"]
+    receipt --> rx
+    effects --> rx
+    rx --> meta["Packet projection<br/>status · operands · optional effect metadata"]
+    rx --> body["Canonical log body<br/>bounded receipt context or empty"]
+    body --> recall["READ log:///…<br/>selects untrimmed content"]
+```
+
+§edit-receipt-removed-text **A pure deletion's receipt quotes what it removed.** An applied effect that inserted nothing and removed at least one line carries `removedText` — the removed text, first 40 lines — projected on the wire as `removed`; an effect that inserted anything carries no such field, its resulting context shows the change.
+
+§edit-receipt-anchored-context **An applied EDIT's resulting context carries anchors.** The bounded resulting context each effect renders (`PLURNK_SERVICE_EDIT_RECEIPT_CONTEXT_LINES` around and inside the landed region) is rendered exactly as a READ renders — `@xxxxx L:text`, hashed with the resource's READ identity ({§line-anchors}) — so a later operation can cite the landed lines by anchor without a READ. A scheme that supplies no identity keeps the line-numbered form.
+
+§edit-result-receipt-projection **EDIT and scoped entry KILL project the
+scheme-owned batch receipt.** The scheme framework owns the exact aggregate
+shape ({§scheme-edit-batch-receipt}). Each operation supplies one splice; Core
+validates and projects its one applied effect or superseded disposition.
+That row carries any reviewer replacement effect. Core stores only the
+per-operation projection on `rx`; the aggregate remains inside dispatch.
+
+| Durable receipt fact                   | Packet projection                                                 | Meaning                                                                                                                   |
+| -------------------------------------- | ----------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------- |
+| Full `revision`                        | not projected                                                     | SHA-256 identity of the complete landed channel body, retained for forensics. No operation takes a revision; it is neither a lookup nor a compare-and-swap token. |
+| `unit`, `before`, `after`              | `extent`                                                          | Whole-line batches use line counts. A batch containing any exact four-coordinate edit uses Unicode code-point counts.     |
+| `parseIssues.before`, `parseIssues.after` | `parseIssues` as `before→after`                                 | Parser-recovery counts for complete source and landed revisions; omitted when both are clean or either is unavailable.     |
+| `effect.requested`, `source`, `result` | `range`                                                           | The admitted marker and its normalized mapping from the common source snapshot into the landed body.                      |
+| `effect.removed`, `inserted`           | `change`                                                          | Removed and inserted counts in the receipt unit. |
+| `effect.removedText`                   | `removed`                                                         | {§edit-receipt-removed-text}: a pure deletion's removed text, first 40 lines; absent when the edit inserted anything.                                                                          |
+| `effect.context`                       | Canonical row body                                                | Numbered physical lines at each landed boundary, bounded symmetrically by `PLURNK_SERVICE_EDIT_RECEIPT_CONTEXT_LINES`.   |
+| `disposition`, `requested`             | `disposition`, `requested`                                       | A reviewer-replaced batch preserves the authored marker while stating that its attributed effect was superseded.          |
+| `replacement`                          | `replacement`, `change`, canonical proposal-owner body           | The one whole-resource effect actually applied by the reviewer replacement; never duplicated across authored rows.        |
+
+§edit-result-receipt-truth **Receipts describe committed state.** Each EDIT
+carries its own landed revision, extent, and optional `parseIssues` transition
+for its complete source and landed revisions. When the proposal lands
+unchanged, the row also carries its requested
+marker, source/result mapping, counts, and context. For configured count `C`,
+the context contains up to `C` surrounding lines and the first and last `C`
+landed lines at the result boundaries. Overlapping windows coalesce; coordinate
+jumps expose an omitted middle. A deletion instead shows up to `C` lines on
+each side of its join.
+
+§edit-result-reviewer-replacement **A resolver replacement is one effect, not a
+guess at authorship.** An arbitrary accepted body replaces that operation's
+proposed body. It cannot be attributed to the authored span: the row retains
+its requested marker with disposition `superseded` and carries the one
+whole-resource replacement effect with bounded landed context. Subsequent
+EDITs address that landed state independently under {§edit-execution}.
+
+| Acceptance                     | Per-authored-row receipt               | Applied effect                                    |
+| ------------------------------ | -------------------------------------- | ------------------------------------------------- |
+| Proposed body unchanged        | Requested marker and its exact mapping | One per authored EDIT                             |
+| Resolver body replaced proposal | Requested marker plus `superseded`     | One whole-resource replacement, carried once     |
+
+Durable `tx` always remains the model's admitted statement. There is no JSON
+row/item receipt mode. A deliberate READ observes its authored execution point
+({§op-execution-order}) and remains the universal request for arbitrary current
+content.
+
+System-narrated environment EDITs are state-diff events rather than authored
+mutation receipts. They carry the resulting span defined by
+{§env-delta-filesystem-narration}.
+
+§edit-result-copy-move-effects **Core composes COPY/MOVE effects only after
+application.** Operands remain owned by the durable statement and render
+independently under {§copy-move-observation}; effects describe only state that
+landed.
+
+| Durable effect field | Contract                                                                                                                           |
+| -------------------- | ---------------------------------------------------------------------------------------------------------------------------------- |
+| `target`             | Canonical model-facing address. The default channel is path-only; an explicitly selected non-default channel retains its fragment. |
+| `action`             | Exactly `create`, `update`, or `delete`.                                                                                           |
+| `receipt`            | Optional validated EDIT projection. Only textual `create` and `update` effects may carry one; a creation receipt has `before=0`.   |
+
+| Outcome                                                                       | Ordered `effects`                                                                                         |
+| ----------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------- |
+| Landed COPY                                                                   | Its destination effect.                                                                                   |
+| Landed MOVE between different resource-channel selections                     | Any destination effect, then any source effect.                                                           |
+| Landed regional MOVE within one resource channel, unchanged by its resolver   | Insertion, then removal; both name the same target because they are distinct effects in one atomic batch. |
+| Resolver body replaces a proposed COPY/MOVE mutation                          | One actual replacement effect. Cross-resource MOVE still appends an independently landed source effect.   |
+| Textual create/update caused by a scope on either operand                     | The effect carries the ordinary bounded EDIT receipt.                                                     |
+| Textual create/update with no scoped operand; binary mutation; channel delete | Structural effect only; no invented text receipt. Scoped source removal is an `update` with a receipt.    |
+| `304`, rejection, or cancellation with no landed mutation                     | `effects` omitted.                                                                                        |
+| Cross-selection MOVE source failure after destination success                 | The failure retains every destination effect that landed.                                                 |
+
+Core validates the complete ordered array before exposing it. Parser-recovery
+inspection is advisory and occurs against complete resulting text after
+successful application. A handler or parser failure emits a Notice, omits
+`parseIssues`, and never changes the mutation outcome.
 
 ### §copy COPY (engine-orchestrated)
 
-AST operands: `{ op: "COPY", source: ResourceSelection, destination: ResourceSelection }`.
+Operand syntax: {§transfer-resource-selections}. Result projection: {§copy-move-observation}.
 
 1. §copy-missing-source-404 Resolve source path, channel, and optional text scope; missing resource or
    channel is 404. Entry sources follow {§membership-source-projection}; active
@@ -2177,8 +2383,6 @@ COPY use this one orchestrator.
 
 ### §move MOVE (engine-orchestrated)
 
-AST operands: `{ op: "MOVE", source: ResourceSelection, destination: ResourceSelection }`.
-
 - §move-relocation-deletes-source MOVE first performs the destination mutation under {§copy}, then removes only
   the selected source region or channel. A whole-channel MOVE deletes the
   source entry only when that was its final channel.
@@ -2186,10 +2390,9 @@ AST operands: `{ op: "MOVE", source: ResourceSelection, destination: ResourceSel
   reads its source exactly as COPY does, writes the destination, and then
   retires the source through the source scheme's own KILL: an entry scheme
   deletes the entry or edits the region out, and the **log** curates — a scoped
-  MOVE from a log region (`### MOVE_ (log:///1/5/3/READ) <123,456>
-  (worker://analyst/notes/Q4-insights.md)`) copies the readable lines and trims them
-  from the projection like the same scoped KILL; an unscoped MOVE retires the
-  row like an unscoped KILL. The recorded evidence is never written or erased
+  MOVE copies the readable lines and trims them from the projection like the
+  same scoped KILL; an unscoped MOVE retires the row like an unscoped KILL.
+  The recorded evidence is never written or erased
   ({§log-readable-projection}), so relocating reasoning or results into a
   scratch note is a first-class curation move, not a refused write. A stream's
   KILL is process control, not content curation, and is not a MOVE source
@@ -2204,13 +2407,11 @@ AST operands: `{ op: "MOVE", source: ResourceSelection, destination: ResourceSel
   preconditions compose against that snapshot, and overlapping regions are 409.
 - A cross-resource destination failure leaves the source untouched. A source
   failure after destination success is an explicit partial failure with
-  `destinationWritten: true`. Proposal acceptance/rejection follows the same
-  ordered rule.
+  `destinationWritten: true` and the destination's identity. Proposal
+  acceptance/rejection follows the same ordered rule.
 - §move-cross-scheme-move Same- and cross-scheme resources use the same
   contract; there is no global cross-scheme transaction.
 - §move-missing-source-404 A missing source is 404.
-- §move-null-body-400 **MOVE is not a delete operation.** A null body returns
-  400 because a destination is required.
 - §move-dev-null-not-special `/dev/null` carries no special meaning; KILL is
   the canonical standalone delete.
 
@@ -2218,7 +2419,9 @@ Log history preserved — `log_entries` stores path tuple as text, not FK to `en
 
 ### §find FIND
 
-AST: `{ op: "FIND", target (scope), body: MatcherBody | null (predicate), signal: tags | null, lineMarker? }`.
+- §log-uniform-query **Log speaks the universal query contract** — ```` ```FIND (log://…) ```` works like every scheme's FIND. Candidates are worker rows scoped by the coordinate hierarchy ({§log-coordinate-hierarchy}) and projected exactly as READ shows them. Content dialects use `Matcher.matchCandidates`; `~` full-text and `&graph` use the same persistent derivation artifacts and candidate rankers as entries. Broad results are one-channel catalog groups whose `[0].path` is `log:///loop/turn/seq/OP`; exact matcher results are flat locations ({§find-result-projection}). Log remains the core event ledger rather than duplicating rows into `entries`; its core-private storage adapter supplies one complete channel representation to the same READ projector. That adapter is not a plugin seam and grants no protocol scheme an alternate READ path.
+- §find-source-agnostic **The content matcher is source-agnostic** — `Matcher.matchCandidates(body, candidates, mimetypes)` applies a content matcher (regex/jsonpath/xpath/glob) to candidates from ANY source, keyed by the caller's own identity (a pathname for entries, a `loop/turn/seq` coordinate for log). The matcher never cares what table the content came from, so FIND works uniformly across schemes by construction: `EntryFind` and `Log.find` run the one shared primitive rather than re-implementing it per scheme. Log stays its own event stream, but its rows are candidates the shared matcher covers like any entry's content.
+- §find-candidate-containment **One candidate's crash is that candidate's problem** — arbitrary member content can crash a mimetype handler mid-match (an unbalanced template partial crashed Readability and killed a 1,916-file FIND as a blank 500, #449). `Matcher.matchCandidates` contains a per-candidate handler throw: the candidate drops out exactly like unsupported content, the cause goes to daemon stderr, and only a FIND whose every candidate crashed reports a 415 whose Problem names the first crashing member and handler. The operation's other candidates always answer.
 
 - §find-scope-prefix-filter Filters entries within scope. A **bare** path is the exact entry; an explicit **shell glob**, classified once by {§path-glob}, expands to a scope. Path globs use segment semantics: `*` and `?` never cross `/`; `**` does — in every spelling: a `**` glued to a name (`**.go`, `src/**.ts`) is matched as `**/*.go` / `src/**/*.ts`, never demoted to a one-level `*` the way a native matcher reads it (run67, 2026-08-29: a whole-repository search silently confined to the root). Terminal `*` and `**` are structural catalog selectors and include dot-prefixed entries, so a complete map does not hide `.env.defaults` or `.github`; richer patterns retain native shell behavior. SQLite prefix queries may reduce the candidate set but never decide the match. A trailing slash is a recursive FIND scope only for a scheme whose manifest declares `folderScopes: true`; otherwise it is ordinary resource syntax. This is an explicit plugin contract, never inferred from URL punctuation.
 
@@ -2231,12 +2434,14 @@ AST: `{ op: "FIND", target (scope), body: MatcherBody | null (predicate), signal
   identity-bearing: `https://example.com/page` queries
   `(https, example.com, /page)`, never an empty-authority row at `/page`.
 - §find-channel-selection The target selects a channel under {§channel-selection}. That channel controls candidate eligibility, every matcher dialect's content or derivation, match-evidence coordinates, and exact producer-result composition. A selected channel absent from an exact entry is 404; a broad scope simply excludes entries lacking it. Successful resource-mode results remain complete default-first channel groups, so sibling channels are navigable catalog metadata rather than additional matches.
-- §find-glob-filter-on-content `body` matcher operates on the addressed entry channel (glob/regex/jsonpath/xpath), per `plurnk.md` "Pattern Filtering"; the path-glob lives in the (target), not the body.
+- §find-glob-filter-on-content The heading's `pattern` option ({§matcher-option})
+  matches the selected channel's content or derivation; path globs select
+  resources through `(target)` ({§path-glob}).
 - §find-fulltext-selection Every matcher operates only over the candidate set selected by `(target)`; indexed matchers do not bypass that selection. `~query` passes the native FTS5 expression to SQLite and ranks matching candidates by ascending BM25, with resource identity breaking ties. Native BM25 uses the shared index's term statistics; candidate visibility, owner, channel and target filters determine which resources can be returned. The ordinary FIND pager selects resources for broad targets or match locations for exact targets: markerless search defaults to `<1,16>`, `<N>` selects position N and `<N,M>` selects an inclusive range. Fractions are invalid result coordinates, not similarity thresholds. Results expose addressable matched text regions; neither cosine scores nor percentage similarity is invented. Native query-syntax failures return 400 with SQLite's diagnostic; database and implementation failures propagate.
 - §find-scoped-isolation Workspace + scheme scoped — no cross-workspace/cross-scheme leakage.
 - §find-result-projection **The authored target shape determines the result unit; result cardinality never changes it** ({§find-result-unit}). Returns `FindResult { status, content, mimetype, results, range, matchingPathCount, matchLocationCount, itemsWeightTotal, returnedItemsWeightTotal }`:
 
-  | Target | Matcher body | `range.unit` | Result rows |
+  | Target | Matcher | `range.unit` | Result rows |
   |---|---|---|---|
   | exact | absent | `resource` | the one catalog channel group |
   | glob or folder | absent | `resource` | catalog channel groups |
@@ -2247,7 +2452,7 @@ AST: `{ op: "FIND", target (scope), body: MatcherBody | null (predicate), signal
   target remains location mode when it has many locations. A valid exact match
   with no addressable location is status 200 with `matchingPathCount: 1`,
   `matchLocationCount: 0`, and no fabricated row; a matcher selecting no
-  resource is 204. A body-less broad empty catalog survey is status 200; an
+  resource is 204. A matcher-less broad empty catalog survey is status 200; an
   absent exact resource is 404. Every entry-channel location names its `channel`
   ({§channel-selection-visibility}); log rows carry none.
 
@@ -2255,7 +2460,7 @@ AST: `{ op: "FIND", target (scope), body: MatcherBody | null (predicate), signal
   complete selection before pagination; the packet curates those facts under
   {§retrieval-packet-metadata}. `path` is reserved for resource or channel identity;
   broad results never nest locations, and exact location rows never repeat the
-  resource path. A **body-less** FIND is the **catalog**. Its outer result array
+  resource path. A **matcher-less** FIND is the **catalog**. Its outer result array
   contains one nonempty, flat channel array per resource. Element `[0]` is always
   the default channel and carries the bare resource path; later elements carry
   their complete `path#channel` addresses. Each channel is
@@ -2314,18 +2519,19 @@ SEND AST: `{ op: "SEND", target: ParsedPath | null, body: SendBody | null, metad
 | TASK omitted | At least one authored operation | 102; no synthetic TASK, warning, or strike | None |
 | explicit empty inventory | Always | 409 receipt; continue, no strike (operator, 2026-09-12) | `No tasks were supplied. Submit a nonempty TASK inventory.` |
 | continue | Always | 102; no implicit join or idle strike | None |
-| pending | Always | 102 | `Pending tasks remain. Review their dependencies.` |
+| todo | Always | 102; no strike | None |
 | wait | Finite timeout, positive poll, or live obligation | 202; durable park and wake of the same loop | Wait timing metadata |
 | wait | No wait obligation; results or curation await the next packet | 102 | Existing result evidence |
 | wait | No wait obligation or unobserved result | 102; no strike | `Nothing is in flight and no timed or polled wait is set. Continuing.` |
-| complete | The loop holds prompt frames it has not yet published ({§completion-defers-to-prompts}) | 102; no strike; the next packet publishes them | `Completion deferred: 1 new prompt arrived during this turn. It is in this packet; a response and a TASK now complete.` |
-| complete | Model fired an operation other than SEND/TASK/KILL, or has unobserved failures or pending work/results | 409; continue with one strike, except {§send-final-strike-retrieval} | Factual pending-result Problem |
+| complete, fail | The loop holds prompt frames it has not yet published ({§completion-defers-to-prompts}) | 102; no strike; the next packet publishes them | `Completion deferred: 1 new prompt arrived during this turn. It is in this packet; a response and a TASK now complete.` |
+| complete | Live work: an open stream or a live child worker ({§completion-joins-live-work}) | 202; durable park and wake of the same loop; no strike | Join detail naming the work, read when the wake lands |
+| complete, fail | Same-turn failures, or settled results the next packet carries — this turn's receipts, a concluded stream, a terminated child ({§completion-defers-to-results}) | 102; no strike; the next packet carries them | Read-time deferral detail naming them |
 | complete | No blocking obligation, or administrative producer | 200 | None |
-| fail | Always | 499; cancel unresolved descendant scope | `All tasks in the final inventory failed.` |
+| fail | Otherwise; live work is cancelled, never waited for | 499; cancel unresolved descendant scope | `All tasks in the final inventory failed.` |
 
 A timing scope on a non-waiting inventory is ignored with `Wait timing was not applied because no waiting intent was selected.` It does not override the inventory. Every continuation retains the same loop's budgets and strike rail. No-op waiting never invents success.
 
-§loop-response-messages **Replies and outcome are independent.** Each successful targetless SEND, and a SEND to one of this loop's own prompts ({§send-prompt-acceptance}), contributes its complete authored body to the loop's response, in turn and operation order, separated by a blank line. Other directed SEND, TASK, asides, interstitial text, inherited rows and ambient observations do not contribute. Collection reads immutable executed operation evidence, not the curated log projection. KILL cannot retract a delivered message. A later failure, cancellation or refused completion preserves prior messages; a task inventory never becomes a synthetic answer. Terminal status and Problem Details remain independent of this response content.
+§loop-response-messages **The response is the last message.** The loop's response is the complete authored body of its last successful targetless SEND, or SEND to one of this loop's own prompts ({§send-prompt-acceptance}), in turn and operation order. Earlier messages reach the client as they are delivered and stay log rows; they are not part of the response, so a corrected answer or a repeated one after a refused completion delivers once. Other directed SEND, TASK, asides, interstitial text, inherited rows and ambient observations never count. The projection reads immutable executed operation evidence, not the curated log projection: KILL cannot retract a delivered message, and a later failure, cancellation or refused completion keeps the last message. A task inventory never becomes a synthetic answer. Terminal status and Problem Details remain independent of this response content. A parent receives its child's response as the child's conclusion (operator, 2026-09-11).
 
 §loop-terminal-authorship **Terminal authorship is explicit when external.**
 
@@ -2336,21 +2542,10 @@ A timing scope on a non-waiting inventory is ignored with `Wait timing was not a
 
 The engine's failure terminals — **500** (strike threshold) and **508** (cycle), {§engine-rails} — are never the model's to pick; they are the engine ruling the loop failed. The surface is small on purpose: the model says done, waiting, or giving up, and is never asked to hold a correct opinion about *how* it failed or *whether* it can be woken — the engine decides those from state.
 
-**Rail accounting is separate from model-facing evidence.** The model sees the
-specific correction on its next packet, never the private strike count
-({§rail-accounting-private}). Each state below contributes one strike and lets
-the loop continue; repeated offenses terminate through the engine's 500.
-
-| state               | model-facing evidence                                      | accounting |
-|---------------------|------------------------------------------------------------|------------|
-| Explicit empty inventory | The TASK's 409 row; preceding valid operations remain executed | No strike (soft 409) |
-| Refused disposition | The disposition's 409 row with its exact Problem Detail   | One strike |
-
-Executor results are evidence, never strikes: a command's nonzero exit — surfaced
-as its completion READ ({§exec-stream}) or read by the model from the stream —
-carries an `executor/*` problem identity and does not enter the streak. Structural
-violations follow the current admission and strike contracts
-({§emission-admission}, {§engine-rails}).
+Disposition outcomes follow {§wait-obligation-matrix},
+{§completion-joins-live-work}, and {§completion-defers-to-results}. Strike
+accounting and model-visible failure evidence remain separately owned by
+{§engine-rails} and {§rail-accounting-private}.
 
 - §send-target-recipient **A SEND target is a recipient.** A model's directed SEND
   addresses a worker (```` ```SEND (worker://<name>) ````), an outbound agent (`a2a://`),
@@ -2364,8 +2559,8 @@ violations follow the current admission and strike contracts
   lists `prompt://<worker>/<loop>/<id>` addresses under Active Prompts, and a model that
   addresses one of them means what an untargeted SEND means. The engine accepts a model
   SEND to a prompt of the current worker and loop as exactly that response: it dispatches
-  as the untargeted case, the row keeps the address the model wrote, and the body joins the
-  loop's response under {§loop-response-messages}. Nothing is taught about the form and it
+  as the untargeted case, the row keeps the address the model wrote, and the body counts as
+  the loop's response under {§loop-response-messages}. Nothing is taught about the form and it
   creates no per-prompt result structure; a prompt of another loop or another worker stays
   `400 send-target-not-a-recipient`. An undocumented acceptance in the same spirit as KILL
   in the completion turn, not a recipient.
@@ -2386,7 +2581,8 @@ violations follow the current admission and strike contracts
   EDIT or KILL carrying `[metadata]` for a scheme whose manifest takes none runs without it,
   and the packet carries one `metadata_ignored` notice naming the scheme (operator,
   2026-09-12: a gentle warning, never a refusal). The `pattern` option never reaches this
-  path; it is lifted into the matcher at parse time ({§matcher-option}).
+  path; it is lifted into the matcher at parse time ({§matcher-option}). Executions, WORK and FORK
+  own their slot and receive it whole ({§env-option}); a key they do not take is their own 400.
 - §send-looks-like-operation **A reply never begins with an operation heading.** When a model's
   untargeted SEND has, as its first non-blank line, a line that parses alone as one clean
   heading naming an operation this worker could perform — a Plurnk operation, or a registered
@@ -2416,36 +2612,56 @@ violations follow the current admission and strike contracts
   results** (every same-turn non-SEND/TASK/KILL operation, terminal stream output
   without a terminal foisted READ, and child results queued for the next packet).
   The set is judged at the disposition's own dispatch, after
-  earlier operations in the emission. `[200]` over a pending member is refused
-  409 and the loop continues, except {§send-final-strike-retrieval}; every refusal
-  strikes uniformly, including a retrieval-only refusal. Its Problem reports the bounded pending kinds
-  `streams`, `workers`, `receipts`, `failed-stream-results`, and
-  `worker-results`. A receipts-only refusal also names the distinct blocking
-  operations in execution order using their model-facing log names
+  earlier operations in the emission. `[200]` over a **live** member joins it
+  ({§completion-joins-live-work}); a claim over only completed-but-unobserved
+  members is a deferral ({§completion-defers-to-results}). Neither is a refusal
+  and neither strikes. The pending kinds are `streams`, `workers`, `receipts`,
+  `failed-stream-results`, and `worker-results`; a receipt names them and never
+  embeds commands, stream handles, result bodies, or a presumed recovery. A
+  nonempty all-`failed` inventory crosses the same deferral and then abandons
+  regardless of live work, which it cancels rather than waits for.
+- §completion-joins-live-work **A completion over live work is a join.** A scope
+  that says done while its own work runs — an open stream, a live child worker —
+  is asking to leave with that work unfinished, and the two exits structured
+  concurrency allows are join and cancel. The `completed` inventory takes the
+  join: the TASK answers 202, the loop parks untimed on the live obligation
+  exactly as a `waiting` inventory would, and the settle edge wakes it with what
+  concluded in the packet; the model's next TASK decides with that result in
+  front of it, so nothing completes on an answer written before the work
+  finished. The `failed` inventory takes the cancel. The join's `detail` is read
+  when the wake lands and speaks from that moment; its `attrs` carry `waiting`
+  and the pending kinds. It is never a strike: the review contract has no
+  violation left, and the rail's remaining sources are hard results, cycles and
+  empty turns ({§engine-rails}). A stream the model meant to leave running parks
+  the loop until it ends, as a model-written `waiting` would; KILL before the
+  claim is the way to leave it running (operator, 2026-09-14: "politely
+  converting completed into waiting when there are streams or workers in-flight").
+- §completion-defers-to-results **Settled results defer a terminal; they never strike.**
+  A completion or abandonment claimed over results the model could not yet have
+  seen — this turn's failed operations, this turn's receipts (successful execution
+  results included, not only READ/FIND), a concluded stream's result, a terminated
+  child's result — is deferred: the TASK answers 102 with no Problem and no strike,
+  the loop continues, and the next packet carries what deferred it. The engine
+  owns every observe edge, so such a claim is early in the observation order, not
+  false about the world. After observing the results, the model can continue work,
+  revise its response, or conclude with TASK alone while retaining its last SEND
+  ({§loop-response-messages}, {§send-undelivered-child-term}).
+  The deferral's `detail` is read one packet later, beside the results it names,
+  and speaks from that moment: a receipts-only deferral names the distinct
+  blocking operations in execution order using their model-facing log names
   ({§log-coordinate-hierarchy}), plus `stream completion` for undelivered terminal
-  stream results. The receipt is read one packet later, beside the results it
-  names, and speaks from that moment: a receipts-only or results-only refusal
-  says the deferred results are in the packet being read and that a TASK now
-  completes; a live obligation names the wait (a TASK with a pending task, or
-  KILL for an execution); a same-turn failure says the failure is in the packet
-  and asks for it to be addressed or completed over. Every completion refusal
-  is `retryable: true`, because the same TASK is the correct next request;
-  none of them names an action to observe, and none describes a persistent
-  unacknowledged obligation.
-  That list obeys the configured error-detail limit; it never
-  embeds commands, stream handles, result bodies, or a presumed recovery.
-  The pending kind changes the factual Problem class, not
-  rail accounting. A nonempty all-`failed` inventory deliberately abandons regardless.
-- §send-final-strike-retrieval **Receipt-only completion at the final strike.**
-  If refusing a model's completion TASK would reach the loop's existing
-  consecutive-strike limit, accept it when `receipts` is the only pending kind
-  and this turn has no failed operations. Receipts include successful execution
-  results, not only READ/FIND. The same streak and configured limit
-  apply; a clean turn resets the streak and there is no separate refusal counter.
-  Live work, undelivered child results, and failed stream results remain blocking.
-  Decide at TASK dispatch: record the accepted TASK and terminal normally,
-  retain all earlier refusals and retrieval results unchanged, and do not invent
-  another model turn or an observation of the pending receipts.
+  stream results; a results deferral names the landed kinds; a failure deferral
+  counts the failures. These deferrals and the live-work join receipt share the
+  conditional guidance: `If your final response has already been sent and these
+  results require no further work or response revision, submit only TASK.` This
+  avoids repeating a delivered response, not delivering one; newly arrived prompts
+  retain their distinct feedback under {§completion-defers-to-prompts}. Their
+  `attrs` carry the pending kinds or the failure count. The rail's streak never
+  enters the decision: a deferral is admissible at any streak, and a loop that
+  keeps issuing operations before each claim pays one packet per claim, never a
+  strike, until the cycle detector rules its repetition ({§engine-cycle-evidence}).
+  Operator, 2026-09-14: the barrier is safety and the rail is liveness; fail is
+  completed with a frowny face and crosses the same barrier.
 - §send-administrative-terminal **An administrative terminal closes its own
   transaction.** A client, plugin, or `_plurnk` operation program runs in its
   own administrative loop. Its all-`completed` TASK concludes exactly that loop;
@@ -2477,9 +2693,9 @@ of which Worker launched it ({§execution-output-identity}).
 Stored runtime entries retain plugin-only writers. Input and termination are
 control capabilities, not exceptions granting write access to stdout/resources.
 
-### §exec EXEC
+### §exec Executions
 
-AST: `{ op: "EXEC", target (optional runtime-specific target), body: string | null (runtime-specific input), signal: string | null (runtime tag), lineMarker (timeout/poll) }`.
+AST: `{ runtime (the fence name in its registered lowercase spelling; there is no operation keyword), target (optional runtime-specific target), body: string | null (runtime-specific input), lineMarker (timeout/poll) }`.
 
 §exec-target-routing Engine routes unconditionally to the `exec` scheme,
 resolves the runtime first, selects its static {§executor-invocation} or exact
@@ -2505,9 +2721,9 @@ names the working directory only when it is not the project root, and then in th
 model's own project-relative form ({§fs-namespace}: the root is the model's `/`, so it
 is never rendered, and no receipt or Problem carries a host-absolute path — the
 batch of 2026-08-29 showed the absolute `cwd` copied back into the target slot as
-`(cwd: /host/path)`). The EXEC `(path)` is a program — a script for an interpreter, a tool name for a tool
+`(cwd: /host/path)`). The `(path)` is a program — a script for an interpreter, a tool name for a tool
 family — and neither a command nor a working directory is ever a target. The default
-shell is taught as targetless bare `EXEC`; `[sh]` remains the explicit form.
+shell is written as its own fence, ```` ```sh ````; no runtime-less form exists.
 
 §exec-tool-fall-through **A tool run as a shell command is named at the failure
 site.** A bare shell command whose program is the name of a tool published by
@@ -2529,7 +2745,7 @@ registry does not know keeps the plain exit-127 receipt.
 
 Body and target requirements come from the same runtime declaration. A runtime
 with no target declaration refuses a target; required body or target fields are
-enforced independently; every EXEC requires at least one of them; and an
+enforced independently; every execution requires at least one of them; and an
 `exclusive` declaration refuses an invocation containing both. A target retains
 its one declared role whether the body is empty or non-empty. Runtime selection,
 target validation, and body/target relation failures therefore occur before
@@ -2567,7 +2783,7 @@ Loop-flag authority follows the selected runtime's declaration:
 | Non-file `resource`                                     | `exec` and the addressed source scheme |
 
 Worker and runtime-stream authorities, query, fragment, and every other
-component of a `resource` address retain their owning READ semantics. EXEC's
+component of a `resource` address retain their owning READ semantics. The execution's
 metadata is not part of that address: the internal READ has no metadata, and
 the selected executor receives the exact original blocks separately from its
 body. A failed source READ is preserved as the proposal-application
@@ -2601,7 +2817,7 @@ catalogue.
 
 Per-tool programs such as `go`, `cargo`, `make`, and `npm` do not earn executor tags merely because they are executables; they are complete shell commands in a `sh` executable fence. Registered tags exist only for tools that own a distinct body, target, or output contract. {§exec-registry-resolves}
 
-**Timeout and poll — `<T,P>` on the `<L>` slot (grammar 0.74.20).** EXEC
+**Timeout and poll — `<T,P>` on the `<L>` slot (grammar 0.74.20).** An execution
 repurposes the line-marker slot as `<timeout, poll>` in **minutes** — agentic
 latencies make a sub-minute horizon a trap — converted at the parse boundary to the
 catalog's internal `stream.seconds`. The TASK `<T>` wait horizon is minutes too.
@@ -2700,7 +2916,7 @@ read effects). Unlisted effects keep the default. An invalid entry — unknown
 effect, unknown policy, or a non-`<effect>:<policy>` shape — fails daemon boot
 loudly rather than degrading admission.
 
-After all non-SEND operations dispatch, the initiating turn applies {§worker-optimistic-settlement} to only the EXEC streams it started, then dispatches its turn disposition against the refreshed lifecycle state. An older stream receives no renewed opportunity merely because another turn began. This is a settlement barrier before disposition, not sibling-operation serialization: dependent EXECs remain separate observed turns.
+After all non-SEND operations dispatch, the initiating turn applies {§worker-optimistic-settlement} to only the execution streams it started, then dispatches its turn disposition against the refreshed lifecycle state. An older stream receives no renewed opportunity merely because another turn began. This is a settlement barrier before disposition, not sibling-operation serialization: dependent EXECs remain separate observed turns.
 
 §exec-stream **Stream surfacing.** An exec's output is *observed, not fetched*, in
 two states and no others:
@@ -2713,7 +2929,7 @@ two states and no others:
 §exec-concurrency **Bounded admission per workspace (#389).** At most
 `PLURNK_SERVICE_EXEC_CONCURRENCY` executions run at once in one workspace (shipped `12`;
 `-1` unbounded); the scope is the workspace, so neither delegation nor later turns
-bypass it and no other workspace can starve it. Every admitted EXEC still creates its
+bypass it and no other workspace can starve it. Every admitted execution still creates its
 entry, channels, and open subscription before its receipt returns, so queued work is
 cancellable, restart-reconcilable, completion-gated, and observed through the ordinary
 stream mechanics ({§exec-stream}). The receipt tells the truth once and never rewrites
@@ -2722,7 +2938,7 @@ it: an immediate slot is `200 { outcome: "started" }`; delayed work is
 `active` in the existing live sense — output growth and terminal settlement are the
 current truth. Admission is FIFO within the workspace; queue residence does not consume
 the execution timeout; a KILL while queued never invokes the executor and closes the
-stream through the normal 499 path. The scheduler is the EXEC scheme's; the knob is the
+stream through the normal 499 path. The scheduler is the exec scheme's; the knob is the
 service's ({§operator-config}), fail-hard on any other value.
 
 §exec-stream-page **An unrequested delivery never exceeds the retrieval page.** The
@@ -2745,7 +2961,7 @@ transition commit atomically. A concluded stream lands one conclusion row per
 channel that holds content, and an empty sibling channel is a fact on that row
 (`channels: {"#stderr": 0}`), never a row of its own; only a stream that printed
 nothing on any channel lands one bodyless conclusion row, on its default
-channel, whose terminal fact, causal EXEC link, and available exit code make
+channel, whose terminal fact, causal execution link, and available exit code make
 completion explicit without invented narration (operator, 2026-09-13: the
 per-channel empty row was "a useless packet bomb" — 131 of 298 conclusion rows
 in the candidate4 run). A skipped channel's publication is still marked
@@ -2755,7 +2971,7 @@ again; the exact terminal result and channel content remain READable at the
 stream address. Every READ then obeys {§body-projection} and therefore renders
 its selected result complete. A stream that closes before a same-turn wait
 remains pending until every selected channel's terminal READ crosses the next
-packet boundary. The EXEC row separately records the authored invocation.
+packet boundary. The execution row separately records the authored invocation.
 
 ```` ```KILL (<runtime>:///<eight-hex-id>) ```` cancels an active subprocess via
 the subscription registry's stored controller. A terminal stream is immutable:
@@ -2764,9 +2980,49 @@ the subscription registry's stored controller. A terminal stream is immutable:
 The runtime scheme participates in the durable lookup; a completed `sh:///`
 stream cannot fall through an internal `exec`-only query. {§stream-control}
 
-§exec-env-scoped **Scoped environment.** An EXEC subprocess inherits the *project's* environment — its `.env`, the standard shell vars — so the model's commands run as the project expects; but never plurnk's own secrets: the provider API keys and `PLURNK_*` config are stripped before the spawn, so a model-executed command can't `printenv` the engine's keys. The service owns the scoping policy (the denylist); the executor spawns with the env it is handed.
-
-- §exec-hold-until-concluded **The turn-hold exception** — for runtimes in `PLURNK_SERVICE_EXEC_HOLD` (a decision-table env, shipped listing the search family), an in-flight stream **pauses the cycle**: the next packet does not assemble until the stream concludes, so the model never burns a turn asking "are we there yet" about a result the engine controls end-to-end. This exception is limited to seconds-bounded runtimes whose final result the engine controls end-to-end. Bounded by `PLURNK_SERVICE_EXEC_HOLD_MS` and **fail-open**: at the cap the standard cycle resumes untouched (waits, wakes, polls). Zero grammar or teaching surface — the model emits EXEC followed by TASK; the wake-shaped world simply arrives one packet sooner. It extends selected runtimes beyond the ordinary {§worker-optimistic-settlement} cap before the next packet assembles. A bare entry holds ALL of a runtime's spawns; a `<runtime>:<effect>` suffix (`github:read`) holds only that effect-class — an MCP server is one runtime whose tools split (a `read` `get_issue` is instant; a `host` `run_migration` is a slow mutation), so an operator opts the known-fast read-class in without parking on the mutation. Conservative stays default: an arbitrary third-party server's latency never parks the engine unless a suffix opts a class in.
+§exec-env-scoped **Scoped environment.** An execution subprocess receives a composed
+environment, never the host's. Two mechanisms apply in order, and they are different kinds
+of thing. First the **ambient policy**, a ceiling: `PLURNK_SERVICE_EXEC_ENV_INHERIT` names
+what the host's environment may contribute at all and `_EXCLUDE` narrows that, both taking
+exact names or one trailing-`*` prefix glob, both ordinary operator knobs under
+{§operator-config-env-defaults}. A worker document or a heading modifier narrows the ceiling
+further; nothing downstream widens it. The worker document is the Worker's `env` state
+({§env-functionality}), read at the spawn: an enabled worker entry sets its own value, a disabled
+entry of either origin withholds the name, and what `list` projects is what the command
+receives. Then the **invariant**, which is not a knob:
+`PLURNK_*` config and every provider credential name are stripped last and unconditionally,
+so no policy, document or modifier can readmit plurnk's own secrets. The service composes;
+the executor spawns with the environment it is handed. Each spawn records the environment it
+received on the output it produces — every name with its provenance: the host through the
+ceiling, this Worker, an ancestor by name, or masked — and the digest renders it beside the
+operation, which closes the host-versus-container confound where it starts.
+
+The ceiling exists because the invariant protects the wrong secrets. It knows plurnk's
+credentials and nothing about the operator's, so a denylist alone hands `SSH_AUTH_SOCK` and
+`NPM_TOKEN` to every command a model writes. Membership is an allowlist: the shipped
+`INHERIT` is what a shell, git, node and python need to run, and an operator who wants a
+tool's credential reachable by model-written commands adds it by name. An empty policy admits
+nothing ambient — the allowlist is declared in `.env.defaults`, so an empty one is a cleared
+policy rather than an unconfigured install.
+
+The full composition for one spawn, nearest setter winning for defaults and ceilings immune,
+is package floors → operator cascade → ambient policy → worker document → the op's modifier →
+body prefixes.
+
+- §env-option **The op's environment.** `env` is the service's key in the heading's `[metadata]`
+  ({§scheme-metadata-modifier}): `[{"env": {"NAME": "value"}}]`, an object of string values.
+  On an executor fence it is that process's environment over the Worker's own
+  ({§env-functionality}) — the layer nearest the spawn, never entering the registry; a runtime
+  that runs in-process ignores the environment it is handed, so there it changes nothing. On
+  WORK and FORK it is the child's starting environment: after the copy the child inherits
+  ({§functionality-scope}), each name lands as the child's own entry through the family's `add`,
+  so a parent hands down its registry and overrides specific names for one child in one heading.
+  Names follow the family's admission — a name a shell can export, never plurnk's own — and a
+  refusal names the key and the reason at the operation, before anything runs or is created; a
+  key WORK or FORK does not take is refused the same way. The durable row redacts the block
+  wholesale ({§log-sensitive-request-evidence}); the spawn's record names each such value's
+  provenance as the modifier's.
+- §exec-hold-until-concluded **The turn-hold exception** — for runtimes in `PLURNK_SERVICE_EXEC_HOLD` (a decision-table env, shipped listing the search family), an in-flight stream **pauses the cycle**: the next packet does not assemble until the stream concludes, so the model never burns a turn asking "are we there yet" about a result the engine controls end-to-end. This exception is limited to seconds-bounded runtimes whose final result the engine controls end-to-end. Bounded by `PLURNK_SERVICE_EXEC_HOLD_MS` and **fail-open**: at the cap the standard cycle resumes untouched (waits, wakes, polls). Zero grammar or teaching surface — the model emits an executor fence followed by TASK; the wake-shaped world simply arrives one packet sooner. It extends selected runtimes beyond the ordinary {§worker-optimistic-settlement} cap before the next packet assembles. A bare entry holds ALL of a runtime's spawns; a `<runtime>:<effect>` suffix (`github:read`) holds only that effect-class — an MCP server is one runtime whose tools split (a `read` `get_issue` is instant; a `host` `run_migration` is a slow mutation), so an operator opts the known-fast read-class in without parking on the mutation. Conservative stays default: an arbitrary third-party server's latency never parks the engine unless a suffix opts a class in.
 - §exec-entry-sink **The entry() sink** implements {§executor-entry-sink} over ordinary scheme-owned entries. Core owns allocation, materialization, and persistence; executors receive only the returned resource address.
 
   | Input / effect | Consumer behavior |
@@ -2776,14 +3032,14 @@ stream cannot fall through an internal `exec`-only query. {§stream-control}
   | Supplied bytes | Retain the original bytes and declared mimetype in an ordinary channel ({§binary-parity}). |
   | Supplied text | Preserve text resources; HTTP/HTML materialization retains source and derived channels under {§html-materialization}. |
   | Null content | Acquire an HTTP(S) resource through the checked WebFetcher, using the same configured materializers as exact HTTP acquisition ({§http-materializer-plugins}). |
-  | Durable evidence | One typed EDIT event in the reserved runtime actor, with the calling Worker as causal source. Binary evidence describes the resource; its complete bytes live in the resource channel. |
+  | Durable evidence | One typed EDIT event in the runtime actor, with the calling Worker as causal source. Binary evidence describes the resource; its complete bytes live in the resource channel. |
   | Model orientation | The executor includes returned addresses in its result. Publication does not independently wake inference or broadcast an observer row ({§env-delta-entry-materialization}). READ controls content acquisition and native delivery. |
 
   A failed acquisition, projection, or write rejects the sink with its cause; it does not erase the upstream operation or imply no external effect. Parallel acquisition begins before the per-invocation serialized write chain. A rejected publication leaves that chain usable. Execution completion and shutdown await the whole chain; one lazily created runtime narration turn owns the invocation's publication evidence.
 
-### §proposal The proposal lifecycle
+## §proposal Proposals and client interactions
 
-§proposal-202-pauses A side-effecting op does not execute on dispatch — it **proposes**. The scheme returns **202** (an EXEC `host` runtime {§exec}, an EDIT to a member file {§membership}); the engine writes the log row `state='proposed'`, registers a waiter keyed by `logEntryId`, and **pauses `dispatch`** awaiting a resolution. The provider exchange and emitted operation are already durable, while the turn remains open until dispatch settles; {§engine-rails} therefore sees the *resolved* status, never the provisional 202. On accept the status becomes 200 and the scheme's effect runs.
+§proposal-202-pauses A side-effecting op does not execute on dispatch — it **proposes**. The scheme returns **202** (an execution on a `host` runtime {§exec}, an EDIT to a member file {§membership}); the engine writes the log row `state='proposed'`, registers a waiter keyed by `logEntryId`, and **pauses `dispatch`** awaiting a resolution. The provider exchange and emitted operation are already durable, while the turn remains open until dispatch settles; {§engine-rails} therefore sees the *resolved* status, never the provisional 202. On accept the status becomes 200 and the scheme's effect runs.
 
 **Resolution arrives through one lifecycle:**
 
@@ -2841,8 +3097,30 @@ execution signal, including KILL and deadline, not just its enclosing loop.
 Reconnect discovery intersects durable rows with live waiters; restart
 removes ownerless rows without fabricating cancellation, payload, or replay.
 
+### §proposal-ownership Loop disposition and client YOLO
+
+Side-effecting operations propose ({§exec}) and pause dispatch at 202 for an
+authority decision ({§engine-rails}, {§methods}). Automatic acceptance has two
+distinct owners:
+
+| Mechanism                                            | Authority path                                                                                                                                    | Intended use                                                       |
+| ---------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------ |
+| §proposal-ownership-loop-auto **Loop disposition**   | `runLoop({ policy: { proposals: "accept" } })` persists a loop-owned disposition; core resolves proposals in process without a client.           | Headless automation, benchmarks, CI, fixtures, and unattended use. |
+| **Client-side YOLO** (`--yolo` / `PLURNK_YOLO`)      | A `proposals: "review"` loop emits the ordinary `loop/proposal`; the client returns an accepted proposal through its standard resolution path.  | Interactive automatic review.                                      |
+
+Core cannot distinguish client-side YOLO from a fast human acceptance and does
+not need to. Loop auto keeps authority inside the loop; client-side YOLO acts
+only after authority crosses the client boundary.
+
+§proposal-ownership-notification **The notification carries disposition, not policy inputs.** `loop/proposal` carries the core-owned `ProposalDisposition` ({§notifications}, {§proposal-disposition}). A connected client presents only `owner="client"`; it never reimplements policy from operation or attrs.
+
 ### §proposal-disposition Settlement authority and precedence
 
+§loop-policy-effective-read `loops.policy` persists one complete immutable
+`LoopPolicy`; every runtime policy read validates that snapshot before use.
+Missing rows or invalid values fail with the owning loop coordinate and cause.
+Raw archival copies and forensic rendering do not interpret policy.
+
 `ProposalDisposition` is either `{ owner: "client" }` or `{ owner: "loop", decision: "accept" | "reject", outcome? }`. The persisted loop policy determines it exactly:
 
 | `policy.proposals` | Disposition                              |
@@ -2935,7 +3213,7 @@ No generator. SQLite-optimal: STRICT (3.37+), `INTEGER PRIMARY KEY` aliasing, ex
 | §db-fk-indexes Foreign-key check paths | Every foreign-key column a delete, cascade, or parent replacement can check carries an index (partial where the column is nullable), and no registry statement's plan scans a growing table: `test/intg/schema-query-plans.test.ts` runs `EXPLAIN QUERY PLAN` over every `-- PREP` statement against the baseline and fails on a `SCAN` of a growing table, except statements that read a whole table by design (digest, startup recovery, whole-workspace listings, scheduled-loop claims). An index claim is a plan, never a grep of index names. |
 | §db-index-owners Every index has an owner | An explicit index earns its place one of three ways: a registry statement's plan uses it, its leading column is a foreign key whose check it serves, or it enforces uniqueness. The same test fails on any other index, naming it: an index nobody reads is a write on every insert. Duplicates of a `UNIQUE` constraint's own index and sort-only indexes no plan selects were removed on this rule; a column no statement reads (`symbol_refs.col`, `ambient_events.created_at`) is not stored. |
 | §db-maintenance-optimize Statistics at shutdown | The daemon's last database step before the caller closes SQLite is `PRAGMA optimize` on the writer (`maintenance_optimize`), so `sqlite_stat1` reflects tables the connection planned against, bounded by SQLite's own analysis limit; a failure there is a reported shutdown error, never silent. Retention runs before it under the operator's policy ({§retention-policy}); no explicit checkpoint and no periodic `ANALYZE` run. |
-| §retention-policy Retention is the operator's policy; information is kept by default | `Retention` (`src/server/Retention.ts`, statements in `Retention.sql`) reads five knobs from `.env.defaults` once at daemon construction and runs three set statements in dependency order — on `PLURNK_SERVICE_RETENTION_INTERVAL_MS` cadence while the daemon runs (0 = shutdown only) and once more at shutdown before `PRAGMA optimize`. `PLURNK_SERVICE_RETAIN_PACKET_TURNS` (-1 = every packet) and `PLURNK_SERVICE_RETAIN_PACKET_MS` (-1 = no age limit) retire a completed turn's packet composition (`turn_sections`, {§packet-items}) once it is beyond the newest N packet-bearing turns of its loop or older than the age; the turn, its bag, its log rows and its accounting stay, and an open turn is never retired. `PLURNK_SERVICE_COLLECT_PACKET_ITEMS` (1) collects items no composition references. `PLURNK_SERVICE_COLLECT_DERIVATIONS` (1) collects derivations no channel, turn source, or log row cites — superseded editions — with their symbols (cascade) and their full-text shadow (`derivations_delete_fts`, a process trigger beside the FTS statements, on every delete path). Under the shipped defaults nothing that is information leaves; only what no row references. A malformed knob refuses daemon construction. Witness: `test/intg/retention.test.ts`. |
+| §retention-policy Retention is the operator's policy; information is kept by default | `Retention` (`src/server/Retention.ts`, statements in `Retention.sql`) reads seven knobs from `.env.defaults` once at daemon construction and runs four set statements in dependency order — on `PLURNK_SERVICE_RETENTION_INTERVAL_MS` cadence while the daemon runs (0 = shutdown only) and once more at shutdown before `PRAGMA optimize`. `PLURNK_SERVICE_RETAIN_PACKET_TURNS` (-1 = every packet) and `PLURNK_SERVICE_RETAIN_PACKET_MS` (-1 = no age limit) retire a completed turn's packet composition (`turn_sections`, {§packet-items}) once it is beyond the newest N packet-bearing turns of its loop or older than the age; the turn, its bag, its log rows and its accounting stay, and an open turn is never retired. `PLURNK_SERVICE_COLLECT_PACKET_ITEMS` (1) collects items no composition references. `PLURNK_SERVICE_COLLECT_DERIVATIONS` (1) collects derivations no channel, turn source, or log row cites — superseded editions — with their symbols (cascade) and their full-text shadow (`derivations_delete_fts`, a process trigger beside the FTS statements, on every delete path). `PLURNK_SERVICE_RETAIN_RESPONSE_TURNS` (-1) and `PLURNK_SERVICE_RETAIN_RESPONSE_MS` (-1) retire a settled call's response body (`model_call_responses`) once it is beyond the newest N body-bearing calls of its loop or its turn is older than the age; the call's identity, failure, capacity, admission and accounting stay, and the digest renders such a call request-only. Under the shipped defaults nothing that is information leaves; only what no row references. A malformed knob refuses daemon construction. Witness: `test/intg/retention.test.ts`. |
 
 - **Schema-alignment test**: loads `@plurnk/plurnk-contracts/schema/*.json`, parses DDL via `node:sqlite` introspection, asserts every required schema field has a corresponding `NOT NULL` column. Contract drift fails CI.
 - DDL = storage truth; JSON Schemas = wire truth. Tested-aligned, allowed to differ where ergonomics demand.
@@ -3060,23 +3338,11 @@ service manifest edit.
 
 ## §grammar Grammar Dependency
 
-`@plurnk/plurnk-contracts` is authoritative; surface gaps through its owning issue and adopt what lands. Do not redesign the contract from core.
-
-### §grammar-provides What grammar provides
-
-- Parser (`PlurnkParser`, ANTLR4) — DSL text → `PlurnkStatement[]`.
-- AST types — exported TypeScript interfaces.
-- JSON schemas (`schema/*.json`, draft 2020-12) for every wire shape.
-- `plurnk.md` — canonical model-facing DSL description.
-
-### §service-tracks What plurnk-service tracks (NOT in grammar)
-
-- Channel state (`static`/`active`/`closed`/`errored`) — persisted channel metadata owned by core and exposed through the schemes capability contract ({§channel-state}).
-- Backpressure caps — none ({§stream-constraints}).
-- Stream cancel — `KILL` of the stream address ({§stream-control}).
-- Delete — `KILL` (entry-KILL, the canonical delete, {§move}); a scoped entry KILL deletes one span through the EDIT path ({§kill-scope-entry}).
-- §loop-policy-effective-read Per-loop policy — `loops.policy` persists one complete immutable `LoopPolicy`; every runtime policy read validates that snapshot before use. Missing rows or invalid values fail with the owning loop coordinate and cause. Raw archival copies and forensic rendering do not interpret policy.
-- Default-channel wire rendering — {§channel-selection}.
+Core consumes the language, schemas, and generated types under
+{§contract-authority} and {§contract-representations}. Provider emissions cross
+{§emission-admission}; admitted programs execute through
+{§turn-ops-admission-path}. Core owns execution and persisted state, not a second
+language definition.
 
 ---
 
@@ -3138,7 +3404,7 @@ Model selection uses one selector vocabulary in `ProviderRegistry` ({§provider-
 | `PLURNK_SERVICE_DB_PATH`                                    | `$XDG_DATA_HOME/plurnk/plurnk.db` | SQLite file path; an explicit non-empty value overrides the derived default. |
 | `PLURNK_HOST`                                               | `127.0.0.1` | Bind address for the listener. Local-only by default. |
 | `PLURNK_PORT`                                               | `1066` | TCP port for THE client surface — the AG-UI+ listener (the plurnk-agui plugin module binds it at boot). Production is single-listener. |
-| §operator-config-git-ceiling `PLURNK_SERVICE_GIT_ALLOWED`   | `1` | Hard service ceiling: only `1` admits Git membership, status, and branch batching; every other value denies them. |
+| §operator-config-git-ceiling `PLURNK_SERVICE_GIT_ALLOWED`   | `1` | Hard service ceiling: only `1` admits Git membership and status; every other value denies them. |
 | §operator-config-file-create-scope `PLURNK_SERVICE_FILE_CREATE_SCOPE` | `root` | Hard file-creation ceiling: `none < root < namespace`. `none` denies new filesystem files, `root` admits only paths inside `project_root`, and `namespace` also admits canonical outside-root paths. Existing-member writes are unaffected. |
 | `PLURNK_SERVICE_FILE_MATERIALIZE_MAX_BYTES`                 | `104857600` | Byte ceiling in `1..104857600` for one workspace-file snapshot ({§membership-materialization-limit}). |
 | `PLURNK_SERVICE_MAX_TURNS`                                  | `-1` | Operator inference-turn **ceiling** — `-1` = no cap; a positive value clamps `runLoop({maxTurns})`. The effective value is persisted on the durable loop and counts completed model/inference turns cumulatively across every `202` park/resume; `_plurnk`, client, and plugin turns remain chronology but consume none of this allowance. |
@@ -3158,7 +3424,7 @@ Model selection uses one selector vocabulary in `ProviderRegistry` ({§provider-
 | `PLURNK_SERVICE_REQUIEM_MAX_TOKENS`                         | `16384` | Initial forensic witness output allowance ({§digest-requiem}). |
 | `PLURNK_SERVICE_REQUIEM_RETRY_MAX_TOKENS`                   | `32768` | Retry allowance; must be at least the initial requiem allowance ({§digest-requiem}). |
 | `PLURNK_SERVICE_FILES_ITEMS`                                | `-1` | Turn-0 catalog preview. Folder-capable schemes render a one-level `*` map with `dir/**` rollups; kernel docs remain recursive and explicitly complete. `-1` = markerless first pages; positive `N` explicitly caps only file-map rows; `0` / unset = off ({§actor-boundary-catalog-preview}). |
-| `PLURNK_SERVICE_MEMBERS_MODEL_SCOPE`                       | `none` | Ceiling for a model's `members` definitions in the lattice `none < root < namespace`; `none` refuses every model definition ({§members-model-scope}). |
+| `PLURNK_SERVICE_MEMBERS_MODEL_SCOPE`                       | `namespace` | Ceiling for a model's `members` definitions in the lattice `none < root < namespace`; `none` refuses every model definition ({§members-model-scope}). |
 | `PLURNK_SERVICE_EXEC_CONCURRENCY`                          | `12` | Executions admitted at once per workspace; the rest queue FIFO with `202 queued` receipts; `-1` unbounded ({§exec-concurrency}). |
 | `PLURNK_SERVICE_PROPOSAL_TIMEOUT_MS`                        | (empty — waits indefinitely) | Finite positive milliseconds before cancellation with outcome `timeout`; empty waits, and every other explicit value fails ({§proposal-timeout-cancels}). |
 | §operator-config-worker-warm `PLURNK_SERVICE_WORKSPACE_WARM_MS` | `900000` | Milliseconds a lease-free workspace Functionality snapshot remains warm; `0` cools without grace and `-1` disables time-based cooling ({§module-workspace-residency}). |
@@ -3364,7 +3630,7 @@ flowchart LR
 | `registerScheme(name, handler)` | Adds one process-wide addressable scheme handler; scheme readiness and model-facing capability publication remain core-owned. |
 | §module-action-registration `registerModuleAction({ name, scope, inputSchema, outputSchema, handler })` | Adds one non-empty, extension-unique action with resolvable JSON Schemas. `scope` is exactly `worldless`, `workspace`, or `worker`; the handler receives schema-validated params and a separate matching context. Scoped contexts contain trusted bound identifiers, never client parameters. A client-interface module decides whether and how the name becomes public, validates successful output, and owns collisions with its built-ins. |
 | §module-workspace-provider `registerWorkspaceCapabilityProvider(namespaceOwner, provider)` | Registers one extension-unique Functionality provider. `activate({ workspaceId, retain })` reconstructs the workspace snapshot; idempotent `deactivate({ workspaceId })` releases process resources. Core coalesces demand and supplies residency leases for work that outlives its caller. |
-| §module-workspace-state `readWorkspaceModuleState(workspaceId, namespaceOwner)` | Reads one nullable JSON state value per workspace and provider. Core owns storage and lifecycle; the provider owns its schema. Store symbolic credential references, not copied secrets. |
+| §module-workspace-state `readWorkspaceModuleState(workspaceId, namespaceOwner)` | Reads one nullable JSON state value per workspace and provider. Core owns storage and lifecycle; the provider owns its schema. Store symbolic credential references, not copied secrets. A worker-scoped family's coordinator reads and replaces the same shape per worker in `worker_module_state` ({§functionality-scope}). |
 | §module-functionality-adapter `registerFunctionalityAdapter(adapter)` | Registers one family beneath the shared coordinator ({§functionality-coordinator}). |
 | §module-workspace-capabilities `replaceWorkspaceCapabilities({ workspaceId, namespaceOwner, state, runtimes })` | Atomically replaces one provider's durable state and runtime/scheme snapshot at the workspace operation boundary. Namespace claims are validated before mutation. Failure restores the prior state and publication. |
 
@@ -3412,11 +3678,21 @@ workspace boundary. Durable configuration, history, and saved entries remain.
 New demand reconstructs the one shared snapshot. Shutdown cancels warm timers
 and closes module resources through their owning provider.
 
+§module-workspace-residency-facet **Residency is the workspace's; processes are
+one family's facet.** The workspace is the lease unit, and every family's
+publication rides the same replacement: its manager executor, its generated
+documents and its state. Only a family that holds processes prepares
+`runtimes` (MCP servers today); the field is absent for every other family, so
+warming and cooling bound workspaces, never families, and the two-stage rollback
+guards the manager registration of every family alongside the one family's
+processes. There is no per-family residency policy (operator, 2026-09-14:
+residency is MCP-specific and is not a family policy system).
+
 The version-1 baseline table `workspace_module_state` stores one JSON value
 per `(workspace_id, namespace_owner)`. It is configuration, not an executable
 registry. Deleting the workspace cascades its state; worker lifecycle does not.
 
-### §functionality Workspace Functionality
+## §functionality Workspace Functionality
 
 §functionality-coordinator **One coordinator owns the common lifecycle.**
 Agent Skills, MCP, outbound A2A agents, and membership are adapters beneath
@@ -3439,7 +3715,11 @@ Retryability describes the actual failed condition, not its numeric status.
 
 §functionality-adapter **An adapter owns protocol truth.** It declares its
 family, namespace owner, definition schema, contributed defaults, discovery,
-admission, preparation, and teardown. Admission distinguishes explicit client
+admission, preparation, and teardown, and its alias grammar when that is not
+the shared lowercase-hyphen one: the coordinator enforces whichever grammar the
+family declares, at admission, in the service projection, and on persisted
+state, so an environment variable's name is an alias exactly as a skill name
+is. Admission distinguishes explicit client
 actions from model operations where the family contract requires it
 ({§members-model-scope}). Preparation returns runtimes, documents, per-alias
 outcomes, and a snapshot with `commit`/`abort`. Successful publication commits;
@@ -3447,17 +3727,79 @@ failure aborts; cooling tears down. Protocol continuations remain ordinary
 module actions. Optional `forget` releases an installed or provisioned
 definition before removal; failure rejects removal ({§skills-remove}).
 
+§env-functionality **Environment is the fourth family, owned per Worker.** Its two origins
+are the ambient names the operator's ceiling admits ({§exec-env-scoped}, service origin, enabled
+until a Worker disables one for itself) and the Worker's own entries (worker origin). `add` takes
+the name as the alias and `{ "value": "…" }` as the definition, used verbatim with no
+interpolation. `disable` withdraws a name from the Worker's spawns while retaining it, which is
+how `CI=1` goes away for one Worker without an operator change; `remove` forgets a Worker's own
+entry and a same-name service baseline reappears disabled, so removal never silently changes what
+the next spawn sees. Service definitions are disable-only.
+
+`list` projects effective values with their origin. Values are shown: the ceiling is the security
+boundary, not the projection, and any admitted name is already readable by every command the
+Worker runs — withholding it here would be theatre and would make `list` lie about the
+environment its commands receive. A name the invariant reserves (`PLURNK_*`, provider credential
+names) is refused at **admission**, not dropped at the spawn, so the model learns why.
+
+`discover` is this installation's configuration catalog: every name an installed package declares
+under {§operator-config-env-defaults} that a Worker may set, projected as candidates whose summary
+is the declaration's own comment and whose provenance is the declaring package. The names the
+invariant reserves — plurnk's own configuration and provider credentials — are the operator's and
+never appear, so the catalog stays short enough to read whole. `query` matches a name or the
+comment that documents it, never a value. It is not a permissions list beyond that — a Worker may
+set any name it lists or none of them — it answers which names have a **consumer**, and it is how
+a Worker learns the name of a value only the operator can supply. The catalog projects
+declarations, never the host environment, so a credential the operator has filled in appears by
+name with its documentation and an empty value ({§exec-env-scoped}: referred to by name, never
+read). `configuration` is refused: a client's own environment contributing candidates would be a
+second door past the ceiling.
+
+The family publishes no runtimes. An environment is read at the spawn that uses it, never held
+resident, so it never enters the warmed capability snapshot ({§module-workspace-residency}).
+
+§functionality-scope **A family declares who owns its definitions.** Skills, MCP, members
+and outbound A2A describe what exists in a **workspace**: a capability, resident or installable,
+that every Worker there shares. Environment describes how one **Worker** works — context rather
+than capability — so its definitions are owned per Worker. The adapter declares `scope`
+(absent means workspace) and the coordinator keys durable state and the locally-owned `origin`
+by it: a workspace-scoped family's own entries carry origin `workspace`, a worker-scoped
+family's carry `worker`. Origin names ownership, never scope, so a projection never claims the
+workspace set a value one Worker set for itself. Nothing else in the contract varies: the six
+verbs, the two projections, enabledness, and the service-baseline rules are one implementation
+across every family, which is what keeps their idioms from drifting apart.
+
+A worker-scoped family projects `worker.<family>.<verb>` in place of
+`workspace.<family>.<verb>`; the action's context names the Worker, as every execution
+does. Its durable value is the same shape per (worker, family) in `worker_module_state`, read
+at each verb and at each spawn rather than held in the workspace snapshot. Its `list` and
+mutations serialize on the Worker's own lane and take no workspace exclusivity: nothing
+resident changes, and the next spawn reads the state, so a Worker shapes its own environment
+while its siblings run. Its preparation yields outcomes only — no runtimes, documents or
+snapshot — and the coordinator refuses one that does more.
+
+A Worker created with a parent — WORK and FORK alike — starts with a copy of the parent's
+worker-scoped state, taken at creation. The child owns its copy: neither side's later edits
+reach the other, and depth is transitive with no further rule. Each copied entry carries
+`inherited`, the Worker that set it, preserved across generations until the child changes that
+entry, so `list` never claims the child set what it inherited; a parent's masking of an
+ambient name travels the same way. WORK and FORK may hand the child more: the heading's `env`
+option lands as the child's own entries through `add`, after the copy ({§env-option}).
+
 §functionality-state **One durable value per workspace and family.**
 `{ version: 1, definitions: { [alias]: { origin, enabled, definition? } } }`
-is stored under the provider namespace in `workspace_module_state`.
-A `service` entry persists enabledness; a `workspace` entry persists its exact
-definition. Active, unavailable, and authorization-required are preparation
+is stored under the provider namespace in `workspace_module_state`; a
+worker-scoped family ({§functionality-scope}) stores the same value per worker
+and family in `worker_module_state`.
+A `service` entry persists enabledness; a `workspace` or `worker` entry persists
+its exact definition. Active, unavailable, and authorization-required are preparation
 outcomes, not durable desired state. The configuration cascade contributes
 defaults; one workspace snapshot is effective authority.
 
 §functionality-publication **One replacement publishes a family.** The
 coordinator prepares, then replaces state and runtimes through
-{§module-workspace-capabilities}, with the manager followed by adapter runtimes.
+{§module-workspace-capabilities}, with the manager followed by any runtimes the
+adapter prepared ({§module-workspace-residency-facet}).
 Admission, tools, documents, Turn 0, and client status consume that publication.
 The coordinator's synchronous `publish` participates in the registry commit;
 its returned undo restores the previous view before rollback reconciles documents.
@@ -3482,6 +3824,10 @@ effects and use normal proposals. Summary, signatures, and deep docs derive
 from the same registry ({§tools-resource-materialization},
 {§executor-input-schema-preview}). Outcomes stream into the invoking operation's
 output entry. The manager closes over workspace identity, not worker identity.
+A worker-scoped family's verbs nonetheless act for the invoking Worker: Core
+binds that Worker to the manager at the operation, so the published manager
+stays one per workspace and the executor framework's arguments carry no
+identity ({§functionality-scope}).
 
 §functionality-document-body **A family's teaching is an authored file beneath
 its generated header.** The adapter names its package directory (`docsDir`);
@@ -3507,7 +3853,7 @@ a failed preparation, and fails 409 while the workspace is held
 ({§module-workspace-quiescence}). Rejecting a proposal prepares, persists, and
 publishes nothing.
 
-### §methods ApplicationPort function set
+## §methods Application interface
 
 `ApplicationPort` is the contracts-owned interface implemented by `Daemon` and
 consumed by every exterior adapter ({§application-port}). Its function names are
@@ -3524,7 +3870,7 @@ Core's behavior behind them.
 | §methods-loop-run Loops                           | `runLoop({ workspaceId, workerId, prompt, source?, maxTurns?, policy?, openPaths?, selector?, childSelector? })` | Validates a model worker and complete loop policy, persists it with the effective turn ceiling, then returns an immediate status-100 acknowledgement with `loopId` and `action`. A trusted adapter may identify the prompt's causal actor with one canonical `source`; ordinary clients cannot author it through their protocol surface. The exact terminal result arrives only through `loop/terminated`; parking and resuming do not replace the loop. |
 | §methods-loop-cancel Loops                        | `cancelDrain(workerId, reason?)`; `cancelWorker({ workspaceId, workerId, reason? })` | `cancelDrain` begins durable structured cancellation and reports whether process-local work existed when called; queued or parked durable work is still terminalized when it is `false`. The ownership-bounded `cancelWorker` awaits that same tree cancellation and stream reap, so an exterior protocol can project the settled durable result without polling or fabricating state. |
 | §methods-op-mirror Client dispatch                | `dispatchClientAction({ workspaceId, workerId, statements })` | Dispatches already-parsed grammar statements as one client action in one administrative loop in the client worker, executing in the workspace's Functionality ({§actor-boundary-attached-functionality}). Every statement is an ordered client/operation turn, and every committed `log/entry` is emitted before the action promise resolves; a proposal may keep its turn, loop, and action promise open until resolution. Core exposes no per-op method family. |
-| Client observation                                | `look({ workspaceId, workerId, statement })` | Runs an already-parsed READ through the full resolver in the workspace's Functionality without a log row. A non-READ statement is rejected ({§op-look}). |
+| Client observation                                | `look({ workspaceId, workerId, statement, perspectiveWorkerId? })` | Runs an already-parsed READ through the full resolver in the workspace's Functionality without a log row. A non-READ statement is rejected ({§op-look}). |
 | §methods-log-read Reads                           | `readLog({ workspaceId, workerId, ...coordinate })` | Ownership-checks the worker, then reads by ids, recency, or the complete `loopSeq`/`turnSeq`/`sequence` display coordinate. `limit` defaults to 100 and is capped at 1000. |
 | §methods-entry-read Reads                         | `readEntry({ workspaceId, workerId, target, channel?, offset? })` | Resolves the selector from that worker's perspective and returns {§entry-read-result}, either complete or as one channel suffix, without creating action evidence. |
 | Providers                                         | `listProviders()` | Lists configured aliases with provider/model identity, active state, and the effective provider-derived `inputCapacity` when known. |
@@ -3582,11 +3928,11 @@ later create or attach result without requiring a new transport; it resolves the
 conversation worker separately, while each client action allocates its own
 administrative loop under {§connection-lifecycle}.
 
-§methods-worker-name-reserved **Client worker-name admission.** Attach,
+§methods-worker-name-admission **Client worker-name admission.** Attach,
 fresh-conversation, and fork apply {§worker-name-minting} before lookup or
-creation. A client therefore cannot forge or resume an internal worker, insert
-a non-mintable spelling, or make the client registry diverge from model worker
-control.
+creation. A client therefore cannot forge or resume the runtime actor (its
+name lies outside `WORKER_NAME`), insert a non-mintable spelling, or make the
+client registry diverge from model worker control.
 
 §capability-admission **One admission path owns external authority.** Core
 derives one or more `CapabilityDescriptor` demands from each routed statement,
@@ -3595,7 +3941,7 @@ survive before execution or proposal creation. A denial is an exact terse 403
 identifying the denied descriptor and owning policy scope; it never guesses the
 model's intent or recommends an alternate operation. COPY demands observation
 of its source and mutation of its destination; MOVE additionally demands
-mutation of its source; resource-backed EXEC demands its runtime plus source
+mutation of its source; a resource-backed execution demands its runtime plus source
 observation. Unknown schemes, runtimes,
 and tools continue to their ordinary resolver so capability policy cannot turn
 absence into a misleading restriction. The same resolver shapes generated
@@ -3639,7 +3985,7 @@ client-interaction lifecycle — durable pause, reconnect discovery,
 cancellation, and the answer-as-resolution all come from
 {§client-interactions}; there is no loopback MCP and no proposal masquerade.
 Answer and cancellation resume the same waiting loop whether resolved before
-or after it parks; the next packet contains the result without replaying EXEC.
+or after it parks; the next packet contains the result without replaying the execution.
 Effect `read`: the tool observes the human's answer and is never
 proposal-gated. Its runtime declares the `interaction` trait, which the shared
 resolver projects as access class `interact`; any capability-policy layer may
@@ -3679,7 +4025,8 @@ cascade. A WORK/FORK child copies the spawning loop's effective spawn model
 no live link and begins with no override, so a later parent change affects
 only that worker's future loops and descendants. Client operation actors and
 Plurnk-owned bookkeeping workers run no model loops and own no model
-selection. An explicit model, spawn-override, or reasoning-policy change while
+selection; the model, spawn-override, and reasoning controls refuse them with
+`409 model-worker-required` before any policy row is initialized or written. An explicit model, spawn-override, or reasoning-policy change while
 the worker holds any queued, running, or parked loop is a precise
 `409 worker-loop-active` ({§worker-lifecycle-live}), independent of a process-local
 drain. The policy write checks liveness atomically, including selections carried
@@ -3774,7 +4121,10 @@ spelling and grammar parsing. It rewrites a valid LOOK statement to READ and
 hands the AST to core's `look`; core owns the full resolver and the no-log
 invariant. The internal closed, rowless observation segment supplies an honest
 numeric loop coordinate for relative `log:///` addressing without leaving
-active lifecycle behind. LOOK text anchors resolve through the same
+active lifecycle behind. The segment belongs to the acting worker (`workerId`);
+the READ resolves as `perspectiveWorkerId` when one is given — `log:///`, `reasoning:///`,
+and `ops:///` as that worker sees them — so a client can look at a conversation without
+adding a loop to it. LOOK text anchors resolve through the same
 {§line-anchors} path as READ.
 
 ### §notifications Core events
@@ -3834,12 +4184,7 @@ module that publishes that protocol.
 
 ---
 
-## §decisions Architectural decisions
-
-Tagged decisions state the durable contract and the reason for it. Investigation,
-implementation status, and superseded alternatives belong in forge issues.
-
-### §packet-assembly Packet assembly: engine builds the default list, plugins transform it
+## §packet-assembly Packet assembly
 
 `PacketBuilder.buildRequestPacket` owns the engine's default ordered section
 list. Trusted scheme plugins may transform that first-class list before it is
@@ -3853,7 +4198,7 @@ flowchart LR
     measure --> rail[Engine budget admission and dispatch]
 ```
 
-#### §packet-cache-monotone Default order and cache locality
+### §packet-cache-monotone Default order and cache locality
 
 Conditional absence never reorders the surviving default sections.
 
@@ -3870,265 +4215,70 @@ Conditional absence never reorders the surviving default sections.
 |     9 | user   | `git`                 | Per-turn workspace status; empty content is omitted. |
 |    10 | user   | `budget`              | `Context Curation`; omitted when capacity is unknown. |
 |    11 | user   | `prompt`              | Current prompt-entry pointers. |
-|    12 | user   | `recap`               | Optional authored operational recap. |
-
-The order favors prefix-cache locality where semantics permit: the definition
-and privileged policy lead operator notes, while the append-mostly
-log leads the volatile user-status clump. It does **not** claim that every system byte is
-immutable or that the complete packet is globally monotone in volatility:
-operator notes and policies can change. Trust is a separate
-admission rule. The system slot contains trusted control-plane material;
-attacker-reachable content stays in the user slot.
-
-#### §packet-plugin-transform Trusted whole-list extension seam
-
-`SchemeRegistry.transformSections` pipes the complete default list through
-every registered scheme implementing `transformSections(sections) -> sections`,
-in registration order, before rendering and measurement. The schemes-owned
-`PacketSectionDraft` contains only `name`, `slot`, `header`, and `content`.
-Each initial or returned list passes the schemes-owned validator, including
-unique-name enforcement, before the next transformer or renderer. Each
-transformer may inspect the section content and add, remove, or reorder
-sections. It receives no separate engine, database, actor, or request context.
-
-This is strictly a trusted in-process seam, admitted through the common plugin
-trust gate; an external client action cannot invoke it. Whole-list transformation is
-the fork-avoidance valve for alternate packet shapes ({§ecosystem}), while
-overflow recovery and packet projection remain closed engine concerns.
-
-### §tokenomics Tokenomics: four facts, one curation ruler
-
-Token accounting distinguishes the artifact being measured, the unit, and the
-time of measurement.
-
-| Fact | Owner and unit | Time | Contract |
-|:-----|:---------------|:-----|:---------|
-| Core curation weight | `contentWeight = ceil(chars/2)` over channel content, canonical log bodies, and rendered packet slots | Write/build | Stable, model-independent pressure and curation savings; never a tokenizer claim. |
-| §tokenomics-context-envelope-admission Provider input capacity | Provider model limits and configured total output envelope, in provider tokens | Before every logical request | `min(maxInputTokens, contextWindow - outputBudget)` over the known terms. The provider alone measures the complete request and admits, defers, or rejects it. |
-| Provider generation envelope | Provider total output budget and optional reasoning subset, in provider tokens | Before every logical request | One total output budget includes hidden reasoning. A reasoning budget is a strict subset, never an additive reserve. |
-| Provider usage and cost | Provider-reported input/output/cache/reasoning tokens and monetary evidence | After every physical request | Durable physical-request forensics under {§provider-usage}; never curation state or a preflight estimate. |
-
-- §tokenomics-weight-stored-at-write **Curation weight, stored at write.** `entry_channels.weight` weighs the complete channel content. `log_entries.weight` weighs the complete canonical `LogBody` content before coordinate and packet presentation; persistence `tx`/`rx` envelopes contribute nothing merely by existing, and proposal settlement recomputes the value when the canonical result changes. Bodyless rows therefore weigh zero. The stored number is a stable content-depth measurement, not a provider-token prediction.
-- §tokenomics-render-weight-budget **Packet curation budget.** `logTokensTotal` measures the *complete assembled packet* after section transforms and readout substitution; it is not a sum of log-row `logTokens` fields. Core measures minimum-width probes, monotonically expands fields that do not fit, then right-aligns final values into those widths; final substitution is length-invariant and the displayed total equals the stored request weight. Receipt, FIND-item, pressure-inventory, total, and ceiling figures all use the same curation ruler. A `SUM` of stored content weights measures a different artifact and cannot substitute for packet render weight.
-- §tokenomics-calibrated-readout **Convert capacity, never content costs.** Before packet assembly, Core obtains the answering model's last five settled emission responses pairing a measured packet weight with a provider-reported prompt count. The conversion factor is `sum(reported) / sum(weight)`; fewer than three samples use 1. `logTokensMax = floor(inputCapacity / factor)` converts provider capacity into curation units. Zero means no whole curation unit fits; unknown input capacity remains `null`. The built packet captures this allowance once for its readout, pressure inventory, overflow admission, and persisted client gauge. Later responses cannot change that packet's allowance. Samples are model-keyed, not worker-local; a model with no samples starts at 1. Calibration never changes stored weights, rendered receipt costs, or the immutable request history ({§tokenomics-agnostic-ruler}).
-- §tokenomics-window-partition **One capacity derivation; no service-side token budget.** The provider owns model limits and the configured total output envelope. Its resolved `inputCapacity` supplies the physical denominator exposed to clients and the boundary conversion into curation units ({§tokenomics-calibrated-readout}). Core shapes context in curation units; provider request-shaped evidence alone admits or rejects physical I/O. `PLURNK_SERVICE_PROMPT_BUDGET`, `PLURNK_SERVICE_SAFETY`, and the additive reasoning/completion reserve knobs are retired; local and custom deployments tune context window, total output budget, optional reasoning subset, and prompt-projection percentage at their owning layers.
-- §tokenomics-prompt-projection-share **Prompt projection is stable packet policy.**
-  `PLURNK_SERVICE_PROMPT_PROJECTION` is a required alias-scoped percentage in
-  `(0, 100)`. It allocates that share of the cold-start curation allowance
-  (the capacity conversion with factor 1) to the aggregate automatic prompt-body
-  projection. Rolling calibration does not resize existing prompt bodies; only
-  the overall curation ceiling adapts. This does not bound stored prompt
-  size, provider capacity, an explicit READ/FIND result, or the complete packet.
-  Basing the share on configured capacity rather than current free weight or
-  sampled conversion keeps one prompt's projection byte-stable as the log and
-  calibration samples evolve.
-- §tokenomics-window-unpollable-deliberate **Unknown provider capacity stays unknown.** When the provider cannot derive `inputCapacity`, Core omits denominator-dependent curation telemetry and uses the ordinary bounded prompt projection. The provider still sends requests whose measurement or limits are estimates or unavailable: ambiguity defers to the upstream capacity oracle rather than becoming a local rejection.
-
-§tokenomics-client-gauge **Clients receive curation and physical occupancy as separate pairs.** `loop/terminated.usage` carries latest packet-bearing model-turn `curationWeight`/`curationBudget` and latest-emission-call `contextTokens`/`contextCapacity`; each unknown fact is `null`. The curation pair is the packet's measured weight and captured allowance, exactly as displayed to the model, not a recalculation using newer usage evidence. Packetless chronology cannot erase an assembled-request gauge. Both physical facts bind to that same call: a preflight rejection may report capacity while its absent physical request leaves `contextTokens=null`, never borrowed from an earlier call. Clients never divide provider-reported physical tokens by Core curation weight. `providers.list` exposes each instantiated alias's `inputCapacity`. A model switch replaces the latest-turn facts together; aggregate provider accounting remains cardinal monetary evidence, not a gauge input.
-
-- **Derivation is exhaustive and demand-led.** Explicit searchable-resource changes may start one coalesced warm. Passive creation and attachment do not. The first model turn starts or joins that warm; later turns derive intervening changes before dispatch. No model operation observes partial graph or full-text coverage. Progress notices make the wait visible. {§derivation-exhaustive}
-- §membership-binary-sniff **Binary truth beats a text label.** Filesystem source acquisition, including tracked members and installed skill resources, inspects up to the first 8192 bytes when extension detection does not identify a binary type. NUL marks `application/octet-stream`; existing binary types retain their declared type. Member projections follow {§membership-source-projection}; installed skill projections follow {§skills-resources}.
-- §tokenomics-agnostic-ruler **One model-agnostic curation ruler.** The daemon runs workers on different models in one workspace concurrently, while catalog and log accounting are workspace-wide. `contentWeight = ceil(chars/2)` therefore gives one content one stable number without per-model workspace state or recount passes. It controls curation only; every provider call independently measures the complete request as well as it can.
-- §tokenomics-neutral-telemetry **Curation telemetry is state, not response allowance.** The model-facing `Context Curation` section is one JSON object carrying `logTokensTotal` and `logTokensMax` (and `tokensResponseMax` when an output floor is disclosed), so the block opens as a JSON payload like ```` ```TASK ````. It never presents their difference as free response tokens. The protocol definition directly requires KILL of irrelevant log items and ranges to keep the next packet within the maximum. Per-entry weights remain on log rows where they describe visible cost and curation savings. Generic packet composition and physical-token speculation are absent.
-- §tokenomics-pressure-inventory **Pressure identifies its reclaimable concentration.** At 80% of `logTokensMax`, a Markdown `> [!WARNING]` block follows the JSON with `> YOU MUST KILL superseded, stale, or irrelevant log items and ranges.` New output withholding replaces that mandate under {§context-output-warning}. The JSON may include `logTokensLargest`: at most five retained log items, each `{path, logTokens}`, ranked by that charge descending and then path. Native-only, suppressed, and metadata-only items remain eligible: whole-item KILL can reclaim their actual contribution. Include the largest prefix that fits; drop the optional list before the warning. Both participate in the final fixed-point total and complete request admission check.
-- §tokenomics-content-hash-identity **Content identity, not per-tokenizer counts.** Static channel writes stamp `content_hash` (SHA-256) as stable content identity. `weight` is stored beside that content and is never keyed or recomputed by model.
-- §tokenomics-provider-usage **Provider accounting is physical-request evidence, not curation state.** Every issued physical request has one durable pre-I/O `provider_requests` identity beneath the normalized {§inference-ledger} and settles once as response or error. Each record preserves conventional {§provider-usage} quantities and required {§provider-cost} evidence; an unreported quantity remains absent, including on response-less failures, and is never replaced by zero. `model_calls` own response/failure evidence, `turn_attempts` specialize emission admission, and `provider_requests` are the sole durable accounting representation. Emissions, BARE calls, rejected responses, retries, failovers, and errors therefore remain cardinal and ordered. Turn, loop, worker, workspace, digest, and protocol accounting are derived from those records through the shared {§provider-accounting} projection; only emission calls contribute the latest-packet context gauge. The baseline stores no floating-point money, denormalized totals, or rollup triggers. A documented direct charge becomes `charged`; otherwise the provider may compute an exact-decimal USD `estimated` amount from complete usage and the exact model's Models.dev rates; insufficient evidence becomes `unknown`. Derived `costUsd` sums every USD-expressible request and is `null` only when no request is expressible; a response-less failure or an uncataloged model is skipped, never allowed to erase the expressible evidence. Each derived aggregate usage field independently sums its reported quantity, so heterogeneous detail coverage remains partial rather than becoming fictitiously complete. This is operational request accounting, not invoice reconciliation. Output and reasoning are quantities the model cannot KILL, so they never alter the model-facing Budget ledger.
-- §tokenomics-negative-pressure **Negative curation pressure is honest but never submitted.** The provisional readout may report `logTokensTotal` above `logTokensMax`. Crossing the maximum withholds new returned output under {§context-output-admission}; no over-ceiling packet reaches `provider.generate`. Output admission creates neither a strike nor another turn.
-
-### §membership Workspace identity, membership, disk co-location
-
-The project-file path has two explicit reconciliation gates. Internal entries do
-not participate in this disk loop.
-
-```mermaid
-flowchart LR
-    git["Git tracked"] --> resolve["Resolve workspace membership"]
-    include["include"] --> resolve
-    exclude["exclude"] -->|subtract| resolve
-    resolve --> materialize["Pre-turn materialize<br/>disk → file snapshot"]
-    materialize --> read["READ snapshot"]
-    materialize --> edit["EDIT against snapshot"]
-    edit --> proposal["Proposal"]
-    proposal -->|"client accepts or loop auto"| cas["synced_sig compare-and-swap"]
-    cas -->|"file snapshot → disk"| project["Project file"]
-    project --> materialize
-```
-
-| Concern            | Owner and representation                                                                                                                    |
-| ------------------ | ------------------------------------------------------------------------------------------------------------------------------------------- |
-| Workspace identity | `workspaces.project_root`; null is headless. There is no separate project entity.                                                           |
-| File visibility    | Workspace-tier resolved membership: `(tracked files ∪ include) − exclude` ({§membership-baseline}). Every worker sees the same result. |
-| File reads         | READ returns the materialized file snapshot stored in the entry body channel; it does not read disk directly.                               |
-| File writes        | EDIT proposes against that snapshot. Only accepted resolution with the captured `synced_sig` writes the project file.                       |
-| Internal entries   | Workspace or worker entries are canonical store state. Writing one never implies a project-file write.                                      |
-| Authority          | Service flags set the membership ceiling; the `members` family's definitions include and exclude within it; client or loop auto resolves proposals. `origin` is attribution. |
-
-§web-search-retrieval **Web discovery is an ordinary MCP concern; retrieval is a first-class composition.** PLURNK owns no search runtime: a search-capable MCP server (e.g. Brave Search) participates through the ordinary MCP contract — admission, read-effect classification, tool documentation, and packet projection are identical to every other MCP tool ({§mcp-tool-presentation}). An executor that wants to materialize discovered pages uses the generic `content: null` `entry()` request ({§exec-entry-sink}): the guarded `WebFetcher` sink fetches candidates in parallel, off the write-serialization chain, and materializes successful bodies as ordinary HTTP entries. Every candidate whose `entry()` call rejects, regardless of failure reason, is mechanically omitted from the model-facing result directory; survivors retain upstream order. Without an entry sink the executor cannot test materialization and omits the verdict.
-
-Search prefetch and direct HTTP READ materialize the same resource contract:
-protocol + canonical authority (including a non-default port) + path + serialized
-query is the absolute identity ({§scheme-address-network}); the sanitized
-readable projection is the fragmentless default, while faithful DOM, origin
-media type, and projection identity remain explicit auxiliary evidence. A
-normal
-```` ```READ (https://host/path?query) ```` therefore publishes only the sanitized body
-under that exact URL—never raw HTML, response headers, or a channel-selection
-lesson. FIND consumes the addressed stored channel representation
-and never re-fetch a match.
-
-§web-retrieval-live Coverage protects the composition at distinct seams: HTTP unit tests pin fragmentless-body publication and explicit auxiliary selection; integration tests pin materialize→FIND and persistence/publication separation. A live positive-control demo requires a materialized HTTPS body and a substantive answer from a real sanitized page; live discovery demos remain diagnostic and may expose model judgment failures without weakening these assertions.
-
-**Git is the substrate and the repository is the boundary:**
-
-- §membership-baseline **The baseline contract — chiseled (#400).** To a workspace a
-  project file is exactly one of three things: **invisible**, **added**, or **tracked
-  by git**. There is no fourth category. Membership — what the model can READ and
-  FIND, what is materialized into the store, what a packet can ship to a provider — is
-  the allowlist `(tracked ∪ include) − exclude` and nothing else. No file is a member because
-  it exists on disk, because git does not ignore it, or because a model would find it
-  convenient: ambient admission of untracked files is prohibited, so a workspace rooted
-  in a home directory or a monorepo exposes exactly what was committed or added (the
-  non-member rule, {§fs-write-nonmember}: no read, no leak, no overwrite). Every
-  exception is a named clause in the register ({§membership-model-universe}), admits
-  files by an exact creation record with recorded provenance, and never by `git add`.
-  Changing this clause, the register, or the composition is an operator ruling recorded
-  on the issue that lands it — never an implementation convenience, never a side effect
-  of making a file visible to solve the problem at hand. The 2026-07-12 – 2026-08-27
-  "untracked-but-not-ignored" ambient admission is retired.
-- §membership-model-universe **The exception register — files in the model's universe.**
-  Admitted by exact creation records (`source: "create"`, origin `constraint`), never
-  staged: (1) a file an accepted EDIT creates; (2) a COPY/MOVE destination
-  ({§membership-create-parents}). Admitted by a published standard as projected
-  instruction documents — never as members: (3) the project's `AGENTS.md` and nested
-  `AGENTS.md` files ({§turn0-agents-stunt}, #346), read from disk regardless of git status
-  and materialized as `worker:///_plurnk/agents.md` and
-  `worker:///_plurnk/instructions/<subtree>/AGENTS.md`; the file itself is a member
-  only when tracked or added, and the standard never overrides the operator's
-  exclusions — an `AGENTS.md` the repository ignores or an exclusion matches
-  is not projected. (4) A definition the model proposes through the `members`
-  family ({§members-functionality}), admitted only under the operator's ceiling
-  `PLURNK_SERVICE_MEMBERS_MODEL_SCOPE` (shipped `none`), projected with source
-  `model`, and never admitted past the repository's ignore rules or an exclusion.
-  Nothing else.
-- §membership-git-membership The workspace owns the Git repository containing
-  `project_root`. Its tracked files (`git ls-files` semantics) are members with
-  no explicit overlay; when the root is a package inside a monorepo, the
-  repository's other packages are members at root-relative paths. An unrelated
-  or nested independent repository is not discovered or managed by this
-  workspace. When Git is absent there is no filesystem walk; member definitions are
-  then the sole source.
-- §git-native-default **Core Git reads use native Git.** Membership and status
-  execute the installed Git binary. An absent or failed binary yields no
-  automatic Git membership or status; core has no alternate implementation or
-  fallback.
-- §membership-git-hermetic Native Git runs with ambient `GIT_*` and
-  global/system config scrubbed, and with the repository's own program-running
-  keys pinned off at the highest precedence (`core.fsmonitor=false`,
-  `core.hooksPath=/dev/null`), so repository identity follows `project_root`,
-  never the daemon's launch environment, and inspecting a supplied repository
-  never runs a program its `.git/config` names. Other repository-local
-  configuration is still read (#568). The one program no key can pin off is a
-  `filter.<name>.clean` / `filter.<name>.process` driver, which `git status`
-  index refresh may run: automatic inspection asks the repository's own config
-  first (`git config --get-regexp`, no program runs) and, when any such key is
-  declared, refuses the repository as a warning-and-skip — Git status and
-  automatic Git membership answer exactly as for a non-repository, and one
-  `engine:membership` / `git_inspection_refused` notice names the key, once per
-  workspace until it changes or clears. User- and model-requested Git commands
-  stay on their explicit execution path.
-- §membership-edit-membership-gate **Membership-gated edits.** EDIT is bounded by membership exactly as READ is. An existing **member**'s baseline is its entry snapshot — the body channel the model READ, not a fresh disk read — so the diff is naive against the view the model saw, never empty (the write-side CAS, {§membership-edit-write-cas}, prevents the silent overwrite of out-of-band drift). An existing **non-member** is refused (403) *before* any read or write: the model never reads a file it can't see (no leak into the proposal) and never overwrites one (no wiping a gitignored `.env` it never added). A **new path** crosses the creation matrix in {§fs-write-surface}; proposal acceptance cannot bypass its scope, exclusion, or incorporation rules. Shell execution reaches beyond file membership; the file scheme does not.
-- §membership-create-parents **Parent-complete creation.** An accepted File creation—whether authored as EDIT or as a COPY/MOVE destination—recursively creates missing parent directories before writing and registering the new member.
-
-**The overlay — `include | exclude`.** `workspace_constraints` holds the `members` family's projected definitions and the engine's creation records ({§members-projection}). Resolved membership is `(project repository files ∪ include) − exclude`.
-
-- §membership-auto-add **Auto-add** — the project repository's ambient membership is its tracked `ls-files`, with `git` origin; an untracked file is never an ambient member ({§membership-baseline}). An accepted creation is incorporated by an exact creation record, never by `git add` ({§membership-model-universe}); a record that cannot be written fails the creation transaction, never an orphan ({§file-create-no-orphans}).
-- §membership-overlay-include **`include`** — admit a file Git misses through a targeted pattern scan (files only), with `constraint` origin. `source: "members"` is a projected human definition, `source: "model"` a projected model definition, `source: "create"` the exact durable record of an accepted creation. Only `members` inclusions override active Git ignore. In a Git-absent root, inclusions are the sole file-membership source.
-- §membership-overlay-exclude **`exclude`** — a `!glob` definition removes a tracked or included file: resolution drops matches (`node:path.matchesGlob`) and reconciles so the entry set *equals* the member set. The lever to exclude a committed-but-oversized or sensitive tracked file; exclusions mask creation records without deleting their provenance ({§fs-create-masked}).
-- §membership-reconcile-sets **Reconciliation is two set statements.** Once the desired set is composed — `(git ls-files ∪ include) − exclude`, glob evaluation and Git shell-outs being the process's own — it lands as one `INSERT … SELECT FROM json_each` with the same idempotent provenance update as a single registration, and every overlay-owned member outside it leaves in one `DELETE … WHERE pathname NOT IN (json_each) RETURNING`, its prior body riding out of the statement. A path that also left disk truth (no longer a candidate at all) becomes a divergence from that prior content; an exclusion is silent. No per-path statement, no set difference outside the database.
-- §membership-glob-in-sql **A constraint is evaluated where it lives.** `glob_match(pathname, glob)` is `node:path.matchesGlob` registered into SQLite (`src/core/glob_match.ts`, deterministic), the one matcher every overlay decision uses, so a lookup that asks the constraints table a question — which exclusion covers this key, whether a members definition includes it, which inclusion owns each untracked path — is one statement over `workspace_constraints`, never a listing filtered in the process. Transient inputs the process already holds (a `git ls-files` listing against the exclude globs) stay filtered in the process; the function exists so the database's own rows can be asked, not so process data makes a round trip.
-
-**File ops act on the entry, not the disk; the two reconcile only at gates.** A `file:///` member is a row whose body channel holds its *materialized model-readable snapshot*. READ returns that channel; EDIT diffs against editable text snapshots — neither reaches the filesystem directly. Entry and disk reconcile at exactly two gates: the **pre-turn materialize** (disk → entry, below) and the **accept-time write-back** (entry → disk, {§proposal}). Between the gates the entry is the truth the model curates against, and `synced_sig` — the member's last-synced disk stat (`mtime:size`) — is the version token both gates compare on.
-
-§membership-source-projection Binary acquisition is transient and bounded by
-{§mimetype-binary-input}; durable entry channels remain Unicode text. Core-private
-`sourceProjection` attributes preserve the source mimetype, opaque projection
-identity, and terminal disposition without exposing raw bytes or a base64 lane.
-
-| Disk source                        | Durable body                                         | Operation effect                                                                 |
-| ---------------------------------- | ---------------------------------------------------- | -------------------------------------------------------------------------------- |
-| Text                               | Verbatim Unicode under the detected textual mimetype | READ and EDIT use the snapshot.                                                  |
-| Binary with readable projection    | Derived Unicode as `text/markdown`                   | READ uses the projection; source-aware EDIT remains 415.                         |
-| Binary without projection/over cap | Empty marker under the source binary mimetype        | READ and EDIT return 415; private metadata distinguishes unavailable from limit. |
-
-§membership-materialization-limit **A pathological member degrades, never the
-workspace.** `PLURNK_SERVICE_FILE_MATERIALIZE_MAX_BYTES` is a required positive
-byte ceiling over one disk source before Core reads it into the canonical file
-snapshot. Its valid range is `1..104857600`, bounded by the channel storage
-contract, and it ships at that 100 MiB maximum. An oversized path remains a real member
-with an empty body channel carrying a durable 413 producer result; no diagnostic
-sentinel impersonates file content. READ therefore names the path, observed bytes,
-ceiling, and recovery through the ordinary result contract, while EDIT returns the
-same 413 instead of diffing against a fictitious empty baseline. Core records the
-materialization disposition and ceiling privately, so an unchanged disk member is
-reconsidered when the operator changes the policy and otherwise remains a stat-only
-no-op. The file write gate independently stats the source against the same ceiling,
-so safety does not depend on a background warm winning a client-operation race.
-
-§derivation-dedup-parallel **The index dedups then parallelizes.** The derivation identity hashes the exact READ channel representation, mimetype, reader behavior, and applicable search exclusion. A channel or log projection attaches the immutable artifact only after it is complete; identical projections therefore share one FTS row and one symbol graph without copying. Distinct artifacts run with bounded producer concurrency (`PLURNK_SERVICE_DERIVE_CONCURRENCY`). Pending artifacts sort by readable content length before entering that pool, so small resources start first while every outlier still derives fully. Unset uses a host-relative square-root fan-out; a positive integer is an exact operator budget and `-1` claims every core. Graph persistence writes at most `PLURNK_SERVICE_DERIVE_STORE_BATCH` definitions or references per SQLite statement. Every launched worker settles before the maintenance pass reports success or failure, so one failed artifact cannot orphan sibling derivations. Every representation completed by a successful pass attaches a terminal classified artifact, identically at concurrency 1 and N. A changed pass emits one immediate `preparing` state, intermediate `indexing` heartbeats at `PLURNK_SERVICE_DERIVE_PROGRESS_HEARTBEAT_MS`, and one immediate `complete` or `failed` state. A no-op pass emits no lifecycle, an indexing heartbeat never claims 100%, and the model-facing Notice buffer retains only the current derivation state while live clients observe each heartbeat.
-
-The artifact also retains a positive `{§mimetype-parse-issues}` count and the
-full normalized `{§mimetype-summary}` when the exact parsed channel reported
-either. Both remain advisory alongside a normally completed search
-disposition; zero, empty, and unavailable evidence persist as absence. Catalog
-projection attaches either only to that channel, never to a sibling whose
-content the artifact does not describe.
+|    12 | user   | `recap`               | Optional authored operational recap. |
 
-Every completed artifact records one terminal disposition: `indexed`, `excluded`
-(the configured search-exclusion table), `unsearchable` (empty or binary), or
-`failed` (a typed {§mimetype-error-policy} invalid-source failure, or the
-handler's own defect on that one member — {§derivation-member-failure}).
+The order favors prefix-cache locality where semantics permit: the definition
+and privileged policy lead operator notes, while the append-mostly
+log leads the volatile user-status clump. It does **not** claim that every system byte is
+immutable or that the complete packet is globally monotone in volatility:
+operator notes and policies can change. Trust is a separate
+admission rule. The system slot contains trusted control-plane material;
+attacker-reachable content stays in the user slot.
 
-§derivation-member-failure **One member's derivation failure never ends the
-pass or the model's turn.** A handler defect on one member — a
-`MimetypeDerivationError` under {§mimetype-derivation-evidence}, the exception
-being a cancellation — is that member's terminal `failed` disposition, whose
-`reason` is the handler's invocation context followed by the exact original
-cause (`Mimetype derivation failed for "/x.js" ("text/javascript").
-RuntimeError: …`). The pass continues, attaches every other member, and
-completes; its terminal `search_progress` notice is `complete` at `level: warn`,
-naming the first failed member and carrying the count. A failed member is
-terminal for that exact content, handler revision, and configuration identity
-({§derivation-dedup-parallel}); a change to any of those derives it again.
-Everything that is not a handler's derivation of one member stays fatal to the
-pass exactly as before: a grammar that is not installed, an index-persistence
-or contract failure, and cancellation, each leaving the artifact `building` for
-retry.
-Cancellation and implementation, loading, database and index-persistence failures
-remain `building`, unattached, and retryable; Core never guesses that an arbitrary
-projection exception is bad content. The digest reports exceptional dispositions
-with their reasons. Successful optional projection degradations continue indexing
-and surface their framework Notice once per identical observation in a maintenance
-pass.
+### §packet-plugin-transform Trusted whole-list extension seam
 
-§membership-change-gated-sync **Sync is idempotent and change-gated.** Per turn, membership materializes every member's model-readable snapshot into its entry. Text with an unchanged disk signature and materialization policy is a stat-only no-op. The version token is either the observed `mtime:size` or the explicit `absent` state; an observed deletion removes the stale readable channels, and a later reappearance is therefore a new divergence rather than a first-sight materialization. Binary sources additionally compare the cached per-mimetype projection identity; unchanged bytes are never reacquired, while changed reader behavior rematerializes without fabricating a filesystem-divergence event. Coverage is exhaustive across the project repository while work is proportional to source or projection change. After a pass every member carries the current representation defined by {§membership-source-projection} and {§membership-materialization-limit}.
+`SchemeRegistry.transformSections` pipes the complete default list through
+every registered scheme implementing `transformSections(sections) -> sections`,
+in registration order, before rendering and measurement. The schemes-owned
+`PacketSectionDraft` contains only `name`, `slot`, `header`, and `content`.
+Each initial or returned list passes the schemes-owned validator, including
+unique-name enforcement, before the next transformer or renderer. Each
+transformer may inspect the section content and add, remove, or reorder
+sections. It receives no separate engine, database, actor, or request context.
 
-§membership-emi-divergence-signal **EMI divergence evidence.** The detector that gates the work *is* the one that records this — one mechanism, not a second full read. When change detection finds a member moved out-of-band, the runtime actor records an `EDIT`-shaped row naming the file with `source="file"`; it does not broadcast that workspace change into unrelated workers' logs ({§env-delta-filesystem-narration}). The model's own edits are write-through (the entry equals disk after a File write), so the scan never mis-attributes them as external divergence. The current file remains ordinarily addressable. A stale anchored edit rejects under {§line-anchors}; a disk race after proposal rejects under {§membership-edit-write-cas}.
+This is strictly a trusted in-process seam, admitted through the common plugin
+trust gate; an external client action cannot invoke it. Whole-list transformation is
+the fork-avoidance valve for alternate packet shapes ({§ecosystem}), while
+overflow recovery and packet projection remain closed engine concerns.
 
-§membership-edit-write-cas **The write-back is a compare-and-swap — never a clobber, never a clever merge.** EDIT is *naive against the editable text snapshot*: it diffs the model's change onto the entry's body channel — the exact Unicode the model READ — and the proposal carries the `synced_sig` that snapshot was taken at. Binary sources are refused before this path ({§membership-source-projection}). At accept, `applyResolution` re-stats disk and lands the proposed content only if that signature still matches. If disk moved out-of-band in the propose→accept window — a sibling worker, the user's editor, a build step — the write is **refused** with the same neutral `edit-collision` as {§edit-collision}, and **nothing is written**. The engine neither blind-writes over the ambient change (a *clobber*) nor silently re-diffs the model's edit against a state it never saw (getting *clever*) — both would bury a stale-view contract violation under a fallback. The collision surfaces instead: a ≥400 apply downgrades to a reject ({§proposal}), so the model sees that EDIT **did not occur** (400; the `edit_collision` outcome is forensics-only). Reconciliation aligns the current file projection and records the `source=file` evidence in the runtime log ({§membership-emi-divergence-signal}); the model re-reads and re-proposes against the fresh snapshot.
+### §tokenomics Tokenomics: four facts, one curation ruler
 
-The version travels *with the proposal*, never re-read from the entry at accept: a sibling worker in the same workspace may reconcile while this proposal sits paused, advancing the entry's `synced_sig` to the drifted disk — comparing against the *current* entry sig would wave that clobber through, so the comparison is always against the sig the proposal was computed at. A proposal that assumed an **absent** path (a create) conflicts only if a file has since appeared; a member with **no recorded snapshot** (an un-materialized entry, null `synced_sig`) has no baseline to guard and writes through — the two are told apart by the proposal's `existed` flag, not by a null sig alone. On a clean landing the entry refreshes to the written content and `synced_sig` is **restamped** to it, so the next reconcile recognizes the model's own write (not an external divergence) and a second same-turn edit bases on the landed bytes, not a stale sig. This is the write-side twin of the read-side change-gate ({§membership-change-gated-sync}): one `synced_sig`, gating both the re-read and the write.
+Token accounting distinguishes the artifact being measured, the unit, and the
+time of measurement.
 
-The CAS is the **hard backstop**, at the moment of writing, on every accept path. It composes with the model-facing {§line-anchors}: an anchor rejects a target whose relevant neighborhood changed before dispatch, while the CAS refuses to write against a snapshot disk left after proposal. An unanchored edit deliberately claims no pre-dispatch stale-view guarantee.
+| Fact | Owner and unit | Time | Contract |
+|:-----|:---------------|:-----|:---------|
+| Core curation weight | `contentWeight = ceil(chars/2)` over channel content, canonical log bodies, and rendered packet slots | Write/build | Stable, model-independent pressure and curation savings; never a tokenizer claim. |
+| §tokenomics-context-envelope-admission Provider input capacity | Provider model limits and configured total output envelope, in provider tokens | Before every logical request | `min(maxInputTokens, contextWindow - outputBudget)` over the known terms. The provider alone measures the complete request and admits, defers, or rejects it. |
+| Provider generation envelope | Provider total output budget and optional reasoning subset, in provider tokens | Before every logical request | One total output budget includes hidden reasoning. A reasoning budget is a strict subset, never an additive reserve. |
+| Provider usage and cost | Provider-reported input/output/cache/reasoning tokens and monetary evidence | After every physical request | Durable physical-request forensics under {§provider-usage}; never curation state or a preflight estimate. |
 
-§membership-git-flags **Permission flags.** Service-wide Git admission comes from {§operator-config-git-ceiling}. `PLURNK_SERVICE_GIT_AUTO=1` (default) includes the repository containing `project_root`; `=0` disables automatic Git membership, leaving member definitions as the only membership source. `ALLOWED` gates `AUTO`.
+- §tokenomics-weight-stored-at-write **Curation weight, stored at write.** `entry_channels.weight` weighs the complete channel content. `log_entries.weight` weighs the complete canonical `LogBody` content before coordinate and packet presentation; persistence `tx`/`rx` envelopes contribute nothing merely by existing, and proposal settlement recomputes the value when the canonical result changes. Bodyless rows therefore weigh zero. The stored number is a stable content-depth measurement, not a provider-token prediction. `entry_channels.lines` is the channel's line count beside it, a stored generated column SQLite keeps on every write (a trailing newline terminates the last line; empty content has none), so a catalog lists extent without reading bodies.
+- §tokenomics-render-weight-budget **Packet curation budget.** `logTokensTotal` measures the *complete assembled packet* after section transforms and readout substitution; it is not a sum of log-row `logTokens` fields. Core measures minimum-width probes, monotonically expands fields that do not fit, then right-aligns final values into those widths; final substitution is length-invariant and the displayed total equals the stored request weight. Receipt, FIND-item, pressure-inventory, total, and ceiling figures all use the same curation ruler. A `SUM` of stored content weights measures a different artifact and cannot substitute for packet render weight.
+- §tokenomics-calibrated-readout **Convert capacity, never content costs.** Before packet assembly, Core obtains the answering model's last five settled emission responses pairing a measured packet weight with a provider-reported prompt count. The conversion factor is `sum(reported) / sum(weight)`; fewer than three samples use 1. `logTokensMax = floor(inputCapacity / factor)` converts provider capacity into curation units. Zero means no whole curation unit fits; unknown input capacity remains `null`. The built packet captures this allowance once for its readout, pressure inventory, overflow admission, and persisted client gauge. Later responses cannot change that packet's allowance. Samples are model-keyed, not worker-local; a model with no samples starts at 1. Calibration never changes stored weights, rendered receipt costs, or the immutable request history ({§tokenomics-agnostic-ruler}).
+- §tokenomics-window-partition **One capacity derivation; no service-side token budget.** The provider owns model limits and the configured total output envelope. Its resolved `inputCapacity` supplies the physical denominator exposed to clients and the boundary conversion into curation units ({§tokenomics-calibrated-readout}). Core shapes context in curation units; provider request-shaped evidence alone admits or rejects physical I/O. `PLURNK_SERVICE_PROMPT_BUDGET`, `PLURNK_SERVICE_SAFETY`, and the additive reasoning/completion reserve knobs are retired; local and custom deployments tune context window, total output budget, optional reasoning subset, and prompt-projection percentage at their owning layers.
+- §tokenomics-prompt-projection-share **Prompt projection is stable packet policy.**
+  `PLURNK_SERVICE_PROMPT_PROJECTION` is a required alias-scoped percentage in
+  `(0, 100)`. It allocates that share of the cold-start curation allowance
+  (the capacity conversion with factor 1) to the aggregate automatic prompt-body
+  projection. Rolling calibration does not resize existing prompt bodies; only
+  the overall curation ceiling adapts. This does not bound stored prompt
+  size, provider capacity, an explicit READ/FIND result, or the complete packet.
+  Basing the share on configured capacity rather than current free weight or
+  sampled conversion keeps one prompt's projection byte-stable as the log and
+  calibration samples evolve.
+- §tokenomics-window-unpollable-deliberate **Unknown provider capacity stays unknown.** When the provider cannot derive `inputCapacity`, Core omits denominator-dependent curation telemetry and uses the ordinary bounded prompt projection. The provider still sends requests whose measurement or limits are estimates or unavailable: ambiguity defers to the upstream capacity oracle rather than becoming a local rejection.
 
-**Rationale.** Workspace is the right scope unit and the containing Git repository is its ordinary development boundary. Membership curation is tiered: Git bounds it by tracking, the client supersedes by overlay, and the model curates its render by READ/KILL. Supporting several independent repositories as one world would require Plurnk-owned topology, synchronization, and model teaching that Git already solves cleanly by treating them as separate workspaces.
+§tokenomics-client-gauge **Clients receive curation and physical occupancy as separate pairs.** `loop/terminated.usage` carries latest packet-bearing model-turn `curationWeight`/`curationBudget` and latest-emission-call `contextTokens`/`contextCapacity`; each unknown fact is `null`. The curation pair is the packet's measured weight and captured allowance, exactly as displayed to the model, not a recalculation using newer usage evidence. Packetless chronology cannot erase an assembled-request gauge. Both physical facts bind to that same call: a preflight rejection may report capacity while its absent physical request leaves `contextTokens=null`, never borrowed from an earlier call. Clients never divide provider-reported physical tokens by Core curation weight. `providers.list` exposes each instantiated alias's `inputCapacity`. A model switch replaces the latest-turn facts together; aggregate provider accounting remains cardinal monetary evidence, not a gauge input.
 
-**Schema.** The version-1 baseline stores the normalized {§inference-ledger},
-its model-response evidence, emission admission, and cardinal
-physical requests. Its constraints distinguish pending calls, response
-evidence, and response-less errors while monetary classification remains
-explicit.
+- **Derivation is exhaustive and demand-led.** Explicit searchable-resource changes may start one coalesced warm. Passive creation and attachment do not. The first model turn starts or joins that warm; later turns derive intervening changes before dispatch. No model operation observes partial graph or full-text coverage. Progress notices make the wait visible. {§derivation-exhaustive}
+- §membership-binary-sniff **Binary truth beats a text label.** Filesystem source acquisition, including tracked members and installed skill resources, inspects up to the first 8192 bytes when extension detection does not identify a binary type. NUL marks `application/octet-stream`; existing binary types retain their declared type. Member projections follow {§membership-source-projection}; installed skill projections follow {§skills-resources}.
+- §tokenomics-agnostic-ruler **One model-agnostic curation ruler.** The daemon runs workers on different models in one workspace concurrently, while catalog and log accounting are workspace-wide. `contentWeight = ceil(chars/2)` therefore gives one content one stable number without per-model workspace state or recount passes. It controls curation only; every provider call independently measures the complete request as well as it can.
+- §tokenomics-neutral-telemetry **Curation telemetry is state, not response allowance.** The model-facing `Context Curation` section is one JSON object carrying `logTokensTotal` and `logTokensMax` (and `tokensResponseMax` when an output floor is disclosed), so the block opens as a JSON payload like ```` ```TASK ````. It never presents their difference as free response tokens. The protocol definition directly requires KILL of irrelevant log items and ranges to keep the next packet within the maximum. Per-entry weights remain on log rows where they describe visible cost and curation savings. Generic packet composition and physical-token speculation are absent.
+- §tokenomics-pressure-inventory **Pressure identifies its reclaimable concentration.** At 80% of `logTokensMax`, a Markdown `> [!WARNING]` block follows the JSON with `> YOU MUST KILL superseded, stale, or irrelevant log items and ranges.` New output withholding replaces that mandate under {§context-output-warning}. The JSON may include `logTokensLargest`: at most five retained log items, each `{path, logTokens}`, ranked by that charge descending and then path. Native-only, suppressed, and metadata-only items remain eligible: whole-item KILL can reclaim their actual contribution. Include the largest prefix that fits; drop the optional list before the warning. Both participate in the final fixed-point total and complete request admission check.
+- §tokenomics-content-hash-identity **Content identity, not per-tokenizer counts.** Static channel writes stamp `content_hash` (SHA-256) as stable content identity. `weight` is stored beside that content and is never keyed or recomputed by model.
+- §tokenomics-provider-usage **Provider accounting is physical-request evidence, not curation state.** Every issued physical request has one durable pre-I/O `provider_requests` identity beneath the normalized {§inference-ledger} and settles once as response or error. Each record preserves conventional {§provider-usage} quantities and required {§provider-cost} evidence; an unreported quantity remains absent, including on response-less failures, and is never replaced by zero. `model_calls` own response/failure evidence, `turn_attempts` specialize emission admission, and `provider_requests` are the sole durable accounting representation. Emissions, BARE calls, rejected responses, retries, failovers, and errors therefore remain cardinal and ordered. Turn, loop, worker, workspace, digest, and protocol accounting are derived from those records through the shared {§provider-accounting} projection; only emission calls contribute the latest-packet context gauge. The baseline stores no floating-point money, denormalized totals, or rollup triggers. A documented direct charge becomes `charged`; otherwise the provider may compute an exact-decimal USD `estimated` amount from complete usage and the exact model's Models.dev rates; insufficient evidence becomes `unknown`. Derived `costUsd` sums every USD-expressible request and is `null` only when no request is expressible; a response-less failure or an uncataloged model is skipped, never allowed to erase the expressible evidence. Each derived aggregate usage field independently sums its reported quantity, so heterogeneous detail coverage remains partial rather than becoming fictitiously complete. This is operational request accounting, not invoice reconciliation. Output and reasoning are quantities the model cannot KILL, so they never alter the model-facing Budget ledger.
+- §tokenomics-negative-pressure **Negative curation pressure is honest but never submitted.** The provisional readout may report `logTokensTotal` above `logTokensMax`. Crossing the maximum withholds new returned output under {§context-output-admission}; no over-ceiling packet reaches `provider.generate`. Output admission creates neither a strike nor another turn.
 
 ### §context-output-admission Budget enforcement: returned-output admission
 
@@ -4160,7 +4310,7 @@ flowchart TD
 | Admitted | Normal projection, thereafter controlled only by deliberate curation and existing delivery rules. |
 | Withheld | Body/native parts stay absent in the original receipt; freeing space does not silently restore them. |
 
-§context-output-receipt A withheld receipt adds `overflow: "N output lines not shown; logTokensTotal exceeds logTokensMax"`, counting the output lines its normal current projection would show, not unrelated source lines. Withheld native media is named as `"N output lines and native content not shown; ..."` or, without a text body, `"native content not shown; ..."`. Its original result status and Problem are unchanged. FORK inherits admission state with the copied log. Explicit KILL still controls readable/active content independently.
+§context-output-receipt A withheld receipt adds `overflow: "N output lines not shown; the log exceeded logTokensMax when this row was withheld"`, counting the output lines its normal current projection would show, not unrelated source lines. Withheld native media is named as `"N output lines and native content not shown; ..."` or, without a text body, `"native content not shown; ..."`. Its original result status and Problem are unchanged. FORK inherits admission state with the copied log. Explicit KILL still controls readable/active content independently.
 
 §context-output-warning **New omission escalates the one curation warning.** The admitting request renders `> [!WARNING]` followed by `> YOU MUST ONLY KILL superseded, stale, or irrelevant log content in bulk.` beneath its JSON readout, replacing the ordinary pressure mandate even when withholding brings usage below 80%. Historical omission alone does not retrigger it. The warning participates in exact packet measurement; optional largest-items entries yield space first.
 
@@ -4244,126 +4394,6 @@ uses the voice door ({§actor-boundary-two-doors}); direct-child terminal
 disposition alone carries the structured-concurrency wake owned by
 {§worker-scheme-collect}. Stream progress remains owned by {§exec-stream}.
 
-### §edit-result-render Mutation log rows render truthful effects
-
-A mutation row keeps request and outcome separate: `tx` is the admitted
-statement; `rx` is its resolved result. Only state that actually landed may
-appear there as an effect.
-
-```mermaid
-flowchart LR
-    authored["Authored EDIT / scoped entry KILL / COPY / MOVE"] --> snapshot["Resolve addressed channel(s)<br/>against pre-mutation snapshots"]
-    snapshot --> apply["Apply synchronously<br/>or settle proposal"]
-    apply --> landed{"Did state land?"}
-    landed -->|no| rx["Persist structured rx"]
-    landed -->|yes| kind{"Operation?"}
-    kind -->|EDIT / scoped entry KILL| receipt["Project one EDIT receipt<br/>for this authored row"]
-    kind -->|COPY / MOVE| effects["Compose ordered effects<br/>after application"]
-    receipt --> rx
-    effects --> rx
-    rx --> meta["Packet projection<br/>status · operands · optional effect metadata"]
-    rx --> body["Canonical log body<br/>bounded receipt context or empty"]
-    body --> recall["READ log:///…<br/>selects untrimmed content"]
-```
-
-§edit-receipt-removed-text **A pure deletion's receipt quotes what it removed.** An applied effect that inserted nothing and removed at least one line carries `removedText` — the removed text, first 40 lines — projected on the wire as `removed`; an effect that inserted anything carries no such field, its resulting context shows the change.
-
-§edit-receipt-anchored-context **An applied EDIT's resulting context carries anchors.** The bounded resulting context each effect renders (`PLURNK_SERVICE_EDIT_RECEIPT_CONTEXT_LINES` around and inside the landed region) is rendered exactly as a READ renders — `@xxxxx L:text`, hashed with the resource's READ identity ({§line-anchors}) — so a later operation can cite the landed lines by anchor without a READ. A scheme that supplies no identity keeps the line-numbered form.
-
-§edit-result-receipt-projection **EDIT and scoped entry KILL project the
-scheme-owned batch receipt.** The scheme framework owns the exact aggregate
-shape ({§scheme-edit-batch-receipt}). Each operation supplies one splice; Core
-validates and projects its one applied effect or superseded disposition.
-That row carries any reviewer replacement effect. Core stores only the
-per-operation projection on `rx`; the aggregate remains inside dispatch.
-
-| Durable receipt fact                   | Packet projection                                                 | Meaning                                                                                                                   |
-| -------------------------------------- | ----------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------- |
-| Full `revision`                        | not projected                                                     | SHA-256 identity of the complete landed channel body, kept in the durable receipt for forensics; no operation takes a revision, so the packet carries none (operator, 2026-09-13). Formerly `rev`, abbreviated; the display knob is gone. Never a lookup or compare-and-swap token. |
-| `unit`, `before`, `after`              | `extent`                                                          | Whole-line batches use line counts. A batch containing any exact four-coordinate edit uses Unicode code-point counts.     |
-| `parseIssues.before`, `parseIssues.after` | `parseIssues` as `before→after`                                 | Parser-recovery counts for complete source and landed revisions; omitted when both are clean or either is unavailable.     |
-| `effect.requested`, `source`, `result` | `range`                                                           | The admitted marker and its normalized mapping from the common source snapshot into the landed body.                      |
-| `effect.removed`, `inserted`           | `change`                                                          | Removed and inserted counts in the receipt unit. |
-| `effect.removedText`                   | `removed`                                                         | {§edit-receipt-removed-text}: a pure deletion's removed text, first 40 lines; absent when the edit inserted anything.                                                                          |
-| `effect.context`                       | Canonical row body                                                | Numbered physical lines at each landed boundary, bounded symmetrically by `PLURNK_SERVICE_EDIT_RECEIPT_CONTEXT_LINES`.   |
-| `disposition`, `requested`             | `disposition`, `requested`                                       | A reviewer-replaced batch preserves the authored marker while stating that its attributed effect was superseded.          |
-| `replacement`                          | `replacement`, `change`, canonical proposal-owner body           | The one whole-resource effect actually applied by the reviewer replacement; never duplicated across authored rows.        |
-
-§edit-result-receipt-truth **Receipts describe committed state.** Each EDIT
-carries its own landed revision, extent, and optional `parseIssues` transition
-for its complete source and landed revisions. When the proposal lands
-unchanged, the row also carries its requested
-marker, source/result mapping, counts, and context. For configured count `C`,
-the context contains up to `C` surrounding lines and the first and last `C`
-landed lines at the result boundaries. Overlapping windows coalesce; coordinate
-jumps expose an omitted middle. A deletion instead shows up to `C` lines on
-each side of its join.
-
-§edit-result-reviewer-replacement **A resolver replacement is one effect, not a
-guess at authorship.** An arbitrary accepted body replaces that operation's
-proposed body. It cannot be attributed to the authored span: the row retains
-its requested marker with disposition `superseded` and carries the one
-whole-resource replacement effect with bounded landed context. Subsequent
-EDITs address that landed state independently under {§edit-execution}.
-
-| Acceptance                     | Per-authored-row receipt               | Applied effect                                    |
-| ------------------------------ | -------------------------------------- | ------------------------------------------------- |
-| Proposed body unchanged        | Requested marker and its exact mapping | One per authored EDIT                             |
-| Resolver body replaced proposal | Requested marker plus `superseded`     | One whole-resource replacement, carried once     |
-
-Durable `tx` always remains the model's admitted statement. There is no JSON
-row/item receipt mode. A deliberate READ observes its authored execution point
-({§op-execution-order}) and remains the universal request for arbitrary current
-content.
-
-System-narrated environment EDITs are state-diff events rather than authored
-mutation receipts. They carry the resulting span defined by
-{§env-delta-filesystem-narration}.
-
-§edit-result-copy-move-effects **Core composes COPY/MOVE effects only after
-application.** Operands remain owned by the durable statement and render
-independently under {§copy-move-observation}; effects describe only state that
-landed.
-
-| Durable effect field | Contract                                                                                                                           |
-| -------------------- | ---------------------------------------------------------------------------------------------------------------------------------- |
-| `target`             | Canonical model-facing address. The default channel is path-only; an explicitly selected non-default channel retains its fragment. |
-| `action`             | Exactly `create`, `update`, or `delete`.                                                                                           |
-| `receipt`            | Optional validated EDIT projection. Only textual `create` and `update` effects may carry one; a creation receipt has `before=0`.   |
-
-| Outcome                                                                       | Ordered `effects`                                                                                         |
-| ----------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------- |
-| Landed COPY                                                                   | Its destination effect.                                                                                   |
-| Landed MOVE between different resource-channel selections                     | Any destination effect, then any source effect.                                                           |
-| Landed regional MOVE within one resource channel, unchanged by its resolver   | Insertion, then removal; both name the same target because they are distinct effects in one atomic batch. |
-| Resolver body replaces a proposed COPY/MOVE mutation                          | One actual replacement effect. Cross-resource MOVE still appends an independently landed source effect.   |
-| Textual create/update caused by a scope on either operand                     | The effect carries the ordinary bounded EDIT receipt.                                                     |
-| Textual create/update with no scoped operand; binary mutation; channel delete | Structural effect only; no invented text receipt. Scoped source removal is an `update` with a receipt.    |
-| `304`, rejection, or cancellation with no landed mutation                     | `effects` omitted.                                                                                        |
-| Cross-selection MOVE source failure after destination success                 | The failure retains every destination effect that landed.                                                 |
-
-Core validates the complete ordered array before exposing it. Parser-recovery
-inspection is advisory and occurs against complete resulting text after
-successful application. A handler or parser failure emits a Notice, omits
-`parseIssues`, and never changes the mutation outcome.
-
-### §proposal-ownership Loop disposition and client YOLO
-
-Side-effecting operations propose ({§exec}) and pause dispatch at 202 for an
-authority decision ({§engine-rails}, {§methods}). Automatic acceptance has two
-distinct owners:
-
-| Mechanism                                            | Authority path                                                                                                                                    | Intended use                                                       |
-| ---------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------ |
-| §proposal-ownership-loop-auto **Loop disposition**   | `runLoop({ policy: { proposals: "accept" } })` persists a loop-owned disposition; core resolves proposals in process without a client.           | Headless automation, benchmarks, CI, fixtures, and unattended use. |
-| **Client-side YOLO** (`--yolo` / `PLURNK_YOLO`)      | A `proposals: "review"` loop emits the ordinary `loop/proposal`; the client returns an accepted proposal through its standard resolution path.  | Interactive automatic review.                                      |
-
-Core cannot distinguish client-side YOLO from a fast human acceptance and does
-not need to. Loop auto keeps authority inside the loop; client-side YOLO acts
-only after authority crosses the client boundary.
-
-§proposal-ownership-notification **The notification carries disposition, not policy inputs.** `loop/proposal` carries the core-owned `ProposalDisposition` ({§notifications}, {§proposal-disposition}). A connected client presents only `owner="client"`; it never reimplements policy from operation or attrs.
-
 ---
 
 ## §packet Packet shape
@@ -4522,7 +4552,7 @@ remain exact. Automatic stream delivery uses that markerless selector too;
 its range or region describes the selected content and the complete stream
 remains addressable. This selection is not a second rendering-time cut.
 
-READ and FIND own their range or pagination before packet rendering; the packet never applies a second hidden substring bound to their selected result. TASK inventory is likewise complete while visible: the model's task inventory is serialized once as compact JSON, never preview-clipped. Reasoning arrives through ordinary scoped READs ({§reasoning-history}). Prompt rows follow their separate adaptive projection contract. Structured mutation contexts already carry the receipt-owned bound in {§edit-result-receipt-truth}, so packet rendering does not preview them again. Rejected-emission artifacts, SEND/WORK/FORK bodies, EXEC commands, environment-delta EDIT spans, and extension-produced bodies use the ordinary fixed bound. When a visible projection differs from its canonical body, metadata carries `chunk` with the exact selected and complete extents defined by {§log-wire-format}; complete and fully suppressed bodies omit it. ```` ```READ (log:///<coordinate>/<OP>) ```` selects untrimmed lines in original coordinates under {§log-readable-projection}; the unsuffixed exact shorthand and authoritative suffix behavior are defined by {§log-coordinate-hierarchy}. ```` ```FIND (log:///...) ```` and search match that same readable view. System/policy sections are not log bodies. Notices are transient non-log observations; they share the ordinary line/character bounds but have no durable body or recovery URI.
+READ and FIND own their range or pagination before packet rendering; the packet never applies a second hidden substring bound to their selected result. TASK inventory is likewise complete while visible: the model's task inventory is serialized once as compact JSON, never preview-clipped. Reasoning arrives through ordinary scoped READs ({§reasoning-history}). Prompt rows follow their separate adaptive projection contract. Structured mutation contexts already carry the receipt-owned bound in {§edit-result-receipt-truth}, so packet rendering does not preview them again. Rejected-emission artifacts, SEND/WORK/FORK bodies, execution commands, environment-delta EDIT spans, and extension-produced bodies use the ordinary fixed bound. When a visible projection differs from its canonical body, metadata carries `chunk` with the exact selected and complete extents defined by {§log-wire-format}; complete and fully suppressed bodies omit it. ```` ```READ (log:///<coordinate>/<OP>) ```` selects untrimmed lines in original coordinates under {§log-readable-projection}; the unsuffixed exact shorthand and authoritative suffix behavior are defined by {§log-coordinate-hierarchy}. ```` ```FIND (log:///...) ```` and search match that same readable view. System/policy sections are not log bodies. Notices are transient non-log observations; they share the ordinary line/character bounds but have no durable body or recovery URI.
 
 §prompt-entry **Prompt as a first-class entry and log row.** Each prompt is stored once at `prompt://<worker>/<loop>/<id>` as an explicitly addressed text/markdown entry — written before any turn of its loop executes — then published to its first model turn as one actionless lowercase `prompt` log row; that row, not the entry, records publication. No synthetic EDIT or READ operation is invented. The row is born visible and obeys {§body-projection}. The **Active Prompts** section closes the user-slot status clump as a paths-only list (`* prompt://<worker>/<loop>/<id>`), so every frame remains directly READable after its log row's body is suppressed or its active projection is retired.
 
@@ -4692,7 +4722,7 @@ Tool-result/output schemas remain ordinary evidence, not teaching.
 flowchart LR
     Survey["Turn 0 FIND<br/>tools/*.md"] --> Families["family paths + summaries"]
     Families --> Read["READ selected family<br/>only when needed"]
-    Read --> Exec["EXEC invocation with an aside"]
+    Read --> Exec["execution with an aside"]
     Read --> Schema["READ linked input schema<br/>when the preview is insufficient"]
     Schema --> Exec
 ```
@@ -4757,10 +4787,11 @@ or an unknown enabled alias fails the daemon at boot.
 
 §members-model-scope *The model's authority.* A model's `add` is admitted against
 `PLURNK_SERVICE_MEMBERS_MODEL_SCOPE` in the file-creation lattice `none < root <
-namespace`, narrowed by `settings.membersModelScope` (most restrictive wins). Shipped `none`
+namespace`, narrowed by `settings.membersModelScope` (most restrictive wins). `none`
 refuses every model definition — inclusion or exclusion — as `403
 members/functionality/model-scope`, naming `git add` and the operator's `/members add` as
-the paths that remain; `root` admits patterns inside the root; `namespace` admits `../` too.
+the paths that remain; `root` admits patterns inside the root; `namespace`, the shipped
+default, admits `../` too.
 `auto` loops self-approve proposals, so the ceiling — not the proposal — is the guard
 ({§membership-baseline}). The coordinator hands `admit` the caller (`action` | `operation`)
 so the family bounds the model without a second grammar.
@@ -4886,7 +4917,7 @@ only through the generated ```` ```skills ```` family
 The catalog and Turn0 describe Functionality under the current workspace
 capability policy and service ceiling. A direct denied attempt receives the
 same exact 403 from dispatch rather than a second documentation policy.
-Optional non-EXEC operations remain a separate `## Enabled Optional Operations`
+Optional non-execution operations remain a separate `## Enabled Optional Operations`
 section because they are language extensions rather than executable tools.
 
 ### §schemes Scheme-reference discovery
@@ -4959,10 +4990,9 @@ contract.
 
 ## §matcher Matcher selection and text regions
 
-Body matchers and text scopes are independent. Matcher prefixes choose a
-dialect (`//` xpath, `/` regex, `$` jsonpath, `~` full-text, `&` graph, otherwise
-glob); they select resources and report evidence. A text scope always addresses
-the exact readable text, regardless of mimetype.
+Matchers select resources and report evidence; text scopes independently
+address the exact readable text, regardless of mimetype. Syntax belongs to
+{§matcher-option}, {§matcher-prefix-claims}, and {§scope-slot}.
 
 ### §matcher-dispatch Matcher dispatch
 
@@ -4988,7 +5018,7 @@ authored target still constrains every resource returned. Outgoing
 references belong to a definition through the handler-reported fully qualified
 container identity.
 
-| Matcher body | Selected resources                                                               | Match evidence                                                            |
+| Matcher      | Selected resources                                                               | Match evidence                                                            |
 | ------------ | -------------------------------------------------------------------------------- | ------------------------------------------------------------------------- |
 | `&<symbol`   | In-scope resources that reference `symbol`                                       | Each matching reference's source span                                     |
 | `&>symbol`   | In-scope resources defining names referenced by each definition of `symbol`      | Each referenced symbol's definition span                                  |
@@ -5022,6 +5052,8 @@ Glob anchoring (`TODO*` starts-with, `*TODO*` contains, `*.log` ends-with,
 
 ### §matcher-result Matcher selection and evidence
 
+- §matcher-selection-signal **Matching carries navigation evidence** - a matcher is a boolean resource predicate. Internally, each selected resource carries `matches: MatchEvidence[]`, where `MatchEvidence` is `{channel?,locator?,region?}`; `channel` names the entry channel the finding was located in and is absent for channel-less resources such as log rows, so line coordinates cannot be mis-attributed across channels of the same resource ({§channel-selection-visibility}). `locator` preserves a structural address without overloading the resource row's `path`; `region` is a complete four-coordinate `TextRegion` only when the finding maps honestly into the exact text the model can READ. Exact duplicate evidence deduplicates. Relation findings map their indexed source spans through the same readable text coordinate index. FIND alone decides whether that grouped selection projects as resource rows or flat locations ({§find-result-projection}); the engine never fabricates a region or guesses which surgical READ the model wants.
+
 §matcher-result-resource-selection **A matcher selects resources; it never extracts a value or chooses a retrieval
 window.** Every dialect answers whether a resource matches and may return
 `MatchEvidence { locator?, region? }` ({§matcher-selection-signal}). `locator` is a
@@ -5115,7 +5147,7 @@ presentation aid, never part of canonical content; matchers and mutations
 consume canonical bytes before rendering. A producer may set `startLine: null`
 only when its content is already source-numbered, such as an effect receipt.
 
-§render-rule-find-renders-result A log row's canonical full body is resolved once by `LogBody`: READ/FIND, actionless source artifacts, prompt, and extension result content comes from `rx.content`; EDIT and scoped entry KILL use their structured receipt, while environment-delta EDIT uses its resulting span; COPY/MOVE concatenate the textual receipt contexts in their ordered `effects`; TASK serializes their canonical inventory through the shared {§json-result-rendering} spread as `application/json`; EXEC and SEND/WORK/FORK use their statement body. Whole-channel COPY/MOVE effects are bodyless rather than fabricating a text projection. Packet rendering applies {§body-projection} and the coordinate projection in {§render-rule-line-navigable-prefix}. READ/FIND over `log:///` and search use the same body with deliberate trims applied under {§log-readable-projection}, without packet-only suppression or preview limits. Status and content are orthogonal: a failed terminal stream READ retains its Problem Details and failure status while rendering captured diagnostic output; failure never erases evidence.
+§render-rule-find-renders-result A log row's canonical full body is resolved once by `LogBody`: READ/FIND, actionless source artifacts, prompt, and extension result content comes from `rx.content`; EDIT and scoped entry KILL use their structured receipt, while environment-delta EDIT uses its resulting span; COPY/MOVE concatenate the textual receipt contexts in their ordered `effects`; TASK serializes their canonical inventory through the shared {§json-result-rendering} spread as `application/json`; executions and SEND/WORK/FORK use their statement body. Whole-channel COPY/MOVE effects are bodyless rather than fabricating a text projection. Packet rendering applies {§body-projection} and the coordinate projection in {§render-rule-line-navigable-prefix}. READ/FIND over `log:///` and search use the same body with deliberate trims applied under {§log-readable-projection}, without packet-only suppression or preview limits. Status and content are orthogonal: a failed terminal stream READ retains its Problem Details and failure status while rendering captured diagnostic output; failure never erases evidence.
 
 An EDIT or scoped entry KILL log row renders its bounded effect receipt (`rx.receipt`) as row
 metadata and join context, not its input statement. Proposal-gated file EDITs
@@ -5174,3 +5206,50 @@ Carried from the contract walk; durable.
 A KILL with a text-coordinate scope aimed at an entry-bearing scheme deletes exactly that span: core prepares and dispatches it as an EDIT with an empty body over the same marker, so anchors resolve, proposals gate it, and the merge facts and receipt are the EDIT path's — while the log row records the model's KILL. Its packet metadata and canonical log body use {§edit-result-receipt-projection}. ```` ```EDIT (path) <scope> ```` with an empty body remains the same act spelled the other way; the teaching names KILL.
 
 §kill-pattern **A pattern on an entry KILL deletes each matching line.** ```` ```KILL (path) [{"pattern": "beta"}] ```` takes the same EDIT path as a scoped KILL, expanded under {§edit-pattern} in whole lines: the resource is read once, the matcher runs line by line, and every line a match touches becomes one empty-body line splice in one atomic batch guarded by those lines' anchors. A numeric scope bounds the lines the pattern may touch. Zero matches change nothing (204, `matched: 0`); a whole-entry KILL never widens from a pattern that selected nothing. The receipt is the EDIT path's, compacted the same way: `matched` lines, the first deletion's `receipt` with its `removedText` ({§edit-receipt-removed-text}), and `last` for the final one. Node-selecting patterns (`//`, `$`) select whole lines here, as they name nodes with line extents; resource-selecting ones (`~`, `&`) are refused (400 `pattern-dialect-unsupported`). The log stays the exception: a pattern on `log:///` selects rows ({§log-curation-set-selection}), and a stream scheme's KILL is process control, so a pattern there is 400 `kill-pattern-unsupported`.
+
+---
+
+## §test-taxonomy Testing and evidence
+
+| Tier | Location | LLM | Substrate |
+|---|---|---|---|
+| **unit** | `src/**/*.test.ts` | No | Isolated logic, mocked boundaries |
+| **intg** | `test/intg/` | No (mock provider) | Real file-backed SqlRite (per-test DB under `test/intg/.tmp/`), real engine |
+| **live** | `test/live/` | Real | Wire-level assertions |
+| **demo** | `test/demo/` | Real | Holistic outcome assertions |
+
+§live-harness-deadline The live and demo tiers use `PLURNK_SERVICE_LIVE_TIMEOUT`
+as one whole-specimen deadline, including multi-prompt stories. The test's abort
+signal reaches the loop wait and invokes ordinary scope cancellation before
+teardown. The runner joins the test body's cleanup before starting the next
+specimen. The shared workspace and story helpers cover setup, inference and
+oracle failures, preserve the primary failure when their cleanup also fails,
+and attempt every registered disposal.
+Provider attempt/recovery limits remain independent; a harness cancellation is
+not evidence that the provider's own deadline expired.
+
+§provider-conformance-matrix **Every configured model alias is exercised through a
+real PLURNK loop: the production packet, a model-selected operation, its
+materialized result, and completion.** Transport-only completions are not
+conformance evidence. Provider-exposed reasoning must survive in the durable
+assistant packet and digest; a provider with no private reasoning is valid when
+the observable operation cycle succeeds. One package-owned runner executes the
+full tier or exactly one registered specimen (`npm run test:live:specimen --
+<exact test name>` in plurnk-core), rejecting absent and duplicate names before
+execution. The ledger and classification taxonomy live in
+`plurnk-providers/README.md` and report authorization/credential failures
+distinct from model failures and repeated stochastic failures separately from
+stable ones, never with weakened assertions.
+
+§test-artifact-retention **File-backed test databases use lane-local current-run
+retention.** Each workspace's normal intg runner clears its own
+`test/intg/.tmp/` once before the suite, reports that forensic directory, and
+retains every artifact the current run creates; a direct `node --test <file>` run bypasses that
+runner, so each test process prunes artifacts older than a day once, and never the current run's. A cross-package test may reuse
+Core's migration fixture only by passing a path inside the caller's artifact
+directory; independently scheduled lanes never share a reset target. A failed
+suite therefore leaves its own evidence intact, and the next normal run of that
+lane removes it before creating anything. Direct `node --test` invocations
+bypass the runner boundary and must invoke the same cleanup procedure
+explicitly when isolation matters. Live/demo run directories are benchmark
+artifacts outside `.tmp` and retain their separate lifecycle.