@plurnk/plurnk-service 1.18.0 → 1.19.0

package/SPEC.md

@@ -4,35 +4,35 @@ Canonical contracts plurnk-service exposes, architecture it implements, promises
 
 ## Contents
 
-- [Glossary](#glossary-glossary)
+- [Glossary](#glossary)
 - [Architecture](#arch-architecture)
 - [Workers and workspace boundaries](#actor-boundary-workers-and-workspace-boundaries)
 - [File membership and project roots](#membership-file-membership-and-project-roots)
 - [Loop scheduling and lifecycle](#worker-loop-lifecycle-loop-scheduling-and-lifecycle)
-- [Provider Contract](#provider-provider-contract)
+- [Provider Contract](#provider-contract)
 - [Scheme Contract](#scheme-scheme-contract)
 - [Mimetype Contract](#mimetype-mimetype-contract)
 - [Search indexing](#persistent-search-index-search-indexing)
 - [Channel Topology](#channels-channel-topology)
-- [Op Surface](#op-op-surface)
+- [Op Surface](#op-surface)
 - [Proposals and client interactions](#proposal-proposals-and-client-interactions)
 - [Stream Model](#stream-stream-model)
-- [Storage Model](#storage-storage-model)
+- [Storage Model](#storage-model)
 - [Plugin composition](#core-plugin-composition-plugin-composition)
 - [Bundled Set](#bundled-set-bundled-set)
-- [Grammar Dependency](#grammar-grammar-dependency)
+- [Grammar Dependency](#grammar-dependency)
 - [Operator Configuration](#operator-config-operator-configuration)
 - [Module seam](#rpc-module-seam)
-- [Workspace Functionality](#functionality-workspace-functionality)
+- [Workspace Functionality](#workspace-functionality)
 - [Application interface](#methods-application-interface)
 - [Packet assembly](#packet-assembly-packet-assembly)
 - [Packet shape](#packet-packet-shape)
-- [Matcher selection and text regions](#matcher-matcher-selection-and-text-regions)
-- [Testing and evidence](#test-taxonomy-testing-and-evidence)
+- [Matcher selection and text regions](#matcher-selection-and-text-regions)
+- [Testing and evidence](#testing-and-evidence)
 
 ---
 
-## §glossary Glossary
+## Glossary
 
 Canonical meanings. When a doc, comment, test name, or commit message uses one of these words, it means exactly what's written here. Drift is a bug.
 
@@ -66,28 +66,28 @@ flowchart LR
 | **`--run`**       | Client compatibility  | A compatibility-sensitive client spelling, not an internal entity. |
 | **session**       | Retired/unqualified   | Not a PLURNK lifecycle noun. Use the actual core noun; a third-party standard may use only its explicitly qualified protocol term. <!-- lexicon-allow: this row defines the retired noun --> |
 
-### §storage-terms Storage terms
+### Storage terms
 
 | Term | Meaning |
 |---|---|
 | **entry** | The unit of canonical state. Identity: `(workspace_id, scheme, authority, pathname)` ({§entry-identity-no-null}). Holds one or more `channels` of content plus scheme-private `attributes`. |
 | **channel** | A named content buffer on an entry. Examples: `body`, `stdout`, `stderr`, `headers`, `symbols`. Each channel has `content`, `mimetype`, curation `weight`, and lifecycle `state`. |
-| **scheme** | An addressed capability family + handler. Built-ins include `worker`, `prompt`, `log`, and bare/file paths; discovered schemes and executor-runtime tags extend that set. Internal `exec` routes executions but is not an addressable model namespace. Consumption surface {§scheme-surface}; author contract: [plurnk-schemes](../plurnk-schemes/SPEC.md). |
-| **mimetype** | A channel's content type. Drives the handler that produces the structural projections (`symbols`, `deepJson`, `deepXml`). Consumption surface {§mimetype-surface}; author contract: [plurnk-mimetypes](../plurnk-mimetypes/SPEC.md). |
-| **provider** | An LLM transport implementing the `@plurnk/plurnk-providers` `Provider` interface. Core supplies an assembled request and generation context; the provider owns endpoint adaptation and normalized response evidence. Consumption surface {§provider}; author contract: [plurnk-providers](../plurnk-providers/SPEC.md). |
+| **scheme** | An addressed capability family + handler. Built-ins include `worker`, `log`, `ops`, `reasoning`, and bare/file paths; discovered schemes and executor-runtime tags extend that set. Internal `exec` routes executions but is not an addressable model namespace. Consumption surface {§scheme-surface}; author contract: [plurnk-schemes](../plurnk-schemes/SPEC.md). |
+| **mimetype** | A channel's content type. Drives the handler that produces the structural projections (`symbols`, `deepJson`, `deepXml`). Consumption surface {§mimetype}; author contract: [plurnk-mimetypes](../plurnk-mimetypes/SPEC.md). |
+| **provider** | An LLM transport implementing the `@plurnk/plurnk-providers` `Provider` interface. Core supplies an assembled request and generation context; the provider owns endpoint adaptation and normalized response evidence. Consumption surface {§provider-surface}; author contract: [plurnk-providers](../plurnk-providers/SPEC.md). |
 
-### §state-terms State / status
+### State / status
 
 Independent axes on entries and channels. Confusion across them is a recurring source of bugs.
 
 | Term | Type | Meaning |
 |---|---|---|
-| **status** | HTTP int | Outcome of an operation. Carried on `log_entries.status_rx`, returned from op handlers. Per the catalogue ({§send-dispatch}). |
+| **status** | HTTP int | Outcome of an operation. Carried on `log_entries.status_rx`, returned from op handlers. Per the catalogue ({§operation-results}). |
 | **channel state** | `static \| active \| closed \| errored` | Streaming lifecycle of a channel's content. Metadata, not gating — engine renders content regardless of state. |
 | **proposal state** | `proposed \| resolved \| failed \| cancelled` | Proposal lifecycle (`log_entries.state`) under {§proposal}; distinct from entry identity and channel state. |
 | **outcome** | `string \| null` | Short reason for `failed`/`cancelled` (`"permission:403"`, `"aborted"`, `"not_found"`). Opaque to most callers. |
 
-### §authority-terms Writer / authority
+### Writer / authority
 
 | Term | Meaning |
 |---|---|
@@ -95,7 +95,7 @@ Independent axes on entries and channels. Confusion across them is a recurring s
 | **origin** | Synonym for writer in log_entries (`log_entries.origin`). Historical naming; treat as equivalent. |
 | **writable_by** | The set of writers a scheme accepts. Subset of `{model, client, _plurnk, plugin}`. Engine rejects writes outside the set with 403; the rejection is logged as the action-entry ({§subscriptions} action-entry-as-outcome). |
 
-### §execution-terms Execution terms
+### Execution terms
 
 | Term                         | Meaning |
 |------------------------------|---|
@@ -124,17 +124,11 @@ Independent axes on entries and channels. Confusion across them is a recurring s
 Daemon composition and startup. Worker attention and workspace state follow
 {§actor-boundary} and {§machine-processes}.
 
-### §ecosystem Ecosystem
+### Ecosystem
 
 The root [`ARCHITECTURE.md`](../ARCHITECTURE.md) owns the platform process and
 package map. The default installed composition is specified in {§bundled-set}.
 
-§ecosystem-composed-host Core is the composed runtime: it owns persistence,
-scheduling, packet assembly, dispatch, and cross-capability orchestration while
-consuming the language and each capability family's author contract. Domain
-logic stays with its owning package. AG-UI projects that runtime to clients;
-clients render and submit actions but contain no engine logic.
-
 ### §observability-boundary Observability boundary
 
 OpenTelemetry may observe PLURNK; it never becomes product state, failure transport, scheduler input, model teaching, or client protocol. Domain and client activity remain on AG-UI. Reusable packages depend on the OTel API only; the daemon constructs only the explicitly configured trace and metric providers. An unconfigured or standards-valid disabled process loads no SDK or exporter implementation and keeps the API's no-op behavior with bounded overhead. OTel Logs have no provider or initialization path.
@@ -142,11 +136,15 @@ OpenTelemetry may observe PLURNK; it never becomes product state, failure transp
 Configuration uses the standard `OTEL_*` environment: `OTEL_TRACES_EXPORTER` / `OTEL_METRICS_EXPORTER` select `otlp` or `console` per signal (a missing or `none` value keeps that signal off; no SDK default selects an exporter), `OTEL_SERVICE_NAME` names the service (default `plurnk-service`), case-insensitive `true` in `OTEL_SDK_DISABLED` turns the boundary off, and OTLP exporters honor `OTEL_EXPORTER_OTLP_*`. An unknown exporter name fails daemon boot; a typo never silently disables observation. OTel Logs and direct draft semantic-convention use are excluded. HTTP spans carry only an AG-UI-owned bounded route class, never an input pathname or query. Spans otherwise carry high-cardinality identifiers; metric labels stay low-cardinality. Prompts, reasoning, file bodies, arbitrary URLs, secrets, and plugin payloads are never recorded as attributes or metric values by default. Exporter failure cannot change product results or client lifecycle. Daemon, telemetry, and database teardown are independent reverse-ownership phases; every phase runs and aggregate failure preserves every cause.
 
 §observability-genai-conventions **GenAI convention projection.** Provider
-request spans use the OpenTelemetry GenAI semantic conventions: a
-CLIENT-kind `gen_ai.client.request` span carrying `gen_ai.operation.name`
-(`chat`), `gen_ai.system` (the provider alias), and `gen_ai.request.model`;
+request spans follow the [GenAI registry at `c88d504`](https://github.com/open-telemetry/semantic-conventions-genai/tree/c88d504ab3d9879f8e50d3cc87e69775e11db234),
+which depends on core semantic conventions v1.44.0: a CLIENT-kind
+`chat {model}` span carrying `gen_ai.operation.name` (`chat`),
+`gen_ai.provider.name` (the constructed route's provider ID in the registry's
+spelling, never its tuning alias; unmatched IDs are preserved, `other` for an
+unregistered handle), and `gen_ai.request.model`;
 on settlement it gains `gen_ai.usage.input_tokens` and
-`gen_ai.usage.output_tokens` from validated accounting plus
+`gen_ai.usage.output_tokens` by aggregating every reported request quantity in
+validated accounting ({§tokenomics-provider-usage}), plus
 `gen_ai.response.finish_reasons`; failures carry `error.type` as the class
 name only. Plurnk custom attributes (attempt, kind, status, loop/turn ids)
 ride alongside and never replace the convention attributes. The redaction
@@ -154,59 +152,34 @@ boundary is unchanged — no prompts, reasoning, bodies, or URLs. This is the
 sanctioned exception to the blanket draft-convention exclusion; no other
 draft convention is projected.
 
-### §standards-discernment Standards discernment
-
-Seven principles govern which exterior standards Plurnk conforms to (#299):
-
-1. **UVP first.** Never conform away what users chose Plurnk for; the OP grammar, curated log, packet, and worker graph are the product, not a compatibility gap.
-2. **Right-fit.** Hobbyist-first: an enterprise-grade feature is acceptable only when its cost lands on the party that wants it, never on general adoption.
-3. **Traction.** Count running counterparties today; integration horizon must be shorter than the standard's expected half-life. Sockets stay configurable with no default until a candidate earns it.
-4. **POSIX app identity.** Decades-stable host-ecosystem conventions (XDG, NO_COLOR, man, completions, service units) outrank months-stable AI-pipeline fashions.
-5. **Faces, never organs.** A standard adopts as one adapter or projection behind an existing seam; if it cannot, that is the alarm, and it goes to a design gate.
-6. **Deletion is the price of admission.** A standard earns adoption by deleting bespoke surface (the ACP Plan object deleted the Markdown plan microformat); parallel representations, second discovery paths, and compatibility grammars are refused.
-7. **Two arbiters.** Model-facing surfaces change only on measured model evidence; human-facing surfaces follow host-ecosystem convention without ceremony. Standards bodies get a vote on neither.
-
-### §in-process In-process architecture
-
-Composed daemon internals + admin CLI. Four plug points:
-
-- **Providers** ({§provider}) — LLM transports. Engine sends a turn's messages, receives raw content + usage; engine parses the content into `PlurnkStatement[]`.
-- **Schemes** ({§scheme}) — addressed capabilities. A scheme handler interprets targets under its prefix and owns its storage substrate.
-- **Mimetypes** ({§mimetype}) — content interpretation. Render-time handlers consume channel content; framework owns the dispatch.
-- **Executors** ({§exec} / {§bundled-set}) — execution dispatch for subprocess, data, and pure-computation runtimes; web discovery rides the ordinary MCP surface.
-
-Core's internal owners compose without becoming new package or public seams:
-
-| Owner | Machine |
-|-------|---------|
-| `Daemon` | Process/module lifecycle, dependency composition, provider policy, notifications, and the external client façade. |
-| `DrainSupervisor` | One worker's queue consumer, drain identity, wake obligations, cancellation scope, poll/park timers, and terminal cleanup. |
-| `Engine` | Loop lifecycle and the public turn, dispatch, derivation, and proposal façades. |
-| `TurnRunner` | Model inference and `_plurnk` initialization, from materialization and output admission through operation settlement. |
-| `Dispatcher` | Operation admission/routing, scheme execution, proposal waiting, curation, and durable log writes. |
-| `ResourceMutations` | EDIT/COPY/MOVE selection, anchor preconditions, cross-scheme effects, and mutation settlement. |
-
-Capability-specific behavior remains with the owning plug point.
+### In-process architecture
 
-The contracts package (`@plurnk/plurnk-contracts`) owns the parser and AST contract. Schemes receive parsed statement fragments via dispatch.
-
-Server posture: this package is the one long-running runtime process. `plurnk-agui` exposes its external protocol; user-facing clients run separately and do not call core's in-process seam directly.
+The process and package map is ARCHITECTURE.md's; this package's AGENTS.md maps core's internal
+owners. Capability-specific behavior remains with the owning plug point.
 
 §service-worker-composition The service launcher and the live/demo workspace
-helper share one registration of default worker-facing modules: MCP and outbound
-A2A. Their management families and readable reference documents are present even
-with no enabled attachments. Workspace capability policy controls every actor's
-surface; registering a family does not enable a remote attachment. Client and
+helper share one registration of default worker-facing modules: MCP, outbound
+A2A, and Schedule. Their management families and readable reference documents are
+present even with no enabled definitions. Workspace capability policy controls every actor's
+surface; registering a family does not enable its definitions. The real-model
+profile ({§operator-config-real-model-profile}) leaves ambient MCP attachments and
+service schedules disabled by default; specimens may add their own through the
+ordinary management surface. Client and
 inbound-A2A listeners and host hooks remain launcher-owned.
 
 ### §service-package-exports Package export surface
 
 | Export path                           | Current contract                                                                                                                                                        |
 |---------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| `@plurnk/plurnk-service`              | Frozen 1.x compatibility barrel. It retains the previously published runtime and type surface, gains no new APIs, and is not the client boundary. Removal is SemVer-major. |
+| `@plurnk/plurnk-service`              | Frozen 1.x compatibility barrel of the exports below. It gains no new APIs and is not the client boundary. Removal is SemVer-major. |
 | `@plurnk/plurnk-service/digest`       | Supported programmatic forensic surface owned by {§digest-programmatic-surface}.                                                                                         |
 | `@plurnk/plurnk-service/package.json` | Supported package metadata surface.                                                                                                                                      |
 
+| Root exports | Names |
+|--------------|-------|
+| Runtime | `Daemon`, `Engine`, `EnvFlags`, `Exec`, `File`, `Log`, `Mimetypes`, `Mock`, `Paths`, `SchemeRegistry`, `Skill` |
+| Types | `ChatMessage`, `EditResult`, `FlagDescriptor`, `MockAssistant`, `MockResponse`, `OpenFoldResult`, `ReadResult` |
+
 New clients use AG-UI. A new library contract belongs in its owning package or
 an explicitly specified subpath, not in the frozen root barrel.
 
@@ -224,13 +197,27 @@ flowchart LR
     DAEMON -. failure .-> TEARDOWN["Close every started owner"] --> FAIL
 ```
 
-§startup-listener-admission The production service binds its sole client
-listener before creating, opening, replacing, rotating, migrating, or otherwise
-mutating anything in the durable data directory. A process that loses the
-listener race fails with the originating address error and byte-identical
-durable storage. The client-interface module owns the socket continuously; it
-answers 503 until activated, so early ownership introduces neither traffic nor a
-close/rebind race.
+§startup-listener-admission The production service binds its one listener
+({§http-host}) before creating, opening, replacing, rotating, migrating, or
+otherwise mutating anything in the durable data directory. A process that loses
+the listener race fails with the originating address error and byte-identical
+durable storage. Core owns the socket continuously; it answers 503 until the
+client-interface module mounts the root at daemon activation, so early
+ownership introduces neither traffic nor a close/rebind race.
+
+§http-host **The daemon opens exactly one transport.** Core binds the HTTP
+listener on `PLURNK_HOST:PLURNK_PORT` and offers it to every exterior adapter as
+`registerHttpRoute(prefix, handler)` and `httpAddress()` on the application port
+({§application-port}). A prefix is an absolute pathname. Each request goes to the
+longest mounted prefix; a prefix claims itself and the subtree beneath it, never
+a longer sibling name; `/` is the root and receives whatever nothing more
+specific claimed. Until a root is mounted the listener answers `503
+service-starting` to every request: the service has not admitted its client
+interface. Adapters mount at `start()`, after durable lifecycle recovery, and
+none opens a socket of its own under the daemon — a module hosted *without* a
+daemon may bind a private one, which is outside this contract. The standards
+address by URL, never by port (#641): AG-UI mounts `/` and `/agui`, A2A the
+well-known card and its endpoint path, on the same address.
 
 §startup-admission-order After listener ownership, database admission completes
 before provider or capability initialization can perform external work. Every
@@ -254,7 +241,7 @@ shared workspace state ({§packet}, {§membership}). Other journals are not
 automatically injected. This follows "one packet, one worker," not an access
 filter over workspace resources.
 
-§actor-boundary-origin-not-filter `origin` ({§authority-terms}) is
+§actor-boundary-origin-not-filter `origin` (the writer, {§scheme-surface-writableby-403}) is
 **attribution** — the delta's provenance ({§env-delta}) — and is never read to
 filter a row.
 
@@ -273,13 +260,14 @@ file or entry through its ordinary read-authority boundary ({§worker-read-scope
 | Door        | Carries                                                                                                                                      | Wake behavior                                                                                 |
 | ----------- | -------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------- |
 | Environment | A direct child's durable activity to its parent, plus a successful mutation of the deliberately global `worker:///` commons to every worker. | Intermediate activity and commons never wake; a child's terminal disposition wakes its parent. |
-| Voice       | A directed `loop.inject` or ```` ```SEND (worker://name) ```` message.                                                                               | An active worker folds it into its next turn; an idle one wakes.                              |
+| Voice       | A directed `loop.inject` or ```` ```SEND (worker://name) ```` request, or an exact-message reply ({§message-reply-delivery}). | Requests enter the next packet or start queued work; replies wake existing assigned/native-sender work without creating a request. |
 
 §actor-boundary-lineage-attention **Addressability is workspace-wide; attention
 is lineage-scoped.** Project files, registered resources, and named scratch
 entries remain addressable throughout the workspace, but ordinary changes do
-not enter unrelated workers' logs. A child's activity reaches only its direct
-parent. That observer row carries the source occurrence identity and never
+not enter unrelated workers' logs. Eligible child actions ({§env-delta-child-activity})
+reach only the direct parent; exploration and local curation do not. That
+observer row carries the source occurrence identity and never
 republishes, so grandparents observe what their own direct children do without
 receiving an automatic recursive mirror of every descendant.
 
@@ -317,8 +305,10 @@ Plurnk never stages a file or runs `git add`.
 
 §turn0-agents-stunt **The project AGENTS.md is a turn-0 stunt.** When
 `<projectRoot>/AGENTS.md` exists, LoopDocs materializes it as the workspace's shared
-`worker:///_plurnk/agents.md` entry and the engine foists one READ of it into
-that model worker's first turn — visible, logged, line-addressable. Absent
+`worker:///_plurnk/AGENTS.md` entry and the engine foists one READ of it into
+that model worker's first turn — visible, logged, line-addressable. The entry
+keeps the standard's own name, as a nested instruction file does: that name is
+in the model's prior, and no other generated document is called it. Absent
 file: no entry, no stunt, nothing 404s. The global XDG configuration `AGENTS.md`
 remains system-prompt policy ({§policy-sections}); the stunt carries only
 local repo guidance.
@@ -338,11 +328,11 @@ narrow or omit the reference catalogs under {§capability-admission}.
 | Agent Skills | `skill://*/SKILL.md` | `<1,-1>`; {§skills-resources} |
 | Plurnk references: executors, schemes, family managers | `worker:///_plurnk/plurnk/*.md` | `<1,-1>` |
 | Enabled tools | `worker:///_plurnk/tools/*.md` | `<1,-1>`; configured expansions follow under {§tools-resource-materialization} |
-| Enabled agents | `worker:///_plurnk/agents/*.md` | `<1,-1>`; {§a2a-agents-catalog} |
+| Enabled agents | `worker:///_plurnk/a2a/*.md` | `<1,-1>`; {§a2a-catalog} |
 | Enabled members | `worker:///_plurnk/members/*.md` | `<1,-1>`; {§members-projection} |
-| Project filesystem | `*` | File cap below; `project filesystem` |
-| Workspace entries | `worker:///*` | Markerless; `workspace entries` |
-| Named scratch entries | `worker://<worker>/*` | Markerless; `worker scratch` |
+| Project filesystem | `*` | File cap below; `project root member files` |
+| Workspace entries | `worker:///*` | Markerless; `workspace knowledgebase entries` |
+| Named scratch entries | `worker://<worker>/*` | Markerless; `worker knowledgebase entries` |
 
 Only the three namespace surveys carry asides; the other targets name
 their surface. The word `skills` names Agent Skills and nothing else.
@@ -351,8 +341,8 @@ supplies examples and complete instructions on demand. A shallow
 result renders direct entries normally and every deeper first-segment directory
 as an actionable `dir/**` summary with its recursive `items` and `tokens`;
 tool-family rows also carry the concise `{§scheme-catalog-aside}` that drives
-on-demand capability discovery. Ordinary surveys use FIND's markerless first-16
-page, whose range metadata reports the requested and returned page against the
+on-demand capability discovery. Ordinary surveys use FIND's markerless first
+page ({§markerless-first-page}), whose range metadata reports the requested and returned page against the
 complete result total; only the small capability-reference surfaces
 explicitly select all. The opening survey demonstrates both `*` and `**` without
 normalizing an all-results override. Every survey executes even when empty
@@ -362,7 +352,14 @@ direct-entry-plus-directory count; `-1` enables the ordinary markerless page;
 unset / `0` disables previews. `log://` is absent because the current worker's
 log already renders in present mode.
 
-§worker-initialization-entry **Model-worker initialization is a real `_plurnk` turn.** A model worker's first loop begins with one packetless `{ producer="_plurnk", kind="initialization" }` turn submitted through {§turn-ops-admission-path}. Its program is stored before execution and dispatches the orienting READ/FIND surveys, the reasoning and program READs in {§reasoning-initial-read}, and the final TASK (in {§op-execution-order}). The prompt is not READ here: its `prompt` row in the first model turn is the one publication of every prompt ({§prompt-entry}), so the body never appears twice. The full `<1,-1>` READ of its own `ops:///<loop>/<turn>` source supplies the worked program example; no actionless source row or simulated READ is added. Every orienting row is structurally classified `_plurnk` and `init`. The program archives nothing: the prompt entry ({§prompt-entry}) is the durable, addressable copy of every prompt, so no scratch archive of it is written. The three namespace surveys carry asides that name what each space is — `project root member files`, `shared worker Extended Context`, `private worker Extended Context` — and, because the program echo shows them verbatim, those asides are the model's map of its spaces. TASK hands off with one {§plan-value} entry: `{"content":"Address the prompt.","status":"in_progress"}`. The first model request occupies the following turn and therefore begins at database/log turn sequence 2; “turn zero” is the initialization phase's model-facing label, not a zero-based database coordinate. Client and `_plurnk` administrative workers execute operation turns and do not receive model initialization.
+§worker-initialization-entry **Model-worker initialization is a real `_plurnk` turn.** A model worker's first loop begins with one packetless `{ producer="_plurnk", kind="initialization" }` turn submitted through {§turn-ops-admission-path}. Its reasoning and program are stored before execution. NOTEs from its reasoning and program, the orienting READ/FIND surveys, and the reasoning and program READs in {§reasoning-initial-read} execute under {§op-execution-order}. The full `<1,-1>` READ of its own `ops://<worker>/<loop>/<turn>` source supplies the worked program example; no actionless source row or simulated READ is added. Every orienting row is structurally classified `_plurnk` and `init`. The namespace surveys and their asides follow {§actor-boundary-catalog-preview}.
+
+Incoming messages publish once as inbound SEND rows in the first model turn
+({§message-arrival}); initialization neither READs nor archives them. The turn
+continues without a lifecycle declaration. The first model
+request occupies database/log turn sequence 2; “turn zero” names the
+initialization phase, not a zero-based database coordinate. Client and
+`_plurnk` administrative workers execute operation turns without model initialization.
 
 ### §machine-processes Workspace and worker state
 
@@ -378,7 +375,7 @@ flowchart TB
     workspace --> parentEntries["Named scratch<br/>worker://a/..."]
     parent --> parentWork["Loops, turns, cancellation scope"]
     parent -->|FORK| child["Worker B"]
-    parentLog -.->|"copy rows, tags, visibility state"| childLog["Worker B log"]
+    parentLog -.->|"copy rows and visibility state"| childLog["Worker B log"]
     parentEntries -.->|"snapshot under new name"| childEntries["Named scratch<br/>worker://b/..."]
     workspace --> childEntries
     child --> childLog
@@ -399,9 +396,9 @@ terminal history.**
 | Project files ({§machine-processes-one-filesystem})   | Workspace         | Shared live; a fork does not create another checkout.                                                              |
 | Shared worker entries (`worker:///...`)               | Workspace commons | Shared live.                                                                                                       |
 | Membership overlay ({§machine-processes-one-overlay}) | Workspace         | Shared unchanged; divergent membership requires another workspace.                                                 |
-| Log items ({§machine-processes-fork-copies-the-log})  | Worker            | Durable events, curation effects, tags, current active/body-suppression projection, and the matching observation cursor are copied as terminal history. Parent-audience occurrences still pending at the fork boundary belong to the snapshot; later sibling activity does not. |
+| Log items ({§machine-processes-fork-copies-the-log})  | Worker            | Durable events, curation effects, current active/body-suppression projection, and the matching observation cursor are copied as terminal history. Parent-audience occurrences still pending at the fork boundary belong to the snapshot; later sibling activity does not. |
 | §machine-processes-fork-cost **Provider evidence and accounting** | Worker | Turns and their model-facing log history are copied, but turn-attached inference calls, their specializations, admission rows, and physical provider requests are not: one issued call or request has one causal branch. Parent and fork accounting therefore includes only work issued in that branch, while workspace accounting never double-counts copied history. |
-| §machine-processes-entry-inheritance **Named scratch and evidence** | Workspace | FORK snapshots quiescent `worker`, `prompt`, and `reasoning` entries whose authority is the source Worker name into the child name. Bytes, attributes, and channel results remain exact; embedded addresses are not rewritten. Other resources, including `worker:///_plurnk/**`, stay shared. |
+| §machine-processes-entry-inheritance **Named scratch and evidence** | Workspace | FORK snapshots quiescent `worker` entries whose authority is the source Worker name into the child name. Bytes, attributes, and channel results remain exact; embedded addresses are not rewritten. Other resources, including `worker:///_plurnk/**`, stay shared. |
 | Active loops, turns, and cancellation                 | Worker            | Never copied as live work; inherited structure is terminal history, then a new loop starts.                        |
 
 §worker-fork-trigger **The branch's claimed row is the fork.** `worker_name_claim` with a fork
@@ -437,13 +434,10 @@ existing workspace worker in its own right.
 §worker-provider-identity **A worker owns a durable provider identity distinct
 from its database id.** Creation mints a globally unique, opaque 128-bit value;
 forks mint their own value. Core supplies it as the provider `workerId` for every
-emission and supplies the lineage root's value as `primaryWorkerId`
-({§provider-cache-identity}). Database ids remain the internal relational and
+emission ({§provider-cache-identity}). Database ids remain the internal relational and
 client coordinate. BARE calls use isolated per-call provider identities rather
 than either worker value.
 
-§worker-primary **The primary worker is the lineage root.** The PRIMARY worker of a turn's lineage is the no-parent root reached by walking `parent_worker_id` up; a no-parent worker is its own primary. Core supplies it on the first-party metadata channel alongside `Worker-Id` (same gate, computed per turn), stamped on EVERY turn including the primary's own (where it equals `Worker-Id`) — absent-with-a-Worker-Id is a contract violation, never a silent "assume primary." An unresolvable root (a corrupt/cyclic parent chain the `parent != id` CHECK forbids) fails hard. Providers emits it as `Plurnk-Worker-Primary`; a consumer routes primary-vs-spawned by equality (`Worker-Primary == Worker-Id` ⇒ the primary; `!=` ⇒ any-depth spawn, no depth math) and groups the worker tree by the shared root.
-
 §machine-processes-fork-shares-the-world **A fork copies history and named
 scratch while sharing the workspace.** It is a new worker in the
 same workspace (`workers.parent_worker_id`, {§lifecycle-terms}); project files,
@@ -460,7 +454,7 @@ or membership overlay requires a new workspace.
 
 §worker-name-minting **URI ingestion is permissive; worker minting is not.**
 Every model/client worker-creation door applies the contracts-owned
-`WORKER_NAME` predicate through one core admission path. Generic URL parsing
+`WORKER_NAME` predicate ({§worker-name}) through one core admission path. Generic URL parsing
 continues to decompose other authorities without treating them as mintable.
 
 | Candidate                                      | Minting result                                                        |
@@ -473,7 +467,7 @@ continues to decompose other authorities without treating them as mintable.
 
 §worker-write-scoping **Scratch is workspace-writable.** All workspace actors may EDIT, COPY, MOVE, or KILL entries in any named or shared scratch namespace, including generated documents. There is no creator-only, self-only, ancestor-only, or runtime-only grant. Workspace admission remains uniform. Intrinsically immutable evidence in other schemes retains its own contract ({§scheme-entry-matrix}); operation provenance and delegation lifecycle do not grant or restrict scratch access.
 
-§worker-generated-subtree **Generated documents share `worker:///_plurnk/`.** Project instructions (`agents.md` and subtree-scoped `instructions/**`), scheme/runtime references (`plurnk/**`), tool details (`tools/**`), and family catalogs are workspace resources. Agent Skills retain their own trees at `skill://<name>/` ({§skills-resources}).
+§worker-generated-subtree **Generated documents share `worker:///_plurnk/`.** Project instructions (`AGENTS.md` and subtree-scoped `instructions/**`), scheme/runtime references (`plurnk/**`), tool details (`tools/**`), and family catalogs are workspace resources. Agent Skills retain their own trees at `skill://<name>/` ({§skills-resources}).
 
 The subtree has ordinary scratch access, not an ACL. Runtime maintenance reconciles it from workspace Functionality through the runtime actor's ordinary turns ({§actor-boundary-doc-injection}); reconciliation may replace manual edits. There are no per-Worker copies or fork rederivation. A runtime's `resourcesPath` is relative to this root ({§tools-resource-materialization}).
 
@@ -526,31 +520,34 @@ Every admitted authority is a literal `workers.name`; self-addressing uses the c
   own work is a fresh loop, so an inherited mid-flight loop never makes the
   branch look forever-live to the {§send-premature-terminate} gate.
 - §worker-scheme-fork-scratch **Forked scratch.** Named scratch and evidence are copied under the new name through {§machine-processes-entry-inheritance}. Parent and branch can edit either scratch namespace; their copies diverge independently.
-- §worker-spawn-no-branch **WORK and FORK take a worker path and a prompt, nothing else.** Branch
-delegation was removed outright (#396). A model manages git branches through ordinary
-the `git` runtime — never engine machinery.
-- §worker-delegation-inherits-policy **Fresh delegated loops inherit proposal disposition.** WORK, FORK, and SEND to an idle Worker carry the sender's proposal disposition. SEND into an active or parked loop leaves its immutable policy untouched. All workers share live workspace capability policy; delegation creates no capability snapshot or bound.
+- §worker-delegation-inherits-policy **Fresh delegated loops inherit the sender's policy.** WORK, FORK, and SEND to an idle Worker carry the sender's complete loop policy, disposition and attendance alike. SEND into an active or parked loop leaves its immutable policy untouched. All workers share live workspace capability policy; delegation creates no capability snapshot or bound.
 - §worker-lifecycle-wake-requeue-not-terminal **A wake re-queue is not a terminal.** A conclusion-wake resumes a 202-blocked loop by re-queueing it (202 → 100); when that lands while the loop's own live drain is between turns, the drain **re-claims and continues** (atomic 100 → 102; the injected prompt is already the next turn). The internal re-queue is never reported as an outward terminal.
 
-- §worker-scheme-collect **Collect** — a worker's loop reaching a terminal status
-  surfaces to its direct parent as an ambient delta ({§env-delta}): a `SEND` from
-  `worker://<name>` carrying the loop's exact terminal operation result. **Every
-  conclusion is born visible** (its body materialized into the parent's packet,
-  not body-suppressed): a child's last message must reach the parent visible and
-  awakening whatever the status, never a bodyless row, because a failure's
-  explanation is its deliverable (operator, 2026-09-14: fail is completed with a
-  frowny face); a failure retains its exact status and Problem beside that
-  message. Every death-path is stamped uniformly —
-  including a spawn that dies before its first turn — so no child termination is
-  silent to its owner; collection is lineage
-  supervision, never a
-  verb. The **pull** side mirrors the push: a path-absent
+- §worker-scheme-collect **Collect** — each concluded child loop reaches its direct
+  parent as an `_plurnk` READ of `ops://<name>/<sequence>` ({§loop-answer}), not a message,
+  and that row carries what the child said.
+  The occurrence retains that loop's exact terminal result; the READ uses ordinary
+  bounded projection. Its body, when present, is initially visible. Replies are
+  independent deliveries ({§message-reply-delivery}), never copied into this outcome. Failures and
+  cancellations retain their exact status, Problem, and visible explanation,
+  including a spawn that fails before its first turn. Observation and wake-up
+  follow {§env-delta-child-termination}; a later child loop cannot replace the
+  retained result. The **pull** side mirrors the push: a path-absent
   ```` ```READ (worker://<name>) ```` collects that same result on demand for a
-  concluded worker; **unfinished work**, including a future scheduled task, has not delivered, so the READ
-  returns **425** (Too Early). TASK independently chooses whether to continue
+  concluded worker and names its canonical loop URI in `resource`; **unfinished loops** have not concluded, so the READ
+  returns **425** (Too Early). An explicit lifecycle declaration chooses whether to continue
   or wait for that worker ({§join-blocking-collect}). A
   missing name is 404. The model therefore reads the worker itself for its
   outcome or a wait rather than guessing a scratch path to "check on" it.
+- §worker-loop-result `ops://<name>/<sequence>` selects one worker-local positive safe-integer
+  loop sequence ({§loop-answer}; the retired `loop://` scheme is gone, and one address now serves
+  both what a loop said and how it ended). It is a read-only resource, not an actor control
+  address: READ, FIND and COPY use ordinary projections; EDIT, MOVE-source, and KILL cannot change
+  it. No query, userinfo, or port is accepted. A coordinate that is not a positive safe integer is
+  400; a missing loop 404; a loop that has not answered and has not concluded 425. A concluded
+  loop remains readable after newer loops, log curation, or a reply to its originating message.
+  A failure reports its problem even when the loop answered earlier: the failure is the news.
+  READs and completion observations use the same resolution, representation and projector.
 - §child-orientation **Child orientation.** Beyond the conclusion delta, every
   turn the packet's status clump surfaces the live things this worker currently
   holds under the teaching's own word for handing work out: `## Delegation` is
@@ -560,11 +557,13 @@ the `git` runtime — never engine machinery.
   history; this section is the current inventory that keeps an active obligation
   visible even when no new activity arrived. Each open stream pointer carries
   its channels' sizes and growth since the last packet in `detail`
-  (`{"status":"active","path":"sh:///1/2/3/sh","detail":"stdout 340 lines (+2048 bytes)"}`)
+  (`{"status":"active","path":"sh:///ab3d5678","detail":"stdout 340 lines (+2048 bytes)"}`)
   — the only thing the model learns about a stream before it closes
   ({§exec-stream}). It is orienting state, never advice: the model sees its live
   subtree (`{"status":102,"path":"worker://worker-x"}`) and reasons for itself —
   READ, SEND, or KILL via the path.
+  Workspace schedules are not held work: an occurrence arrives as a message
+  ({§schedule-delivery}).
 - §packet-empty-sections **Emptiness is stated where the model decides on it.**
   `## Delegation` renders every turn, each of its two lists `[]` when empty: the
   model decides whether to wait or complete on exactly these facts, so their
@@ -576,8 +575,8 @@ the `git` runtime — never engine machinery.
 - §packet-current-turn **The packet says who and which turn, below the log.** The
   `## Worker` block is the first section after the log, carrying
   `{"path": "worker://<name>", "parent": <address or null>, "loop": L, "turn": T}`: the actor,
-  whose child it is, and the coordinate this packet's response becomes, so `reasoning:///L/T`
-  and `ops:///L/T` are the model's own and `log:///L/T/*` its rows; a model never infers the
+  whose child it is, and the coordinate this packet's response becomes, so `reasoning://<worker>/L/T`
+  and `ops://<worker>/L/T` are the model's own and `log:///L/T/*` its rows; a model never infers the
   present from the last row's coordinate, which may or may not be its own turn. The block
   changes every turn, so nothing of it precedes the log, and the packet carries no date, time
   or zone anywhere (operator, 2026-09-13: no date or time injection, and nothing volatile above
@@ -627,8 +626,6 @@ under that exact URL—never raw HTML, response headers, or a channel-selection
 lesson. FIND consumes the addressed stored channel representation
 and never re-fetch a match.
 
-§web-retrieval-live Coverage protects the composition at distinct seams: HTTP unit tests pin fragmentless-body publication and explicit auxiliary selection; integration tests pin materialize→FIND and persistence/publication separation. A live positive-control demo requires a materialized HTTPS body and a substantive answer from a real sanitized page; live discovery demos remain diagnostic and may expose model judgment failures without weakening these assertions.
-
 **Git is the substrate and the repository is the boundary:**
 
 - §membership-baseline **The baseline contract — chiseled (#400).** To a workspace a
@@ -652,7 +649,7 @@ and never re-fetch a match.
   ({§membership-create-parents}). Admitted by a published standard as projected
   instruction documents — never as members: (3) the project's `AGENTS.md` and nested
   `AGENTS.md` files ({§turn0-agents-stunt}, #346), read from disk regardless of git status
-  and materialized as `worker:///_plurnk/agents.md` and
+  and materialized as `worker:///_plurnk/AGENTS.md` and
   `worker:///_plurnk/instructions/<subtree>/AGENTS.md`; the file itself is a member
   only when tracked or added, and the standard never overrides the operator's
   exclusions — an `AGENTS.md` the repository ignores or an exclusion matches
@@ -725,7 +722,7 @@ reconsidered when the operator changes the policy and otherwise remains a stat-o
 no-op. The file write gate independently stats the source against the same ceiling,
 so safety does not depend on a background warm winning a client-operation race.
 
-§derivation-dedup-parallel **The index dedups then parallelizes.** The derivation identity hashes the exact READ channel representation, mimetype, reader behavior, and applicable search exclusion. A channel or log projection attaches the immutable artifact only after it is complete; identical projections therefore share one FTS row and one symbol graph without copying. The identity hashes the representation's own SHA-256 ({§tokenomics-content-hash-identity}), never its body, so a maintenance pass judges an entry channel from its stored `content_hash` without the body crossing into the process; a body is acquired only for a derivation that runs, under that same identity (a representation that moved on since it was judged returns nothing and is judged again next pass), or for a channel with no stored identity, an open or streamed channel, which must be read to be judged. Log rows and turn sources still arrive whole. The pass reports the bytes it acquired beside the derivations it ran, and an unchanged workspace acquires none of its channel bodies at any concurrency. Distinct artifacts run with bounded producer concurrency (`PLURNK_SERVICE_DERIVE_CONCURRENCY`). Pending artifacts sort by readable content length before entering that pool, so small resources start first while every outlier still derives fully. Unset uses a host-relative square-root fan-out; a positive integer is an exact operator budget and `-1` claims every core. Graph persistence writes at most `PLURNK_SERVICE_DERIVE_STORE_BATCH` definitions or references per SQLite statement. Every launched worker settles before the maintenance pass reports success or failure, so one failed artifact cannot orphan sibling derivations. Every representation completed by a successful pass attaches a terminal classified artifact, identically at concurrency 1 and N. A changed pass emits one immediate `preparing` state, intermediate `indexing` heartbeats at `PLURNK_SERVICE_DERIVE_PROGRESS_HEARTBEAT_MS`, and one immediate `complete` or `failed` state. A no-op pass emits no lifecycle, an indexing heartbeat never claims 100%, and the model-facing Notice buffer retains only the current derivation state while live clients observe each heartbeat.
+§derivation-dedup-parallel **The index dedups then parallelizes.** The derivation identity hashes the exact READ channel representation, mimetype, reader behavior, and applicable search exclusion. A channel or log projection attaches the immutable artifact only after it is complete; identical projections therefore share one FTS row and one symbol graph without copying, and the FTS index reads its text from the content store ({§content-store}) instead of keeping a copy. The identity hashes the representation's own SHA-256 ({§tokenomics-content-hash-identity}), never its body, so a maintenance pass judges an entry channel from its stored `content_hash` without the body crossing into the process; a body is acquired only for a derivation that runs, under that same identity (a representation that moved on since it was judged returns nothing and is judged again next pass), or for a channel with no stored identity, an open or streamed channel, which must be read to be judged. Log rows and turn sources still arrive whole. The pass reports the bytes it acquired beside the derivations it ran, and an unchanged workspace acquires none of its channel bodies at any concurrency. Distinct artifacts run with bounded producer concurrency (`PLURNK_SERVICE_DERIVE_CONCURRENCY`). Pending artifacts sort by readable content length before entering that pool, so small resources start first while every outlier still derives fully. Unset uses a host-relative square-root fan-out; a positive integer is an exact operator budget and `-1` claims every core. Graph persistence writes at most `PLURNK_SERVICE_DERIVE_STORE_BATCH` definitions or references per SQLite statement. Every launched worker settles before the maintenance pass reports success or failure, so one failed artifact cannot orphan sibling derivations. Every representation completed by a successful pass attaches a terminal classified artifact, identically at concurrency 1 and N. A changed pass emits one immediate `preparing` state, intermediate `indexing` heartbeats at `PLURNK_SERVICE_DERIVE_PROGRESS_HEARTBEAT_MS`, and one immediate `complete` or `failed` state. A no-op pass emits no lifecycle, an indexing heartbeat never claims 100%, and the model-facing Notice buffer retains only the current derivation state while live clients observe each heartbeat.
 
 The artifact also retains a positive `{§mimetype-parse-issues}` count and the
 full normalized `{§mimetype-summary}` when the exact parsed channel reported
@@ -783,14 +780,14 @@ explicit.
 
 ## §worker-loop-lifecycle Loop scheduling and lifecycle
 
-- §join-blocking-collect **Collection and scheduling are independent.** A path-absent ```` ```READ (worker://<running-child>) ```` returns **425** (Too Early), without a strike or scheduler side effect. TASK with waiting intent joins live obligations; an `in_progress` inventory keeps working. A child reaching any terminal status wakes a waiting parent with its result, including completion racing the park boundary. Children retain their own limits; TASK timing may additionally bound the parent's wait. Collection never arms an implicit disposition override.
+- §join-blocking-collect **Collection and scheduling are independent.** A path-absent ```` ```READ (worker://<running-child>) ```` returns **425** (Too Early), without a strike or scheduler side effect. WAIT joins live obligations; ordinary operations without WAIT keeps working. A child reaching any terminal status wakes a waiting parent with its result, including completion racing the park boundary. Children retain their own limits. Collection never arms an implicit disposition override.
 
 A worker is a **log plus a cancellation scope** — one `AbortController` per worker, reused while live and replaced only once aborted, so a cancel ends the worker as a unit and a later `runLoop` request is never born cancelled. A worker's queued loops are advanced by a **drain**: a single per-worker drain that claims loops atomically (status 100→102) and runs each under the worker's scope. A loop may spawn **streams** (execs) that outlive it; each is a row in the subscription registry ({§subscriptions}) — the durable record of what the worker holds open. Cancellation and conclusion are defined against these structures, never wall-clock timing.
 
 ```mermaid
 stateDiagram-v2
     [*] --> Queued: runLoop request
-    Queued --> Running: due task claimed by drain
+    Queued --> Running: queued task claimed by drain
     Running --> Parked: wait with live obligations
     Parked --> Queued: obligation settles or arrival
     Running --> Terminal: conclude or fail
@@ -807,80 +804,21 @@ newer terminal loop cannot mask older queued, running, or parked work. Name
 collision, workspace worker caps, child obligations, orientation, and recovery
 all use that one definition.
 
-### §worker-scheduled-send Scheduled worker tasks
-
-A numeric scope on `SEND (worker://name)` queues a new task with the authored
-body, even when the recipient has unfinished work. Unscoped SEND retains its
-ordinary arrival semantics. Timing is whole minutes, not text coordinates.
-
-| Directed SEND scope | First occurrence | Subsequent occurrences |
-|---|---|---|
-| `<D>`, `D ≥ 0` | Eligible after D minutes. | None. |
-| `<D,I>`, `D ≥ 0`, `I > 0` | Eligible after D minutes. | Fixed cadence of I minutes from the initial due time. |
-
-- Queued tasks carry a durable due time and the recipient's model selection,
-  sender's delegated policy, and original prompt source. They do not activate
-  provider inference or workspace Functionality before eligibility. Due tasks are
-  claimed in queue order; an earlier future task cannot block ready work.
-- A recurrence has at most one unfinished occurrence. A successful terminal
-  transition atomically queues its successor; all-failed inventory, engine failure, and
-  cancellation queue none. Continuing or waiting TASKs retain the same occurrence and limits.
-- At first claim, overdue ticks coalesce into the latest due cadence slot. There is
-  no catch-up backlog. Each occurrence has its own loop/turn/execution limits
-  and the original task's generation/capability snapshot; injected corrections
-  and response bodies are not recurrence instructions. Resuming a wait neither
-  rechecks the occurrence's initial delay nor changes its selected cadence slot.
-- Ownership is the existing durable recipient worker and lineage, never its
-  reclaimable name. Future queued work remains live for parent obligations,
-  cancellation, name collision, and model-policy protection. KILL cancels its
-  current and future work; later explicit SEND may authorize new work.
-- Restart retains queued and parked occurrences and their due times. Interrupted
-  active work follows the ordinary owner-loss failure rule, without replaying
-  uncertain effects or automatically rearming a failed recurrence.
-- Ordinary loop inspection exposes due time, recurrence identity, and interval.
-  SEND acknowledges the accepted task identity and timing. Parent orientation
-  includes queued future tasks; a completed occurrence is not a concluded
-  recurring assignment.
-
-```mermaid
-stateDiagram-v2
-    [*] --> Queued: explicitly scheduled task
-    Queued --> Running: due claim; coalesce elapsed ticks
-    Running --> Parked: TASK waiting
-    Parked --> Queued: same occurrence wakes
-    Running --> Success: TASK terminal with at least one completed item
-    Success --> Queued: atomic successor for recurrence
-    Success --> [*]: one-shot
-    Running --> Failed: TASK all failed, or engine failure
-    Queued --> Cancelled: KILL
-    Parked --> Cancelled: KILL
-    Running --> Cancelled: KILL
-    Failed --> [*]
-    Cancelled --> [*]
-```
-
 ### §worker-wait-timing Durable waits and wake ownership
 
-With waiting intent, an explicit finite TASK deadline or positive poll interval is itself
-a live obligation. A wake continues the same loop with the same prompts,
-generation policy, and cumulative turn ceiling; it never creates another assignment.
-
-| TASK scope with waiting intent, in minutes | Deadline | Observation |
-|---|---|---|
-| absent / `<-1>` | No clock deadline; join existing work. | Inherit open streams' polling policy; child completion is event-driven. |
-| `<T>`, `T ≥ 0` | Resume no later than T, even without a child or stream. | Inherit open streams' polling policy. |
-| `<T,P>`, `P > 0` | T as above, or unbounded for -1. | Resume after P, or earlier on deadline, completion, or a message. |
-| `<T,0>` | T as above. | Disable periodic observation for this wait; events and deadline still wake it. |
-
-Polling observes, never repeats operations. A wake ends this wait; a subsequent
-waiting TASK is a new wait with its own timing. Deadline expiry does not cancel a child
-or declare its execution failed. Ordinary terminal and cancellation rules
-remain authoritative.
+WAIT has no timing operand; its optional path is a label ({§send-wait-scope}).
+With live work—an open stream or a live child worker—the loop parks durably
+and wakes on settlement, on a
+message, or on the inherited observation cadence of its open streams
+({§exec-lifetime}); without live work it continues at once, told so. A wake
+continues the same loop with the same messages, generation policy, and
+cumulative turn ceiling; it never creates another assignment. Scheduled messages
+exist independently of a loop's optional attachment to one occurrence.
 
 ```mermaid
 stateDiagram-v2
-    Running --> Parked: atomically persist wait identity and timing
-    Parked --> Queued: arrival / completion / due clock, guarded by wait identity
+    Running --> Parked: atomically persist the wait identity
+    Parked --> Queued: arrival / completion / inherited observation, guarded by wait identity
     Parked --> Terminal: cancellation
     Queued --> Running: same loop claimed by its worker's drain
 ```
@@ -893,18 +831,35 @@ obligations, not merely its latest parked loop. A completion crossing an active
 loop's park boundary is owed to that loop, never a future unrelated loop.
 
 Each loop captures the worker's completion revision when its program begins.
-Stream closure and direct-child terminalization advance that revision in the
-same database mutation as their terminal evidence. An unobserved completion
-remains owed through parking and restart; another loop's turn cannot consume
-it. Waking is guarded by both the wait identity and the relevant due/event
-predicate, so delayed callbacks do not wake programs that already observed
-their evidence.
-
-Wait identity and requested timing commit with the parked transition. SQLite
-owns due times; process timers only arrange a bounded next check. A restart
-retains future timed waits and reconciles elapsed ones once. Waking or
-terminalizing invalidates the old wait. Duplicate and racing wakes have one
-durable winner, and cancellation cannot be reversed by a timer.
+Before inference, it acknowledges the current revision only after every addressed
+terminal/reply occurrence has crossed the ambient observation cursor and every
+closed stream has published its terminal channels. The publication check and
+revision acknowledgement are atomic; an arrival beyond either materialization
+snapshot remains owed. Stream closure, direct-child terminalization and addressed
+replies advance the revision in the same database mutation as their evidence.
+An unobserved completion remains owed through parking and restart; another loop's
+turn cannot consume it. Waking is guarded by both the wait identity and the
+relevant due/event predicate, so delayed callbacks do not wake programs that
+already observed their evidence.
+
+Wait identity commits with the parked transition. The drain persists any
+inherited stream-observation due time; process timers only arrange a bounded
+next check. Restart reconciles obligations under {§worker-lifecycle-restart-recovery}.
+Waking or terminalizing invalidates the old wait. Duplicate and racing wakes
+have one durable winner, and cancellation cannot be reversed by a timer.
+
+§loop-claim-latency **A loop's first claim is durable.** `loops.claimed_at` is
+stamped by trigger the first time a loop enters status 102, at insertion for a
+loop created running and on the move from queued otherwise; later re-claims never
+move it. The digest reports, per loop, the claim time and how long after it the
+first model turn started, so a stall between claim and inference (a heartbeat has
+waited 7.5 h, #703) is a number rather than a gap.
+
+§digest-storage **The digest states the file's health.** Beside the database path it
+reports the file size, the free pages it holds, its `auto_vacuum` mode, and the six
+largest tables and indexes by allocated bytes (`dbstat`), so growth is a number in
+every digest (#764). The digest reads loops as stored, so a database made before a
+lifecycle column was added still digests.
 
 §loop-execution-allowance **One task has one execution allowance.** The first
 execution snapshots `PLURNK_SERVICE_LOOP_TIMEOUT` on the loop. Active segments
@@ -926,21 +881,21 @@ superseded exclusive lineage permission.
 An exhausted allowance aborts in-flight execution and produces `504`; a late
 callback cannot override a committed disposition. Restart preserves parked
 allowances; interrupted active tasks follow ordinary owner-loss recovery,
-never replay interrupted effects to reconstruct time. Wait deadlines remain
-the separate wall-clock scheduling contract above.
+never replay interrupted effects to reconstruct time. Future messages use
+the separate schedule contract ({§schedule-delivery}).
 
 §worker-message-admission **Recipient selection and admission are one decision.**
 An arrival to a worker selects its running loop, otherwise its oldest parked
 loop, otherwise a new queued loop. Compatibility is checked against the exact
-loop that receives the prompt; the writer does not reselect another recipient.
-The worker's admission lock covers selection, compatibility, prompt publication,
+loop that receives the message; the writer does not reselect another recipient.
+The worker's admission lock covers selection, compatibility, message admission,
 and the park-boundary wake check against orphan recovery. Fresh task insertion
 includes its complete generation policy, proposal disposition, and initial paths
 atomically; no drain may claim partially configured work.
 
 | Message at the receiving task's end | Disposition |
 |---|---|
-| Delivered to an unfinished loop | Append one ordered prompt frame; waking does not repeat earlier frames. |
+| Delivered to an unfinished loop | Append one ordered message to the loop's inbox; waking does not repeat earlier messages. |
 | Admitted but not observed before ordinary completion | Preserve through the existing orphan-message admission path. |
 | Cancelled as part of the worker scope | Preserve the frame as evidence; never promote it into executable work, including after restart. |
 | Explicit new arrival after cancellation | Admit under ordinary current worker policy; never revive a terminal loop. |
@@ -967,26 +922,24 @@ stateDiagram-v2
     Observed --> [*]
 ```
 
-| §worker-lifecycle-subscription-matrix Subscription state at a waiting TASK | Terminal observation already in a packet | Result |
+| §worker-lifecycle-subscription-matrix Subscription state at WAIT | Terminal observation already in a packet | Result |
 |-------------------------------------------------------------------------|---:|---|
 | open                                                                    | no | park; polling or closure may wake it |
 | closed, any status, empty or non-empty                                  | no | continue directly to the observation turn |
 | closed, any status, empty or non-empty                                  | yes | no stream obligation remains |
 | cancelled as part of worker cancellation                                | irrelevant | terminate the cancelled worker; never resurrect it |
 
-Polling observes a still-open stream; it never changes ownership or manufactures
-completion. Closure is always a wake edge regardless of polling mode.
+Observation watches a still-open stream; it never changes ownership or manufactures
+completion. Closure is always a wake edge.
 
-| §worker-lifecycle-poll-matrix execution poll marker | While open | On closure |
+| §worker-lifecycle-poll-matrix stream | While open | On closure |
 |------------------------------------------------|---|---|
-| omitted                                        | exponential-backoff observation wakes | resume once with terminal observation |
-| positive `P`                                   | fixed-cadence observation wakes every `P` minutes | cancel cadence; resume once |
-| zero                                           | no observation wakes | resume once |
-| turn-scoped `<0>`                              | reap at the next pre-turn boundary | surface the terminal outcome |
+| any lifetime but `turn`                        | the daemon's exponential-backoff observation wakes ({§exec-lifetime}) | resume once with terminal observation |
+| `[{"lifetime":"turn"}]`                        | reap at the next pre-turn boundary | surface the terminal outcome |
 
 The structured-concurrency sequence is identical whether a child performs an
-execution, retrieval, or pure inference. Intermediate child status is private to the
-child. Only the child's terminal loop result crosses the parent edge.
+execution, retrieval, or pure inference. Intermediate status does not drain the
+child obligation; explicit replies may arrive earlier ({§message-reply-delivery}).
 
 ```mermaid
 sequenceDiagram
@@ -994,9 +947,9 @@ sequenceDiagram
     participant C as Child loop
     participant S as Child stream
     P->>C: WORK or FORK
-    P->>P: TASK waiting parks on live child
+    P->>P: WAIT parks on live child
     C->>S: execution opens subscription
-    C->>C: TASK waiting parks on live stream
+    C->>C: WAIT parks on live stream
     loop backoff, fixed cadence, or explicit arrival
         S-->>C: optional progress observation
         C->>C: continue or park
@@ -1017,16 +970,16 @@ sequenceDiagram
 | cancelled or failed terminal                              | no | same wake/delivery path as success; outcome remains non-2xx |
 
 A stream's close status and a loop's terminal status are separate layers. A
-stream may close 4xx/5xx and wake its worker to recover. TASK adjudicates the
-loop's inventory independently of stream and message-delivery statuses
-({§send}). Only a concluded loop crosses the parent edge as the child's result.
+stream may close 4xx/5xx and wake its worker to recover. The lifecycle resolver adjudicates the
+loop's answered messages, observation boundaries, and held work independently of
+stream and message-delivery statuses ({§send}). Only a concluded loop drains the child obligation.
 
 §worker-lifecycle-terminal-result **Terminal truth is a result, not a lifecycle code.** `loops.terminal_result`
 stores the exact universal operation result. A failure therefore retains its
 RFC 9457 Problem Details and exact status through persistence, restart,
-parent collection, and `loop/terminated`; successful turn disposition content and
-mimetype remain in the same result. Cancellation markers and branch receipts
-are derived presentation, never a second stored outcome. The constrained `loops.status`
+parent collection, and `loop/terminated`. Message delivery and execution outcome
+are independent: neither completion nor cancellation borrows the last reply's body.
+Cancellation markers are derived presentation, never a second stored outcome. The constrained `loops.status`
 column remains only the scheduler's compact lifecycle projection: known
 terminal classes remain themselves, other 2xx/3xx statuses project to `200`,
 and other 4xx/5xx statuses project to `500`; exact `202` is forbidden because
@@ -1053,28 +1006,27 @@ observe their terminal results. No effect is replayed across an unknown
 boundary.
 
 - §worker-lifecycle-single-drain **One drain advances a worker.** At most one drain is registered for a worker at any instant: a `runLoop` request or wake on a worker with a live drain folds in (active→next-turn) or enqueues a loop that drain claims, never a second parallel drain. A drain's start and its empty-queue teardown relinquish the worker under one per-worker lock, so the teardown's re-claim cannot race a concurrent start into a double-drain. Fresh-loop sequence allocation and insertion are one mutation under that same lock; concurrent accepted prompts remain distinct ordered queue items.
-- §worker-lifecycle-total-reap **Cancellation is recursive and reaps every held stream.** `loop.cancel`, worker `KILL`, and a failed TASK terminalize every unresolved loop in the cancelled worker subtree and iterate each worker's durable open-subscription rows, invoking each exact callable owner from the process-local live registry. The durable rows answer *what is held*; the live registry answers *how this process tears it down*; the abort signal is a fast-path optimization. There is no implicit detachment. Shutdown reaps process-local streams while preserving parked work under {§worker-lifecycle-durable-disposition}. Before shutdown awaits drains, it cancels every process-local proposal waiter through {§proposal-cancel-aborts} with outcome `daemon_stopping`, so a stopped-world dispatch cannot hold teardown open. A stream that is running, mid-spawn (its row written before it is killable), or spawned after the cancel is reaped alike. The teardown abort is bounded: the executor sends a polite signal then SIGKILL after a consumer-set grace (`PLURNK_SERVICE_EXEC_KILL_GRACE_MS`). A model ```` ```KILL [code] ```` on one live stream instead delivers exactly that signal once (bare KILL uses the executor's SIGHUP default; ```` ```KILL [9] ```` uses SIGKILL).
+- §worker-lifecycle-total-reap **Cancellation is recursive and reaps every held stream.** `loop.cancel` and worker `KILL` terminalize every unresolved loop in the cancelled worker subtree and iterate each worker's durable open-subscription rows, invoking each exact callable owner from the process-local live registry. The durable rows answer *what is held*; the live registry answers *how this process tears it down*; the abort signal is a fast-path optimization. There is no implicit detachment. Shutdown reaps process-local streams while preserving parked work under {§worker-lifecycle-durable-disposition}. Before shutdown awaits drains, it cancels every process-local proposal waiter through {§proposal-cancel-aborts} with outcome `daemon_stopping`, so a stopped-world dispatch cannot hold teardown open. A stream that is running, mid-spawn (its row written before it is killable), or spawned after the cancel is reaped alike. The teardown abort is bounded: the executor sends a polite signal then SIGKILL after a consumer-set grace (`PLURNK_SERVICE_EXEC_KILL_GRACE_MS`). A model ```` ```KILL [code] ```` on one live stream instead delivers exactly that signal once (bare KILL uses the executor's SIGHUP default; ```` ```KILL [9] ```` uses SIGKILL).
 - §worker-lifecycle-exec-epoch-bound **A stream's kill binds to the scope it captured at spawn.** A stream captures the worker's cancellation scope as it registers and wires its kill to it, re-checking `aborted` AFTER wiring — no check-then-listen gap can drop an abort that lands mid-registration. Because the scope is replaced only once aborted, a captured-then-replaced scope is necessarily already aborted, so replacement never strands a live stream.
-- §worker-lifecycle-no-resurrection **Cancelled work does not revive its scope.** A cancelled worker cannot be woken by its torn-down streams, stale timers, or cancelled undelivered prompt frames. The evidence remains readable. A `499` result from cancelling only one stream is still a completion owed to a live waiting worker: result status is not proof of worker cancellation. Only an explicit new arrival admits new work after scope cancellation; terminal loops themselves remain immutable.
-- §worker-cancel-trigger **A cancellation is one bound statement.** `lifecycle_cancel_workers` writes the causal cutoff and the cancellation Problem onto every worker of the scope; `workers_cancel_live_loops` (an `INIT` process trigger beside the lifecycle statements, {§db-process-triggers}) retires each worker's live loops inside that statement — 499, waits cleared, the delivered response kept as the result's `content`, the Problem instanced `loop:///<id>`, `terminated_by = 'cancel'` — so cutoff and cancellation cannot land apart and no value is string-interpolated. Execution consumption is measured by the process-local monotonic timers ({§loop-execution-allowance}) and lands first through `lifecycle_checkpoint_executions`; a wall clock cannot stand in for it, so the timer stays outside the database by design.
-- §worker-causal-admission **Admission and cancellation have one ordering.** DrainSupervisor serializes message admission, prompt promotion, and subtree cancellation within the workspace, taking the worker queue lock inside that control boundary. No provider, tool, fork-history copying, or stream reap holds it. WORK, FORK, and directed SEND identify their originating loop; admission requires that task still running. An accepted message to an independent recipient is a committed effect, not retroactively withdrawn by cancelling its sender.
+- §worker-lifecycle-no-resurrection **Cancelled work does not revive its scope.** A cancelled worker cannot be woken by its torn-down streams, stale timers, or cancelled unpublished messages. The evidence remains readable. A `499` result from cancelling only one stream is still a completion owed to a live waiting worker: result status is not proof of worker cancellation. Only an explicit new arrival admits new work after scope cancellation; terminal loops themselves remain immutable.
+- §worker-cancel-trigger **A cancellation is one bound statement.** `lifecycle_cancel_workers` writes the causal cutoff and the cancellation Problem onto every worker of the scope; `workers_cancel_live_loops` (an `INIT` process trigger beside the lifecycle statements, {§db-process-triggers}) retires each worker's live loops inside that statement — 499, waits cleared, message evidence left unchanged, the Problem instanced `loop://<worker>/<sequence>`, `terminated_by = 'cancel'` — so cutoff and cancellation cannot land apart and no value is string-interpolated. Execution consumption is measured by the process-local monotonic timers ({§loop-execution-allowance}) and lands first through `lifecycle_checkpoint_executions`; a wall clock cannot stand in for it, so the timer stays outside the database by design.
+- §worker-causal-admission **Admission and cancellation have one ordering.** DrainSupervisor serializes message admission, orphan-message recovery, and subtree cancellation within the workspace, taking the worker queue lock inside that control boundary. No provider, tool, fork-history copying, or stream reap holds it. WORK, FORK, and directed SEND identify their originating loop; admission requires that task still running. An accepted message to an independent recipient is a committed effect, not retroactively withdrawn by cancelling its sender.
 
   | Boundary outcome | Durable consequence |
   |---|---|
   | Admission before cancellation | Owned work is included in cancellation. |
-  | Recurring success during cancellation | Its successor is cancelled and reported from the durable cutoff, not a previously sampled task list. |
   | Cancellation before admission | The cancelled task cannot deliver further messages or start children. Created identities and evidence are retained. |
-  | Cancellation with unread prompts on completed tasks | Atomically record each worker's greatest admitted loop sequence as `cancelled_through_sequence` and cancel unresolved tasks. Prompt promotion, including boot recovery, excludes sources at or below that cutoff; completed results and prompt evidence are unchanged. |
+  | Cancellation with unpublished messages on completed tasks | Atomically record each worker's greatest admitted loop sequence as `cancelled_through_sequence` and cancel unresolved tasks. Orphan-message recovery, including boot recovery, excludes sources at or below that cutoff; completed results and message evidence are unchanged. |
   | Independent arrival after cancellation | Admit a new loop above the cutoff using the ordinary worker policy. |
   | Slow stream teardown after new admission | Reap only subscription identities captured by cancellation; late old-scope spawns follow {§worker-lifecycle-exec-epoch-bound}. |
 
 - §worker-lifecycle-wake-liveness **A stream conclusion always reaches its worker.** The stream first persists its terminal state. A worker **blocked on a 202 wait** for that stream ({§wait-obligation-matrix}) then **awakens that loop in place** — the blocked loop *is* the continuation, so there is no fresh loop and no summary-as-prompt fiction. An already-active worker needs no injected prompt or second wake because its next packet reads the durable terminal state. A concluded worker receives no synthetic loop from ambient stream closure. The result remains available in the stream's own state under every case.
 - §worker-lifecycle-child-wake **Each child task completion notifies its parent.** Terminal-task publication, including failure and cancellation of a parked task, notifies the direct parent without injecting a prompt. Other unfinished tasks or streams in that child remain independent obligations; they cannot suppress notification. The parent's eligible waits requeue in place under {§loop-wake-identity} and the bounded {§worker-optimistic-settlement} opportunity. Durable revisioning covers completion-before-park and restart; drain teardown and whole-worker quiescence are not completion identities.
-- §worker-optimistic-settlement **Asynchronous settlement receives one bounded worker-local opportunity before model dispatch.** An initiating turn lets only the streams it started settle before its turn disposition; separately, a stream or direct-child conclusion persists and publishes immediately but holds eligible parked loops' `202→100` requeues while another stream or direct child remains live. Both use `PLURNK_SERVICE_OPTIMISTIC_WAIT_MS`, shipped at five seconds; zero disables the opportunity. The wake hold ends as soon as no sibling obligation remains, never extends its original deadline, and coalesces conclusions within that window into at most one requeue per eligible loop. With no sibling obligation the wake is immediate; at the deadline, surviving work follows the ordinary monitored lifecycle. A conclusion that lands after provider dispatch begins retains its next wake, while poll, park-deadline, prompt, and operator wakes never open this hold. Only packet/provider dispatch waits: terminal state, client events, cancellation, and child execution do not. One redaction-safe span records elapsed time, quiescence versus deadline, and conclusion count without entering the packet.
-- §worker-lifecycle-idle-is-concluded **No implicit completion.** A waiting inventory without a finite deadline, positive poll or live obligation continues under {§wait-obligation-matrix}. Only a terminal inventory with at least one completed task claims success. A concluded worker retains durable history; a later addressed arrival starts a new loop.
+- §worker-optimistic-settlement **Asynchronous settlement receives one bounded worker-local opportunity before model dispatch.** An initiating turn lets only the streams it started settle before program completion; separately, a stream conclusion, direct-child conclusion or addressed reply persists and publishes immediately but holds eligible parked loops' `202→100` requeues while another stream or direct child remains live. Both use `PLURNK_SERVICE_OPTIMISTIC_WAIT_MS`, shipped at five seconds; zero disables the opportunity. The wake hold ends as soon as no sibling obligation remains, never extends its original deadline, and coalesces arrivals within that window into at most one requeue per eligible loop. With no sibling obligation the wake is immediate; at the deadline, surviving work follows the ordinary monitored lifecycle. An arrival after provider dispatch begins retains its next wake, while poll, new-request and operator wakes never open this hold. Only packet/provider dispatch waits: durable state, client events, cancellation and the replying program do not. One redaction-safe span records elapsed time, quiescence versus deadline, and arrival count without entering the packet.
+- §worker-lifecycle-idle-is-concluded **Idle is not unanswered.** An empty WAIT continues; an answered, observed program without held work concludes under {§wait-obligation-matrix}. A concluded worker retains durable history; a later addressed arrival starts a new loop.
 - §worker-lifecycle-no-lost-loop **A loop is never stranded by a drain's exit.** A drain relinquishes its registry slot only after a lock-held re-claim confirms the queue is empty; a loop enqueued during that teardown is either re-claimed by the exiting drain or claimed by a fresh drain that a later inject starts. The relinquish and the start are serialized, so neither the lost-loop hang nor a transient double-drain can occur.
 - §worker-lifecycle-durable-disposition **Durable disposition wins cancellation races.** At a turn boundary, the engine reads the loop's durable status before interpreting a process-local abort. A committed `202` park survives a later daemon-shutdown signal; only a loop still durably running at `102` can be terminalized by that cancellation. Wake selection rechecks shutdown and worker cancellation before requeuing each parked loop.
-- §worker-lifecycle-restart-recovery **Restart is owner-loss reconciliation, not replay.** Before opening client transports, the service holds an exclusive database-adjacent daemon lock; a second live owner fails before touching SQLite, while a dead-PID crash claim is replaced atomically without a timeout lease. Boot preserves accepted `100` loops and restores their drains. A `102` loop belonged to a vanished drain/provider call, so it settles `500` with the interruption on its durable row—never replayed across an unknown effect boundary. Every pending physical provider request first settles as an error with absent usage and explicitly unknown cost; then its logical model call closes. Recovery never fabricates zero evidence. Every durable proposed operation likewise lost its process-local resolution waiter and settles as a visible `500 owner_vanished` occurrence rather than an unresolvable interrupt ({§proposal-list}). A pending client interaction also lost its exact awaiting operation, so boot removes the orphan instead of replaying work or inventing a response ({§client-interactions}). Every durable-open subscription belonged to a vanished callable: active channels become errored and its row closes `500`. A `202` continuation preserves its requested deadline and observation interval. An unseen completion requeues it; an untimed join whose obligations vanished also requeues. Otherwise a future timed wait remains parked and an expired due time wakes it through the same guarded scheduler. Child terminalization wakes its parked parent on every outcome, including provider exceptions, cancellation, and restart interruption, recursively through the durable parent edges. These operations are idempotent, so an interrupted recovery safely repeats.
+- §worker-lifecycle-restart-recovery **Restart is owner-loss reconciliation, not replay.** Before opening client transports, the service holds an exclusive database-adjacent daemon lock; a second live owner fails before touching SQLite, while a dead-PID crash claim is replaced atomically without a timeout lease. Boot preserves accepted `100` loops and restores their drains. A `102` loop belonged to a vanished drain/provider call, so it settles `500` with the interruption on its durable row—never replayed across an unknown effect boundary. Every pending physical provider request first settles as an error with absent usage and explicitly unknown cost; then its logical model call closes. Recovery never fabricates zero evidence. Every durable proposed operation likewise lost its process-local resolution waiter and settles as a visible `500 owner_vanished` occurrence rather than an unresolvable interrupt ({§proposal-list}). A pending client interaction also lost its exact awaiting operation, so boot removes the orphan instead of replaying work or inventing a response ({§client-interactions}). Every durable-open subscription belonged to a vanished callable: active channels become errored and its row closes `500`. A `202` continuation requeues on an unseen completion or when no live obligation remains. Otherwise it stays parked on surviving children; the drain restores inherited stream observation through the same guarded scheduler ({§worker-wait-timing}). Child terminalization wakes its parked parent on every outcome, including provider exceptions, cancellation, and restart interruption, recursively through the durable parent edges. These operations are idempotent, so an interrupted recovery safely repeats.
 
 ---
 
@@ -1088,7 +1040,7 @@ their absence never makes a client, plugin, or `_plurnk` turn exceptional.
 |---|---|
 | `producer` | Required actor class: `model`, `client`, `plugin`, or `_plurnk`. |
 | `kind` | Required purpose: `inference`, `initialization`, `operation`, or `maintenance`. Model iff inference; initialization and maintenance require `_plurnk`. Producer and kind are immutable. A maintenance turn's successful rows are packet-suppressed — a receipt answers an asker, and maintenance has none ({§actor-boundary-doc-injection}). |
-| `status`, `completed_at` | A new turn is open at status 102 with `completed_at=NULL`. Completion records the exact turn disposition/operation disposition and timestamp; a completed 102 is therefore distinct from an open 102. |
+| `status`, `completed_at` | A new turn is open at status 102 with `completed_at=NULL`. Completion records the program outcome and timestamp; a completed 102 is distinct from an open 102. A successful administrative program completes at 200 without concluding its host model loop. |
 | Operations | Ordered by `(turn_id, sequence)` on one exact worker/loop/turn chain. Each row's `origin` is the turn producer or `_plurnk` making a system observation; the observation does not impersonate the producer. |
 | Program source | Every admitted source-backed turn preserves its exact program before dispatch in `turn_sources`, independently of log receipts, under {§turn-ops-entry}. |
 | Inference evidence | Model calls, `packet`, model, finish reason, and provider metadata belong only to model/inference turns. Turn fields are nullable until recorded and remain NULL for every other kind. |
@@ -1104,7 +1056,7 @@ recovery completes any turn whose producer vanished.
 A provider response, deterministic `_plurnk` program, or future client/plugin
 program crosses one admission boundary into the same executor. That executor
 parses once, dispatches the admitted statements in order, records their ordinary
-outcomes, and completes the turn from its TASK ruling. Exact source is retained before dispatch.
+outcomes, and completes the turn from its lifecycle ruling. Exact source is retained before dispatch.
 Provider attempts, grammar recovery, reasoning, and accounting end before this
 shared seam. A programmatic operation batch that supplied no Plurnk source does
 not fabricate verbatim source.
@@ -1113,7 +1065,7 @@ not fabricate verbatim source.
 Immediately before statement dispatch, the shared executor captures that worker's
 append-only log high-water mark. Every log-targeted KILL in the program resolves
 row membership at or below that same boundary, while prior curation effects still
-compose normally. Prompt and other pre-program rows already present in the turn
+compose normally. Message arrivals and other pre-program rows already present in the turn
 remain selectable; preceding and later operation rows cannot be captured by
 their own program. A directly dispatched
 single operation captures the equivalent boundary before dispatch. This limits
@@ -1129,7 +1081,6 @@ These are the complete strike sources:
 | Strike source       | Exact trigger                                                                                                    | Model-visible occurrence                                      |
 |---------------------|------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------|
 | Hard result         | An admitted non-execution operation or bounded parse-error status is `>= 400`, except the soft set `404`, `409`, `416`, `425`, `501`. | The originating failure row.                                  |
-| Inventory steering  | Retired (2026-09-14): a completion claimed over live work joins it ({§completion-joins-live-work}) and one over settled results defers ({§completion-defers-to-results}); every answer to a TASK claim, an empty inventory's soft 409 included, is a receipt and never a strike; a malformed TASK (`400 wait-timing-invalid`) is a hard result like any other operation's. | The TASK receipt. |
 | Cycle               | The executed operations and their observed results repeat under {§engine-cycle-evidence}.                         | None; cycle detection itself is private engine accounting.    |
 
 Execution results remain exact model-visible evidence but are always soft: an
@@ -1142,9 +1093,10 @@ other violations in the same turn still strike normally.
 
 §engine-cycle-evidence Cycle identity contains the ordered executed operations
 and their dispatch results, including complete operands, scopes, bodies, and
-scheme metadata, including the complete TASK inventory and SEND bodies. Source
+scheme metadata, including the complete NOTE and response bodies. Source
 positions and asides are excluded. Engine-assigned
-Problem `instance` addresses are excluded from results. Object member order is
+Problem `instance` addresses and NOTE's assigned storage `resource` coordinate
+are excluded from results; the complete note body still distinguishes activity. Object member order is
 irrelevant; operation and array order are preserved. Only the configured
 `MIN_CYCLES × MAX_CYCLE_PERIOD` history window is retained. Repeated addresses
 alone are not a cycle: changing inputs or observations distinguish activity.
@@ -1156,8 +1108,8 @@ effects. Ordinary contract strikes and operator budgets remain independent.
 call fails with a network failure, rate limit, deadline, or interrupted resource after
 the provider's own retries, the turn records the exact Problem as a `_plurnk` row,
 notices the client (`engine:provider` / `provider_unavailable`), waits with
-exponential backoff (`PLURNK_SERVICE_PROVIDER_RECOVERY_BACKOFF`, doubling, capped at
-twelve times itself), and re-issues the same call against the exact frozen model
+exponential backoff (`PLURNK_SERVICE_PROVIDER_RECOVERY_BACKOFF`, doubling up to
+`PLURNK_SERVICE_PROVIDER_RECOVERY_BACKOFF_MAX`), and re-issues the same call against the exact frozen model
 messages whose response is still outstanding. Each reissue remains a distinct logical
 model call with complete physical-request accounting, but the active turn's newly
 recorded provider Problems do not recursively enter that request; they surface normally
@@ -1166,8 +1118,10 @@ scored. Every recovery checkpoint broadcasts live, while the model-facing Notice
 retains only the current provider state; the next completed exchange notices
 `provider_recovered`. Recovery is bounded by `PLURNK_SERVICE_PROVIDER_RECOVERY`; when it
 is spent the turn completes as `202` and the loop parks exactly like a
-TASK wait ({§worker-lifecycle-wake-requeue-not-terminal}), resuming on the
-next prompt or wake with its log intact. Only a client cancel, the execution allowance
+WAIT ({§worker-lifecycle-wake-requeue-not-terminal}), resuming on the
+next prompt or wake with its log intact — **unless the run is unattended
+({§loop-attendance}), in which case the loop concludes on the provider's exact failure
+instead, because parking stops the execution clock and no wake would ever arrive.** Only a client cancel, the execution allowance
 ({§operator-config-loop-timeout}), or a non-recoverable provider Problem (refusal,
 authorization, quota, an invalid response) settles a loop on a provider failure.
 
@@ -1183,15 +1137,14 @@ The contracts, and the violation of each that strikes:
 | Contract | Violation that strikes |
 |---|---|
 | operation contract | a hard operation failure (status ≥ 400) in an admitted turn — soft statuses below excluded |
-| review contract | none since 2026-09-14: a completion claimed over live work joins it ({§completion-joins-live-work}), one over settled results defers ({§completion-defers-to-results}), and an empty inventory or an already-terminal loop is a soft receipt |
+| review contract | none: answered work joins live obligations ({§completion-joins-live-work}) or continues to observe results ({§completion-defers-to-results}) |
 | progress contract | a detected operation cycle (`MIN_CYCLES` × period), or an admitted turn with no operation ({§empty-turn}) |
 | frame contract | emission attempts exhausted with no admissible turn |
 | provider response contract | the provider returned an invalid response |
 
 Errors and issues are NOT contract violations. Each keeps its own disposition
 and never strikes: exploration misses (404, 416) and unsupported capability
-(501) are how discovery works; raw 409 outcomes are soft (the review ruling is
-steer's alone); execution outcomes and `executor/*` problem rows are world evidence;
+(501) are how discovery works; raw 409 outcomes are soft; execution outcomes and `executor/*` problem rows are world evidence;
 provider weather (rate limit, network failure, deadline, interruption) recovers
 ({§provider-recovery}); provider capacity has its own packet recovery and
 terminal ({§provider-capacity-failure}); request rejection
@@ -1201,9 +1154,7 @@ attempts are forensic evidence beneath their turn ({§emission-admission}) —
 only their exhaustion surfaces, as one frame-contract violation. The
 independent turn ceiling terminates at **429** ({§loop-terminals}). The streak
 and cycle verdict are absent from model packets; only the concrete occurrences
-in the table are shown. The current streak may ride first-party provider
-metadata ({§strikes-first-party-metadata}), which does not make it
-model-facing.
+in the table are shown. The streak never leaves the daemon.
 
 §loop-rail-continuity Rail state belongs to the durable loop, not its execution
 segment. The strike streak and bounded cycle history survive driver cleanup and
@@ -1217,13 +1168,13 @@ restart; curation of log evidence cannot alter them.
 | Recoverable provider outage | No assessment; preserve the streak. | Preserve until an actual park. |
 | New loop | Start at zero. | Start empty. |
 
-The turn belongs to the wait revision under which it began. A rejected waiting TASK or
+The turn belongs to the wait revision under which it began. A rejected WAIT or
 one resolved without parking does not close a window. Periodic observations
 separated by actual waits are not an uninterrupted cycle; cumulative turn and
 execution allowances remain independent bounds. A committed terminal result
 cannot be replaced by a later rail assessment ({§worker-lifecycle-state-machine}).
 
-## §provider Provider Contract
+## Provider Contract
 
 Author-facing contract: [`@plurnk/plurnk-providers`](../plurnk-providers/SPEC.md). Below: consumption surface + engine→provider guarantees.
 
@@ -1241,7 +1192,7 @@ Three current entry points:
 
 §meta-passthrough **Metadata passthrough (provider → client).** `generate` may return an open `meta: Record<string, unknown>` bag. The service stores it unenforced per turn (`turns.meta`, `json_valid` only — no schema) and forwards the latest turn's blob in `loop/terminated.usage` ({§notifications}). The service never reads a field within it. Providers own their metadata shapes; monetary values carry an explicit amount and currency rather than an implied unit. Absent → `{}`. The mirror direction (client → provider, the self-identified `client` id) rides `generate({client})` ({§attribution}).
 
-### §provider-guarantees Engine → provider guarantees
+### Engine → provider guarantees
 
 - `messages` is a complete prompt (the section list, pre-assembled into the system + user messages). Provider does not reorder.
 - §provider-guarantees-signal-wired `signal` is wired to the worker's AbortController.
@@ -1253,7 +1204,7 @@ Three current entry points:
 
 ### §emission-admission Provider emission admission
 
-A completed provider exchange is an **emission attempt**, not necessarily an engine turn. ANTLR admits at least one parsed source operation, no `unparsedTail`, and at most one final TASK. Omitted TASK continues silently under {§turn-shape}, without a synthesized inventory, receipt, diagnostic, warning, or strike. Bounded operation errors retain useful siblings and participate in the ordinary struck turn; statements after TASK are admitted in authored order and the disposition is scheduled last ({§disposition-anywhere}). A duplicate TASK or an unfinished heading slot at the end of the input rejects the exchange; no recovered prefix dispatches. A missing closer never rejects ({§closer-fallback}). An exchange with no operation and no other hard error is not rejected: it is admitted as an empty turn ({§empty-turn}). Parser warnings remain admissible. `finish=length` is evidence of likely truncation, not an independent rejection rule. Provider-declared interruption never reaches admission ({§provider-interrupted-attempt}). Accepted source bytes and statement positions remain exact in response evidence and `turnOps`. Execution follows {§op-execution-order}.
+A completed provider exchange is an **emission attempt**, not necessarily an engine turn. **The harness admits every program whose meaning it can determine, runs what it admitted, and reports — never refuses — what it could not read**; a refusal is for undecidable text alone. ANTLR admits at least one parsed source operation. WAIT is optional under {§turn-shape}; omission invents no operation, diagnostic, warning or strike; any number of WAITs are one park, scheduled last ({§disposition-anywhere}), and statements after them remain admitted in authored order. Bounded operation errors retain useful siblings and participate in the ordinary struck turn. An unfinished heading slot ({§unparsed-tail-boundary}) refuses only what follows it: the statements that closed before it run, and the loss is one more hard diagnostic — a failed row with the lexer's own reason; an exchange that lost its boundary before any statement closed has nothing admissible and is rejected. A missing closer never rejects ({§closer-fallback}). An exchange with no operation and no other hard error is not rejected: it is admitted as an empty turn ({§empty-turn}). Parser warnings remain admissible. `finish=length` is evidence of likely truncation, not an independent rejection rule. Provider-declared interruption never reaches admission ({§provider-interrupted-attempt}). Accepted source bytes and statement positions remain exact in response evidence and `turnOps`. Execution follows {§op-execution-order}.
 
 §safe-uri-target-groups After source and authored-command admission, Core tolerates one target group on READ or KILL only when splitting its raw target at top-level comma or whitespace separators produces at least two members and every member independently parses as an explicit `scheme://` URI. Request-metadata blocks are opaque to this split. Each member becomes one ordinary statement with an independent dispatch outcome and log row, in authored member order at that operation's position under {§op-execution-order}. Otherwise the target remains exactly singular, including local filenames containing spaces or commas. The stored `turnOps` and authored command count remain unexpanded, and no other operation admits target groups.
 
@@ -1262,16 +1213,16 @@ Core retries a rejected emission against the exact same packet beneath the same
 When the loop continues after exhaustion under {§invalid-emission-attempts}, the next ordinary turn's packet projects the latest rejected response visibly from a durably body-suppressed emission-attempt item under {§rejected-emission-entry} and carries one transient `invalid_emission` Notice: `Response rejected before dispatch; no operations were performed.` followed by `Parser: <the latest attempt's first diagnostic>` with its `content-offset` position — the model sees why, at which line, against its own projected text. The Notice states only observed admission facts; it does not classify the response as unrecoverable, infer why generation ended, or prescribe intent beyond the parser-owned diagnostic. Attempt count and rail state never become model-facing. The recovery turn has its own honestly stored packet and its configured private same-packet attempts. The packet-local projection never changes the row's curation state, so no later packet repeats that malformed body unless the model explicitly READs its exact address. Admission clears the recovery projection; another exhaustion replaces it with the latest rejected response if the loop continues.
 
 Outside-block text has no execution, message, or receipt semantics under
-{§whitespace-contract}. The `ops:///` source retains it verbatim under
+{§whitespace-contract}. The `ops://<worker>/` source retains it verbatim under
 {§turn-ops-log-curation}; execution never reconstructs source from the AST.
 
-An admitted program may contain bounded malformed statements.
-Parsed operations still dispatch; each hard parser diagnostic
-becomes one durable model-origin `error` row with the parser's exact detail under
-{§parse-diagnostics} and status 400. These failures are committed before the
-explicit final TASK, or at the end of a TASK-less program, participate in the ordinary strike rail, and prevent completed
-inventories from concluding before the model sees them in the next packet.
-A waiting inventory without a live obligation continues to those results.
+An admitted program may contain bounded malformed statements, or end in a lost
+boundary. Parsed operations still dispatch; each hard parser diagnostic — the
+tail's reason included — becomes one durable model-origin `error` row with the
+parser's exact detail under {§parse-diagnostics} and status 400. These failures are committed before the
+explicit WAIT, or at the end of a program without WAIT, participate in the ordinary strike rail, and prevent
+completion before the model sees them in the next packet.
+WAIT without a live obligation continues to those results.
 This is operation recovery, not provider
 resampling. A malformed statement's Problem records the factual
 `siblingsRetained: true` extension.
@@ -1314,9 +1265,7 @@ Runtime hooks are synchronous and receive only the attempt coordinates. A hook
 failure is an internal plugin-contract failure; Core does not silently discard
 it or reinterpret a malformed tag list.
 
-§strikes-first-party-metadata The loop's **current strike streak** rides `generate({ strikes })` the same way — first-party outbound metadata (`Plurnk-Strikes` under the `firstPartyMetadata` gate): the hosted router's escalation signal (route-after-strike). The shape is a bare number — the streak at generate-time, the same figure the 500-threshold compares; a clean turn zeroes it, every loop starts at 0, and `0` is sent explicitly (clean ≠ unreported). It is NEVER model-facing ({§rail-accounting-private}) — headers only, the packet never carries it.
-
-§client-metadata **The workspace's `client` id rides the same wire.** A frontend self-identifies (e.g. `plurnk.nvim/1.4.0`) at `workspace.create({ settings: { client } })`; the engine forwards it per turn on `generate({ client })`, which only the `plurnk` provider emits (as `Plurnk-Client`). Workspace-stable and self-reported — distinct from attribution's install-grounded tags — and omitted when unset.
+§client-metadata **The workspace records which frontend opened it.** A frontend self-identifies (e.g. `@plurnk/plurnk-tui/1.4.0`) at `workspace.create({ settings: { client } })` and the daemon stores it with the workspace. It is validated on write, never forwarded to a provider, and never model-facing. Workspace-stable and self-reported — distinct from attribution's install-grounded tags — and omitted when unset.
 
 ### §provider-instantiation Provider instantiation
 
@@ -1367,7 +1316,7 @@ PLURNK_MODEL=gemma
 
 First path segment = provider name; rest = provider-native model id.
 
-### §mock-provider Mock provider (sibling fixture)
+### Mock provider (sibling fixture)
 
 §mock-provider-mock-fixture `Mock` (exported from `@plurnk/plurnk-providers`) — intg fixture + reference implementation. `{ contextWindow, responses }` constructor; `generate` shifts from the queue. `MockResponse.assistant.ops?: PlurnkStatement[]` is a pre-parsed escape hatch the engine consumes directly when present; production providers don't expose this — and being a plugin export, this contract has no service-side `§`-ref.
 
@@ -1411,14 +1360,24 @@ meaning of an authored URI authority before any entry capability is exposed:
 | Project files | Filesystem namespace | Workspace policy | Shared live |
 | `worker:///...` | Empty, shared scratch | Any workspace actor | Shared live |
 | `worker://alice/...` | Named scratch | Any workspace actor | Snapshot source namespace into new name |
-| `prompt://alice/...` | Named prompt evidence | Intrinsic scheme contract; model-read-only | Snapshot source history into new name |
-| `ops:///...`, `reasoning:///...` | Current worker's turn coordinates | Immutable for every actor | Snapshot sources at identical local coordinates |
+| `ops://<worker>/<loop>/<turn>`, `reasoning://<worker>/<loop>/<turn>` | Named worker's turn history | Immutable for every actor | Snapshot sources at identical coordinates under the child's name |
+| `note://<worker>/<loop>/<turn>/<item>` | Named worker's NOTE history | Immutable for every actor | Snapshot sources at identical coordinates under the child's name |
+| `ops://<worker>/<loop>` | Named worker's loop | Immutable: what it said, or how it ended | Snapshot terminal history under the child's name |
+| `message://<worker>/<id>` | Native message admitted to the named worker | Immutable; SEND records a separate reply | Retain original addresses |
+| `log:///<loop>/<turn>/<item>/<op>` | Implicit observing worker | KILL curates the projection, not its source | Snapshot projection; explicit source addresses stay unchanged |
+| `<executor>:///<id>` | Empty, workspace output namespace | Executor stream contract | Shared live; no copied process |
 | `skill://recipe/...` | Installed skill name | Skill resource contract | Shared installation |
 | HTTP, WebSocket, executor/MCP, A2A resources | Scheme's canonical namespace | Scheme contract and workspace policy | Shared live; no copied connection |
 
 Copied bodies and log references remain verbatim. Explicit source addresses continue to name the source; only copied scratch/evidence resources' own authority becomes the child's name ({§machine-processes-entry-inheritance}).
 
-§fs-namespace **The workspace is a mount namespace; `project_root` is the model's `/`.** Chroot semantics: host paths do not exist inside the jail, and no engine surface folds a host-absolute spelling onto a member. The root is **fixed immutably at workspace creation** (headless is forever); the namespace's mount table changes only through the declared membership overlay ({§membership}), never by re-rooting. At `project_root = /` the jail is the whole filesystem and every rule below degenerates to identity — the design's proof case, and the common benchmark topology.
+The scheme identifies the resource kind, the authority names its namespace, and
+the path identifies the resource within it. History uses worker-local loop/turn/item
+sequences; native messages and workspace outputs use opaque identifiers rather than
+pretending to be turn coordinates. `worker://<name>` addresses the actor, not a
+historical execution. No address grants ownership or access restrictions.
+
+§fs-namespace **The workspace is a mount namespace; `project_root` is the model's `/`.** A namespace *names*; it does not confine. Host paths do not exist in it, and no engine surface folds a host-absolute spelling onto a member — not because a wall refuses them, but because those coordinates have no meaning here. What the model can reach is exactly the mount table, which the operator composes: a membership overlay routinely mounts a path from above the root (`../house-policy.md` is an ordinary `include` grantor, {§fs-visibility-grantors}), and it arrives named in namespace coordinates like everything else. Plurnk is therefore not a sandbox and claims no containment — confinement is the host's job; what Plurnk owns is authority, consent and audit. The root is **fixed immutably at workspace creation** (headless is forever); the mount table changes only through the declared membership overlay ({§membership}), never by re-rooting. At `project_root = /` the namespace is the whole filesystem and every rule below degenerates to identity — the design's proof case, and the common benchmark topology.
 
 §fs-namei **Resolution is namei over the mount table.** The model's CWD is permanently `/`, so `src/x.md` and `/src/x.md` are the same name — the slash rule is a corollary, never a legislated equivalence. Resolution is lexical: `.` and `..` resolve before anything touches storage (`..` is legal *during* traversal); the final name lands in the root subtree (a bare key), on a declared outside-root mount (a `../`-prefixed key — the git-style overlay), or names nothing (404 carrying the resolved form). Containment is the resolution semantics — there is no separate traversal check to forget.
 
@@ -1481,7 +1440,7 @@ Every fact names the canonical key, never the host root or an echo of the
 model's spelling. These classes let a caller distinguish a wrong address, an
 invalid range, read-only authority, and occupied hidden state without guessing.
 
-§membership-read-refusal **A READ miss that is really a non-member is refused, not denied.** An exact-path READ of an in-root path that exists on disk but is not a member returns 404 `entry-not-member` — `'<key>' exists on disk but is not a member of this workspace.` — with a recovery naming the door (```` ```members (add) ```` with a `{"glob": "<path>"}` body); it never claims absence. Occupancy surfaces, content does not ({§membership}).
+§membership-read-refusal **A file miss speaks of membership, never of the disk.** A file is read only as a member, so every `file` miss — READ, FIND of an exact path, KILL, a COPY or MOVE source — is 404 `entry-not-found`, `No member of this workspace is at '<key>'.`, with a recovery naming both doors: EDIT creates a member at the path, and ```` ```members (add) ```` with a `{"glob": "<path>"}` body admits a file that already exists. The sentence is about the address and is true whether or not a file is there: it neither claims absence nor hints at presence. Beyond the root the engine does not look at the disk at all, so two reads of `../` paths differ only in the name they echo. Inside the root occupancy is not secret ({§fs-write-nonmember}), so an exact-path READ of a path that exists on disk but is not a member says so instead — 404 `entry-not-member`, `'<key>' exists on disk but is not a member of this workspace.` Occupancy may surface there; content never does ({§membership}).
 
 §fs-world-state **The world-state harness — coverage that closes the class.** Op-outcome tests check what an op returned; the harness checks the resulting world. `WorldState.check(db)` asserts, pure-db and read-only: identity uniqueness in practice (no tuple holds two rows), the canonical fixpoint on every file-class key, channel orphan-freedom, the closed admission set (every file row's origin is Git or constraint), and sig-coherence. Generated-pick incorporation and lifecycle require filesystem/Git evidence and are covered by the composed creation matrix rather than a false pure-database proxy. The harness runs as a lifecycle-test epilogue and at every soak turn boundary, where the delta half applies: an idle turn grows the entries table by ZERO. A violation names its law and its row.
 
@@ -1498,13 +1457,14 @@ own a more specific operation. A stored-entry publication atomically upserts
 one workspace identity, metadata, and its complete channel set. Concurrent
 publications expose one complete result, never a mix of channels; a failed
 publication leaves the prior entry unchanged. Omitted attributes preserve the
-existing bag. Reads observe metadata and channels in one snapshot. There is no
+existing bag. Unchanged channel representations retain their derivations;
+changed representations invalidate them and omitted channels are removed.
+Reads observe metadata and channels in one snapshot. There is no
 cross-scheme SQL transaction. Core's create-only publication claims the same
 identity atomically: an existing identity returns 409 without changing its
-metadata or channels. Generated prompt IDs retry that collision; they never
-upsert another prompt's contents ({§prompt-address}).
+metadata or channels.
 
-### §op-methods Op methods
+### Op methods
 
 §op-methods-op-dispatch Engine operation ownership follows the public scheme contract:
 
@@ -1521,7 +1481,7 @@ Registration precedes loop affinity:
 | Registered but inactive under flag | The flag gate returns `403 scheme-unavailable`.                         |
 | Registered and active              | Dispatch continues to the operation owner.                              |
 
-- §op-execution-order **An admitted turn is an ordered program.** Model, client, and harness operations execute in authored order. Only an explicit disposition operation is deferred until all other admitted operations settle or establish their explicitly asynchronous work; a model turn may author it anywhere ({§disposition-anywhere}), and internal and client programs keep the same schedule. Its obligation checks and client-visible completion run last. Without a disposition, the turn settles its spawns and defaults to 102 without inventing an operation or inventory; existing cycle, no-operation, and resource rails remain effective. An observation records the resource state at its execution point; the model sees that receipt in the next packet. Exact submitted source and actual operation outcomes remain durable. Earlier successful effects survive a later operation failure; a producer requesting fail-on-error stops before subsequent operations.
+- §op-execution-order **An admitted turn is an ordered program.** Model, client, and harness operations execute in authored order. Only WAIT is deferred until all other admitted operations settle or establish their explicitly asynchronous work ({§disposition-anywhere}). The complete program then settles under {§wait-obligation-matrix}, whether or not it contains WAIT; no completion operation or inventory is invented. Existing cycle, no-operation, and resource rails remain effective. An observation records the resource state at its execution point; the model sees that receipt in the next packet. Exact submitted source and actual operation outcomes remain durable. Earlier successful effects survive a later operation failure; a producer requesting fail-on-error stops before subsequent operations.
 
 §bare-inference **BARE is isolated, synchronous retrieval over the durable child-provider policy.**
 
@@ -1538,11 +1498,12 @@ Registration precedes loop affinity:
 - §op-synchronous **Decisive operations settle before the next operation.** The dispatcher awaits each operation and its proposal resolution. Work remains in flight only when the operation's contract deliberately creates concurrency: FORK, WORK, a stream-producing execution, and streaming READ after acquisition. Such a READ first establishes its durable subscription and returns `102`; a later operation may address that live owner. Dispatching an execution before KILL does not wait for the process to finish using a resource. KILL of a worker synchronously ends its live loops before disposition checks the pending set; physical scope cleanup remains asynchronous.
 - §edit-execution **One authored EDIT is one mutation.** Each EDIT resolves against current resource state when dispatch reaches it, owns its proposal when gated, and records its own resulting revision. No later EDIT is prepared or applied in advance. Numeric scopes address current coordinates; an earlier EDIT may change what those numbers select. Rejection applies only to that operation, not its successful siblings.
 - §edit-anchor-continuity **Own EDITs preserve untouched hash targets within one program.** Core carries an anchor through exact, successfully applied EDIT splices when its line survives unchanged, even if its ordinal or neighborhood changes. Scoped entry KILL uses the same deletion path. Target-line replacement or deletion invalidates that binding. Continuity is private to the admitted program and canonical resource/channel; it is not a new published anchor format. The complete normalized line content must match the expected result of the preceding recorded EDIT, otherwise retained bindings are discarded and ordinary current-state validation applies. Reviewer replacement and results without an applied EDIT receipt do not carry bindings forward. Normalization is the same line-content representation used by READ and line hashing; file-write revision checks remain independent. No approximate text matching is used. Lowered coordinates retain a current-anchor precondition at the mutation owner; ambiguous matches and concurrent changes remain collisions.
+- §anchor-offset **An anchor offset is tolerated, never taught (#749).** A line mark may carry an offset from its anchor (`@abcde+1`, `@abcde-2`), and a bare `+N` after an anchor counts from that anchor (`<@abcde,+1>`). The anchor resolves as usual and the offset is added; a result before line 1 is an invalid mark, and past the end is the ordinary range refusal. Continuity and current-anchor preconditions check the anchor's own line. No teaching text, scope table or receipt mentions offsets; `plurnk.md` keeps its two anchor forms. A bare `+N` with no anchor before it is refused as before.
 - §edit-batch **One compound operation may require atomic splices.** The scheme's `editBatch` primitive validates all supplied numeric edits against one snapshot and commits one revision or none. Core supplies one statement for an authored EDIT; same-resource MOVE can supply multiple splices as one operation. This primitive does not group separate authored operations. Its replacement, insertion, conflict, and receipt rules remain owned by the shared Slicer.
 - §edit-batch-receipt **A refusal describes its own unapplied work.** An anchor collision lists every distinct unresolved anchor in that EDIT, including both range endpoints, in `unresolvedAnchors` (`anchor`, `kind: missing | ambiguous`, and matching `lines` when ambiguous). Missing is not proof of earlier validity or subsequent change. It carries `editCount: 1`, `applied: 0`, and recovery directing a READ for current coordinates; it makes no claim about other operations. A refused compound splice batch lists all conflicting pairs in `conflicts`, non-conflicting regions in `cleanRegions`, its first pair in `conflictingRegions`, and its own `editCount` and `applied: 0`.
 - §edit-batch-merges **Normalizations require evidence and a receipt.** An EDIT body carrying only this resource's published `@xxxxx L:` prefixes is stripped when those prefixes verify against current anchors or this worker's preserved READ receipts (`rendered-prefix-stripped`); otherwise it remains literal content (`rendered-prefix-unverified`). Within a single atomic splice batch, the Slicer can deduplicate identical regions/bodies, concatenate same-boundary insertions, assign a shared endpoint to the sole body reproducing that line, or relocate an inner change when its original content occurs exactly once in the outer body. An already-applied inner body can be dropped. Unevidenced overlap remains a collision. These batch resolutions never reinterpret separate authored EDITs. Applied normalizations carry their exact merge facts and a notice; receipts describe only the applied effects.
 
-### §orchestration Cross-scheme orchestration
+### Cross-scheme orchestration
 
 Core owns same- and cross-scheme transfers under {§copy} and {§move}; handlers
 provide the underlying resource operations. Each operand independently selects
@@ -1550,16 +1511,40 @@ a resource, channel, and optional text scope ({§transfer-resource-selections}).
 Source acquisition follows {§universal-read-composition}; landed mutation
 effects follow {§edit-result-copy-move-effects}.
 
-### §send-dispatch SEND dispatch (a message to a recipient)
+### SEND dispatch (a message to a recipient)
 
-A recipient SEND (non-null path — {§turn-disposition}) routes to the scheme's
-`send`: the body is the message — a WebSocket frame, exec stdin, an HTTP POST, an A2A
-message, a worker's next prompt. TASK never reaches a scheme: it controls the
-turn ({§send}). Cancelling a stream and deleting an entry are KILL ({§stream}, {§move}).
+Targetless and exact-message SENDs follow the reply accounting at
+{§send-response-receipt}. Other directed SENDs route to the recipient scheme's
+`send`: the body is the message — a WebSocket frame, exec stdin, an HTTP POST,
+an A2A message, or new work for a worker.
 
-§send-dispatch-entry-schemes-501 An entry-bearing scheme carries no messages: a recipient SEND aimed at one returns 501.
+§send-dispatch-entry-schemes-501 A SEND aimed at a resource entry, rather than a
+message or actor endpoint, returns 501. Its recovery distinguishes replying to
+Open Messages from sending new work to a worker, without assuming either intent.
 
-Null-path SEND is broadcast ({§send}), engine-handled.
+#### §send-resource-attachments Explicit message attachments
+
+Targetless replies, worker messages, and A2A messages accept
+`[{"attachments":["report.pdf","worker://alice/result.json"]}]` on SEND.
+The body remains the authored message, not an attachment envelope.
+
+| Boundary | Contract |
+|---|---|
+| Selection | An ordered array of exact resource/channel addresses; no implicit export, glob expansion, or Markdown-link interpretation. |
+| Acquisition | The same source selection and representation preparation as COPY, under ordinary READ capability admission; acquire every source before delivering the message. A failed source produces its normal failure and delivers nothing. |
+| Snapshot | Preserve the selected bytes, media type, name, and source address at SEND time. Later source mutation, deletion, or log curation cannot alter the delivered content. |
+| Receipt | Safe attachment descriptors identify immutable content; binary payloads do not enter ordinary log text. |
+| Ownership | Message recipients opt into this option. HTTP headers and executor stdin retain their own metadata contracts. |
+| Arrival | Publish attachments as ordinary typed resources and link them from the inbound SEND. Arrival alone does not inject native media; READ does. |
+
+#### §message-envelope-evidence Durable message evidence
+
+The ordinary inbox retains an optional transport envelope alongside the
+model-facing body and attachments. Exterior adapters own its protocol shape;
+Core preserves it without interpreting protocol fields. History reads this
+durable evidence, not a curated text projection. Accepted interaction answers
+retain their envelope before waking the waiting operation; rejected answers
+create no message evidence.
 
 ### §scheme-surface Consumption surface
 
@@ -1634,9 +1619,9 @@ Handler authority, discovery, projection identity, and failures follow
 persistence, packet accounting ({§tokenomics-agnostic-ruler}), and subscriptions
 ({§subscriptions}); handlers do not.
 
-### §mimetype-surface Consumption surface
+### Consumption surface
 
-plurnk-service is mimetype-illiterate. Engine hands channel content + mimetype label to `Mimetypes.process({content, hint})`; the manifest build uses `result.totalLines` for each channel's `lines`. Content reaches the model on READ, not as a rendered preview.
+plurnk-service is mimetype-illiterate. A channel's `lines` is stored when its content is written, so the catalog reads no bodies and calls no handler; `Mimetypes.process({content, hint})` serves search derivation ({§persistent-search-index}) and parse-issue probes. Content reaches the model on READ, not as a rendered preview.
 
 §mimetype-owned-lifecycle `Daemon` owns and disposes the `Mimetypes` instance
 it constructs. A constructor-injected instance remains caller-owned. Shutdown
@@ -1664,7 +1649,7 @@ model-independent ruler for stored/catalog weights and the model-facing curation
 confined to provider-owned physical capacity assessment
 ({§tokenomics-context-envelope-admission}).
 
-**Conformance.** Mimetype-specific behavioral tests live in each handler's own surface. plurnk-service intg covers integration: the engine routes through `Mimetypes.process` with the right hint and the catalog reflects `totalLines`; tests use auto-discovery (production handler set); a custom-handler test injects a stub `BaseHandler` via `loader + discovery`.
+**Conformance.** Mimetype-specific behavioral tests live in each handler's own surface. plurnk-service intg covers integration: the engine routes through `Mimetypes.process` with the right hint and the catalog reflects the stored line count; tests use auto-discovery (production handler set); a custom-handler test injects a stub `BaseHandler` via `loader + discovery`.
 
 ## §persistent-search-index Search indexing
 
@@ -1682,6 +1667,15 @@ empty setting excludes nothing, and the first match is the observable reason.
 | Other-scheme channel | Always eligible; its pathname is a resource identity.   |
 | Log projection       | Always eligible; it has no repository-path membership.  |
 
+§search-size-bound Every search subject, whatever its scheme, is also bounded
+by size when the operator sets one: a body longer than
+`PLURNK_SERVICE_SEARCH_MAX_BYTES` (default empty = unbounded) is `excluded` with the reason `larger than N bytes`, before
+its body is read. It is neither parsed for symbols nor full-text indexed; READ,
+FIND by path, and membership are unaffected. The reason joins the derivation
+identity, so changing the bound re-derives the affected bodies and retention
+collects what they leave. Origin (#729): the dogfood workspaces indexed 29
+tokenizer vocabularies (up to 31 MB each) as full text.
+
 A match produces the `excluded` derivation disposition and suppresses graph
 and FTS while leaving the stored channel and direct READ unchanged. The
 same reason participates in the derivation hash and is surfaced by diagnostics
@@ -1714,7 +1708,7 @@ operator knobs in `.env.defaults`. Search indexing performs no inference.
 
 ## §channels Channel Topology
 
-§channels-channels-append-only Every entry has named channels. **Channels are append-only content stores** keyed by `(entry_id, name)`. Schemes write content; the engine reads at turn boundaries; mimetype handlers interpret.
+§channels-entry-name-key Every entry has named channels: **content stores keyed by `(entry_id, name)`**, one row per name. Schemes write content — appending to a channel, replacing it, or deleting it; mimetype handlers interpret it.
 
 ### §per-entry-channels Per-entry channels
 
@@ -1753,17 +1747,17 @@ Rules:
 | URI                                  | Channel                              |
 | ------------------------------------ | ------------------------------------ |
 | `worker:///france/capital`           | body (default)                       |
-| `sh:///1/1/2/sh#stdout`            | stdout                               |
-| `sh:///1/1/2/sh#stderr`            | stderr                               |
+| `sh:///a3b7c921#stdout`            | stdout                               |
+| `sh:///a3b7c921#stderr`            | stderr                               |
 | `https://feed.example/y#body`        | body                                 |
-| `log:///N/T/A`                       | (no channel concept; atomic log row) |
+| `log:///1/2/3/READ`                  | (no channel concept; atomic log row) |
 
 Op implications:
 
 - EDIT to undeclared channel → 404; read-only channel → 405.
 - COPY/MOVE source and destination fragments independently select channels.
 
-Client-interface target parameters carry fragments inline (`{ target: "sh:///1/1/2/sh#stderr" }`).
+Client-interface target parameters carry fragments inline (`{ target: "sh:///a3b7c921#stderr" }`).
 
 **Wire rendering: default channel is path-only.** A rendered target omits `#channel` when channel matches `defaultChannel`. Single-channel entries render path-only; multi-channel entries render the default path-only and only non-default carries `#name`.
 
@@ -1802,7 +1796,7 @@ Model uses state to anticipate growth between turns. Clients use state for UI (s
 
 ---
 
-## §op Op Surface
+## Op Surface
 
 Per-op semantics. AST shapes come from `@plurnk/plurnk-contracts`'s `PlurnkStatement`. Engine dispatches by `op`; scheme implements per author contract ({§scheme}).
 
@@ -1947,6 +1941,7 @@ READ is the one fan-out core performs ({§read-fan-out}).
   when that differs from the channel's own mimetype the result names the
   channel's as `sourceMimetype`, so a consumer can still run the channel's
   handlers over a whole-resource `<1,-1>` read.
+- §log-range-miss-names-stream A 416 on a log execution item is the range twin of its channel miss ({§log-channel-miss-names-stream}): the coordinate addresses the row's invocation (its authored call body, often empty or one line) while the execution's output stays readable at the stream address the row records. When that stream link exists, the 416 gains it as `stream`, the detail appends where the command's streams live, and `recovery` is `READ <stream> for the command's stream`, whether the invocation's extent is empty or merely shorter than the range (#759). A 416 on a row with no recorded stream stays byte-identical to the generic slicer's.
 - §read-pattern **A pattern selects the lines a READ renders.** With a heading
   matcher ({§matcher-option} in the contracts SPEC) an exact-target READ stays a
   READ: the matcher runs over the channel's text line by line — a regex anchors
@@ -1983,13 +1978,14 @@ READ is the one fan-out core performs ({§read-fan-out}).
   resources, not lines, so that READ dispatches as the FIND survey. Operator,
   2026-09-13: "give it what it asked for" — a model that asked to read the pantry
   looped five turns on the catalog it was handed instead.
-- §read-bytes A binary channel with no readable projection, and the `#bytes` view of
+- §read-bytes A binary channel, and the `#bytes` view of
   any resource whose scheme supplies bytes, reads as the source bytes one hexadecimal
   octet per line: coordinate = line = byte, so `<a,b>` selects bytes, the markerless
-  default is the same `<1,16>`, `<1,-1>` is the whole resource, and the extent carries
+  default is the shared first page ({§markerless-first-page}), `<1,-1>` is the whole resource, and the extent carries
   `unit: "byte"`. The result keeps the source mimetype and names `projection: "hex"`;
   anchors do not exist there (400). Bytes are read from the source at READ time, sized
-  then windowed, never stored: `file:` supplies them from the member on disk, and a
+  then windowed: `file:` supplies them from the member on disk, DB-backed schemes
+  recover their stored bytes under {§binary-parity}, and a
   scheme that keeps no bytes answers 501 `bytes-unavailable` for `#bytes` and 415 for a
   binary channel, as before. An execution whose target is a file member already runs the
   bytes on disk. Byte selection affects only this hexadecimal projection: when the
@@ -2017,8 +2013,11 @@ READ is the one fan-out core performs ({§read-fan-out}).
   window is preserved, and the whole spliced result is re-written through the proposal gate. A binary
   **lives in a DB entry** as its bytes base64 in the channel's TEXT content; the same READ, byte range,
   and COPY/MOVE recover them through a byte source synthesized from that content, so a File member and a
-  `worker://` entry hold and yield a binary identically. This supersedes the older blanket refusal (#140)
-  for both the file and the entry case. Native image/PDF attachment facts come from the configured
+  `worker://` entry hold and yield a binary identically. An empty binary channel represents
+  zero bytes, not an unsupported format; whole COPY/MOVE preserves it. Failed acquisition
+  is not an empty success: its producer outcome remains authoritative for READ and transfer.
+  This supersedes the older blanket refusal (#140)
+  for both the file and the entry case. Native image/PDF/audio attachment facts come from the configured
   mimetype handler over original bytes, whether supplied by a file or stored channel
   ({§packet-attachment-parts}); the hexadecimal view remains available. The exceptions are narrow and
   defined, each a clear receipt rather than a dead end: a binary region addressed by a **textual anchor**
@@ -2051,30 +2050,23 @@ same transitions the dispatcher's atomic curation event makes, without the row.
 | Surface | Contract |
 |---|---|
 | Evidence | Original provider reasoning remains verbatim in immutable model-call responses and admitted packets. Resource and log operations never rewrite it. Only an admitted response, or the final exhausted emission attempt, produces a model reasoning source; missing provider reasoning creates no substitute. A non-model producer may record its own authored rationale under {§turn-source-resources}. |
-| Resource | `reasoning:///<loop>/<turn>` is immutable text/plain source belonging to the current worker's turn under {§turn-source-resources}. Every actor may READ, FIND, search and COPY from it; none may EDIT, KILL, COPY into or MOVE it. |
+| Resource | `reasoning://<worker>/<loop>/<turn>` is immutable text/plain source belonging to the named workspace worker's turn under {§turn-source-resources}. Every workspace actor may READ, FIND, search and COPY from it; none may EDIT, KILL, COPY into or MOVE it. |
 | Delivery | Initialization READs its own authored rationale under {§reasoning-initial-read}. Further observations require deliberate READs. The selected model reasoning source is stored before its OPs execute, so an ordinary READ of the current turn resolves immediately and is visible in subsequent packets. Every READ retains its authored scope and ordinary range metadata, without edit anchors. |
 | Curation | Scoped log KILL suppresses receipt lines; whole log KILL retires the receipt. Neither affects the source. Explicit log READs retain ordinary curation anchors. A mutable working copy requires ordinary COPY into an editable resource. |
-| Lifecycle | Restart retains sources and observations. FORK snapshots sources at the same local coordinates and receipts with independent curation. No curation or lifecycle event automatically READs model reasoning. A turn the provider left without reasoning reads empty; future and foreign coordinates return the ordinary missing result ({§turn-source-resources}). |
+| Lifecycle | Restart retains sources and observations. FORK snapshots sources under the child's name at the same loop/turn coordinates and receipts with independent curation. No curation or lifecycle event automatically READs model reasoning. A turn the provider left without reasoning reads empty; absent workers and turns return the ordinary missing result ({§turn-source-resources}). |
 | Client | Standard live reasoning events and replay retain original provider reasoning; working resources and READ receipts never substitute for or replay that stream. |
 
 ### §reasoning-initial-read Initial reasoning observation
 
-The real initialization turn records a short `_plurnk`-authored rationale before
-executing its program. That program READs its own reasoning and its own persisted
-ops before TASK; the Active Prompt arrives as its `prompt` row ({§prompt-entry}),
-never as a second READ. The rationale identifies its harness origin and carries
-exactly one `Note:` line — `Note: Prior reasoning can be searched with the pattern
-filters.` (operator's words, 2026-09-13) — and the reasoning READ is the pattern
-read `READ (reasoning:///L/T) ^Note:.* <!-- pluck notes from this turn's reasoning -->`
-({§naked-pattern} in the contracts SPEC), so the first model packet shows the
-maneuver working rather than described: only the note lands. The model's own
-coordinate is inferable from the `## Worker` block below the log
-({§packet-current-turn}), so the note teaches nothing the packet already says
-(operator, 2026-09-12: "Recursive Reasoning" — mark what must survive `Note:`,
-pluck it, and let the rest of the reasoning go). Each resolves through ordinary
-READ dispatch.
+The initialization turn records a short `_plurnk`-authored rationale containing
+a fenced NOTE. The shared reasoning extractor ({§reasoning-notes}) executes that
+NOTE through ordinary dispatch, creating its log item and immutable source.
+The program begins with its own NOTE and READs its reasoning and persisted ops,
+demonstrating both NOTE placements and their ordinary results. The initial message arrives separately as an
+inbound SEND ({§message-arrival}). Neither initialization nor later turns
+manufacture a task inventory.
 `PLURNK_REASONING_VIEW_LINES` (default `-1`, alias-scoped) selects this one READ's
-scope: `0` omits it, `-1` leaves the pattern unbounded, and a positive integer
+scope: `0` omits it, `-1` reads the complete rationale, and a positive integer
 bounds it to the first N lines. Source retention, deliberate READs, and client
 streaming are independent. No later turn automatically requests reasoning.
 
@@ -2118,18 +2110,66 @@ The `## Log` section is a sequence of ordinary Markdown records separated by one
 <coordinate-prefixed body lines when visible>
 ```
 
-The H3 is the row's complete model-facing identity and canonical READ target; metadata never duplicates `path` or `op`. The following line is one strict JSON object: every receipt puts `target` first and `aside` second when present; all remaining members use stable alphabetical order. Absent fields are not invented. Every physical body line retains its canonical numeric `N:` or anchored `@hash N:` coordinate, so source text cannot create a record boundary. The section contains records only, with no leading prose or enclosing fence.
+The H3 is the row's complete model-facing identity and canonical READ address; metadata never repeats that identity or its operation. The following line is one strict JSON object: addressed operands ({§log-address-metadata}) precede `aside`, then all remaining members use stable alphabetical order. Absent fields are not invented. Every physical body line retains its canonical numeric `N:` or anchored `@hash N:` coordinate, so source text cannot create a record boundary. The section contains records only, with no leading prose or enclosing fence.
+
+§log-address-metadata **Addresses name their relationship, not the row's producer.**
+
+| Metadata | Meaning | Order |
+|---|---|---|
+| `path` | The operation's addressed operand, matching `OP (path)`: read resource, mutation subject, message recipient, or executor operand. Explicit and automatic READs use the same field. Pathless operations omit it. | First |
+| `from`, `to` | COPY/MOVE's two operand selections, each retaining its optional scope; neither replaces actor attribution or is repeated as `path`. | First, in that order |
+| `stream` | An executor invocation's separately created output address, never a READ's alternative spelling of `path`. | Remaining facts |
+| `resource` | A distinct returned resource under {§operation-resource-receipt}. | Remaining facts |
+
+Nested mutation effects and delivered attachments name their resource with `path`.
+These packet spellings do not rename the submitted AST, durable operation results,
+or client protocol fields. Invocation correlation remains on the subscription and
+its publication identity; an automatic stream READ does not copy the invocation's
+log address into its `source`. Actual actor/subsystem attribution remains governed
+by {§env-delta-attribution}.
 
-Coordinate-prefixed lines are the text currently in context; a metadata-only row contributes no text body. A partially trimmed row carries `"folded":["<scope>",...]`; coordinate gaps expose omissions without renumbering. A bounded projection carries `"chunk":"showing <selected> of <complete>"` in metadata. Complete-line extents use inclusive two-coordinate regions; a cut inside a line uses four-coordinate, start-inclusive and end-exclusive regions with 1-based Unicode code-point columns.
+Coordinate-prefixed lines are the text currently in context; a metadata-only row contributes no text body. Selection, preview, and curation metadata follow {§packet-extent-metadata}; coordinate gaps expose omissions without renumbering.
+
+§packet-extent-metadata **One scope notation, distinct coordinate owners.**
+
+| Field | Coordinate owner | Representation |
+|---|---|---|
+| `range` | The resource addressed by a successful READ/FIND | `<first,last> of N lines/resources/match locations/bytes`; singleton scopes use `<first>`. A complete dense selection reduces to `N units`; an empty selection from a nonempty extent is `none of N units`. |
+| `range` for exact text | The addressed text resource | `<startLine,startColumn,endLine,endColumn>`; no invented available extent. |
+| `preview` | The retained receipt body | Only when displayed incompletely: selected scope(s) `of N lines`, or exact selected region `of` complete region for an in-line cut. Replaces the body's otherwise redundant `lines` count. |
+| `trimmed` | The receipt's original physical body lines | Array of deliberately removed `<scope>`s on a partially visible row; initial suppression is not curation. |
+| `effect` | The mutation's source and landed revisions | Resolved `<source> -> <result>`; counts and complete-resource extent remain separate facts. |
+
+Scopes use the existing inclusive line/item/byte coordinates or start-inclusive,
+end-exclusive Unicode-code-point text regions ({§text-scope-semantics}). Sparse
+retrieval ranges are enclosing spans; body ordinals and matcher counts retain
+the gaps, and a sparse span covering both endpoints is not abbreviated as a
+complete acquisition. Sparse previews list their selected contiguous runs.
+Retrieval `range` records acquisition, not subsequent visibility: KILL changes
+the log projection, never the original source selection. A READ's source line
+numbers and its receipt's body-relative curation coordinates remain distinct
+({§log-kill-scope}). Byte ranges describe the hex selection, not native-media
+cropping ({§packet-attachment-parts}).
+
+Successful retrieval metadata omits requested coordinates; durable results and
+submitted programs retain them. Failed selections keep requested coordinates
+and available extent in their owning Problem. Projection never parses its
+display strings to recover typed facts. A hidden body has no `preview`; a
+complete non-retrieval body retains `lines` where no other field supplies its
+navigable extent. None of these spellings changes acquisition, delivery,
+curation, admission, or immutable evidence.
 
 Field absence carries defaults: `origin` is omitted for the owning model, `source` for the owning worker, and `status` for a routine 200. Dispositions always carry their lifecycle status, SEND its delivery status, KILL keeps an explicit 200, and every non-200 stays explicit. A present authored aside appears as `aside`. Every row's accounting follows {§packet-token-accounting}.
 
+- §operation-resource-receipt A result's nonempty `resource` address remains visible in receipt metadata when distinct from its `path` and `stream`. It identifies returned material without replacing the addressed operand or injecting that material into context; ordinary READ acquires it.
 - §packet-attachment-parts A successful READ of an attachable resource carries projection facts with its
   result ({§mimetype-projection-facts}): an image ({§mimetype-image}) as
   `image: { mimetype, width, height, bytes }`, a PDF ({§mimetype-pdf-facts}) as
   `document: { mimetype, pages, bytes }` (`pages` null when the page tree is unreadable; the
-  attachment then weighs by bytes and carries no page count). READ snapshots complete source bytes through
-  the scheme's byte supplier or ordinary stored binary channel ({§binary-parity}); the text/hex projection
+  attachment then weighs by bytes and carries no page count), or audio ({§mimetype-audio-facts}) as
+  `audio: { mimetype, duration, bytes }` (`duration` in seconds, null when unknown). READ snapshots complete source bytes through
+  the scheme's byte supplier or ordinary stored binary channel ({§binary-parity}), checking
+  {§mimetype-binary-input} before loading the native snapshot; the text/hex projection
   and native observation use those same bytes. Immutable content-addressed `native_contents` stores each
   byte sequence once; the result's `nativeContentHash`, enforced by the log's foreign key, identifies it.
   This is retained evidence, not a separate visibility or delivery lifecycle. Source mutation/deletion
@@ -2140,12 +2180,13 @@ Field absence carries defaults: `origin` is omitted for the owning model, `sourc
   suppresses the complete native part under {§context-output-admission}. Unsupported routes receive only the
   text projection and no native charge; switching back to a compatible route exposes still-retained media.
   Each included part contributes `tokensAttachment` within `logTokens`: `ceil(width × height / 750)` for an
-  image, `pages × 1500` for a document, or `ceil(bytes / 4)` when its page count is unknown. Byte ranges select
+  image, `pages × 1500` for a document, `ceil(duration × 32)` for audio, or `ceil(bytes / 4)` when page count
+  or duration is unknown. Byte ranges select
   hexadecimal text, never crop the native resource. Retries reuse the frozen request; model-call evidence
   records the exact READ coordinates sent without controlling retention. Missing immutable bytes are an
   internal integrity failure, never silently dropped content. No ejection message or permanent teaching is
   added. These stable curation weights are not provider-token measurements ({§tokenomics-render-weight-budget}).
-- §packet-token-accounting Every row reports one `logTokens` charge: its complete materialized H3, metadata, visible body, and selected native attachment. The completed record is measured to a fixed point, including the accounting field itself. No `tokensBody`, `tokensMetadata`, or `tokensActive` field is serialized. Hidden text is not charged; metadata-only rows still have a reclaimable charge. Source/FIND-item `tokens` measure source content, not the observation's context footprint. A FIND's nonzero `itemsTokenTotal` weighs the complete matched set; a nonzero `returnedItemsTokenTotal` appears only when the returned page differs. All use stable curation weights, not provider tokens or dollars. Native component accounting follows {§packet-attachment-parts}; ordinary addressability and truthful errors follow {§log-wire-format} and {§log-wire-format}.
+- §packet-token-accounting Every row reports one `logTokens` charge: its complete materialized H3, metadata, visible body, and selected native attachment. The completed record is measured to a fixed point, including the accounting field itself. No `tokensBody`, `tokensMetadata`, or `tokensActive` field is serialized. Hidden text is not charged; metadata-only rows still have a reclaimable charge. Source/FIND-item `tokens` measure source content, not the observation's context footprint. A FIND's nonzero `itemsTokenTotal` weighs the complete matched set; a nonzero `returnedItemsTokenTotal` appears only when the returned page differs. All use stable curation weights, not provider tokens or dollars. Native component accounting follows {§packet-attachment-parts}; ordinary addressability and truthful errors follow {§log-wire-format}.
 
 ### §retrieval-packet-metadata READ/FIND packet metadata
 
@@ -2153,33 +2194,41 @@ The packet projects one actionable owner for each retrieval fact:
 
 | Result mode | Extent | Result-body evidence | Additional aggregate fact |
 |---|---|---|---|
-| line READ | compact `line` range | none | none |
-| exact-coordinate READ | none | top-level `region` | none |
+| line READ | `range` in line scopes | none | none |
+| exact-coordinate READ | `range` in exact text coordinates | none | none |
 | READ-shaped materialization notice | none | none | generic body `lines` |
-| catalog/path FIND | compact `resource` range | none | none |
-| broad matcher FIND | compact `resource` range | per-resource match-location counts; a resource with exactly one match also carries that match's `locator`/`region` | nonzero complete `matchLocationCount` |
-| exact matcher FIND | compact `matchLocation` range | each row's locator/region; a regex or glob row also carries `matched`, the matched text | none |
-| pattern READ ({§read-pattern}) | compact `line` range over the physical lines | the selected lines with their ordinals and anchors | `matcher` and `matched`, the selected line count |
+| catalog/path FIND | `range` in resources | none | none |
+| broad matcher FIND | `range` in resources | per-resource match-location counts; a resource with exactly one match also carries that match's `locator`/`region` | nonzero complete `matchLocationCount` |
+| exact matcher FIND | `range` in match locations | each row's locator/region; a regex or glob row also carries `matched`, the matched text | none |
+| pattern READ ({§read-pattern}) | `range` over the physical lines | the selected lines with their ordinals and anchors | `matcher` and `matched`, the selected line count |
 
 Any row whose statement carried a heading pattern ({§matcher-option}) names it as
 `matcher`, and a pattern mutation ({§edit-pattern}, {§kill-pattern},
 {§copy-move-pattern}) carries its `matched` count beside its receipt, so a
 digest can show what a pattern selected and how much it touched.
 
-The compact range is `{ unit, total, requested: [first,last], returned?:
-[first,last] }` ({§range-extent}); empty results omit `returned`. An empty result
+The packet formats the typed {§range-extent} and {§text-region} facts under
+{§packet-extent-metadata}; the operation result retains its structured facts.
+An empty result
 set satisfies any well-formed page: zero matches is the answer, a 200 with no items,
 never a 416 (#425 F9). Transparent
 coordinates let the model determine whether more material exists and choose
 its own next request, so packet metadata never prescribes `next`, `complete`,
 or `all`. FIND range cardinality replaces top-level `items`, `lines`, and
 `matchingPathCount`; line READ likewise omits the rendered-body `lines` count
-and its internally resolved whole-line region. Exact READ retains only its
-region. A failed retrieval's Problem owns its range extension rather than
-repeating it at top level. Generic `tokens` always weighs the rendered body;
+and its internally resolved whole-line region. Exact READ formats its region
+as `range`. A failed retrieval's Problem owns its range extension rather than
+repeating it at top level. `logTokens` weighs the complete rendered record
+under {§packet-token-accounting};
 generic body `lines` remains available on READ-shaped materialization notices
 that have no retrieval extent. FIND content weights follow {§log-wire-format};
-ordinary bounded bodies expose their displayed and complete chunk extents there.
+ordinary bounded bodies expose their displayed and complete extents as `preview`
+under {§packet-extent-metadata}.
+
+§read-past-end A line READ whose range starts past the end of nonempty content is
+answered like an empty FIND page: with no lines and its extent (`none of N lines`), not a 416; a
+single line past the end, a reversed range, empty content, a command's log row
+({§log-range-miss-names-stream}) and every write keep their refusal (#759).
 
 ### §turn-ops-entry The admitted turn program
 
@@ -2189,17 +2238,18 @@ ordinary bounded bodies expose their displayed and complete chunk extents there.
 
 | Surface | Contract |
 |---|---|
-| Identity | `ops:///<loop>/<turn>` and `reasoning:///<loop>/<turn>` resolve against the current worker's durable loop and turn sequences. Authorities are invalid; there is no cross-worker alias or access policy. |
-| Source | `ops` is exact admitted `text/vnd.plurnk`; `reasoning` is `text/plain` containing the selected original provider reasoning or a non-model producer's authored rationale. Producer identity comes from the owning turn; a harness rationale is not provider evidence. The turn decides existence and the source decides content: a turn that exists but has no source of that kind reads as the ordinary empty resource (204, empty body), never a fabricated one; a coordinate whose turn does not exist is 404. Emptiness over absence, so `reasoning:///L/T` is a stable coordinate for every turn that happened. |
-| Retention | One immutable source of each kind per turn. An optional inference-call link records provenance. Source removal follows deletion of its owning turn, never log curation. |
-| Operations | Ordinary scoped READ, FIND, content search and COPY from source. READ returns data and never executes it. Sources are read-only for every actor and have no edit hashes. |
+| Identity | `ops://<worker>/<loop>/<turn>`, `reasoning://<worker>/<loop>/<turn>`, and `note://<worker>/<loop>/<turn>/<item>` name a worker in the current workspace and its durable coordinates. A note's item is its dispatched NOTE ordinal. The worker authority is required and case-sensitive; userinfo, ports, and queries are invalid. Source identity never depends on the reading worker. `log:///` remains local; READ, FIND and KILL reject log authorities, userinfo, ports and queries with 400, never substitute the caller's log. |
+| Source | `ops` is exact admitted `text/vnd.plurnk`; `reasoning` is `text/plain` containing the selected original provider reasoning or a non-model producer's authored rationale. Producer identity comes from the owning turn; a harness rationale is not provider evidence. The turn decides existence and the source decides content: a turn that exists but has no source of that kind reads as the ordinary empty resource (204, empty body), never a fabricated one; a worker or turn that does not exist is 404. |
+| Notes | Each dispatched NOTE stores its exact literal body as an immutable `text/plain` source and returns its worker-qualified address. There may be multiple notes in a turn, from reasoning, content, or another producer. A missing note is 404, not an empty invented note. Sharing its URI uses ordinary SEND; the receiver deliberately READs it. NOTE itself sends no ambient update. |
+| Retention | One ops source and one reasoning source per turn; one note source per NOTE ordinal. An optional inference-call link records provenance. Source removal follows deletion of its owning turn, never log curation. |
+| Operations | Ordinary scoped READ, FIND, content search and COPY from any named worker's source within the workspace. FIND accepts authority and path patterns, retaining complete worker-qualified identities in results and folder selectors. READ returns data and never executes it. Sources are read-only for every actor and have no edit hashes. |
 | Index | Source text uses the existing derivation, FTS and graph machinery; only its derivation attachment is replaceable. |
-| FORK | Sources copy with the inherited turns at identical local coordinates. Branch receipt curation is independent; neither branch can rewrite source evidence. |
+| FORK | Sources copy with the inherited turns at identical loop/turn/item coordinates under the fork's own authority. Bytes and embedded source references are preserved verbatim; an explicit reference still names its original worker. Branch receipt curation is independent; neither branch can rewrite source evidence. |
 | Forensics | Digest assistant artifacts read source directly, independently of receipt presence or curation. Original provider responses retain all attempts and opaque fields separately. |
 
 §rejected-emission-entry A rejected provider response is not `turnOps`: it never became an admitted turn program. The one bounded invalid-emission recovery item under {§emission-admission} has `attrs.kind="emissionAttempt"`, `origin="model"`, the canonical model-facing `/attempt` leaf, and the exact latest rejected response. The packet does not duplicate that identity as `kind` metadata. It is born durably body-suppressed and projected visibly only in the informed recovery packet; every other rejected attempt remains forensic-only.
 
-- §log-coordinate-hierarchy **Log coordinates are a hierarchical prefix; the trailing slash is optional** — a coordinate is `loop/turn/sequence`, and a PARTIAL coordinate selects its descendants: `log:///1` = loop 1's rows, `log:///1/2` = turn 1/2's rows, `log:///1/2/3` = the one row. A full coordinate is always three parts, so a one- or two-part path is unambiguously a prefix — the trailing slash is an optional alias (`log:///1/2` ≡ `log:///1/2/`), uniform with ```` ```READ (worker:///docs/) ````. A complete `[start-end]` segment in any numeric coordinate slot selects that inclusive decimal interval; brackets elsewhere retain ordinary path-glob meaning. Every rendered row appends one canonical model-facing leaf: the native operation name or invoked executor name, `/attempt` for a rejected emission. An executor leaf is derived from the durable submitted statement (its `runtime`), never an internal dispatch type or the current tool registry. Digits and punctuation in executor names remain part of the leaf. The leaf names identity rather than adding a resource level. Exact consumers tolerate the unsuffixed three-part shorthand; when supplied, the case-insensitive leaf is authoritative and a disagreement resolves 404. READ anchors use the canonical suffixed identity even when addressed by shorthand. Typed entry materialization therefore resolves as `/READ` while retaining its durable `EDIT` event ({§exec-entry-sink}). `log:///1/2/*` still selects the turn's item rows, while `log:///**/READ`, `log:///**/python3`, and `log:///**/attempt` deliberately filter canonical leaves. An executor's output stream lives at that same item address under its runtime scheme — `sh:///1/2/3/sh#stdout` — so one `loop/turn/item/invocation` schema addresses log rows and streams. Error pointers, Problem instances, source attribution, and search use this same identity; client stream coordinates retain the numeric triple. Within a turn, sequence is arrival order, and the turn's prompt rows arrive first: the prompt publication row and any injected prompt rows are materialized before the program runs, so a turn that received a prompt holds it at `log:///L/T/1/prompt` (further prompts follow, oldest first) and the model's own operations come after — a contract, not an accident of dispatch order ({§packet-current-turn} names `L/T`).
+- §log-coordinate-hierarchy **Log coordinates are a hierarchical prefix; the trailing slash is optional** — a coordinate is `loop/turn/sequence`, and a PARTIAL coordinate selects its descendants: `log:///1` = loop 1's rows, `log:///1/2` = turn 1/2's rows, `log:///1/2/3` = the one row. A full coordinate is always three parts, so a one- or two-part path is unambiguously a prefix — the trailing slash is an optional alias (`log:///1/2` ≡ `log:///1/2/`), uniform with ```` ```READ (worker:///docs/) ````. A complete `[start-end]` segment in any numeric coordinate slot selects that inclusive decimal interval; brackets elsewhere retain ordinary path-glob meaning. Every rendered row appends one canonical model-facing leaf: the native operation name or invoked executor name, `/attempt` for a rejected emission. An executor leaf is derived from the durable submitted statement (its `runtime`), never an internal dispatch type or the current tool registry. Digits and punctuation in executor names remain part of the leaf. The leaf names identity rather than adding a resource level. Exact consumers tolerate the unsuffixed three-part shorthand; when supplied, the case-insensitive leaf is authoritative and a disagreement resolves 404. READ anchors use the canonical suffixed identity even when addressed by shorthand. Typed entry materialization therefore resolves as `/READ` while retaining its durable `EDIT` event ({§exec-entry-sink}). `log:///1/2/*` still selects the turn's item rows, while `log:///**/READ`, `log:///**/python3`, and `log:///**/attempt` deliberately filter canonical leaves. Executor outputs instead use workspace-wide claims such as `sh:///ab3d5678#stdout` ({§execution-output-identity}); their source operation has log coordinates, but resource lifetime and identity are independent of that observation. Error pointers, Problem instances, source attribution, and search use this same identity; client stream coordinates retain the numeric triple. Within a turn, sequence is arrival order. Inbound SEND rows publish before the program runs ({§message-arrival}); a turn receiving messages holds the first at `log:///L/T/1/SEND`, followed by further arrivals oldest first, then the model's operations ({§packet-current-turn} names `L/T`).
 - §log-curation-folder-idiom **Log curation speaks the folder idiom; a zero-match sweep is a no-op success** — KILL takes a concrete coordinate or a path-glob, and a **trailing slash or a partial coordinate means "the contents"** ({§log-coordinate-hierarchy}), like a folder-scoped FIND: ```` ```KILL (log:///1/2) <1,-1> ```` suppresses turn 1/2's bodies. A **well-formed selection that matches nothing is 204 with `matched: 0`**; a successful sweep's rx carries `matched: N`. A targetless KILL is 400.
 - §log-curation-set-selection **Row selection and body scope are independent** — target/glob and an optional heading pattern (```` ```KILL (log:///**) [{"pattern": "~stale"}] ````, every dialect a FIND over rows accepts) compose by intersection into the affected row set. An optional `<L>` or `<SL,EL>` then intersects each selected canonical body; it never paginates or changes the selected set. Thus ```` ```KILL (log:///**/READ) <17,-1> ```` may change long READs and no-op on short ones while reporting every selected row in `matched`.
 
@@ -2207,7 +2257,8 @@ ordinary bounded bodies expose their displayed and complete chunk extents there.
 
 | KILL result | Packet receipt |
 |---|---|
-| Successful log-item or line curation, including a 204 no-op | Not shown, including the first packet after the operation. |
+| Successful log-item or line curation (200) | Not shown, including the first packet after the operation: the rows that are gone are the receipt. |
+| A curation that matched nothing (204) | Shown once, in the packet of the very next turn, then retired like any other row. A success and a mismatch are not both silent: the model cannot otherwise tell that its earlier KILL is what emptied the selection (#779). |
 | Failed log curation | Visible with its ordinary Problem. |
 | Non-log target: file, worker, stream, or other resource | Ordinary scheme-owned receipt. |
 
@@ -2257,7 +2308,7 @@ flowchart LR
     body --> recall["READ log:///…<br/>selects untrimmed content"]
 ```
 
-§edit-receipt-removed-text **A pure deletion's receipt quotes what it removed.** An applied effect that inserted nothing and removed at least one line carries `removedText` — the removed text, first 40 lines — projected on the wire as `removed`; an effect that inserted anything carries no such field, its resulting context shows the change.
+§edit-receipt-removed-text **A pure deletion's receipt quotes what it removed.** An applied effect that inserted nothing and removed at least one line carries `removedText` — the removed text, its first `PLURNK_SERVICE_EDIT_RECEIPT_REMOVED_LINES` lines — projected on the wire as `removed`; an effect that inserted anything carries no such field, its resulting context shows the change.
 
 §edit-receipt-anchored-context **An applied EDIT's resulting context carries anchors.** The bounded resulting context each effect renders (`PLURNK_SERVICE_EDIT_RECEIPT_CONTEXT_LINES` around and inside the landed region) is rendered exactly as a READ renders — `@xxxxx L:text`, hashed with the resource's READ identity ({§line-anchors}) — so a later operation can cite the landed lines by anchor without a READ. A scheme that supplies no identity keeps the line-numbered form.
 
@@ -2273,9 +2324,9 @@ per-operation projection on `rx`; the aggregate remains inside dispatch.
 | Full `revision`                        | not projected                                                     | SHA-256 identity of the complete landed channel body, retained for forensics. No operation takes a revision; it is neither a lookup nor a compare-and-swap token. |
 | `unit`, `before`, `after`              | `extent`                                                          | Whole-line batches use line counts. A batch containing any exact four-coordinate edit uses Unicode code-point counts.     |
 | `parseIssues.before`, `parseIssues.after` | `parseIssues` as `before→after`                                 | Parser-recovery counts for complete source and landed revisions; omitted when both are clean or either is unavailable.     |
-| `effect.requested`, `source`, `result` | `range`                                                           | The admitted marker and its normalized mapping from the common source snapshot into the landed body.                      |
+| `effect.source`, `result`             | `effect` as `<source> -> <result>`                                | Resolved scopes mapping the source snapshot into the landed body; the admitted marker stays in durable `requested` and `tx`. |
 | `effect.removed`, `inserted`           | `change`                                                          | Removed and inserted counts in the receipt unit. |
-| `effect.removedText`                   | `removed`                                                         | {§edit-receipt-removed-text}: a pure deletion's removed text, first 40 lines; absent when the edit inserted anything.                                                                          |
+| `effect.removedText`                   | `removed`                                                         | {§edit-receipt-removed-text}: a pure deletion's removed text, its first `PLURNK_SERVICE_EDIT_RECEIPT_REMOVED_LINES` lines; absent when the edit inserted anything.                                                                          |
 | `effect.context`                       | Canonical row body                                                | Numbered physical lines at each landed boundary, bounded symmetrically by `PLURNK_SERVICE_EDIT_RECEIPT_CONTEXT_LINES`.   |
 | `disposition`, `requested`             | `disposition`, `requested`                                       | A reviewer-replaced batch preserves the authored marker while stating that its attributed effect was superseded.          |
 | `replacement`                          | `replacement`, `change`, canonical proposal-owner body           | The one whole-resource effect actually applied by the reviewer replacement; never duplicated across authored rows.        |
@@ -2283,8 +2334,8 @@ per-operation projection on `rx`; the aggregate remains inside dispatch.
 §edit-result-receipt-truth **Receipts describe committed state.** Each EDIT
 carries its own landed revision, extent, and optional `parseIssues` transition
 for its complete source and landed revisions. When the proposal lands
-unchanged, the row also carries its requested
-marker, source/result mapping, counts, and context. For configured count `C`,
+unchanged, the row carries its source/result mapping, counts, and context;
+the authored marker remains in durable evidence. For configured count `C`,
 the context contains up to `C` surrounding lines and the first and last `C`
 landed lines at the result boundaries. Overlapping windows coalesce; coordinate
 jumps expose an omitted middle. A deletion instead shows up to `C` lines on
@@ -2469,7 +2520,7 @@ Log history preserved — `log_entries` stores path tuple as text, not FK to `en
   channel derivation under `{§scheme-catalog-parse-issues}`.
 
   §scheme-catalog-aside **Catalog aside.** `aside` is the exact channel
-  derivation's `{§mimetype-summary}`. Prose is clipped to at most 256 Unicode
+  derivation's `{§mimetype-summary}`. Prose is clipped to at most `PLURNK_SERVICE_CATALOG_SUMMARY_CHARS` Unicode
   code points including a visible terminal ellipsis, so a row stays one line
   of orientation; an invocation-form witness — a summary that is one fenced
   operation, the shape every tool family's summary takes
@@ -2484,8 +2535,8 @@ Log history preserved — `log_entries` stores path tuple as text, not FK to `en
   that shape, while deeper first-segment directories collapse to the one-element
   group `[{ path: "dir/**", items, weight }]`, where the selector and both aggregates
   describe the exact recursive subtree. Scope summaries are navigation
-  metadata, not resources. Markerless FIND returns positions 1–16 in the
-  selected unit; `<N,M>` selects an inclusive page and `<1,-1>` explicitly
+  metadata, not resources. Markerless FIND returns the first page
+  ({§markerless-first-page}) of positions in the selected unit; `<N,M>` selects an inclusive page and `<1,-1>` explicitly
   selects all. `range` reports the unit, complete result total, normalized
   request, and returned positions ({§range-extent}). `itemsWeightTotal` weighs the complete matched set while
   `returnedItemsWeightTotal` weighs the returned resource page; in exact
@@ -2507,40 +2558,47 @@ Log history preserved — `log_entries` stores path tuple as text, not FK to `en
 
 SEND AST: `{ op: "SEND", target: ParsedPath | null, body: SendBody | null, metadata, lineMarker }`.
 
-- **Message:** SEND addresses its recipient through {§send-dispatch}, or the user when targetless. It never controls the turn.
-- **Disposition:** TASK declares the complete current inventory; {§task-inventory-intent} reduces its statuses, never its prose, to one workflow intent.
+- **Message:** SEND delivers to an actor, endpoint or exact message address. Targetless SEND answers observed Open Messages.
+- **Workflow:** WAIT yields; successful reply delivery and settled work permit completion at the end of the whole program. NOTE retains memory.
 
-§wait-obligation-matrix **Runtime resolution.** Apply this table after earlier operations have executed. The durable TASK retains its authored inventory even when the actual outcome differs. A live obligation is a worker-owned unresolved child or non-detached stream, read as one row from the `worker_obligations` view ({§worker-obligations}). Unobserved results include this turn's retrievals, mutations and failures, and undelivered stream or child conclusions. Scope `<timeout[,poll]>` follows {§worker-wait-timing} only for a waiting intent.
+§worker-obligations A worker holds its unresolved children and open non-detached
+streams (`worker_obligations`); `loop_obligations` names them per loop. The
+packet's Delegation list, WAIT, completion and drain wake settlement use that
+same durable liveness.
 
-§worker-obligations **What a worker holds is one durable row.** `worker_obligations(worker_id, streams, workers)` is a view: `streams` is an open subscription of the worker's with `detached = 0` (`subscriptions.detached` is written when a `<-1>` spawn opens its stream, so a detached spawn is nobody's obligation by the row, never by asking the exec scheme's memory), and `workers` is a child with an unresolved loop — the same liveness the Delegation section shows, so the 409 gate and the section the model reads cannot disagree ({§child-orientation}). The completion gate ({§send-premature-terminate}), the wait matrix, and the drain's wake settlement all read `worker_live_obligations`; nothing computes the union in the process.
+§wait-obligation-matrix **End-of-program resolution.** Execute all admitted operations and settle optimistic work before applying this table. WAIT is an optional yield, not an end-of-program delimiter.
 
-| Inventory intent | Runtime condition | Outcome | Model-facing feedback |
-|---|---|---|---|
-| TASK omitted | At least one authored operation | 102; no synthetic TASK, warning, or strike | None |
-| explicit empty inventory | Always | 409 receipt; continue, no strike (operator, 2026-09-12) | `No tasks were supplied. Submit a nonempty TASK inventory.` |
-| continue | Always | 102; no implicit join or idle strike | None |
-| todo | Always | 102; no strike | None |
-| wait | Finite timeout, positive poll, or live obligation | 202; durable park and wake of the same loop | Wait timing metadata |
-| wait | No wait obligation; results or curation await the next packet | 102 | Existing result evidence |
-| wait | No wait obligation or unobserved result | 102; no strike | `Nothing is in flight and no timed or polled wait is set. Continuing.` |
-| complete, fail | The loop holds prompt frames it has not yet published ({§completion-defers-to-prompts}) | 102; no strike; the next packet publishes them | `Completion deferred: 1 new prompt arrived during this turn. It is in this packet; a response and a TASK now complete.` |
-| complete | Live work: an open stream or a live child worker ({§completion-joins-live-work}) | 202; durable park and wake of the same loop; no strike | Join detail naming the work, read when the wake lands |
-| complete, fail | Same-turn failures, or settled results the next packet carries — this turn's receipts, a concluded stream, a terminated child ({§completion-defers-to-results}) | 102; no strike; the next packet carries them | Read-time deferral detail naming them |
-| complete | No blocking obligation, or administrative producer | 200 | None |
-| fail | Otherwise; live work is cancelled, never waited for | 499; cancel unresolved descendant scope | `All tasks in the final inventory failed.` |
-
-A timing scope on a non-waiting inventory is ignored with `Wait timing was not applied because no waiting intent was selected.` It does not override the inventory. Every continuation retains the same loop's budgets and strike rail. No-op waiting never invents success.
-
-§loop-response-messages **The response is the last message.** The loop's response is the complete authored body of its last successful targetless SEND, or SEND to one of this loop's own prompts ({§send-prompt-acceptance}), in turn and operation order. Earlier messages reach the client as they are delivered and stay log rows; they are not part of the response, so a corrected answer or a repeated one after a refused completion delivers once. Other directed SEND, TASK, asides, interstitial text, inherited rows and ambient observations never count. The projection reads immutable executed operation evidence, not the curated log projection: KILL cannot retract a delivered message, and a later failure, cancellation or refused completion keeps the last message. A task inventory never becomes a synthetic answer. Terminal status and Problem Details remain independent of this response content. A parent receives its child's response as the child's conclusion (operator, 2026-09-11).
+| Condition, in evaluation order | Outcome |
+|---|---|
+| Worker or loop already cancelled/terminal | Preserve that result. |
+| Administrative program | Finish its transaction without adjudicating another model loop's work. |
+| New unpublished message | Continue; publish it in the next packet. |
+| Live work and either WAIT or no unanswered messages | Park the same loop; message arrival, child or stream settlement, or stream cadence wakes it. |
+| WAIT without live work | Continue; never invent a future wake. |
+| Unanswered messages | Continue. |
+| Unobserved operation results, failures, child results or stream conclusions | Continue; the next packet presents them. |
+| No outstanding messages, live work or unobserved results | Conclude successfully, without a synthetic operation. |
+
+An empty emission is handled by {§empty-turn}, not this completion rule. Ordinary strikes,
+cycles and execution limits remain independent. NOTE and successful KILL do not themselves
+require another observation turn. Failed KILL and every other operational result do.
+
+§loop-response-messages **A response is a recorded delivery.** A successful SEND reply records
+the exact message addresses it answers. All replies remain independently recoverable in
+message history, in execution order, regardless of producer. An actor-addressed SEND that
+does not answer a message, WAIT, NOTE, asides, inherited rows and ambient observations are
+not replies. Curation cannot retract delivery; cancellation or later failure retains it.
+Attachment-only replies retain their attachments without replacing earlier text. A child
+conclusion carries its execution outcome under {§send-undelivered-child-term}, not a second delivery.
 
 §loop-terminal-authorship **Terminal authorship is explicit when external.**
 
 | `terminated_by` | Meaning | Presentation |
 |---|---|---|
 | `NULL` | The model's own terminal or an engine verdict whose exact result already carries the story. | No authorship marker. |
-| `cancel` | An external client cancelled the structured scope ({§methods-loop-cancel}). | COLLECT and the termination delta prepend a cancellation marker to the exact Problem's presentation, so cancellation cannot masquerade as a deliverable. The model's prior log rows remain untouched. |
+| `cancel` | The structured scope was explicitly cancelled, through the client or worker KILL ({§methods-loop-cancel}). | COLLECT and the termination delta prepend a cancellation marker to the exact Problem's presentation, so cancellation cannot masquerade as a deliverable. The model's prior log rows remain untouched. |
 
-The engine's failure terminals — **500** (strike threshold) and **508** (cycle), {§engine-rails} — are never the model's to pick; they are the engine ruling the loop failed. The surface is small on purpose: the model says done, waiting, or giving up, and is never asked to hold a correct opinion about *how* it failed or *whether* it can be woken — the engine decides those from state.
+The engine's failure terminals — **500** (strike threshold) and **508** (cycle), {§engine-rails} — are never the model's to pick; they are the engine ruling the loop failed. The model answers, waits or cancels its scope; the engine derives the lifecycle outcome from that state.
 
 Disposition outcomes follow {§wait-obligation-matrix},
 {§completion-joins-live-work}, and {§completion-defers-to-results}. Strike
@@ -2549,29 +2607,44 @@ accounting and model-visible failure evidence remain separately owned by
 
 - §send-target-recipient **A SEND target is a recipient.** A model's directed SEND
   addresses a worker (```` ```SEND (worker://<name>) ````), an outbound agent (`a2a://`),
-  or a scheme that implements SEND (an `https://` POST). A SEND to a scheme the model may not write (the prompt, the
+  or a scheme that implements SEND (an `https://` POST). A SEND to a scheme the model may not write (the
   log) is refused 400 `send-target-not-a-recipient`, never the unrelated writer
   rule. The detail states only that the addressed scheme is not a recipient;
   neutral recovery distinguishes targetless replies from directed SEND without
   guessing which one was intended. A scheme that does not implement SEND
   answers its ordinary factual 501 without grafting a guessed recovery onto it.
-- §send-prompt-acceptance **One tolerated exception: this loop's own prompt.** The packet
-  lists `prompt://<worker>/<loop>/<id>` addresses under Active Prompts, and a model that
-  addresses one of them means what an untargeted SEND means. The engine accepts a model
-  SEND to a prompt of the current worker and loop as exactly that response: it dispatches
-  as the untargeted case, the row keeps the address the model wrote, and the body counts as
-  the loop's response under {§loop-response-messages}. Nothing is taught about the form and it
-  creates no per-prompt result structure; a prompt of another loop or another worker stays
-  `400 send-target-not-a-recipient`. An undocumented acceptance in the same spirit as KILL
-  in the completion turn, not a recipient.
-- §send-response-receipt **A reply's receipt names its recipients.** A delivered untargeted
-  SEND (and a SEND accepted under {§send-prompt-acceptance}) carries `recipients`: the loop's
-  Active Prompts, oldest first, exactly as the packet lists them. The row shows where the text
-  went, so a model that meant a worker, a stream, or an operation sees the user received it.
-- §empty-turn **A response with no operation is a turn, not a retry.** When the parser finds
-  no operation and no other hard error (prose, bare headings outside fences, an empty
-  response), the emission is admitted as an empty turn (operator, 2026-09-12): its text and
-  reasoning are stored like any turn's (`ops:///`, `reasoning:///`), the model's own message
+- §send-response-receipt **A reply records exactly which messages it answers.** A successful
+  reply carries `answers`, the immutable message addresses it answered, not recipient actors. Targetless SEND
+  answers this loop's published, unanswered messages, oldest first. SEND to an exact message
+  address answers only that message; SEND to an actor endpoint remains ordinary communication
+  and answers no assignment implicitly. An unpublished arrival cannot be answered by the
+  targetless shorthand. Failed delivery answers nothing. Reply accounting reads executed
+  delivery evidence, never log visibility or the mere existence of a later SEND.
+- §prose-conclusion **Prose is the answer.** An admitted response whose content has no
+  operation, attempts none ({§operation-attempt}), was not cut at the output
+  allowance, is not empty, says something outside its quotations ({§quotation}: a reply that is
+  nothing but quoted material is a misfenced program) and holds no misplaced operation fence
+  (`must start its line to run`) is the model's answer (operator, 2026-09-18, #761): the engine
+  admits it as a targetless SEND whose body is the trimmed content, positioned on line 1. It
+  answers the open messages, reaches clients and a parent exactly as a SEND does, and meets the
+  completion barrier as a SEND does ({§completion-joins-live-work},
+  {§completion-defers-to-results}). Reasoning NOTEs ride with it. The model is taught
+  "respond without performing any OPs" and is never taught the SEND. A reply wrapped whole in one
+  `markdown` or `md` fence is delivered as that fence's content ({§quotation}). Its row is stored as the
+  SEND that delivers it (reply accounting, delivery and clients read SEND rows) but carries
+  `attrs.answer = "prose"` and `resource: ops://<worker>/<loop>`, and is addressed and rendered
+  under the leaf `answer` (`log:///1/2/2/answer`), never as a SEND the model did not write.
+- §loop-answer **A loop's address is what it said.** READ `ops://<worker>/<loop>` resolves to
+  the latest reply the loop gave to the message that started it: a prose conclusion's text or
+  the body of a SEND that targeted that message. A running loop without one is 425; a loop that
+  ended without one is its terminal problem (404 when it ended 2xx). `ops://<worker>/<loop>/<turn>`
+  remains that turn's emission. A concluded child's `loop_termination` row to its parent carries
+  `answer: ops://<child>/<loop>` beside its status. Witness: `test/intg/loop-answer.test.ts`.
+- §empty-turn **A response with no operation that is not an answer is a turn, not a retry.**
+  When the parser finds no operation and no other hard error, and the response is not an
+  answer under {§prose-conclusion} — an operation attempt, prose cut at the output allowance,
+  or an empty response — it is admitted as an empty turn (operator, 2026-09-12): its text and
+  reasoning are stored like any turn's (`ops://<worker>/`, `reasoning://<worker>/`), the model's own message
   stays in the next packet's history, that packet carries one `turn_no_operations` notice and
   any {§bare-heading-advisory} notices, the turn continues at 102, and the strike rail counts
   one progress-contract strike, so a model that only talks strikes out at the ordinary
@@ -2581,8 +2654,9 @@ accounting and model-visible failure evidence remain separately owned by
   EDIT or KILL carrying `[metadata]` for a scheme whose manifest takes none runs without it,
   and the packet carries one `metadata_ignored` notice naming the scheme (operator,
   2026-09-12: a gentle warning, never a refusal). The `pattern` option never reaches this
-  path; it is lifted into the matcher at parse time ({§matcher-option}). Executions, WORK and FORK
-  own their slot and receive it whole ({§env-option}); a key they do not take is their own 400.
+  path; it is lifted into the matcher at parse time ({§matcher-option}). SEND recipients,
+  executions, WORK and FORK own their input and receive it whole ({§send-resource-attachments},
+  {§env-option}); a key they do not take is their own 400.
 - §send-looks-like-operation **A reply never begins with an operation heading.** When a model's
   untargeted SEND has, as its first non-blank line, a line that parses alone as one clean
   heading naming an operation this worker could perform — a Plurnk operation, or a registered
@@ -2600,75 +2674,29 @@ accounting and model-visible failure evidence remain separately owned by
   as a literal — on a reply's first line that is prose. Origin: the 2026-09-11 dogfood,
   where four operations on the line after their fences were delivered as four 200 replies and the
   loop then parked fifteen minutes on receipts that could never arrive.
-- §send-idle-turn **Inventory-only continuation is valid.** An `in_progress` inventory continues whether or not another operation ran, including while children or streams are live. TASK is operational state; neither absence of other operations nor a not-ready READ may replace its intent with an implicit park. Exact repeating activity remains subject to {§engine-cycle-evidence}.
-- §send-premature-terminate **Premature terminate — the pending set.**
-  A model's completion turn permits SEND, TASK, and KILL. Every other
-  fired operation requires another packet, regardless of success, stream
-  timing, or empty results. KILL does not erase other observation requirements
-  or failed results. Execution is judged from durable
-  operation records, never the curated log projection. Pending work has two states:
-  **live obligations** (open
-  streams/spawns and live child workers) and **completed-but-unobserved
-  results** (every same-turn non-SEND/TASK/KILL operation, terminal stream output
-  without a terminal foisted READ, and child results queued for the next packet).
-  The set is judged at the disposition's own dispatch, after
-  earlier operations in the emission. `[200]` over a **live** member joins it
-  ({§completion-joins-live-work}); a claim over only completed-but-unobserved
-  members is a deferral ({§completion-defers-to-results}). Neither is a refusal
-  and neither strikes. The pending kinds are `streams`, `workers`, `receipts`,
-  `failed-stream-results`, and `worker-results`; a receipt names them and never
-  embeds commands, stream handles, result bodies, or a presumed recovery. A
-  nonempty all-`failed` inventory crosses the same deferral and then abandons
-  regardless of live work, which it cancels rather than waits for.
-- §completion-joins-live-work **A completion over live work is a join.** A scope
-  that says done while its own work runs — an open stream, a live child worker —
-  is asking to leave with that work unfinished, and the two exits structured
-  concurrency allows are join and cancel. The `completed` inventory takes the
-  join: the TASK answers 202, the loop parks untimed on the live obligation
-  exactly as a `waiting` inventory would, and the settle edge wakes it with what
-  concluded in the packet; the model's next TASK decides with that result in
-  front of it, so nothing completes on an answer written before the work
-  finished. The `failed` inventory takes the cancel. The join's `detail` is read
-  when the wake lands and speaks from that moment; its `attrs` carry `waiting`
-  and the pending kinds. It is never a strike: the review contract has no
-  violation left, and the rail's remaining sources are hard results, cycles and
-  empty turns ({§engine-rails}). A stream the model meant to leave running parks
-  the loop until it ends, as a model-written `waiting` would; KILL before the
-  claim is the way to leave it running (operator, 2026-09-14: "politely
-  converting completed into waiting when there are streams or workers in-flight").
-- §completion-defers-to-results **Settled results defer a terminal; they never strike.**
-  A completion or abandonment claimed over results the model could not yet have
-  seen — this turn's failed operations, this turn's receipts (successful execution
-  results included, not only READ/FIND), a concluded stream's result, a terminated
-  child's result — is deferred: the TASK answers 102 with no Problem and no strike,
-  the loop continues, and the next packet carries what deferred it. The engine
-  owns every observe edge, so such a claim is early in the observation order, not
-  false about the world. After observing the results, the model can continue work,
-  revise its response, or conclude with TASK alone while retaining its last SEND
-  ({§loop-response-messages}, {§send-undelivered-child-term}).
-  The deferral's `detail` is read one packet later, beside the results it names,
-  and speaks from that moment: a receipts-only deferral names the distinct
-  blocking operations in execution order using their model-facing log names
-  ({§log-coordinate-hierarchy}), plus `stream completion` for undelivered terminal
-  stream results; a results deferral names the landed kinds; a failure deferral
-  counts the failures. These deferrals and the live-work join receipt share the
-  conditional guidance: `If your final response has already been sent and these
-  results require no further work or response revision, submit only TASK.` This
-  avoids repeating a delivered response, not delivering one; newly arrived prompts
-  retain their distinct feedback under {§completion-defers-to-prompts}. Their
-  `attrs` carry the pending kinds or the failure count. The rail's streak never
-  enters the decision: a deferral is admissible at any streak, and a loop that
-  keeps issuing operations before each claim pays one packet per claim, never a
-  strike, until the cycle detector rules its repetition ({§engine-cycle-evidence}).
-  Operator, 2026-09-14: the barrier is safety and the rail is liveness; fail is
-  completed with a frowny face and crosses the same barrier.
-- §send-administrative-terminal **An administrative terminal closes its own
-  transaction.** A client, plugin, or `_plurnk` operation program runs in its
-  own administrative loop. Its all-`completed` TASK concludes exactly that loop;
-  it neither claims nor consumes the Worker's model-visible pending set. Model
-  completion rails therefore apply only to a model-authored disposition.
+- §send-idle-turn **NOTE is memory, not a yield.** NOTE does not imply parking.
+  With unanswered messages it continues; after replies and observation it may be the only
+  operation in the program that concludes. Repetition remains subject to {§engine-cycle-evidence}.
+- §send-premature-terminate **Completion follows observation.** Every fired operation except
+  SEND, NOTE, WAIT and successful KILL requires a subsequent packet. This barrier uses durable
+  executed evidence, not curated rows. Fast completion, an empty result or curation cannot
+  erase it. New arrivals are protected by {§completion-defers-to-messages}; no terminal verb
+  or prose overrides this rule.
+- §completion-joins-live-work **Answered work still joins its live obligations.** Once all
+  observed messages are answered, live children, non-detached streams park the same loop
+  as WAIT does. Each ordinary wake presents the newly settled state; completion is evaluated
+  again after the next program. KILL owns cancellation; a reply never cancels work implicitly.
+- §completion-defers-to-results **Results keep the loop running until observed.** Same-turn
+  operations and failures, plus undelivered child or stream conclusions, require the next
+  packet. This is ordinary continuation, not a strike or a synthetic refusal receipt.
+  The already-delivered answer remains delivered. If observation warrants no further work
+  or revision, a NOTE or curation-only program can conclude without repeating the answer.
+- §send-administrative-terminal **Administrative programs close their own transaction.**
+  Their caller closes the administrative loop after execution; no terminal operation is
+  manufactured. Initialization runs in the model loop without concluding it.
+
 - §send-undelivered-child-term **Completion is not delivery.** A result becomes
-  observed only after crossing a packet boundary. An untimed waiting TASK parks only on
+  observed only after crossing a packet boundary. WAIT parks only on
   live obligations. If work has completed but is unobserved, it continues
   directly to the next packet because the wake edge has already fired. A genuinely
   empty wait also continues under {§wait-obligation-matrix}, never concluding implicitly.
@@ -2725,6 +2753,15 @@ batch of 2026-08-29 showed the absolute `cwd` copied back into the target slot a
 family — and neither a command nor a working directory is ever a target. The default
 shell is written as its own fence, ```` ```sh ````; no runtime-less form exists.
 
+§exec-target-near-miss Two target near-misses have one reading each and are read
+without a diagnostic (#758). A directory target is never a program: with a body
+and no explicit `cwd`, the body runs with that directory as its working
+directory; without a body it is still `target-not-a-program`. A target in the
+executor's own scheme whose path can never be a stream (`sh:///daemon-env`;
+streams are eight hex digits) is the writer's name for the run: with a body, the
+body runs as if targetless; without one, the source read refuses as before. A
+real stream id is always the program source.
+
 §exec-tool-fall-through **A tool run as a shell command is named at the failure
 site.** A bare shell command whose program is the name of a tool published by
 another enabled runtime (`brave_web_search {…}` under the default shell) exits
@@ -2820,45 +2857,30 @@ Per-tool programs such as `go`, `cargo`, `make`, and `npm` do not earn executor
 **Timeout and poll — `<T,P>` on the `<L>` slot (grammar 0.74.20).** An execution
 repurposes the line-marker slot as `<timeout, poll>` in **minutes** — agentic
 latencies make a sub-minute horizon a trap — converted at the parse boundary to the
-catalog's internal `stream.seconds`. The TASK `<T>` wait horizon is minutes too.
-
-§exec-timeout `T` (`mark[0]`) caps the spawn's lifetime. At `T>0` the service
-aborts it — a bounded reap, polite signal then SIGKILL after
-`PLURNK_SERVICE_EXEC_KILL_GRACE_MS` — and stamps the stream **504**, distinct
-from a deliberate kill (499) or a clean exit (200). Absent is unbounded but
-loop-life bounded — reaped on every loop terminal except 202 — the
-background-stream behavior. **`-1` is unbounded and detached**: the spawn
-outlives its loop's terminal, 200 included. It never binds to the loop's
-teardown and is nobody's obligation — completion is not gated by it, a waiting TASK does
-not park on it, optimistic settlement looks past it — and it ends only by KILL,
-the worker's total reap, or daemon shutdown; its late conclusion surfaces
-without opening a loop. **`0` is turn-scoped**:
-the stream is reaped at the worker's next pre-turn via the registry abort,
-before the turn's own spawns, so it never survives into the subsequent turn;
-its terminal output surfaces born visible like any close ({§exec-stream}).
-
-§exec-poll `P` (`mark[1]`) is the **poll cadence**, stored on the subscription.
-While the loop is parked waiting for that stream, the daemon persists
-the tightest open poll cadence on that exact wait and resumes the blocked
-loop every P minutes, floored by `PLURNK_SERVICE_OPTIMISTIC_WAIT_MS` so it cannot tick
-faster than the optimistic settlement scale, to inspect progress. It does **nothing while the
-loop is active** because ambient stream deltas already surface progress. An
-open stream without `P` uses exponential backoff
-(`PLURNK_SERVICE_EXEC_POLL_SEC` and `PLURNK_SERVICE_EXEC_POLL_TURNS`); explicit
-`<,P>` wins and `<,0>` disables polling for that stream. Open subscriptions
-aggregate into each wait's inherited observation policy as follows; an explicit
-TASK poll interval overrides this aggregation ({§worker-wait-timing}):
-
-| Open-stream policies                          | Worker timer                  |
-| --------------------------------------------- | ----------------------------- |
-| Any positive `P`                              | The smallest positive cadence |
-| No positive `P`, at least one omitted `P`     | Exponential backoff           |
-| Every `P` is explicit zero                    | Disabled                      |
-
-Child-only joins never use this timer: child settlement is their durable wake
-edge. Stream closure remains a wake edge under every poll policy.
-
-§exec-host-proposes **Effect-gating.** Each executor declares an `effect` (`pure` | `read` | `host`); the service maps it to policy (`EffectPolicy`). A `host` runtime (subprocess; file-backed sqlite) proposes under {§proposal}. Once accepted, it spawns and writes channels at its workspace execution address ({§execution-output-identity}), returning `102 Processing`. Channel state transitions (`active` → `closed`/`errored`) drive subsequent observations ({§channel-state}).
+catalog's internal `stream.seconds`. WAIT takes no timing; future wakes belong to the schedule family.
+
+§exec-lifetime **How long a spawn may live is the fence's metadata, one field.**
+`[{"lifetime": …}]` takes a duration (`30s`, `30m`, `2h`), or one of three words;
+absent is `loop`. An execution takes no scope: a numeric coordinate on an
+executor target is refused `scope-unsupported` (400), naming the field.
+
+| `lifetime`   | The spawn |
+| ------------ | --------- |
+| a duration   | Aborted at the deadline — a bounded reap, polite signal then SIGKILL after `PLURNK_SERVICE_EXEC_KILL_GRACE_MS` — and the stream is stamped **504**, distinct from a deliberate kill (499) or a clean exit (200). |
+| `loop` (absent) | Loop-life bounded: reaped on every loop terminal except 202, the background-stream behavior. |
+| `turn`       | Reaped at the worker's next pre-turn via the registry abort, before the turn's own spawns, so it never survives into the subsequent turn; its terminal output surfaces born visible like any close ({§exec-stream}). |
+| `detached`   | Outlives its loop's terminal, 200 included. It never binds to the loop's teardown and is nobody's obligation — completion is not gated by it, WAIT does not park on it, optimistic settlement looks past it — and it ends only by KILL, the worker's total reap, or daemon shutdown; its late conclusion surfaces without opening a loop. |
+
+**Cadence is the daemon's, never the model's.** While a loop is parked on an open
+stream the daemon wakes it on the worker's exponential backoff
+(`PLURNK_SERVICE_EXEC_POLL_SEC`, `PLURNK_SERVICE_EXEC_POLL_TURNS`, floored by
+`PLURNK_SERVICE_OPTIMISTIC_WAIT_MS`) to inspect progress; it does nothing while
+the loop is active, because ambient stream deltas already surface progress.
+Closure is a wake edge regardless. Child-only joins never use this timer: child
+settlement is their durable wake edge. A recurring check on the calendar is a
+schedule targeting yourself ({§schedule-delivery}), not a loop that polls.
+
+§exec-host-proposes **Effect-gating.** Each executor — and each scheme operation that mutates something outside this process — declares an `effect` (`pure` | `read` | `host`); the service maps it to policy (`EffectPolicy`). The declarer states the FACT, the panel decides the POLICY, and one rule covers every operation: nothing that changes the world runs on nobody's authority. A `host` runtime (subprocess; file-backed sqlite) proposes under {§proposal}, and so does an outbound request that mutates a remote resource ({§http-outbound-proposes}). Once accepted, it spawns and writes channels at its workspace execution address ({§execution-output-identity}), returning `102 Processing`. Channel state transitions (`active` → `closed`/`errored`) drive subsequent observations ({§channel-state}).
 
 §entry-owner **Every entry belongs directly to one workspace.** Its immutable identity is `(workspace_id, scheme, authority, pathname)`. The workspace foreign key supplies lifetime; URI authority supplies the literal resource namespace. There is no entry-owner Worker, synthetic commons actor, caller-relative alias, or per-Worker access grant. Core binds one canonical coordinate through {§entry-address-resolution} for every operation and consumer. Producer and subscriber Worker ids describe causal activity, not ownership.
 
@@ -2908,15 +2930,14 @@ inventory; allocation never rewrites the submitted operation's target.
 
 §exec-readpure-ungated A `read` runtime (observes external state, e.g. search) or `pure` runtime (no observable effect, e.g. `:memory:` sqlite) is side-effect-free → **auto-run**: no proposal, no human gate, no notification. Core persists the prepared operation before applying it; that write-ahead staging has no resolution waiter and therefore cannot enter proposal discovery ({§proposal-list}). It skips the gate a host command faces, but it does NOT resolve in-band — like every exec it backgrounds and streams, its output reaching the model through the environment-observation injector (a foisted READ of newly publishable stream content each turn, {§exec-stream}), never a same-turn receipt.
 
-§effect-policy-tunable **Effect admission is deployment-tunable.** The default
-map (`host` proposes; `read`/`pure` auto-run) is the contract; the operator may
-override it deployment-wide with `PLURNK_SERVICE_EFFECT_POLICY`, a
-comma-separated `<effect>:<policy>` list (e.g. `read:propose` proposes even
-read effects). Unlisted effects keep the default. An invalid entry — unknown
-effect, unknown policy, or a non-`<effect>:<policy>` shape — fails daemon boot
-loudly rather than degrading admission.
+§effect-policy-tunable **Effect admission is one knob per effect.**
+`PLURNK_SERVICE_EFFECT_HOST`, `PLURNK_SERVICE_EFFECT_READ` and
+`PLURNK_SERVICE_EFFECT_PURE` each say `propose` or `auto`, and together they are
+the whole map: no effect's admission is held in code, so a deployment that
+proposes even reads says so in one place an operator can read. An invalid value
+fails daemon boot by the knob's name rather than degrading admission.
 
-After all non-SEND operations dispatch, the initiating turn applies {§worker-optimistic-settlement} to only the execution streams it started, then dispatches its turn disposition against the refreshed lifecycle state. An older stream receives no renewed opportunity merely because another turn began. This is a settlement barrier before disposition, not sibling-operation serialization: dependent EXECs remain separate observed turns.
+After all non-WAIT operations dispatch, the initiating turn applies {§worker-optimistic-settlement} to only the execution streams it started, then resolves the whole program against the refreshed lifecycle state. An older stream receives no renewed opportunity merely because another turn began. This is a settlement barrier before completion, not sibling-operation serialization: dependent executions remain separate observed turns.
 
 §exec-stream **Stream surfacing.** An exec's output is *observed, not fetched*, in
 two states and no others:
@@ -2924,7 +2945,16 @@ two states and no others:
 | state | what the model receives |
 |---|---|
 | active | nothing in the Log. The `## Delegation` stream pointer names the stream with each channel's size and its growth since the last packet ({§child-orientation}); the model READs any range it wants, and every READ of a stream channel carries `terminal: false` while it runs and `terminal: true` once it has concluded, so an empty page is never mistaken for a finished command that printed nothing (operator, 2026-09-13). |
-| terminal | ONE `origin=_plurnk` READ at the execution's channel address, born visible, that is exactly a markerless READ of the channel — its bounded first page ({§read-selection-projection}, the whole channel when it fits, the channel's own mimetype), the `range` or `region`, terminal status and Problem, `terminal: true`, any producer-supplied integer `exitCode`, and `source: log:///<coord>/<runtime>` linking the causal invocation. The packet renders that address under `stream`, exactly as the invocation row links its output, never under `target`: a stream is observed, not a slot to author. |
+| terminal | ONE `origin=_plurnk` READ at the execution's channel address, born visible, that is exactly a markerless READ of the channel — its bounded first page ({§read-selection-projection}, the whole channel when it fits, the channel's own mimetype), the `range` or `region`, terminal status and Problem, `terminal: true`, and any producer-supplied integer `exitCode`. The packet identifies the read resource with `path`, exactly as an explicit READ does ({§log-address-metadata}). |
+
+§stream-observation-result **One liveness fact.** The durable READ result owns
+`terminal`, derived from its selected channel's state, for explicit and automatic
+observations alike, independently of mimetype: `active` gives false, `closed` or
+`errored` gives true, and `static` has no streaming liveness field. Packet
+projection preserves that Boolean and any included
+integer `exitCode`, even for an empty body. An automatic observation's atomic
+publication transition consumes the same result flag; private log attributes
+retain only the publication offset, not a second liveness value.
 
 §exec-concurrency **Bounded admission per workspace (#389).** At most
 `PLURNK_SERVICE_EXEC_CONCURRENCY` executions run at once in one workspace (shipped `12`;
@@ -2974,19 +3004,40 @@ remains pending until every selected channel's terminal READ crosses the next
 packet boundary. The execution row separately records the authored invocation.
 
 ```` ```KILL (<runtime>:///<eight-hex-id>) ```` cancels an active subprocess via
-the subscription registry's stored controller. A terminal stream is immutable:
-499 returns 410 (already killed), every other terminal status returns an RFC
-9457 409 Problem carrying `terminalStatus`, and an unknown address returns 404.
+the subscription registry's stored controller. A terminal stream is immutable,
+and KILL of one is satisfied rather than refused: it returns 200 carrying the
+recorded `terminalStatus` (499 when it was already killed); an unknown address
+returns 404 (#757).
 The runtime scheme participates in the durable lookup; a completed `sh:///`
 stream cannot fall through an internal `exec`-only query. {§stream-control}
 
+§workspace-env **Workspace environment.** The `env` family has workspace defaults and
+worker overrides. Its six verbs accept `scope: "workspace" | "worker"`; model calls
+default to `worker`. Client actions bind the scope in `workspace.env.*` or
+`worker.env.*`. An explicit scope must agree with that action's context.
+
+| Consumer | Composition, later layers win |
+|---|---|
+| Worker command | Admitted ambient environment → workspace entries → worker entries → invocation `env` |
+| Shared capability process | Admitted ambient environment → workspace entries → explicit capability launch options |
+
+Each layer uses the same value and masking rules. A worker's list includes workspace
+defaults by reference with `origin: "workspace"`; worker overrides and masks remain
+worker-owned. Enabling an inherited entry clears this layer's mask, not a mask in a
+lower layer; an explicit local value can override that lower layer. A mask follows
+the name even when its lower-layer origin changes. Removing an override reveals the lower entry disabled, as for a service
+baseline. Forking copies only worker state, not the workspace defaults. Workspace edits
+affect subsequent launches, not existing processes or other workspaces. A shared
+capability never acquires an invoking worker's overrides or ownership.
+
 §exec-env-scoped **Scoped environment.** An execution subprocess receives a composed
 environment, never the host's. Two mechanisms apply in order, and they are different kinds
 of thing. First the **ambient policy**, a ceiling: `PLURNK_SERVICE_EXEC_ENV_INHERIT` names
 what the host's environment may contribute at all and `_EXCLUDE` narrows that, both taking
 exact names or one trailing-`*` prefix glob, both ordinary operator knobs under
 {§operator-config-env-defaults}. A worker document or a heading modifier narrows the ceiling
-further; nothing downstream widens it. The worker document is the Worker's `env` state
+further; nothing downstream widens ambient admission. Explicit entries may supply their
+own non-reserved values. Workspace defaults precede the Worker's `env` state
 ({§env-functionality}), read at the spawn: an enabled worker entry sets its own value, a disabled
 entry of either origin withholds the name, and what `list` projects is what the command
 receives. Then the **invariant**, which is not a knob:
@@ -3006,14 +3057,16 @@ nothing ambient — the allowlist is declared in `.env.defaults`, so an empty on
 policy rather than an unconfigured install.
 
 The full composition for one spawn, nearest setter winning for defaults and ceilings immune,
-is package floors → operator cascade → ambient policy → worker document → the op's modifier →
+is package floors → operator cascade → ambient policy → workspace entries → worker entries → the op's modifier →
 body prefixes.
 
 - §env-option **The op's environment.** `env` is the service's key in the heading's `[metadata]`
   ({§scheme-metadata-modifier}): `[{"env": {"NAME": "value"}}]`, an object of string values.
   On an executor fence it is that process's environment over the Worker's own
   ({§env-functionality}) — the layer nearest the spawn, never entering the registry; a runtime
-  that runs in-process ignores the environment it is handed, so there it changes nothing. On
+  that runs in-process has no process environment to change. A capability manager may
+  retain explicit launch overrides when adding a process-backed definition; it never
+  persists the composed ambient environment. On
   WORK and FORK it is the child's starting environment: after the copy the child inherits
   ({§functionality-scope}), each name lands as the child's own entry through the family's `add`,
   so a parent hands down its registry and overrides specific names for one child in one heading.
@@ -3022,7 +3075,7 @@ body prefixes.
   key WORK or FORK does not take is refused the same way. The durable row redacts the block
   wholesale ({§log-sensitive-request-evidence}); the spawn's record names each such value's
   provenance as the modifier's.
-- §exec-hold-until-concluded **The turn-hold exception** — for runtimes in `PLURNK_SERVICE_EXEC_HOLD` (a decision-table env, shipped listing the search family), an in-flight stream **pauses the cycle**: the next packet does not assemble until the stream concludes, so the model never burns a turn asking "are we there yet" about a result the engine controls end-to-end. This exception is limited to seconds-bounded runtimes whose final result the engine controls end-to-end. Bounded by `PLURNK_SERVICE_EXEC_HOLD_MS` and **fail-open**: at the cap the standard cycle resumes untouched (waits, wakes, polls). Zero grammar or teaching surface — the model emits an executor fence followed by TASK; the wake-shaped world simply arrives one packet sooner. It extends selected runtimes beyond the ordinary {§worker-optimistic-settlement} cap before the next packet assembles. A bare entry holds ALL of a runtime's spawns; a `<runtime>:<effect>` suffix (`github:read`) holds only that effect-class — an MCP server is one runtime whose tools split (a `read` `get_issue` is instant; a `host` `run_migration` is a slow mutation), so an operator opts the known-fast read-class in without parking on the mutation. Conservative stays default: an arbitrary third-party server's latency never parks the engine unless a suffix opts a class in.
+- §exec-hold-until-concluded **The turn-hold exception** — for runtimes in `PLURNK_SERVICE_EXEC_HOLD` (a decision-table env, shipped listing the search family), an in-flight stream **pauses the cycle**: the next packet does not assemble until the stream concludes, so the model never burns a turn asking "are we there yet" about a result the engine controls end-to-end. This exception is limited to seconds-bounded runtimes whose final result the engine controls end-to-end. Bounded by `PLURNK_SERVICE_EXEC_HOLD_MS` and **fail-open**: at the cap the standard cycle resumes untouched (waits, wakes, polls). Zero grammar or teaching surface — the model emits an executor fence, optionally followed by WAIT; the wake-shaped world simply arrives one packet sooner. It extends selected runtimes beyond the ordinary {§worker-optimistic-settlement} cap before the next packet assembles. A bare entry holds ALL of a runtime's spawns; a `<runtime>:<effect>` suffix (`github:read`) holds only that effect-class — an MCP server is one runtime whose tools split (a `read` `get_issue` is instant; a `host` `run_migration` is a slow mutation), so an operator opts the known-fast read-class in without parking on the mutation. Conservative stays default: an arbitrary third-party server's latency never parks the engine unless a suffix opts a class in.
 - §exec-entry-sink **The entry() sink** implements {§executor-entry-sink} over ordinary scheme-owned entries. Core owns allocation, materialization, and persistence; executors receive only the returned resource address.
 
   | Input / effect | Consumer behavior |
@@ -3045,7 +3098,7 @@ body prefixes.
 
 - **Client disposition** ({§methods-proposal-resolve}) — a client interface delivers accept, reject, or cancel; AG-UI uses standard resume entries ({§agui-proposal-resolve}).
 - **Loop disposition** ({§proposal-disposition}) — core applies the exact automatic accept/reject before observational subscribers run; automatic policy is not an event listener or client fallback.
-- §proposal-timeout-cancels **Timeout is OPT-IN; the shipped default is a world that WAITS** - `PLURNK_SERVICE_PROPOSAL_TIMEOUT_MS` empty (shipped) means a pending proposal - a file edit awaiting review - waits indefinitely for its human: absence is not an answer, so the service does not synthesize a cancellation. A finite positive millisecond value establishes the bound; then elapsing synthesizes `cancel` (outcome `timeout`), server-side, needing no client. Every other explicit value fails at the proposal lifecycle owner and terminalizes an already-written proposal rather than silently choosing an indefinite wait.
+- §proposal-timeout-cancels **Timeout is OPT-IN; the shipped default is a world that WAITS** - `PLURNK_SERVICE_PROPOSAL_TIMEOUT_MS` empty (shipped) means a pending proposal - a file edit awaiting review - waits indefinitely for its human: absence is not an answer, so the service does not synthesize a cancellation. A finite positive millisecond value establishes the bound; then elapsing synthesizes `cancel` (outcome `timeout`), server-side, needing no client. Every other explicit value fails at the proposal lifecycle owner and terminalizes an already-written proposal rather than silently choosing an indefinite wait. Indefinite is with respect to the clock alone: the wait ends with its loop. A loop whose signal aborts — its own timeout, `loop.cancel`, worker `KILL` — settles every proposal it is holding through {§proposal-cancel-aborts}, carrying the abort's reason as the outcome, because a cancelled loop is not a loop awaiting a decision.
 
 **The decision drives a one-way state transition** on `log_entries.state` (resolution is idempotent — `WHERE state='proposed'`, so a second resolution 404s):
 
@@ -3055,7 +3108,7 @@ body prefixes.
 | §proposal-reject-fails reject   | `failed` | 400 | `rejected` | none — the action did not occur. |
 | §proposal-cancel-aborts cancel  | `cancelled` | 499 | `loop_aborted` | none — the loop is abandoning. |
 
-§proposal-outcome-terse-error A caller-supplied `outcome` overrides the default. On an **accept** it stays forensics-only; a **non-accept** carries it as the `rx`'s terse `error` token (`write_failed` / `rejected` / `timeout` — one word, never prose), because "the action didn't occur" without the mechanical why leaves the model acting on a phantom success (the fan-out dead-park: an ENOENT apply rendered as a mute 400).
+§proposal-outcome-terse-error A caller-supplied `outcome` overrides the default. On an **accept** it rides the result as the forensic `outcome` field; a **non-accept** is a Problem that carries the same `outcome` field (`write_failed` / `rejected` / `timeout` — one word) and names it in its detail, because "the action didn't occur" without the mechanical why leaves the model acting on a phantom success (the fan-out dead-park: an ENOENT apply rendered as a mute 400). A settlement the **harness itself** decided — nobody attending, no answer before a deadline, a loop or daemon ending while the proposal waited — also states that condition and an exit in its detail and `recovery`, because a reviewer's outcome is a reviewer's word but these have no author present to explain them; the one-word token stays as the forensic `outcome` either way.
 
 §proposal-proposed-hidden **A proposed row is invisible until it resolves.** A `state='proposed'` / 202 row is withheld from both packet materialization and `log/entry`; it surfaces exactly once after resolution, carrying its terminal status — models and clients see outcomes, never pending proposals.
 
@@ -3094,10 +3147,12 @@ issues; the same request remains pending and answerable. Cancellation requires n
 payload. Owner abort deletes the row and rejects the
 waiter with that owner's cancellation reason. An executor's waiter follows its
 execution signal, including KILL and deadline, not just its enclosing loop.
+Scheme and executor interaction requests may supply a narrower signal; Core
+composes it with the existing owner signal before registering the same waiter.
 Reconnect discovery intersects durable rows with live waiters; restart
 removes ownerless rows without fabricating cancellation, payload, or replay.
 
-### §proposal-ownership Loop disposition and client YOLO
+### Loop disposition and client YOLO
 
 Side-effecting operations propose ({§exec}) and pause dispatch at 202 for an
 authority decision ({§engine-rails}, {§methods}). Automatic acceptance has two
@@ -3116,11 +3171,76 @@ only after authority crosses the client boundary.
 
 ### §proposal-disposition Settlement authority and precedence
 
+§loop-attendance **A loop says whether anyone is attending, and a wait nobody could end is
+never taken.** `LoopPolicy.attended` is the whole of it: `true` says an interactive partner is
+present, `false` declares an unattended loop. It is one field of the loop's complete policy, so
+its creator states it or leaves it to the panel ({§loop-policy-composition}); the client's
+`--auto` is exactly the statement `attended: false`. A fresh delegated loop inherits it with the
+rest of the policy ({§worker-delegation-inherits-policy}), so a child of a headless run is
+headless too.
+
+Unattended, three things follow and nothing else does:
+
+- **A proposal is never held for review.** `{ proposals: "review", attended: false }` is not a
+  `LoopPolicy`: the schema refuses the pair, so no loop can persist it. The panel cannot produce
+  it, because attendance picks which disposition knob answers. Only a creator's own statement
+  can ask for it, and that is refused **400 `loop-policy-invalid`** naming the way out.
+- **No interactive partner is offered.** `ClientInteractions.request` refuses **501
+  `loop-unattended`** instead of writing the request down and waiting. Every wiring funnels
+  through that one request — the `question` runtime ({§question-tool}), the execution input
+  bridge, the scheme interaction caps, and MCP elicitation — so one refusal covers them all. The
+  `question` runtime's effect is `read`, so it is never proposal-gated and a disposition does
+  nothing for it. The refusal is the asking executor's **own result**, never a thrown contract
+  violation: the model has to read why it cannot ask.
+
+  Dispatch refuses it first, at the **loop ring** of the capability cascade: an unattended loop's
+  own layer denies the `interact` access class ({§worker-tool-admission}), and that 403 names the
+  ring, the reason and the recovery — a subtracted tool must say why it is gone and what to do
+  instead. Every other ring is operator configuration and speaks for itself; the loop ring is the
+  one the model can act on. The 501 at the interaction itself is the backstop for the paths that
+  do not cross dispatch (MCP elicitation raised inside a tool call, the execution-input bridge).
+  The ring reaches dispatch but not the reserved tree's listing, which is one artifact per
+  workspace: an unattended model still sees the question document and learns at dispatch that it
+  is refused (#770).
+- **A provider-recovery park becomes a conclusion** ({§provider-recovery}), carrying the
+  provider's own exact Problem. Never a substituted "the model gave up".
+
+**A park is a promise that something will restart it.** `LoopLifecycle.park` takes the waker
+by name; `null` says nothing will. Parking an unattended loop with no waker is a contract
+violation and throws, so a park site added later fails loudly on its first unattended run
+instead of idling until some caller's clock notices. It is a tripwire, not a fallback: the
+provider-recovery path concludes before reaching it.
+
+Attendance never converts a legitimate wait that has a real waker — a `WAIT`, an open stream,
+a delegated child — into a termination. Those have wakers; a human question
+does not. A prompt prefix states a disposition, never an attendance: typing `?` asks for review,
+and an unattended loop refuses that statement rather than conjuring a reviewer.
+
+§loop-policy-composition **A loop's policy is what its creator stated over what the panel
+says.** A creator — a client's `loop.run`, a schedule definition, a transport module — states
+any part of a policy as a `LoopPolicyRequest`, or nothing. The request stays exactly as stated
+until a fresh loop is persisted: an omitted field is no opinion, so a fold compares only what
+was said ({§methods-loop-run-fold-consistency}). `LoopPolicies.compose` then makes it whole,
+once. `PLURNK_SERVICE_ATTENDED` answers an unstated attendance, and the attendance picks which
+knob answers an unstated disposition: `PLURNK_SERVICE_PROPOSALS` for an attended loop,
+`PLURNK_SERVICE_UNATTENDED_PROPOSALS` for an unattended one, whose vocabulary has no `review`.
+Every panel state is therefore lawful, and an invalid knob fails boot by its name. No code,
+schema or column holds a default ({§operator-config-only-home}): `loops.policy` and
+`loops.max_turns` carry none, so every insert states both, and an administrative loop — a
+client's direct statements, the runtime's own narration — states the panel's policy like any
+other loop whose creator said nothing.
+
 §loop-policy-effective-read `loops.policy` persists one complete immutable
 `LoopPolicy`; every runtime policy read validates that snapshot before use.
 Missing rows or invalid values fail with the owning loop coordinate and cause.
 Raw archival copies and forensic rendering do not interpret policy.
 
+The cascade's rings are `service`, `workspace` and, innermost, `loop`. The loop ring exists only
+for an unattended run and is purely subtractive like every other layer, so it can never widen what
+its workspace allows; a capability denial names the ring that refused. The operator's capability
+projection and the shared reserved-document materialization take no loop coordinate on purpose:
+those questions are about a workspace, not about one run.
+
 `ProposalDisposition` is either `{ owner: "client" }` or `{ owner: "loop", decision: "accept" | "reject", outcome? }`. The persisted loop policy determines it exactly:
 
 | `policy.proposals` | Disposition                              |
@@ -3139,7 +3259,7 @@ Capability admission precedes this decision, so proposal disposition cannot gran
 
 ### §subscriptions Subscriptions
 
-§subscriptions-subscription-registry-routes-cancellation READ on a streaming scheme is a subscription, not a one-shot. The scheme establishes its protocol-specific acquisition boundary, returns `102 Processing`, and stays alive through the `StreamSubscription` returned by `subscriptions.open()`. The service commits that initial operation result normally; later chunk and terminal work cannot rewrite it. Durable terminal truth lives on the subscription and its channels. The service records durable subscription identity and metadata in SQLite and retains the callable `SubscriptionHandle` only in its process-local live registry. A failed TASK, worker cancellation, turn-scoped reap, and shutdown all route through that one live registry; no handler-specific cancellation hook or database access is part of the plugin contract.
+§subscriptions-subscription-registry-routes-cancellation READ on a streaming scheme is a subscription, not a one-shot. The scheme establishes its protocol-specific acquisition boundary, returns `102 Processing`, and stays alive through the `StreamSubscription` returned by `subscriptions.open()`. The service commits that initial operation result normally; later chunk and terminal work cannot rewrite it. Durable terminal truth lives on the subscription and its channels. The service records durable subscription identity and metadata in SQLite and retains the callable `SubscriptionHandle` only in its process-local live registry. Worker cancellation, turn-scoped reap, and shutdown all route through that one live registry; no handler-specific cancellation hook or database access is part of the plugin contract.
 
 The durable row is lifecycle evidence and the lookup key, not a serialized callback. `subscriptions.open()` establishes both halves before yielding a composed `StreamSubscription`: an `AbortSignal` whose fused `notifyChunk` and terminal `close` methods are safe to retain without the operation's general `SchemeCtx`. `close(result, summary?, channelResults?)` validates one universal terminal producer result plus exact named channel overrides. One SQLite transition closes the subscription and installs each channel's terminal `producerResult`; its lifecycle state derives from that result. The transition then wakes the worker when appropriate and unregisters the live handle. `close_status` is a constrained relational projection of `close_result.status`, never an independent result, while `channel_results` preserves historical overrides after a later subscription replaces the channel's current evidence. A durable open row without a live handle is an explicit lifecycle failure, never a fabricated cancellation success. Channel state ({§channel-state}) + log entries ({§no-chunk-rows}) carry lifecycle.
 
@@ -3160,7 +3280,7 @@ live executor's current declaration.
 
 §subscriptions-fold-keeps-subscription A scoped KILL changes a log row's readable projection ({§log-kill-scope}), never the subscription registry. Curation of a streaming entry's log body leaves the live stream and its source running; it is not cancellation.
 
-### §chunk-accumulation Chunk accumulation
+### Chunk accumulation
 
 §chunk-accumulation-chunks-accumulate SSE event types, WS message types, exec stdout/stderr each map to a named channel. Each stored channel carries `content`, `mimetype`, curation `weight`, and lifecycle `state` ({§channel-state}). The subscription registry owns durable subscription identity and process-local cancellation routing, not a second channel-state representation. Chunks accumulate into the channel as they arrive — not buffered until close.
 
@@ -3170,20 +3290,16 @@ live executor's current declaration.
 
 Model sees lifecycle events in the `log` section per turn.
 
-### §deep-slices Deep slices on demand
-
-```` ```READ (https://feed.example/x#body) <N-M> ```` pulls a slice into a log row when the model wants a specific line-range of an SSE stream.
-
 ### §stream-control Stream control and writes
 
 - **Cancel:** ```` ```KILL (https://feed.example/x) ```` — the service invokes the handle registered by `subscriptions.open()` and aborts the composed subscription signal.
-- **Kill:** ```` ```KILL (sh:///ab3d5678) ```` — the model terminates the addressed workspace stream. This is stream control, not a write: the output scheme's `writableBy` never gates it. An already-killed stream answers 410; another terminal stream answers 409 with its recorded status ({§runtime-resource-binding}). A queued execution ({§exec-concurrency}) is cancelled the same way and never enters its executor.
+- **Kill:** ```` ```KILL (sh:///ab3d5678) ```` — the model terminates the addressed workspace stream. This is stream control, not a write: the output scheme's `writableBy` never gates it. A stream that already ended, killed or not, answers 200 with its recorded `terminalStatus`: the process is not running, which is what KILL asks for (#757); a stream that never existed answers 404 ({§runtime-resource-binding}). A queued execution ({§exec-concurrency}) is cancelled the same way and never enters its executor.
 - **WebSocket write:** ```` ```EDIT (wss://feed/x) ```` or ```` ```SEND (wss://feed/x) ```` with a body sends one whole text frame through the active owner. Either write can follow the opening READ in the same turn under {§op-execution-order}.
 - **Other stream write:** ```` ```SEND (…) ```` remains scheme-defined, including exec stdin.
 
 ### §stream-constraints Engine constraints
 
-ONE engine-level constraint: **100 MiB char-length cap per channel body**. `CHECK (length(content) <= 104857600)` on `entry_channels.content` in `migrations/005_entries.sql`. Violations → SQLITE_CONSTRAINT; action-entry captures rejection at status 500.
+ONE engine-level constraint: **100 MiB char-length cap per channel body**. `CHECK (length(content) <= 104857600)` on `contents.content` and on an active stream's `entry_channel_rows.buffer` in `migrations/005_entries.sql` ({§content-store}). Violations → SQLITE_CONSTRAINT; action-entry captures rejection at status 500.
 
 §stream-constraints-engine-one-cap All other limits are extrinsic — providers (request size, model context, fetch timeouts), schemes (per-call validation), mimetypes (render budgets). Engine does not throttle, batch, rate-limit, or cap anything else.
 
@@ -3195,11 +3311,11 @@ The model is NOT a stream/event consumer — turn-based only; sees whatever's in
 
 ---
 
-## §storage Storage Model
+## Storage Model
 
 SQLite (`node:sqlite`) with WAL mode and STRICT tables. Hand-written DDL; CI-aligned against grammar schemas.
 
-### §ddl DDL strategy
+### DDL strategy
 
 No generator. SQLite-optimal: STRICT (3.37+), `INTEGER PRIMARY KEY` aliasing, explicit `NOT NULL`, indexed query paths, deliberate FK `ON DELETE`/`ON UPDATE`, `WITHOUT ROWID` where access pattern warrants, generated columns, FTS5.
 
@@ -3213,10 +3329,11 @@ No generator. SQLite-optimal: STRICT (3.37+), `INTEGER PRIMARY KEY` aliasing, ex
 | §db-fk-indexes Foreign-key check paths | Every foreign-key column a delete, cascade, or parent replacement can check carries an index (partial where the column is nullable), and no registry statement's plan scans a growing table: `test/intg/schema-query-plans.test.ts` runs `EXPLAIN QUERY PLAN` over every `-- PREP` statement against the baseline and fails on a `SCAN` of a growing table, except statements that read a whole table by design (digest, startup recovery, whole-workspace listings, scheduled-loop claims). An index claim is a plan, never a grep of index names. |
 | §db-index-owners Every index has an owner | An explicit index earns its place one of three ways: a registry statement's plan uses it, its leading column is a foreign key whose check it serves, or it enforces uniqueness. The same test fails on any other index, naming it: an index nobody reads is a write on every insert. Duplicates of a `UNIQUE` constraint's own index and sort-only indexes no plan selects were removed on this rule; a column no statement reads (`symbol_refs.col`, `ambient_events.created_at`) is not stored. |
 | §db-maintenance-optimize Statistics at shutdown | The daemon's last database step before the caller closes SQLite is `PRAGMA optimize` on the writer (`maintenance_optimize`), so `sqlite_stat1` reflects tables the connection planned against, bounded by SQLite's own analysis limit; a failure there is a reported shutdown error, never silent. Retention runs before it under the operator's policy ({§retention-policy}); no explicit checkpoint and no periodic `ANALYZE` run. |
-| §retention-policy Retention is the operator's policy; information is kept by default | `Retention` (`src/server/Retention.ts`, statements in `Retention.sql`) reads seven knobs from `.env.defaults` once at daemon construction and runs four set statements in dependency order — on `PLURNK_SERVICE_RETENTION_INTERVAL_MS` cadence while the daemon runs (0 = shutdown only) and once more at shutdown before `PRAGMA optimize`. `PLURNK_SERVICE_RETAIN_PACKET_TURNS` (-1 = every packet) and `PLURNK_SERVICE_RETAIN_PACKET_MS` (-1 = no age limit) retire a completed turn's packet composition (`turn_sections`, {§packet-items}) once it is beyond the newest N packet-bearing turns of its loop or older than the age; the turn, its bag, its log rows and its accounting stay, and an open turn is never retired. `PLURNK_SERVICE_COLLECT_PACKET_ITEMS` (1) collects items no composition references. `PLURNK_SERVICE_COLLECT_DERIVATIONS` (1) collects derivations no channel, turn source, or log row cites — superseded editions — with their symbols (cascade) and their full-text shadow (`derivations_delete_fts`, a process trigger beside the FTS statements, on every delete path). `PLURNK_SERVICE_RETAIN_RESPONSE_TURNS` (-1) and `PLURNK_SERVICE_RETAIN_RESPONSE_MS` (-1) retire a settled call's response body (`model_call_responses`) once it is beyond the newest N body-bearing calls of its loop or its turn is older than the age; the call's identity, failure, capacity, admission and accounting stay, and the digest renders such a call request-only. Under the shipped defaults nothing that is information leaves; only what no row references. A malformed knob refuses daemon construction. Witness: `test/intg/retention.test.ts`. |
+| §db-space-reclamation The daemon keeps its own file healthy | `PLURNK_SERVICE_AUTO_VACUUM` (`incremental`, the default, or `none`) names the mode the daemon keeps its file in. At start, before any drain, a database in another mode is converted (set the mode, one `VACUUM`, which rewrites the file and needs free disk about its size) and the journal says so with page counts before and after. Under `incremental`, every retention pass ends by stepping `PRAGMA incremental_vacuum` to completion once free pages reach `PLURNK_SERVICE_RECLAIM_MIN_FREE_BYTES` (0, the default, = every pass), and reports `reclaimedPages`; below the floor, free pages stay for SQLite to reuse. Under `none` the file never shrinks and freed pages are reused. No operator step is involved beyond the knobs. The WAL stays bounded by SQLite's automatic checkpoint (#764). |
+| §content-store Every body is stored once | `contents` holds each settled body once, addressed by its SHA-256, however many channels, workspaces, forks or derivations carry it; rows are immutable. `entry_channel_rows` points a settled channel at its body and keeps an active stream's body as a private buffer until it settles, when it is interned. Every reader and writer uses the `entry_channels` view, whose `INSTEAD OF` triggers intern bodies, refuse a bound `content_hash` that is not the content's, and write each column group only when it changed, so a search attachment is never a representation write. SQLite counts no changes for a view, so a write that must know whether its channel exists returns the channel's name; an outer join cannot flatten the view, so the two statements that need one read `entry_channel_rows` and `contents` directly. `derivation_fts` is an external-content index over `derivation_texts` (a derivation joined to its body); `derivations.content_id` names the indexed text, and the triggers in `_entry-fts.sql` move the index with it and forget it on delete. A body no channel holds and no derivation indexes is collected by retention under `PLURNK_SERVICE_COLLECT_CONTENTS` (1). Witnesses: `test/intg/retention.test.ts`, `test/intg/entries.test.ts`, `test/intg/fulltext-index.test.ts`. |
+| §retention-policy Retention is the operator's policy; information is kept by default | `Retention` (`src/server/Retention.ts`, statements in `Retention.sql`) reads ten knobs from `.env.defaults` once at daemon construction (the two storage knobs are {§db-space-reclamation}) and runs four set statements in dependency order — on `PLURNK_SERVICE_RETENTION_INTERVAL_MS` cadence while the daemon runs (0 = shutdown only) and once more at shutdown before `PRAGMA optimize`. `PLURNK_SERVICE_RETAIN_PACKET_TURNS` (-1 = every packet) and `PLURNK_SERVICE_RETAIN_PACKET_MS` (-1 = no age limit) retire a completed turn's packet composition (`turn_sections`, {§packet-items}) once it is beyond the newest N packet-bearing turns of its loop or older than the age; the turn, its bag, its log rows and its accounting stay, and an open turn is never retired. `PLURNK_SERVICE_COLLECT_PACKET_ITEMS` (1) collects items no composition references. `PLURNK_SERVICE_COLLECT_CONTENTS` (1) collects stored bodies nothing holds ({§content-store}), after the collectors that release them. `PLURNK_SERVICE_COLLECT_DERIVATIONS` (1) collects derivations no channel, turn source, or log row cites — superseded editions — with their symbols (cascade) and their full-text shadow (`derivations_delete_fts`, a process trigger beside the FTS statements, on every delete path). `PLURNK_SERVICE_RETAIN_RESPONSE_TURNS` (-1) and `PLURNK_SERVICE_RETAIN_RESPONSE_MS` (-1) retire a settled call's response body (`model_call_responses`) once it is beyond the newest N body-bearing calls of its loop or its turn is older than the age; the call's identity, failure, capacity, admission and accounting stay, and the digest renders such a call request-only. Under the shipped defaults nothing that is information leaves; only what no row references. A malformed knob refuses daemon construction. Witness: `test/intg/retention.test.ts`. |
 
-- **Schema-alignment test**: loads `@plurnk/plurnk-contracts/schema/*.json`, parses DDL via `node:sqlite` introspection, asserts every required schema field has a corresponding `NOT NULL` column. Contract drift fails CI.
-- DDL = storage truth; JSON Schemas = wire truth. Tested-aligned, allowed to differ where ergonomics demand.
+- DDL = storage truth; JSON Schemas = wire truth. They are allowed to differ where ergonomics demand.
 - §entry-identity-no-null **Identity components are never NULL.** `(workspace_id, scheme, authority, pathname)` is a unique key. `workspace_id` references the workspace directly with cascading deletion. Namespace schemes use empty authority; resource schemes retain their canonical authority. File members use nonempty `scheme="file"` and render as bare paths. Registration refuses `storedScheme: null`.
 
 ### §sql-ts-boundary SQL/TS responsibility boundary
@@ -3336,10 +3453,10 @@ service manifest edit.
 
 ---
 
-## §grammar Grammar Dependency
+## Grammar Dependency
 
 Core consumes the language, schemas, and generated types under
-{§contract-authority} and {§contract-representations}. Provider emissions cross
+{§contract-representations}. Provider emissions cross
 {§emission-admission}; admitted programs execute through
 {§turn-ops-admission-path}. Core owns execution and persisted state, not a second
 language definition.
@@ -3358,7 +3475,7 @@ and is ignored rather than resolved against the working directory.
 |---|---|---|
 | Configuration | `$XDG_CONFIG_HOME` (default `~/.config`) | `plurnk/.env`, `plurnk/AGENTS.md` |
 | Durable user data | `$XDG_DATA_HOME` (default `~/.local/share`) | `plurnk/plurnk.db` and SQLite sidecars |
-| Persistent operational state | `$XDG_STATE_HOME` (default `~/.local/state`) | Reserved; no directory is created without an owned artifact. |
+| Persistent operational state | `$XDG_STATE_HOME` (default `~/.local/state`) | On-demand workspace/module directories ({§module-workspace-directory}). |
 | Reproducible cache | `$XDG_CACHE_HOME` (default `~/.cache`) | Reserved; no directory is created without an owned artifact. |
 | Shared global Agent Skills | User home | `.agents/skills/<name>/SKILL.md` |
 
@@ -3384,6 +3501,23 @@ Node's pre-script env-file form and the executable's post-script form share the
 
 §operator-config-env-defaults **Every package owns its knobs — `.env.defaults` is the standard.** Each package in the daemon's ecosystem — internal or third-party — ships a `.env.defaults` at its package root declaring its own knobs; the file is the package's configuration reference, traveling in the tarball and changing with the code that reads it. At boot the daemon assembles every installed member's file into one floor (membership = the `@plurnk/*` scope or a `plurnk` package.json field, gated by `PLURNK_PLUGINS_TRUSTED_ONLY` with discover()'s exact semantics) and applies it set-if-unset under every operator source. `plurnk-service config defaults` renders the same complete, owner-labelled aggregate to stdout on demand, preserving comments and optional declarations without persisting a second copy or exposing effective secret values. A key claimed by two packages fails boot naming both. With the reader-declares discipline, each key has one implementation and one defaults owner.
 
+§operator-config-only-home **The cascading environment is the only home for a choice.** The principle and its reasons are ARCHITECTURE.md's (*Configuration authority*); this is what `scripts/env-surface-policy.mjs` enforces in `root:lint`, over the source Git tracks:
+
+| Rule | What it refuses |
+|---|---|
+| `undeclared` | a knob read that no panel declares, live or as an optional knob; a computed name is covered by one declared example of its family |
+| `fallback` | a read that carries its own value |
+| `reader-fallback` | a reader whose signature accepts one, so a caller could state what the panel did not |
+| `default-constant` | a constant named `DEFAULT_*`: *default* is a word reserved for a value on the panel |
+| `tunable` | a numeric constant whose own name says duration, size, count or pacing, unless `scripts/env-surface-mechanism.json` registers why it is mechanism |
+| `timer-literal` | a bare number handed to a timer or a deadline; it is named or read from the panel, and has no register |
+| `dead-knob` | a live declaration nothing consumes |
+| `retired-declared` | a retired key still declared; a retired key is named only by the code that refuses it |
+| `duplicate-owner` | a key two packages declare |
+| `test-floor` | a package that ships a panel and tests off it |
+
+Reading the system environment directly is the mechanism and never a finding. The allowance file is a ratchet — new debt is refused, and so is a paid debt left on the books — and it is empty. The register is not a debt: it is the reviewed list of deliberate non-knobs, each with its reason, and an entry whose number is gone is refused.
+
 §operator-config-source-errors An optional member file may be absent; other read failures surface with the
 owning package and original cause, never as an incomplete successful catalog.
 
@@ -3399,36 +3533,37 @@ complete installed option catalog.
 
 Model selection uses one selector vocabulary in `ProviderRegistry` ({§provider-instantiation}). `PLURNK_MODEL_<alias>=<provider>/<model-id>` optionally declares a friendly route and tuning scope; `PLURNK_MODEL=<selector>` selects either that alias or an exact provider/model route. `PLURNK_MODEL_CHILD=<selector>` uses the same vocabulary for the default child provider; unset means inherit the spawning loop's provider. Operator selections and alias declarations live in `.env`, not `.env.defaults`.
 
-| Var                                                         | Default | Purpose |
-|-------------------------------------------------------------|---------|---------|
-| `PLURNK_SERVICE_DB_PATH`                                    | `$XDG_DATA_HOME/plurnk/plurnk.db` | SQLite file path; an explicit non-empty value overrides the derived default. |
-| `PLURNK_HOST`                                               | `127.0.0.1` | Bind address for the listener. Local-only by default. |
-| `PLURNK_PORT`                                               | `1066` | TCP port for THE client surface — the AG-UI+ listener (the plurnk-agui plugin module binds it at boot). Production is single-listener. |
-| §operator-config-git-ceiling `PLURNK_SERVICE_GIT_ALLOWED`   | `1` | Hard service ceiling: only `1` admits Git membership and status; every other value denies them. |
-| §operator-config-file-create-scope `PLURNK_SERVICE_FILE_CREATE_SCOPE` | `root` | Hard file-creation ceiling: `none < root < namespace`. `none` denies new filesystem files, `root` admits only paths inside `project_root`, and `namespace` also admits canonical outside-root paths. Existing-member writes are unaffected. |
-| `PLURNK_SERVICE_FILE_MATERIALIZE_MAX_BYTES`                 | `104857600` | Byte ceiling in `1..104857600` for one workspace-file snapshot ({§membership-materialization-limit}). |
-| `PLURNK_SERVICE_MAX_TURNS`                                  | `-1` | Operator inference-turn **ceiling** — `-1` = no cap; a positive value clamps `runLoop({maxTurns})`. The effective value is persisted on the durable loop and counts completed model/inference turns cumulatively across every `202` park/resume; `_plurnk`, client, and plugin turns remain chronology but consume none of this allowance. |
-| `PLURNK_SERVICE_MAX_COMMANDS`                               | `-1` | Per-emission action ceiling; `-1` = no cap (default) — every generated op dispatches. A positive value caps dispatched actions: overflow ops drop with one durable `max-commands-exceeded` error row on the next packet. The final disposition always dispatch. Tightened per workspace via `settings.maxCommands` (min wins). |
-| §operator-config-loop-timeout `PLURNK_SERVICE_LOOP_TIMEOUT` | `86400000` | Positive ms of cumulative active execution per loop ({§loop-execution-allowance}); excludes parked/queued time. Snapshotted on first execution, retained across wakes. Exhaustion aborts in-flight work and terminates `504 loop_timeout`, including a stuck provider call. |
-| `PLURNK_SERVICE_PROVIDER_RECOVERY`                          | `900000` | ms a turn keeps re-issuing its provider call after a recoverable provider failure before the loop parks ({§provider-recovery}); `0` parks at once. |
-| `PLURNK_SERVICE_PROVIDER_RECOVERY_BACKOFF`                  | `5000` | First recovery delay (ms); doubles per failure, capped at twelve times itself ({§provider-recovery}). |
-| `PLURNK_SERVICE_MAX_STRIKES`                                | `3` | Consecutive turn-contract strike threshold ({§engine-rails}). |
-| `PLURNK_SERVICE_EMISSION_ATTEMPTS`                          | `3` | Completed provider responses allowed beneath one engine turn before frame admission is exhausted. Bounded interior operation errors are admitted without spending this budget. Exhaustion contributes one frame-contract strike under {§invalid-emission-attempts}. |
-| `PLURNK_SERVICE_PREVIEW_LINES`                              | `16` | Maximum lines in automatic text previews and markerless READs ({§body-projection}). |
-| `PLURNK_SERVICE_PREVIEW_CHARS`                              | `2560` | Independent Unicode code-point bound on the same previews, with CRLF treated as one indivisible separator ({§body-projection}). |
-| `PLURNK_SERVICE_PROMPT_PROJECTION`                          | `25%` | Aggregate curation-weight share of the provider-derived input capacity available to automatic prompt-body projection ({§prompt-projection}); alias-scoped overrides are supported. |
-| `PLURNK_SERVICE_LINE_ANCHOR_CONTEXT_LINES`                  | `2` | Complete neighboring lines hashed on each side of a model-facing line anchor ({§line-anchors}). |
-| `PLURNK_SERVICE_EDIT_RECEIPT_CONTEXT_LINES`                 | `2` | Surrounding and landed lines shown at each EDIT result boundary ({§edit-result-receipt-projection}). |
-| `PLURNK_SERVICE_MIN_CYCLES`                                 | `3` | Min repetitions before cycle detection fires ({§engine-rails}). |
-| `PLURNK_SERVICE_MAX_CYCLE_PERIOD`                           | `4` | Max period length cycle detection examines ({§engine-rails}). |
-| `PLURNK_SERVICE_REQUIEM_MAX_TOKENS`                         | `16384` | Initial forensic witness output allowance ({§digest-requiem}). |
-| `PLURNK_SERVICE_REQUIEM_RETRY_MAX_TOKENS`                   | `32768` | Retry allowance; must be at least the initial requiem allowance ({§digest-requiem}). |
-| `PLURNK_SERVICE_FILES_ITEMS`                                | `-1` | Turn-0 catalog preview. Folder-capable schemes render a one-level `*` map with `dir/**` rollups; kernel docs remain recursive and explicitly complete. `-1` = markerless first pages; positive `N` explicitly caps only file-map rows; `0` / unset = off ({§actor-boundary-catalog-preview}). |
-| `PLURNK_SERVICE_MEMBERS_MODEL_SCOPE`                       | `namespace` | Ceiling for a model's `members` definitions in the lattice `none < root < namespace`; `none` refuses every model definition ({§members-model-scope}). |
-| `PLURNK_SERVICE_EXEC_CONCURRENCY`                          | `12` | Executions admitted at once per workspace; the rest queue FIFO with `202 queued` receipts; `-1` unbounded ({§exec-concurrency}). |
-| `PLURNK_SERVICE_PROPOSAL_TIMEOUT_MS`                        | (empty — waits indefinitely) | Finite positive milliseconds before cancellation with outcome `timeout`; empty waits, and every other explicit value fails ({§proposal-timeout-cancels}). |
-| §operator-config-worker-warm `PLURNK_SERVICE_WORKSPACE_WARM_MS` | `900000` | Milliseconds a lease-free workspace Functionality snapshot remains warm; `0` cools without grace and `-1` disables time-based cooling ({§module-workspace-residency}). |
-| `PLURNK_SERVICE_WORKSPACE_WARM_MAX`                            | `2` | Maximum lease-free workspace Functionality snapshots retained process-wide; `0` retains none and `-1` disables the idle-LRU bound ({§module-workspace-residency}). |
+Each knob's value lives on its panel and nowhere else (`plurnk-service config defaults` prints them all); this table says what the service's knobs mean.
+
+| Var | Purpose |
+|---|---|
+| `PLURNK_SERVICE_DB_PATH` | SQLite file path; an explicit non-empty value overrides the derived default. |
+| §operator-config-shared-keys `PLURNK_HOST`, `PLURNK_PORT` | The listener's bind address and TCP port — THE client surface, the AG-UI+ listener the plurnk-agui module binds at boot; production is single-listener. **A key the daemon and its clients both read has a shared owner**: `@plurnk/plurnk-contracts` declares these two and the optional `PLURNK_AGUI_URL` on its own panel, the one package every side depends on. The daemon folds it like any installed member's, a client folds it beneath its own, and so neither holds the other's default. The service's `--host` and `--port` flags are generated from that panel. |
+| §operator-config-git-ceiling `PLURNK_SERVICE_GIT_ALLOWED` | Hard service ceiling: only `1` admits Git membership and status; every other value denies them. |
+| §operator-config-file-create-scope `PLURNK_SERVICE_FILE_CREATE_SCOPE` | Hard file-creation ceiling: `none < root < namespace`. `none` denies new filesystem files, `root` admits only paths inside `project_root`, and `namespace` also admits canonical outside-root paths. Existing-member writes are unaffected. |
+| `PLURNK_SERVICE_FILE_MATERIALIZE_MAX_BYTES` | Byte ceiling in `1..104857600` for one workspace-file snapshot ({§membership-materialization-limit}). |
+| `PLURNK_SERVICE_MAX_TURNS` | Operator inference-turn **ceiling** — `-1` = no cap; a positive value clamps `runLoop({maxTurns})`. The effective value is persisted on the durable loop and counts completed model/inference turns cumulatively across every `202` park/resume; `_plurnk`, client, and plugin turns remain chronology but consume none of this allowance. |
+| `PLURNK_SERVICE_MAX_COMMANDS` | Per-emission action ceiling; `-1` = no cap (default) — every generated op dispatches. A positive value caps dispatched actions: overflow ops drop with one durable `max-commands-exceeded` error row on the next packet. The final disposition always dispatch. Tightened per workspace via `settings.maxCommands` (min wins). |
+| §operator-config-loop-timeout `PLURNK_SERVICE_LOOP_TIMEOUT` | Positive ms of cumulative active execution per loop ({§loop-execution-allowance}); excludes parked/queued time. Snapshotted on first execution, retained across wakes. Exhaustion aborts in-flight work and terminates `504 loop_timeout`, including a stuck provider call. |
+| `PLURNK_SERVICE_PROVIDER_RECOVERY` | ms a turn keeps re-issuing its provider call after a recoverable provider failure before the loop parks ({§provider-recovery}); `0` parks at once. |
+| `PLURNK_SERVICE_PROVIDER_RECOVERY_BACKOFF` | First recovery delay (ms); doubles per failure up to `PLURNK_SERVICE_PROVIDER_RECOVERY_BACKOFF_MAX` ({§provider-recovery}). |
+| `PLURNK_SERVICE_MAX_STRIKES` | Consecutive turn-contract strike threshold ({§engine-rails}). |
+| `PLURNK_SERVICE_EMISSION_ATTEMPTS` | Completed provider responses allowed beneath one engine turn before frame admission is exhausted. Bounded interior operation errors are admitted without spending this budget. Exhaustion contributes one frame-contract strike under {§invalid-emission-attempts}. |
+| `PLURNK_SERVICE_PREVIEW_LINES` | First page of every markerless retrieval, in the projection's own units, and the head bound of an automatic preview ({§markerless-first-page}, {§body-projection}). |
+| `PLURNK_SERVICE_PREVIEW_CHARS` | Independent Unicode code-point bound on the same previews, with CRLF treated as one indivisible separator ({§body-projection}). |
+| `PLURNK_SERVICE_PROMPT_PROJECTION` | Aggregate curation-weight share of the provider-derived input capacity available to the automatic projection of arrivals from outside the workspace ({§message-projection}); alias-scoped overrides are supported. |
+| `PLURNK_SERVICE_LINE_ANCHOR_CONTEXT_LINES` | Complete neighboring lines hashed on each side of a model-facing line anchor ({§line-anchors}). |
+| `PLURNK_SERVICE_EDIT_RECEIPT_CONTEXT_LINES` | Surrounding and landed lines shown at each EDIT result boundary ({§edit-result-receipt-projection}). |
+| `PLURNK_SERVICE_MIN_CYCLES` | Min repetitions before cycle detection fires ({§engine-rails}). |
+| `PLURNK_SERVICE_MAX_CYCLE_PERIOD` | Max period length cycle detection examines ({§engine-rails}). |
+| `PLURNK_SERVICE_REQUIEM_MAX_TOKENS` | Initial forensic witness output allowance ({§digest-requiem}). |
+| `PLURNK_SERVICE_REQUIEM_RETRY_MAX_TOKENS` | Retry allowance; must be at least the initial requiem allowance ({§digest-requiem}). |
+| `PLURNK_SERVICE_FILES_ITEMS` | Turn-0 catalog preview. Folder-capable schemes render a one-level `*` map with `dir/**` rollups; kernel docs remain recursive and explicitly complete. `-1` = markerless first pages; positive `N` explicitly caps only file-map rows; `0` / unset = off ({§actor-boundary-catalog-preview}). |
+| `PLURNK_SERVICE_MEMBERS_MODEL_SCOPE` | Ceiling for a model's `members` definitions in the lattice `none < root < namespace`; `none` refuses every model definition ({§members-model-scope}). |
+| `PLURNK_SERVICE_EXEC_CONCURRENCY` | Executions admitted at once per workspace; the rest queue FIFO with `202 queued` receipts; `-1` unbounded ({§exec-concurrency}). |
+| `PLURNK_SERVICE_PROPOSAL_TIMEOUT_MS` | Finite positive milliseconds before cancellation with outcome `timeout`; empty waits, and every other explicit value fails ({§proposal-timeout-cancels}). |
+| §operator-config-worker-warm `PLURNK_SERVICE_WORKSPACE_WARM_MS` | Milliseconds a lease-free workspace Functionality snapshot remains warm; `0` cools without grace and `-1` disables time-based cooling ({§module-workspace-residency}). |
+| `PLURNK_SERVICE_WORKSPACE_WARM_MAX` | Maximum lease-free workspace Functionality snapshots retained process-wide; `0` retains none and `-1` disables the idle-LRU bound ({§module-workspace-residency}). |
 
 Every core knob listed is enforced at its owning read site; `.env.defaults` is the authoritative default ({§operator-config-env-defaults}). Provider, scheme, executor, mimetype, and client-interface knobs are documented by their owning packages and appear in the assembled catalog.
 
@@ -3449,11 +3584,11 @@ template both ways: every `PLURNK_SERVICE_*` the service reads has a
 declared `PLURNK_SERVICE_*` is read. A half-landed rename therefore fails a test
 instead of a user's boot, and a dead knob cannot ship.
 
-§operator-config-real-model-profile **Real-model gate profile.** `plurnk-core/.env.test` is committed source and is the single shared profile for live, demo, and the candidate daemon used by benchlets. Live/demo load it after operator files; the candidate daemon loads it below its inherited environment. Direct shell/benchmark overrides win in both paths. Its exact allowlist is limited to the safe default model plus gate-wide service posture: a local model, complete catalog orientation, automatic Git membership when the operator ceiling permits Git, ambient operator-file docs/packet notes cleared, and `PLURNK_EXECS_QUESTION=0` for unattended runs. The ordinary executor switch removes the question tool and its teaching; an explicit override can opt into an attended drill. Configuration with a narrower or variable owner stays outside it:
+§operator-config-real-model-profile **Real-model gate profile.** `plurnk-core/.env.test` is committed source and is the single shared profile for live, demo, and the candidate daemon used by benchlets. Live/demo load it after operator files; the candidate daemon loads it below its inherited environment. Direct shell/benchmark overrides win in both paths. Its exact allowlist is limited to gate-wide service posture that is identical on every machine: complete catalog orientation, automatic Git membership when the operator ceiling permits Git, ambient operator-file docs/packet notes cleared, ambient MCP selections and schedules disabled, and `PLURNK_EXECS_QUESTION=0` for unattended runs. The ordinary executor switch removes the question tool and its teaching; an explicit override can opt into an attended drill. Configuration with a narrower or variable owner stays outside it:
 
 | Owner | Configuration |
 |---|---|
-| `.env.test` | Safe default model selection and universal real-model gate posture, with no alias declarations, routes, secrets, model tuning, or cost/sandbox ceilings. |
+| `.env.test` | Universal real-model gate posture, with no model selection, alias declarations, routes, secrets, model tuning, or cost/sandbox ceilings. |
 | Live/demo scripts | The repository policy path and runner topology. |
 | Benchlets | Their snapshotted policy, workspace restrictions, and task-specific exceptions; direct env wins over the profile. |
 | Operator env/shell | Model alias declarations and explicit selection overrides, provider capability such as GBNF, endpoints, credentials, tuning, and deliberate ceiling overrides. |
@@ -3631,9 +3766,22 @@ flowchart LR
 | §module-action-registration `registerModuleAction({ name, scope, inputSchema, outputSchema, handler })` | Adds one non-empty, extension-unique action with resolvable JSON Schemas. `scope` is exactly `worldless`, `workspace`, or `worker`; the handler receives schema-validated params and a separate matching context. Scoped contexts contain trusted bound identifiers, never client parameters. A client-interface module decides whether and how the name becomes public, validates successful output, and owns collisions with its built-ins. |
 | §module-workspace-provider `registerWorkspaceCapabilityProvider(namespaceOwner, provider)` | Registers one extension-unique Functionality provider. `activate({ workspaceId, retain })` reconstructs the workspace snapshot; idempotent `deactivate({ workspaceId })` releases process resources. Core coalesces demand and supplies residency leases for work that outlives its caller. |
 | §module-workspace-state `readWorkspaceModuleState(workspaceId, namespaceOwner)` | Reads one nullable JSON state value per workspace and provider. Core owns storage and lifecycle; the provider owns its schema. Store symbolic credential references, not copied secrets. A worker-scoped family's coordinator reads and replaces the same shape per worker in `worker_module_state` ({§functionality-scope}). |
+| `readWorkspaceEnvironment(workspaceId)` | Captures the workspace env layer ({§workspace-env}) and returns its composer. No argument uses admitted host values; a supplied environment supplies a module's reference-resolution context. Both apply the same captured values and masks, without worker overrides. |
+| §module-workspace-directory `workspaceStateDirectory(workspaceId, namespaceOwner)` | Returns and creates the module's absolute operational-state directory under the daemon's XDG state home. Core owns path resolution and a stable random workspace storage key in its own `workspace_module_state` row. The key survives workspace renames and daemon restarts; independently created workspaces, including in other databases, receive different keys. The module owns its contents and child-directory lifetimes. |
 | §module-functionality-adapter `registerFunctionalityAdapter(adapter)` | Registers one family beneath the shared coordinator ({§functionality-coordinator}). |
 | §module-workspace-capabilities `replaceWorkspaceCapabilities({ workspaceId, namespaceOwner, state, runtimes })` | Atomically replaces one provider's durable state and runtime/scheme snapshot at the workspace operation boundary. Namespace claims are validated before mutation. Failure restores the prior state and publication. |
 
+Module directory allocation is lazy, atomic in SQLite, and independent of the
+project root, daemon CWD, and workspace/worker environment overrides. New
+directories use mode `0700`; existing permissions are not rewritten. Module
+names occupy a single encoded path component. Missing workspaces, invalid
+stored keys, and filesystem failures are errors, never a fallback to CWD.
+Allocated state is not erased on cooling, disable, removal, or shutdown: its
+contents may be persistent or referenced by retained results. Deleting a
+workspace forgets its storage key through the existing foreign key; old disk
+state is not reassigned or automatically purged. A database copy preserves its
+storage identities; the directory is operational state, not a backup of it.
+
 §workspace-environment-sharing **The workspace owns its shared environment.**
 Workers own their logs; delegation retains its existing lifecycle.
 Creating, attaching, forking, cancelling, or deleting a worker does not create,
@@ -3692,7 +3840,7 @@ The version-1 baseline table `workspace_module_state` stores one JSON value
 per `(workspace_id, namespace_owner)`. It is configuration, not an executable
 registry. Deleting the workspace cascades its state; worker lifecycle does not.
 
-## §functionality Workspace Functionality
+## Workspace Functionality
 
 §functionality-coordinator **One coordinator owns the common lifecycle.**
 Agent Skills, MCP, outbound A2A agents, and membership are adapters beneath
@@ -3727,14 +3875,27 @@ failure aborts; cooling tears down. Protocol continuations remain ordinary
 module actions. Optional `forget` releases an installed or provisioned
 definition before removal; failure rejects removal ({§skills-remove}).
 
-§env-functionality **Environment is the fourth family, owned per Worker.** Its two origins
-are the ambient names the operator's ceiling admits ({§exec-env-scoped}, service origin, enabled
-until a Worker disables one for itself) and the Worker's own entries (worker origin). `add` takes
+An adapter may expose a `scheme` facet beneath its family's runtime namespace
+({§runtime-resource-binding}). A facet claims a path subtree and is the scheme's
+whole live half there: READ and FIND preparation, FIND, SEND, WAIT and KILL are
+its own wherever it implements them. A claimed KILL the facet does not implement
+is the ordinary entry KILL ({§stream-control}); an unclaimed coordinate keeps the
+stored-execution behaviour, SEND to a process included. Where its resources are
+not shaped like the executor's output, the facet states their representation —
+resource authority, channels, the default channel — and that manifest governs
+every claimed coordinate: its address, its fragmentless READ, the channel a
+subscription publishes. An adapter states the `traits` of its runtime — `web`
+for a family that reaches the network — so {§capability-admission} selects its
+manager and its resources alike.
+
+§env-functionality **Environment is a scoped family.** Ambient names admitted by the
+operator's ceiling ({§exec-env-scoped}, service origin) precede workspace defaults and
+worker overrides ({§workspace-env}). `add` takes
 the name as the alias and `{ "value": "…" }` as the definition, used verbatim with no
-interpolation. `disable` withdraws a name from the Worker's spawns while retaining it, which is
-how `CI=1` goes away for one Worker without an operator change; `remove` forgets a Worker's own
-entry and a same-name service baseline reappears disabled, so removal never silently changes what
-the next spawn sees. Service definitions are disable-only.
+interpolation. `disable` withholds a name in the selected scope while retaining it;
+`remove` forgets a locally-owned entry and a same-name lower baseline reappears
+disabled, so removal never silently changes what the next spawn sees. Definitions
+from a lower layer are disable-only in the current scope.
 
 `list` projects effective values with their origin. Values are shown: the ceiling is the security
 boundary, not the projection, and any admitted name is already readable by every command the
@@ -3755,23 +3916,24 @@ name with its documentation and an empty value ({§exec-env-scoped}: referred to
 read). `configuration` is refused: a client's own environment contributing candidates would be a
 second door past the ceiling.
 
-The family publishes no runtimes. An environment is read at the spawn that uses it, never held
-resident, so it never enters the warmed capability snapshot ({§module-workspace-residency}).
+The family publishes no process runtimes. Its values are read at the spawn that uses them,
+not from a live process or a cached worker environment.
 
-§functionality-scope **A family declares who owns its definitions.** Skills, MCP, members
+§functionality-scope **A family declares its supported scopes.** Skills, MCP, members
 and outbound A2A describe what exists in a **workspace**: a capability, resident or installable,
 that every Worker there shares. Environment describes how one **Worker** works — context rather
-than capability — so its definitions are owned per Worker. The adapter declares `scope`
-(absent means workspace) and the coordinator keys durable state and the locally-owned `origin`
+than capability — with worker overrides above workspace defaults. The adapter declares
+`scopes` (absent means `["workspace"]`; the first is the model default), and the
+coordinator keys durable state and the locally-owned `origin`
 by it: a workspace-scoped family's own entries carry origin `workspace`, a worker-scoped
 family's carry `worker`. Origin names ownership, never scope, so a projection never claims the
 workspace set a value one Worker set for itself. Nothing else in the contract varies: the six
 verbs, the two projections, enabledness, and the service-baseline rules are one implementation
 across every family, which is what keeps their idioms from drifting apart.
 
-A worker-scoped family projects `worker.<family>.<verb>` in place of
-`workspace.<family>.<verb>`; the action's context names the Worker, as every execution
-does. Its durable value is the same shape per (worker, family) in `worker_module_state`, read
+A family projects `<scope>.<family>.<verb>` for each supported scope. The action's
+context binds that scope; a worker-scoped action also names the Worker. Its durable
+value is the same shape per (worker, family) in `worker_module_state`, read
 at each verb and at each spawn rather than held in the workspace snapshot. Its `list` and
 mutations serialize on the Worker's own lane and take no workspace exclusivity: nothing
 resident changes, and the next spawn reads the state, so a Worker shapes its own environment
@@ -3791,8 +3953,8 @@ option lands as the child's own entries through `add`, after the copy ({§env-op
 is stored under the provider namespace in `workspace_module_state`; a
 worker-scoped family ({§functionality-scope}) stores the same value per worker
 and family in `worker_module_state`.
-A `service` entry persists enabledness; a `workspace` or `worker` entry persists
-its exact definition. Active, unavailable, and authorization-required are preparation
+A locally-owned entry persists its exact definition; a lower-layer entry persists
+only enabledness, never a copied value. Active, unavailable, and authorization-required are preparation
 outcomes, not durable desired state. The configuration cascade contributes
 defaults; one workspace snapshot is effective authority.
 
@@ -3829,6 +3991,10 @@ binds that Worker to the manager at the operation, so the published manager
 stays one per workspace and the executor framework's arguments carry no
 identity ({§functionality-scope}).
 
+Expected adapter failures retain their exact status and Problem in both client
+actions and the model operation's stream/result ({§problem-error-carrier}). An
+unexpected exception remains an executor fault, not a managed refusal.
+
 §functionality-document-body **A family's teaching is an authored file beneath
 its generated header.** The adapter names its package directory (`docsDir`);
 that package's `docs/<family>.md` is read once, by the same rule runtimes use
@@ -3871,7 +4037,7 @@ Core's behavior behind them.
 | §methods-loop-cancel Loops                        | `cancelDrain(workerId, reason?)`; `cancelWorker({ workspaceId, workerId, reason? })` | `cancelDrain` begins durable structured cancellation and reports whether process-local work existed when called; queued or parked durable work is still terminalized when it is `false`. The ownership-bounded `cancelWorker` awaits that same tree cancellation and stream reap, so an exterior protocol can project the settled durable result without polling or fabricating state. |
 | §methods-op-mirror Client dispatch                | `dispatchClientAction({ workspaceId, workerId, statements })` | Dispatches already-parsed grammar statements as one client action in one administrative loop in the client worker, executing in the workspace's Functionality ({§actor-boundary-attached-functionality}). Every statement is an ordered client/operation turn, and every committed `log/entry` is emitted before the action promise resolves; a proposal may keep its turn, loop, and action promise open until resolution. Core exposes no per-op method family. |
 | Client observation                                | `look({ workspaceId, workerId, statement, perspectiveWorkerId? })` | Runs an already-parsed READ through the full resolver in the workspace's Functionality without a log row. A non-READ statement is rejected ({§op-look}). |
-| §methods-log-read Reads                           | `readLog({ workspaceId, workerId, ...coordinate })` | Ownership-checks the worker, then reads by ids, recency, or the complete `loopSeq`/`turnSeq`/`sequence` display coordinate. `limit` defaults to 100 and is capped at 1000. |
+| §methods-log-read Reads                           | `readLog({ workspaceId, workerId, ...coordinate })` | Ownership-checks the worker, then reads by ids, recency, or the complete `loopSeq`/`turnSeq`/`sequence` display coordinate. An omitted `limit` is `PLURNK_SERVICE_LOG_READ_PAGE`, and any `limit` is capped at `PLURNK_SERVICE_LOG_READ_MAX`. |
 | §methods-entry-read Reads                         | `readEntry({ workspaceId, workerId, target, channel?, offset? })` | Resolves the selector from that worker's perspective and returns {§entry-read-result}, either complete or as one channel suffix, without creating action evidence. |
 | Providers                                         | `listProviders()` | Lists configured aliases with provider/model identity, active state, and the effective provider-derived `inputCapacity` when known. |
 | Model catalog                                     | `listModels(query)` | Returns one validated bounded {§model-catalog-wire} page under {§model-catalog}; performs no provider request or selection. |
@@ -3882,10 +4048,10 @@ Core's behavior behind them.
 | §methods-conversation-worker Workspace lifecycle  | `createConversationWorker({ workspaceId, name? })` | Creates a distinct model-origin root worker with empty history: a fresh conversation over the same world, not a fork or the stable default. |
 | Workspace lifecycle                               | `forkWorker({ workspaceId, workerId, name? })` | Creates a child worker that branches the source worker's history while sharing workspace state. |
 | §methods-workspace-rename Workspace metadata      | `renameWorkspace(workspaceId, name)` | Changes only the world's unique mutable name; workers, log, and membership remain intact. |
-| §methods-workspace-prompts Workspace metadata     | `listPrompts(workspaceId, limit?)` | Returns nonempty loop-seed prompts from the workspace's model-origin root conversations, newest-first. The positive limit defaults to 100; spawned and forked child prompts are excluded. |
+| §methods-workspace-prompts Workspace metadata     | `listPrompts(workspaceId, limit?)` | Returns nonempty loop-seed prompts from the workspace's model-origin root conversations, newest-first. An omitted limit is `PLURNK_SERVICE_PROMPTS_PAGE`; spawned and forked child prompts are excluded. |
 | Workspace metadata                                | `listWorkspaces()`, `workspaceDerivationStatus(...)` | Reads current workspace identity and derivation progress. |
 | §methods-worker-read Worker topology              | `readWorker({ workspaceId, identity })` | Ownership-bounds an exact id-or-name lookup and returns one durable Worker projection or `null` under {§application-worker-observation}. Supplying both identities or neither is invalid. |
-| §methods-worker-list Worker topology              | `listWorkers(workspaceId, query?)` | Returns the workspace's durable Worker projections under {§application-worker-observation}. The origin filter is exact; an explicitly present `parentWorkerId` filters roots (`null`) or one immediate parent (id), while omission returns every lineage position. Each projection carries `kind` (`conversation`, `fork` for a child with a fork boundary, `work` for any other child) and `lifecycle`, the latest work loop's status through {§loop-lifecycle-vocabulary} (`idle` with no work loop), so a directory row shows the same lifecycle glyph the bound worker's own status gauge shows; clients infer neither (#523). |
+| §methods-worker-list Worker topology              | `listWorkers(workspaceId, query?)` | Returns the workspace's durable Worker projections under {§application-worker-observation}. The origin filter is exact; an explicitly present `parentWorkerId` filters roots (`null`) or one immediate parent (id), while omission returns every lineage position. Each projection carries `kind` (`conversation`, `fork` for a child with a fork boundary, `work` for any other child) and `lifecycle`, the representative work loop's status through {§loop-lifecycle-vocabulary} (`idle` with no work loop), so a directory row shows the same lifecycle glyph the bound worker's own status gauge shows; clients infer neither (#523). |
 | §methods-worker-loops Loop lifecycle              | `listWorkerLoops({ workspaceId, workerId })` | Ownership-checks the Worker and returns its Loops in sequence order under {§application-loop-observation}, including the validated exact terminal result when one exists. It performs no scheduling or event replay. |
 | Extension actions | `listModuleActions()`, `invokeModuleAction(name, params, context)` | Lists setup-registered `{ name, scope, inputSchema, outputSchema }` descriptors in sorted order. Invocation requires a context matching the registered scope; missing names, forged scope, and missing workspace identity fail before the owner runs. Handler values remain opaque to core. |
 
@@ -3898,26 +4064,26 @@ already durable on the loop remains authoritative:
 |-----------------------|------------------------------------------------------|--------------------------------|--------------------------------------|
 | Provider/model        | The resolved request selection must still agree.     | Fold.                          | 409 provider conflict.               |
 | `maxTurns`            | Keep the durable ceiling.                            | Fold.                          | 409 turn-ceiling conflict.           |
-| Partial `policy`      | Keep the complete durable loop policy.               | Fold.                          | 409 policy conflict.                 |
+| `policy` request      | Keep the complete durable loop policy.               | Fold.                          | 409 policy conflict.                 |
 
 The conflict names both selections and directs the caller to cancel or conclude
 the loop before changing configuration. A newly enqueued loop instead persists
 the requested configuration normally.
 
 §methods-loop-run-open-paths **Workspace paths are core-owned context reads.**
-`openPaths` belongs to the prompt frame submitted by the client. The client
+`openPaths` belongs to the message submitted by the client. The client
 sends paths, never duplicated file bytes; core dispatches one ordinary
 `plurnk`-origin READ per path from inside the owning workspace, and successes
 and failures surface through the normal operation-result contract.
 
-| `runLoop` disposition | Prompt-frame and path behavior                                                                    |
-|-----------------------|---------------------------------------------------------------------------------------------------|
-| New loop              | Persist with the initial frame; publish the frame and READ its paths on turn 1.                    |
-| Active loop           | Persist with the injected frame; publish the frame and READ its paths together on the next turn.  |
-| Parked loop           | Persist with the waking frame; publish the frame and READ its paths together on the resumed turn. |
+| `runLoop` disposition | Message and path behavior                                                                            |
+|-----------------------|------------------------------------------------------------------------------------------------------|
+| New loop              | Persist with the initial message; publish it and READ its paths on turn 1.                          |
+| Active loop           | Persist with the injected message; publish it and READ its paths together on the next turn.        |
+| Parked loop           | Persist with the waking message; publish it and READ its paths together on the resumed turn.       |
 
-If an undelivered frame is promoted into subsequent work under
-{§prompt-loop-containment}, its selected paths travel with it.
+If an unpublished message is promoted into subsequent work under
+{§message-loop-containment}, its selected paths travel with it.
 
 §methods-rebind **Binding belongs to the client-interface module.** Core's
 workspace lifecycle calls return exactly the workspace and selected client actor
@@ -3945,7 +4111,7 @@ mutation of its source; a resource-backed execution demands its runtime plus sou
 observation. Unknown schemes, runtimes,
 and tools continue to their ordinary resolver so capability policy cannot turn
 absence into a misleading restriction. The same resolver shapes generated
-scheme references, worker tool documents, and Turn0 surveys. TASK inventory, log KILL,
+scheme references, worker tool documents, and Turn0 surveys. NOTE, lifecycle declarations, log KILL,
 and label or targetless SEND are log/program control rather than routed
 external demands and therefore remain outside capability selectors.
 Runtime mutations of owned generated entries ({§worker-generated-subtree})
@@ -4105,9 +4271,8 @@ beside database ids, so a client can render and resolve the logical `L/T/S`
 coordinate without fetching all rows and matching locally.
 
 §methods-log-entry-wire **Log entry wire fidelity.** `readLog` and `log/entry`
-preserve causal `source` and parse the row's JSON `attrs` into structured data;
-they also project the row's complete sorted `tags` classification. Client
-interfaces do not reconstruct these fields from operation or origin.
+preserve causal `source` and parse the row's JSON `attrs` into structured data.
+Client interfaces do not reconstruct these fields from operation or origin.
 
 §methods-readable-reasoning **Readable provider reasoning remains derived
 provider evidence.** On model SEND and disposition rows, `readLog` and `log/entry`
@@ -4122,8 +4287,8 @@ hands the AST to core's `look`; core owns the full resolver and the no-log
 invariant. The internal closed, rowless observation segment supplies an honest
 numeric loop coordinate for relative `log:///` addressing without leaving
 active lifecycle behind. The segment belongs to the acting worker (`workerId`);
-the READ resolves as `perspectiveWorkerId` when one is given — `log:///`, `reasoning:///`,
-and `ops:///` as that worker sees them — so a client can look at a conversation without
+the READ resolves `log:///` as `perspectiveWorkerId` when one is given; explicit source
+authorities retain their identity under {§turn-source-resources}. A client can look at a conversation without
 adding a loop to it. LOOK text anchors resolve through the same
 {§line-anchors} path as READ.
 
@@ -4175,13 +4340,6 @@ defining the public client lifecycle. Multiple client actors have distinct worke
 only the model worker's private log; client action rows are structurally absent
 without an origin filter ({§actor-boundary-isolation}).
 
-### §versioning Versioning
-
-The typed module seam is released with the service package. Core exposes no
-runtime version or update-advertising action. External protocol compatibility
-and any protocol-level version negotiation belong to the client-interface
-module that publishes that protocol.
-
 ---
 
 ## §packet-assembly Packet assembly
@@ -4214,7 +4372,7 @@ Conditional absence never reorders the surviving default sections.
 |     8 | user   | `notices`             | Per-turn observations; empty content is omitted. |
 |     9 | user   | `git`                 | Per-turn workspace status; empty content is omitted. |
 |    10 | user   | `budget`              | `Context Curation`; omitted when capacity is unknown. |
-|    11 | user   | `prompt`              | Current prompt-entry pointers. |
+|    11 | user   | `messages`            | `Open Messages`: immutable message addresses and causal sources ({§message-arrival}). |
 |    12 | user   | `recap`               | Optional authored operational recap. |
 
 The order favors prefix-cache locality where semantics permit: the definition
@@ -4238,7 +4396,7 @@ sections. It receives no separate engine, database, actor, or request context.
 
 This is strictly a trusted in-process seam, admitted through the common plugin
 trust gate; an external client action cannot invoke it. Whole-list transformation is
-the fork-avoidance valve for alternate packet shapes ({§ecosystem}), while
+the fork-avoidance valve for alternate packet shapes, while
 overflow recovery and packet projection remain closed engine concerns.
 
 ### §tokenomics Tokenomics: four facts, one curation ruler
@@ -4274,9 +4432,9 @@ time of measurement.
 - **Derivation is exhaustive and demand-led.** Explicit searchable-resource changes may start one coalesced warm. Passive creation and attachment do not. The first model turn starts or joins that warm; later turns derive intervening changes before dispatch. No model operation observes partial graph or full-text coverage. Progress notices make the wait visible. {§derivation-exhaustive}
 - §membership-binary-sniff **Binary truth beats a text label.** Filesystem source acquisition, including tracked members and installed skill resources, inspects up to the first 8192 bytes when extension detection does not identify a binary type. NUL marks `application/octet-stream`; existing binary types retain their declared type. Member projections follow {§membership-source-projection}; installed skill projections follow {§skills-resources}.
 - §tokenomics-agnostic-ruler **One model-agnostic curation ruler.** The daemon runs workers on different models in one workspace concurrently, while catalog and log accounting are workspace-wide. `contentWeight = ceil(chars/2)` therefore gives one content one stable number without per-model workspace state or recount passes. It controls curation only; every provider call independently measures the complete request as well as it can.
-- §tokenomics-neutral-telemetry **Curation telemetry is state, not response allowance.** The model-facing `Context Curation` section is one JSON object carrying `logTokensTotal` and `logTokensMax` (and `tokensResponseMax` when an output floor is disclosed), so the block opens as a JSON payload like ```` ```TASK ````. It never presents their difference as free response tokens. The protocol definition directly requires KILL of irrelevant log items and ranges to keep the next packet within the maximum. Per-entry weights remain on log rows where they describe visible cost and curation savings. Generic packet composition and physical-token speculation are absent.
-- §tokenomics-pressure-inventory **Pressure identifies its reclaimable concentration.** At 80% of `logTokensMax`, a Markdown `> [!WARNING]` block follows the JSON with `> YOU MUST KILL superseded, stale, or irrelevant log items and ranges.` New output withholding replaces that mandate under {§context-output-warning}. The JSON may include `logTokensLargest`: at most five retained log items, each `{path, logTokens}`, ranked by that charge descending and then path. Native-only, suppressed, and metadata-only items remain eligible: whole-item KILL can reclaim their actual contribution. Include the largest prefix that fits; drop the optional list before the warning. Both participate in the final fixed-point total and complete request admission check.
-- §tokenomics-content-hash-identity **Content identity, not per-tokenizer counts.** Static channel writes stamp `content_hash` (SHA-256) as stable content identity. `weight` is stored beside that content and is never keyed or recomputed by model.
+- §tokenomics-neutral-telemetry **Curation telemetry is state, not response allowance.** The model-facing `Context Curation` section is one JSON object carrying `logTokensTotal` and `logTokensMax` (and `tokensResponseMax` when an output floor is disclosed). It never presents their difference as free response tokens. The protocol definition directly requires KILL of irrelevant log items and ranges to keep the next packet within the maximum. Per-entry weights remain on log rows where they describe visible cost and curation savings. Generic packet composition and physical-token speculation are absent.
+- §tokenomics-pressure-inventory **Pressure identifies its reclaimable concentration.** At `PLURNK_SERVICE_BUDGET_PRESSURE` of `logTokensMax`, a Markdown `> [!WARNING]` block follows the JSON with `> YOU MUST KILL superseded, stale, or irrelevant log items and ranges.` New output withholding replaces that mandate under {§context-output-warning}. The JSON may include `logTokensLargest`: at most `PLURNK_SERVICE_BUDGET_LARGEST_ITEMS` retained log items, each `{path, logTokens}`, ranked by that charge descending and then path. Native-only, suppressed, and metadata-only items remain eligible: whole-item KILL can reclaim their actual contribution. Include the largest prefix that fits; drop the optional list before the warning. Both participate in the final fixed-point total and complete request admission check.
+- §tokenomics-content-hash-identity **Content identity, not per-tokenizer counts.** A settled channel's `content_hash` (SHA-256) is its body's identity in the content store ({§content-store}); a writer may bind it, a bound hash must match the content, and an active stream has none until it settles. `weight` is stored beside that content and is never keyed or recomputed by model.
 - §tokenomics-provider-usage **Provider accounting is physical-request evidence, not curation state.** Every issued physical request has one durable pre-I/O `provider_requests` identity beneath the normalized {§inference-ledger} and settles once as response or error. Each record preserves conventional {§provider-usage} quantities and required {§provider-cost} evidence; an unreported quantity remains absent, including on response-less failures, and is never replaced by zero. `model_calls` own response/failure evidence, `turn_attempts` specialize emission admission, and `provider_requests` are the sole durable accounting representation. Emissions, BARE calls, rejected responses, retries, failovers, and errors therefore remain cardinal and ordered. Turn, loop, worker, workspace, digest, and protocol accounting are derived from those records through the shared {§provider-accounting} projection; only emission calls contribute the latest-packet context gauge. The baseline stores no floating-point money, denormalized totals, or rollup triggers. A documented direct charge becomes `charged`; otherwise the provider may compute an exact-decimal USD `estimated` amount from complete usage and the exact model's Models.dev rates; insufficient evidence becomes `unknown`. Derived `costUsd` sums every USD-expressible request and is `null` only when no request is expressible; a response-less failure or an uncataloged model is skipped, never allowed to erase the expressible evidence. Each derived aggregate usage field independently sums its reported quantity, so heterogeneous detail coverage remains partial rather than becoming fictitiously complete. This is operational request accounting, not invoice reconciliation. Output and reasoning are quantities the model cannot KILL, so they never alter the model-facing Budget ledger.
 - §tokenomics-negative-pressure **Negative curation pressure is honest but never submitted.** The provisional readout may report `logTokensTotal` above `logTokensMax`. Crossing the maximum withholds new returned output under {§context-output-admission}; no over-ceiling packet reaches `provider.generate`. Output admission creates neither a strike nor another turn.
 
@@ -4284,7 +4442,7 @@ time of measurement.
 
 Operations and their results are execution history. Packet admission controls
 only whether newly presented returned output fits, never what executed or what
-the model's TASK inventory means.
+the model's lifecycle declaration means.
 
 ```mermaid
 flowchart TD
@@ -4302,7 +4460,7 @@ flowchart TD
     prompt -->|no| stop
 ```
 
-§context-output-selection **First presentation, not a turn-number heuristic, owns admission.** Canonical log-body resolution distinguishes authored input from returned output. Before provider I/O, the run boundary records the first admission turn of each newly visible returned body. On measured overflow, that batch's returned bodies and native parts are withheld together. Already-admitted output, authored TASK/program/message bodies, actual statuses and Problems, effects, child state, and immutable evidence remain unchanged. Bodyless and initially suppressed rows require no admission. Packet assembly is pure. No recovery turn, generated TASK, KILL operation, strike, or extra model attempt is manufactured.
+§context-output-selection **First presentation, not a turn-number heuristic, owns admission.** Canonical log-body resolution distinguishes authored input from returned output. Before provider I/O, the run boundary records the first admission turn of each newly visible returned body. On measured overflow, that batch's returned bodies and native parts are withheld together. Already-admitted output, authored NOTE/lifecycle/program/message bodies, actual statuses and Problems, effects, child state, and immutable evidence remain unchanged. Bodyless and initially suppressed rows require no admission. Packet assembly is pure. No recovery turn, generated lifecycle declaration, KILL operation, strike, or extra model attempt is manufactured.
 
 | Projection fact | Meaning |
 |---|---|
@@ -4314,11 +4472,25 @@ flowchart TD
 
 §context-output-warning **New omission escalates the one curation warning.** The admitting request renders `> [!WARNING]` followed by `> YOU MUST ONLY KILL superseded, stale, or irrelevant log content in bulk.` beneath its JSON readout, replacing the ordinary pressure mandate even when withholding brings usage below 80%. Historical omission alone does not retrigger it. The warning participates in exact packet measurement; optional largest-items entries yield space first.
 
-§context-output-hard-413 **Unfittable retained context fails honestly.** If the request still exceeds the ceiling after withholding newly presented output, it terminalizes with an exact `engine/context/token-budget-overflow` 413 Problem without provider I/O. No unrelated older history or authored inventory is pruned. Separately, provider capacity failures follow {§provider-surface-capacity}: withholding automatic prompt-body projection permits a retry only when it changes the request; otherwise the exact provider-owned 413 terminates the request-only model turn.
+§context-output-hard-413 **Unfittable retained context fails honestly.** If the request still exceeds the ceiling after withholding newly presented output, it terminalizes with an exact `engine/context/token-budget-overflow` 413 Problem without provider I/O. No unrelated older history or authored memory is pruned. Separately, provider capacity failures follow {§provider-surface-capacity}: withholding automatic prompt-body projection permits a retry only when it changes the request; otherwise the exact provider-owned 413 terminates the request-only model turn.
 
 - §tokenomics-fetch-fits-free **Withholding is not deletion.** The complete result lands once. READ/FIND of its original log address retain the readable body and original coordinates; scoped READ creates a fresh output occurrence subject to the same admission rule. Source resources and forensic evidence remain unchanged. Deliberate scoped KILL, unlike withholding, removes lines from subsequent readable projections ({§log-readable-projection}).
 
-- §loop-terminals **Engine-imposed terminals are HTTP-precise** — the loop-status vocabulary, one meaning each: `200` concluded (terminal inventory with at least one completed task) · `499` model-abandoned (a nonempty all-failed inventory, or a cancel) · `429` maxTurns exhausted · `413` token-ceiling recovery failure or provider input-capacity failure after changed-request recovery · `500` strike threshold or invalid-emission exhaustion (distinct Problem types; `508` when the crossing strike was a detected cycle) · `504` loop timeout / exec-timeout restamp · `202` waiting — a TASK inventory waiting on a live obligation or explicit deadline/poll ({§wait-obligation-matrix}, {§worker-wait-timing}); an empty untimed wait continues at `102`, never implicit success · `100`/`102` queued/running. Never a catch-all, never a new value without changing the owning schema.
+- §loop-terminals **Lifecycle outcomes are HTTP-precise.**
+
+  | Status | Outcome |
+  |---|---|
+  | 100 / 102 | Queued / running |
+  | 202 | WAIT or answered work joining a live obligation ({§wait-obligation-matrix}, {§worker-wait-timing}) |
+  | 200 | Messages answered, results observed, held work settled |
+  | 499 | Worker-scope or client cancellation |
+  | 429 | Turn allowance exhausted |
+  | 413 | Token-ceiling recovery failure or provider input-capacity failure after changed-request recovery |
+  | 500 / 508 | Strike threshold or invalid-emission exhaustion / crossing strike caused by a cycle |
+  | 504 | Loop timeout or exec-timeout restamp |
+
+  An empty WAIT continues at 102. The exact terminal result retains its Problem;
+  status classes are not catch-all replacements for that evidence.
 
 ### §env-delta The environment delta: what changed since the model last looked
 
@@ -4356,7 +4528,10 @@ pre-existing broadcast history stays out while later occurrences remain
 deliverable even before its first packet. A fork instead copies the parent's
 cursor and captures its own fork high-water atomically with worker creation
 ({§machine-processes-fork-pending-activity}). Observer rows retain the source
-identity and never publish another occurrence.
+identity and never publish another occurrence. Newly materialized ambient and
+terminal-stream rows emit the ordinary client notification
+({§notifications-log-entry-notify}) before the next inference; an idempotent
+pull does not emit an existing row again.
 
 §env-delta-worker-entry-visibility **The commons is global; every other
 resource follows lineage.** A successful state-changing `EDIT`, `COPY`, `MOVE`,
@@ -4368,8 +4543,8 @@ ordinary operation evidence still reaches that child's direct parent.
 
 | Producer / event                                      | Durable occurrence                                                                                     | Observer projection                                                                                                                |
 | ----------------------------------------------------- | ------------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------- |
-| §env-delta-child-activity Direct-child activity       | Every final op-bearing child log row except the runtime's own rows — `_plurnk` initialization, maintenance, and operation turns are private to the child: prompt, continuation inventory, operation result, or actionless error. | Direct parent only; one exact attributed row born body-suppressed. Provider reasoning, calls, rejected emissions, turnOps, and harness maintenance do not cross. |
-| §env-delta-child-termination Direct-child termination | The child's exact terminal loop result, except loops containing only `_plurnk` operation or maintenance turns. A conclusion before the first turn still reports, including failed spawns. The observation is untargeted, a SEND message representing the child's disposition: `source` (`worker://<name>`) names the actor and the READ address of its deliverable, and no commons-shaped `worker:///<name>` target is invented (#567). | Direct parent only; a 2xx deliverable is born visible and every failure is body-suppressed ({§worker-scheme-collect}). Excluded administrative loops create no pending child-result edge. |
+| §env-delta-child-activity Direct-child activity       | Child-authored final EDIT, COPY, MOVE, SEND, executor invocation, WORK, FORK, and non-log KILL receipts, including failures. `_plurnk` initialization, maintenance, and operation turns stay with the worker. A reply already delivered to the parent uses its reply occurrence instead ({§message-reply-delivery}). | Direct parent only; one exact attributed row born body-suppressed. Incoming message projections ({§message-arrival}), NOTE, READ (including executor-output READs), FIND, BARE, WAIT, and log KILL never create activity occurrences. Provider reasoning, calls, rejected emissions, and turn sources do not cross automatically. |
+| §env-delta-child-termination Direct-child termination | The child's exact terminal loop result, except loops containing only `_plurnk` operation or maintenance turns. A conclusion before the first turn still reports, including failed spawns. `source` names the actor; the READ target selects its exact loop result ({§worker-loop-result}). | Direct parent only; an ordinary bounded READ projection of the retained occurrence, never a fresh lookup of the child's latest loop. The outcome's own body is visible within the ordinary READ bound; replies are separate messages and are never copied or deduplicated by content ({§worker-scheme-collect}). Excluded administrative loops create no pending child-result edge. |
 | §env-delta-commons-mutation Commons mutation          | One successful resolved operation whose landed effects touch `worker:///...`.                         | Every existing worker; one body-suppressed row per observer, deduplicated with any lineage audience.                               |
 | §env-delta-filesystem-narration Project-file divergence | Runtime-owned reconciliation evidence remains in the runtime actor's own log.                        | No ambient observer row. Current content remains addressable and stale hash edits reject at their owned boundary.                 |
 | §env-delta-entry-materialization Executor `entry()` sink | The runtime records typed materialization evidence under its owning actor.                           | No ambient observer row unless the resulting operation itself is direct-child activity or a commons mutation ({§exec-entry-sink}). |
@@ -4380,19 +4555,19 @@ ordinary operation evidence still reaches that child's direct parent.
 | ----------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | `worker_id` | The worker whose self-contained log owns the materialized row.                                                                                                                          |
 | `origin`    | The actor tier that wrote the row; a materialized delta is `_plurnk`.                                                                                                                   |
-| `source`    | The immediate causal identity in this log: a lineage or commons observation uses canonical `worker://<producer>`, a terminal stream observation uses its causal `log:///<coord>/<runtime>`, and a subsystem observation may use its stable token (for example `file`). Self-authored rows omit it. |
+| `source`    | The attributed actor or subsystem: a lineage or commons observation uses canonical `worker://<producer>`; a subsystem observation may use its stable token (for example `file`). Self-authored rows omit it. Stream invocation correlation belongs to the subscription/publication relationship, not this field. |
 
-§env-delta-no-coalescing **Activity is never coalesced.** Each admitted child
-operation and each commons mutation has one occurrence identity. Combining
+§env-delta-no-coalescing **Activity is never coalesced.** Each eligible child
+action and each commons mutation has one occurrence identity. Combining
 them would destroy causal order and conflate event replay with a state
 comparison.
 
-§env-delta-passive **Observation never forces a turn.** Deltas materialize only
+§env-delta-passive **Passive observation never forces a turn.** Deltas materialize only
 while a packet is already assembling. Intermediate child activity and commons
 broadcasts therefore cannot wake an idle worker. Urgent directed communication
-uses the voice door ({§actor-boundary-two-doors}); direct-child terminal
-disposition alone carries the structured-concurrency wake owned by
-{§worker-scheme-collect}. Stream progress remains owned by {§exec-stream}.
+uses the voice door ({§actor-boundary-two-doors}); child conclusions and addressed
+replies use {§worker-lifecycle-child-wake} and {§message-reply-delivery}.
+Stream progress remains owned by {§exec-stream}.
 
 ---
 
@@ -4423,12 +4598,12 @@ their boundaries ({§log-wire-format}).
 | `inject`        | system | Authored Markdown                                                                             | {§packet-inject}                |
 | `log`           | user   | Markdown H3 records with JSON metadata                                                        | {§log-wire-format}              |
 | `worker`        | user   | JSON `path` with the literal Worker address, `parent` (address or `null`), `loop`, `turn`     | {§packet-current-turn}          |
-| `delegation`    | user   | JSON `{workers, streams}` status/path pointers, each `[]` when empty                          | {§child-orientation}            |
+| `delegation`    | user   | JSON `{workers, streams}`                                                                    | {§child-orientation}            |
 | `errors`        | user   | JSON status/log-path pointers                                                                 | {§operation-results}            |
 | `notices`       | user   | Terse observation bullets                                                                     | {§notice-drain-on-read}         |
 | `git`           | user   | Working-tree state in a NOTE blockquote                                                       | {§packet-cache-monotone}        |
 | `budget`        | user   | JSON curation usage and ceiling; pressure guidance when needed                                | {§tokenomics-neutral-telemetry} |
-| `prompt`        | user   | JSON `prompt://<worker>/<loop>/<N>` pointers                                                  | {§prompt-entry}                 |
+| `messages`      | user   | JSON pointers to the loop's unanswered immutable messages, path and source                    | {§message-arrival}              |
 | `recap`         | user   | Optional authored operational recap                                                           | {§recap}                        |
 
 §packet-stored-shape **A model packet preserves the rendered request and, only
@@ -4540,38 +4715,87 @@ reasoning continuation. Readable reasoning remains independent.
 | row producer | ordinary visible projection |
 |---|---|
 | any `READ` or `FIND` | complete selected operation result |
-| `TASK` | complete canonical Plurnk Plan JSON {§plan-value} |
-| actionless lowercase `prompt` | budgeted head under {§prompt-projection} |
+| `NOTE`, `WAIT` | complete literal authored text |
+| inbound `SEND` from outside the workspace | budgeted head under {§message-projection} |
 | structured `EDIT` receipt or textual `COPY`/`MOVE` effects | complete receipt-owned join context |
 | every other nonempty body | head bounded independently by `PLURNK_SERVICE_PREVIEW_LINES` and `PLURNK_SERVICE_PREVIEW_CHARS` |
 | bodyless row | metadata only; no coordinate lines; `logTokens` includes any selected native part |
 
+§markerless-first-page **Every markerless retrieval takes the same implicit marker.** A marker's
+unit is whatever its projection counts, so `PLURNK_SERVICE_PREVIEW_LINES` is the first page of
+all of them: lines of text, bytes of a byte view ({§read-bytes}), positions of a FIND. It is one
+choice with one home; no operation carries a page size of its own.
+
 Markerless text READs select their page with the same line/character bound as
 ordinary previews, before result storage and packet rendering. Explicit scopes
 remain exact. Automatic stream delivery uses that markerless selector too;
 its range or region describes the selected content and the complete stream
 remains addressable. This selection is not a second rendering-time cut.
 
-READ and FIND own their range or pagination before packet rendering; the packet never applies a second hidden substring bound to their selected result. TASK inventory is likewise complete while visible: the model's task inventory is serialized once as compact JSON, never preview-clipped. Reasoning arrives through ordinary scoped READs ({§reasoning-history}). Prompt rows follow their separate adaptive projection contract. Structured mutation contexts already carry the receipt-owned bound in {§edit-result-receipt-truth}, so packet rendering does not preview them again. Rejected-emission artifacts, SEND/WORK/FORK bodies, execution commands, environment-delta EDIT spans, and extension-produced bodies use the ordinary fixed bound. When a visible projection differs from its canonical body, metadata carries `chunk` with the exact selected and complete extents defined by {§log-wire-format}; complete and fully suppressed bodies omit it. ```` ```READ (log:///<coordinate>/<OP>) ```` selects untrimmed lines in original coordinates under {§log-readable-projection}; the unsuffixed exact shorthand and authoritative suffix behavior are defined by {§log-coordinate-hierarchy}. ```` ```FIND (log:///...) ```` and search match that same readable view. System/policy sections are not log bodies. Notices are transient non-log observations; they share the ordinary line/character bounds but have no durable body or recovery URI.
-
-§prompt-entry **Prompt as a first-class entry and log row.** Each prompt is stored once at `prompt://<worker>/<loop>/<id>` as an explicitly addressed text/markdown entry — written before any turn of its loop executes — then published to its first model turn as one actionless lowercase `prompt` log row; that row, not the entry, records publication. No synthetic EDIT or READ operation is invented. The row is born visible and obeys {§body-projection}. The **Active Prompts** section closes the user-slot status clump as a paths-only list (`* prompt://<worker>/<loop>/<id>`), so every frame remains directly READable after its log row's body is suppressed or its active projection is retired.
-
-§prompt-causal-source **Prompt authorship and delivery are distinct facts.** The harness publishes every prompt row with `origin="_plurnk"`; the row's existing `source` carries the canonical address of a different causal actor. Native WORK, FORK, and directed worker SEND derive `worker://<sender>` from the authenticated sender worker ID. A trusted exterior adapter may supply its own canonical actor address through {§methods-loop-run}. An absent source means the owning worker itself. Attribution persists with the prompt frame through active delivery, parking, orphan recovery, restart, and later log projection; model syntax cannot author it.
-
-§prompt-projection **Prompt storage is unbounded by model context; automatic materialization is not.** Core persists every accepted prompt completely before packet assembly. The selected provider's derived `inputCapacity` and the alias-resolved percentage from `PLURNK_SERVICE_PROMPT_PROJECTION` derive one aggregate curation-weight allowance for visible prompt bodies. Complete prompt bodies render when their aggregate weight fits. Otherwise all visible prompt rows share the allowance: full bodies consume only their required share, unused shares are redistributed, and partial bodies render the largest leading complete-line region that fits their share or an exact character-bound prefix when the first physical line alone is larger. The sum of their rendered body weights never exceeds the allowance. Every partial body carries its exact `chunk` metadata. The canonical `prompt://<worker>/` entry remains complete and READ/FIND-addressable; its `log:///` body additionally obeys deliberate curation under {§log-readable-projection}. When provider input capacity is unknown the percentage is underivable, so prompt rows retain the ordinary bounded projection rather than inventing capacity. This policy never rejects, summarizes, or discards a prompt because it exceeds a context window.
+READ and FIND own their range or pagination before packet rendering; the packet never applies a second hidden substring bound to their selected result. NOTE and lifecycle bodies are complete literal text while visible, never preview-clipped. Reasoning arrives through ordinary scoped READs ({§reasoning-history}). Arrivals from outside the workspace follow their separate adaptive projection contract ({§message-projection}). Structured mutation contexts already carry the receipt-owned bound in {§edit-result-receipt-truth}, so packet rendering does not preview them again. Rejected-emission artifacts, SEND/WORK/FORK bodies, execution commands, environment-delta EDIT spans, and extension-produced bodies use the ordinary fixed bound. When a visible projection differs from its canonical body, metadata carries `preview` under {§packet-extent-metadata}; complete and fully suppressed bodies omit it. ```` ```READ (log:///<coordinate>/<OP>) ```` selects untrimmed lines in original coordinates under {§log-readable-projection}; the unsuffixed exact shorthand and authoritative suffix behavior are defined by {§log-coordinate-hierarchy}. ```` ```FIND (log:///...) ```` and search match that same readable view. System/policy sections are not log bodies. Notices are transient non-log observations; they share the ordinary line/character bounds but have no durable body or recovery URI.
 
-§prompt-address The frame uses its literal Worker name: `prompt://alice/<loop>/<id>`, where `id` is an opaque eight-character hexadecimal identifier. Any workspace actor can read or search it. Identity is not arrival order or a turn number. The entry separately persists its delivery `ordinal`; the initial prompt reserves ordinal 1 before materialization. Repeated initialization reuses that prompt's existing identity. Prompt publication follows the producing Worker's loop, independently of who reads the source.
+§message-arrival **A message source, its log observations and its reply state are distinct.**
 
-§prompt-loop-containment A loop contains every prompt that arrives before it
-concludes; the next turn publishes every entry for which
-that loop has no `op='prompt'` row, oldest first. Every still-undelivered frame
-at conclusion moves into one source-keyed recovery loop with its opaque ID intact and a new delivery ordinal; that loop's
-first turn publishes the complete ordered set exactly once. Recovery retries
-complete the same queued loop and never mint duplicate work. Output withholding
-preserves readable prompt rows; explicit KILL follows the ordinary log
-contract.
-
-§completion-defers-to-prompts **A completion never answers a conversation the model has not seen.** A model TASK that would end the loop at `200` while the loop still contains an unpublished prompt frame ({§prompt-loop-containment}) is deferred at `102` with a receipt naming the arrival; the next turn boundary publishes the frame as usual and the model completes after it. The arrival is not the model's doing, so the deferral is neither a refusal nor a strike. `499` is not deferred: declaring failure is weighing it, and the orphan recovery loop still carries any unpublished frame. The recovery loop also remains the guard for the one true race, a frame written after the terminal decision is committed.
+| Fact | Owner | Curation effect |
+|---|---|---|
+| Accepted body, attachments, address and causal source | Durable inbox message | None; ordinary READ/FIND/COPY can recover the source. |
+| Arrival seen at a turn boundary | One inbound SEND log row, `origin="_plurnk"`, `attrs.kind="message"` | Ordinary KILL can trim or remove this observation. |
+| Answered messages | Successful executed reply, {§send-response-receipt} | None; curation cannot retract delivery. |
+
+Every accepted message enters its recipient loop's inbox in arrival order, with its selected
+paths, and publishes exactly once at the next turn boundary. **Open Messages** lists the
+unanswered messages by their immutable source address (`path`) and optional causal `source`,
+not a log coordinate. Each arrival receipt's `resource` names that same retained source.
+Trusted protocol modules supply message addresses in their own scheme;
+native arrivals use `message://<recipient>/<opaque-id>`, separate from the worker's
+actor and scratch addresses. Ordinary worker scratch remains writable. Source bodies
+are not edited or deleted through resource operations; independently curatable READs and
+arrival rows obey {§log-readable-projection}. No curation operation answers a message.
+Within a workspace an address identifies exactly one accepted message. Reusing it for
+another admission is a 409 conflict, not a second message or an implicit content update.
+
+§message-reply-delivery **A reply is delivered once, not re-enqueued as a request.**
+
+| Audience | Delivery | Effect |
+|---|---|---|
+| Assigned worker | Its conversation, even when another actor answered | Visible reply; wakes eligible parked work without a new Open Message or loop. |
+| Original native sender | That worker, if distinct from the assigned worker | The same reply, through the same wake and observation path. |
+| Exterior sender | The assigned conversation's protocol adapter | The adapter delivers the answer through its standard message channel. |
+| Replying actor | Its own executed SEND | No duplicate ambient occurrence. |
+
+The successful SEND and its addressed occurrences commit together. Reply occurrences use
+the ordinary durable ambient cursor and wake revision; curation cannot revoke delivery or
+replay it. An addressed reply replaces the same parent's generic activity observation.
+Child completion is a separate READ of its execution outcome; replies are not outcome bodies.
+The complete outcome remains available at its {§worker-loop-result} address.
+Unobserved replies prevent conclusion just as unobserved child results do. All operation
+producers notify the same settlement path after durable execution; reply wake-up shares
+{§worker-optimistic-settlement}, without delaying the replying program.
+
+§message-short-identity **The model addresses a message by its short name.** Every message carries
+`message://<worker>/<key>` (`key_path`), the form the worker docs teach, and that is what the packet
+shows in Open Messages and in an arrival row's `resource`. A client's own identity for the same
+message — an AG-UI message UUID, an A2A address — stays the durable `path` that correlation,
+delivery and reply accounting use, and remains addressable in its own scheme; the short form is an
+additional alias. Answering either reaches the same message. Origin (operator, 2026-09-18): the
+packet showed a 77-character `agui://anonymous/threads/…/messages/<uuid>` twice per open message,
+while the docs taught the short form.
+
+§message-causal-source **Message authorship and delivery are distinct facts.** The harness publishes every arrival row; the row's `source` carries the canonical address of the causal actor. Native WORK, FORK, and directed worker SEND derive `worker://<sender>` from the authenticated sender worker ID. A trusted exterior adapter supplies its own canonical actor address through {§methods-loop-run}: the AG-UI bridge names the client's message under `agui://` ({§agui-run-source}), the inbound A2A adapter under `a2a://`. An absent source means the owning worker itself. Attribution persists with the message through the inbox, parking, orphan recovery, restart, and later log projection; model syntax cannot author it. The wire renders the row's `source` and omits its `origin`, which is constant for every arrival; the Open Messages pointer carries the same source ({§message-arrival}) — except where the source is the transport that minted this very message, which says nothing the address does not ({§message-short-identity}).
+
+§message-projection **Message storage is unbounded by model context; automatic materialization is not.** Core persists every accepted message completely before packet assembly. The selected provider's derived `inputCapacity` and the alias-resolved percentage from `PLURNK_SERVICE_PROMPT_PROJECTION` derive one aggregate curation-weight allowance for the visible bodies of arrivals other than a peer worker's — every `source` that is not a `worker://` address, the loop's own assignment included. Complete bodies render when their aggregate weight fits. Otherwise all such visible rows share the allowance: full bodies consume only their required share, unused shares are redistributed, and partial bodies render the largest leading complete-line region that fits their share or an exact character-bound prefix when the first physical line alone is larger. The sum of their rendered body weights never exceeds the allowance. Every partial body carries `preview` under {§packet-extent-metadata}. The row remains complete and READable by coordinate; its `log:///` body additionally obeys deliberate curation under {§log-readable-projection}. A peer worker's message takes the ordinary bounds. When provider input capacity is unknown the percentage is underivable, so arrival rows retain the ordinary bounded projection rather than inventing capacity. This policy never rejects, summarizes, or discards a message because it exceeds a context window.
+
+§message-loop-containment A loop contains every message that arrives before it
+concludes; the next turn boundary publishes every inbox row the loop has not yet
+published, oldest first, and stamps each with the row it became. Ordinal 1 is the loop's
+own assignment and shares the loop's fate: a loop that fails before its first turn does
+not replay it. Every other still-unpublished message at conclusion moves into one
+source-keyed recovery loop, renumbered from its first, whose headline it becomes; that loop's first turn publishes the complete
+ordered set exactly once. Recovery retries complete the same queued loop and never
+mint duplicate work. Output withholding preserves readable arrival rows; explicit
+KILL follows the ordinary log contract.
+
+§completion-defers-to-messages **Conclusion does not cross an unanswered arrival.** The end-of-program check includes messages that arrived during inference. The final database transition rechecks unanswered messages atomically. An arrival that wins the race continues the current loop; one admitted after conclusion belongs to a new loop. Orphan recovery preserves messages accepted before an independently forced termination.
 
 §packet-catalog **Catalogs are query results, not packet state.** The packet
 stores no materialized manifest. Complete and one-level entry directories,
@@ -4601,7 +4825,8 @@ retain distinct contracts and lifetimes.
   an unfittable retained context fails before inference ({§context-output-hard-413}).
 - §log-row-self-explains **Every ≥400 pointer names a record that states its
   why.** A model-operation failure is the model's own operation result; its
-  Problem Details `instance` is that row's `log:///` URI and packet wire renders
+  Problem Details `instance` retains the originating occurrence URI; when absent,
+  persistence assigns that row's `log:///` URI. Packet wire renders
   the contracts-owned compact `{§problem-projection}` on its meta line whether
   its body is visible or suppressed. The enclosing row owns status, model-facing path, source, and target;
   an identical extension is not repeated inside the projection. No
@@ -4611,9 +4836,9 @@ retain distinct contracts and lifetimes.
   failure status, a top-level string `error`, or mismatched result/problem
   statuses violate the producer contract and fail hard. Genuine
   engine-internal faults crash and never mint model-facing rows.
-- **Asynchronous work does not weaken the contract.** A stream-producing operation returns its initial `102` after acquisition. At conclusion the subscription stores the exact universal terminal result; `stream/concluded` carries it unchanged; the next ambient terminal READ merges it with the stream payload and assigns the committed `log:///.../READ` Problem instance. Timeouts and service cancellations replace the complete terminal result with a new valid 504/499 Problem—they never mutate a status while retaining a contradictory Problem.
+- **Asynchronous work does not weaken the contract.** A stream-producing operation returns its initial `102` after acquisition. At conclusion the subscription stores the exact universal terminal result; `stream/concluded` carries it unchanged; the next ambient terminal READ merges it with the stream payload and preserves its Problem instance, assigning the committed `log:///.../READ` URI only when absent. Timeouts and service cancellations replace the complete terminal result with a new valid 504/499 Problem—they never mutate a status while retaining a contradictory Problem.
 - **Self-explaining rows.** A problem `title` names the stable class and `detail` states the occurrence-specific cause. Producer-known operands belong in factual extensions. `stage` appears only when neighboring stages imply different recovery; `recovery` states one generally valid next action; `retryable` is true only when the producer recommends automatically retrying the identical request. Unknown recovery or retryability is omitted rather than guessed. General workflow teaching stays in the packet rather than being duplicated into every failure. The runtime-neutral writing contract is owned by `@plurnk/plurnk-contracts`.
-- **Exact Problems cross durable and external boundaries.** Scheme capabilities, proposal application, subscription conclusion, loop settlement, AG-UI, clients, digests, and benchmark records preserve the originating Problem object. The model packet alone derives `{§problem-projection}` without mutating that object. An adapter may add the durable `instance`; it must not rebuild failure truth from `status`, `detail`, `RUN_ERROR`, a scheduler projection, or a legacy string. A failed boundary without a valid Problem is a contract violation and fails hard.
+- **Exact Problems cross durable and external boundaries.** Scheme capabilities, proposal application, subscription conclusion, loop settlement, AG-UI, clients, digests, and benchmark records preserve the originating Problem object. The model packet alone derives `{§problem-projection}` without mutating that object. An adapter may add a missing durable `instance`, never replace an existing one; it must not rebuild failure truth from `status`, `detail`, `RUN_ERROR`, a scheduler projection, or a legacy string. A failed boundary without a valid Problem is a contract violation and fails hard.
 - **Caught diagnostics are bounded.** Core-owned Problems may include a bounded preview of a caught runtime diagnostic when it states the occurrence-specific cause. `PLURNK_SERVICE_ERROR_DETAIL_LIMIT` owns that model-facing character bound; complete errors remain in daemon diagnostics. Input validation and stable contract failures do not spend this allowance on implementation text.
 - §notice-drain-on-read **Notices** - the few observations that are not log rows render one terse line under their distinct `## Notices` section, never a JSON dump. Packet rendering normalizes whitespace, bounds the producer message with the shared preview limits, and appends any typed position. The notice buffer drains on read; event Notices appear on at most one packet. Stateful derivation progress and provider availability coalesce in the buffer, so clients observe every checkpoint live while a later model packet receives only the current state under ordinary level filtering.
 - §rail-accounting-private **Rail accounting is private.** Visibility is owned by {§engine-rails}: the model sees concrete failures from admitted turns, never rejected emissions, attempt counts, the strike streak, or cycle detection. Surfacing internal state creates a gamification surface where the model optimizes for engine metrics instead of the task.
@@ -4630,7 +4855,7 @@ retain distinct contracts and lifetimes.
 |---|---|---|
 | `grammar_unenforced` | engine rail verdict, or a forwarded provider transport anomaly such as a discarded-channel escape | content-offset when the observed position maps into content; none for a reasoning-prefix divergence |
 | `parse_advisory` | grammar parser — recoverable near-miss which did not invalidate the parsed statements | content-offset into the model's emission |
-| `search_progress` | repository materialization/indexing lifecycle ({§mimetype-surface}); structured phase, count, and percent; `level: info`, `warn` when a completed pass carries failed members ({§derivation-member-failure}), `error` on terminal failure | none |
+| `search_progress` | repository materialization/indexing lifecycle ({§persistent-search-index}); structured phase, count, and percent; `level: info`, `warn` when a completed pass carries failed members ({§derivation-member-failure}), `error` on terminal failure | none |
 | `git_inspection_refused` | engine membership — automatic Git inspection refused a supplied repository whose config declares a `filter.*` program ({§membership-git-hermetic}); names the key; `level: warn`, once per workspace until the key changes or clears | none |
 
 §notice-level **Severity on the wire (`level`, required).** Every `Notice` carries `level: "error" | "warn" | "info"`, set by the **producer** at the emit site. The level is client presentation, not operation status: even an `error` notice cannot terminalize work or substitute for a durable Problem. A forwarded `grammar_unenforced` is `warn`; ordinary lifecycle and progress notices are `info`. Clients color straight off `level` without interpreting the open `kind` vocabulary.
@@ -4645,7 +4870,8 @@ retain distinct contracts and lifetimes.
 | -------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------- |
 | Import `@plurnk/plurnk-service/digest` | Ships `Digest` and its package-owned SqlRite statements; importing performs no I/O or process action. The CLI wrapper alone invokes it.             |
 | `run({ dbPath })`                      | Reads the required database and writes a complete digest to `./test/digest` relative to the caller's working directory.                             |
-| `digestDir`                            | Selects the output directory. `run` removes and recreates it so stale packet artifacts cannot survive; concurrent callers use distinct directories. |
+| `digestDir`                            | Selects a nonempty output directory. Both `run` and `requiem` refuse an output containing the input pathname or its resolved database before database/provider I/O or output writes; normalized and real paths participate in that check. `run` removes and recreates output so stale artifacts cannot survive; concurrent callers use distinct directories. |
+| Reader lifetime                       | Both methods close their database reader on successful or failed reads, before rendering output or awaiting witness inference. |
 | `workerId`                             | Narrows workers and every dependent loop, turn, turn-attached logical inference, specialization, physical request, and log row to that one worker. |
 | `workspaceId`                          | Narrows workers plus every logical inference and dependent evidence owned by one workspace, when both selectors are present they intersect. |
 
@@ -4655,7 +4881,7 @@ retain distinct contracts and lifetimes.
 
 §digest-wire-line **Wire health aggregated.** Each worker summary renders a `Wire:` line — total physical provider requests, error-outcome count, and the error percentage when nonzero. Provider-level failures are absorbed by retries below the packet stream, so without this aggregate a rate-limit storm is invisible in every summary while the model's experience stays clean.
 
-§digest-forensic-fidelity **Forensic fidelity and cardinality.** The digest's machine-readable JSON preserves every log event with its initial and current projection, causal `source`, tags, and structured `attrs`; every exact log-KILL target effect; the exact Problem on every failed row; each loop's exact terminal result; and every ordered physical provider request. Programs still produce chronological `assistant.md` artifacts after every READ receipt is KILLed; source is independent of log curation. Each stored packet validates independently: one malformed historical packet remains exact raw evidence with its complete validation error chain and never prevents healthy turns from being projected. Accounting on broader rows is the shared exact derivation from that ledger, never a second stored fact. A worker's Cost line names how many settled requests carry no usage at all (errored or aborted exchanges) — their server-side spend is unrecorded rather than silently priced as zero. The reasoning chronology distinguishes readable reasoning content from provider-reported reasoning usage: when tokens were reported but no readable content was returned, it states both facts instead of implying that no reasoning occurred. The human Markdown waterfall shows a present causal source and may preview only the Problem detail because it remains a triage projection, not the machine record. Targets reconstruct the model-visible address, including hostname, port, serialized query, and fragment; an authority-bearing URL must never degrade from `https://host/path` to `https:///path`, and durable resource coordinates render back to their authority form. Its human Markdown waterfall groups identical per-turn op outcomes and typed `entry_materialized` narrations, reporting the exact count and sequence span (`xN (seq A-B)`). Grouping keys include source and the complete target, so distinct causes, authorities, or channels never collapse. Thus amplification is conspicuous without making the diagnostic artifact itself pathological; valid packet files remain byte-identical records of what the model saw.
+§digest-forensic-fidelity **Forensic fidelity and cardinality.** The digest's machine-readable JSON preserves every log event with its initial and current projection, causal `source`, and structured `attrs`; every exact log-KILL target effect; the exact Problem on every failed row; each loop's exact terminal result, settlement time, scheduled due time, recurring interval, and recurrence lineage; and every ordered physical provider request. Programs still produce chronological `assistant.md` artifacts after every READ receipt is KILLed; source is independent of log curation. Each stored packet validates independently: one malformed historical packet remains exact raw evidence with its complete validation error chain and never prevents healthy turns from being projected. Accounting on broader rows is the shared exact derivation from that ledger, never a second stored fact. A worker's Cost line names how many settled requests carry no usage at all (errored or aborted exchanges) — their server-side spend is unrecorded rather than silently priced as zero. The reasoning chronology distinguishes readable reasoning content from provider-reported reasoning usage: when tokens were reported but no readable content was returned, it states both facts instead of implying that no reasoning occurred. The human Markdown waterfall shows a present causal source and may preview only the Problem detail because it remains a triage projection, not the machine record. Targets reconstruct the model-visible address, including hostname, port, serialized query, and fragment; an authority-bearing URL must never degrade from `https://host/path` to `https:///path`, and durable resource coordinates render back to their authority form. Its human Markdown waterfall groups identical per-turn op outcomes and typed `entry_materialized` narrations, reporting the exact count and sequence span (`xN (seq A-B)`). Grouping keys include source and the complete target, so distinct causes, authorities, or channels never collapse. Thus amplification is conspicuous without making the diagnostic artifact itself pathological; valid packet files remain byte-identical records of what the model saw.
 
 Unrecognized actionless log rows are retained and labelled as such, not
 interpreted as executable turnOps or allowed to prevent the remaining digest.
@@ -4677,7 +4903,7 @@ turn.** It cannot execute operations or alter the audited history.
 | Scope     | One interview for each worker with model-bearing inference turns; workers without inference evidence are omitted.                                                |
 | Evidence  | The worker's final packet plus every attempt's exact normalized response and admission evidence; opaque raw transport remains in durable forensic artifacts. Quoted evidence is budgeted to the witness window ({§digest-requiem-evidence-budget}). |
 | Witness   | An explicitly supplied provider or the active configured provider; absence fails hard.                                                                          |
-| Identity  | The worker's durable provider identity ({§worker-provider-identity}) is sent as both `workerId` and `primaryWorkerId`, making the synthetic interview its own root without asserting a live worker topology. |
+| Identity  | The worker's durable provider identity ({§worker-provider-identity}) is sent as the `workerId`, without asserting a live worker topology. |
 | Attempts  | One call at `PLURNK_SERVICE_REQUIEM_MAX_TOKENS`; only an empty length-limited response receives one retry at `PLURNK_SERVICE_REQUIEM_RETRY_MAX_TOKENS`.         |
 | Artifacts | `requiem.md` carries testimony and exact nullable USD accounting. `requiem.json` is durably materialized before each call and preserves logical call state, messages, normalized responses, every physical request's state and accounting, and their shared aggregate projection. |
 
@@ -4697,9 +4923,9 @@ USD, and token totals across every physical exchange the turn paid for, failed
 calls included. It is the shared exact derivation from the ledger, never a second
 stored fact, so a live watcher accrues running loop cost per turn (#465).
 
-§notice-content-offset-pointer **Content-offset position.** A non-fatal diagnosis on an accepted emission (for example `grammar_unenforced` or `parse_advisory`) carries `position: { type: "content-offset", line, column }` into the model's exact `ops:///<loop>/<turn>` source. A bounded hard parse error becomes a durable failed operation whose Problem Details preserve its line, column, source, and parser-owned diagnostic. Hard errors that make the frame untrustworthy remain only with their rejected forensic attempt.
+§notice-content-offset-pointer **Content-offset position.** A non-fatal diagnosis on an accepted emission (for example `grammar_unenforced` or `parse_advisory`) carries `position: { type: "content-offset", line, column }` into the model's exact `ops://<worker>/<loop>/<turn>` source. A bounded hard parse error becomes a durable failed operation whose Problem Details preserve its line, column, source, and parser-owned diagnostic. Hard errors that make the frame untrustworthy remain only with their rejected forensic attempt.
 
-### §tools Executable tool resources
+### Executable tool resources
 
 §tools-resource-discovery **Executable capability discovery uses ordinary
 Plurnk resources.** No generated tool table rides the system packet. Every
@@ -4716,7 +4942,9 @@ preserve the full tool description and raw input schema under
 {§executor-input-schema-preview}; their nested paths do not contribute extra
 Turn0 rows. A schema-backed general runtime uses `<runtime>/input.md`.
 Non-schema targets retain supplemental details in family sections.
-Tool-result/output schemas remain ordinary evidence, not teaching.
+Tool-result/output schemas remain ordinary evidence, not teaching. Unknown-target
+recovery names the published family document through the same path owner as
+materialization, including a runtime's declared `resourcesPath`.
 
 ```mermaid
 flowchart LR
@@ -4781,7 +5009,7 @@ untracked, absent); a glob previews what `add` would include or exclude. Names o
 content; nothing is added.
 
 §members-configuration *Available definitions.* The operator's `PLURNK_MEMBERS_<ALIAS>=<glob>`
-(`!glob` excludes) and `PLURNK_MEMBERS_ENABLED=[…]` (absent or `[]` enables none) are the
+(`!glob` excludes) and `PLURNK_MEMBERS_ENABLED=[…]` (`[]` enables none) are the
 service-origin definitions, the shape `PLURNK_MCP_*` already has; an empty glob, a bare `!`,
 or an unknown enabled alias fails the daemon at boot.
 
@@ -4840,7 +5068,9 @@ contributes nothing and is refused with 400.
 
 *Admission.* `add {alias, definition}` requires `alias = name`, a `source`,
 and a project root when `scope` is `project`; the workspace definition may
-shadow a service skill of the same name.
+shadow a service skill of the same name. The family's aliases use the standard
+skill-name grammar ({§agent-skills-name}), including digit-leading and Unicode
+names, rather than the coordinator's generic default.
 
 *Preparation.* For each enabled alias the adapter selects the host-provided
 tree for `service` scope or locates the directory at the filesystem scope;
@@ -4867,6 +5097,9 @@ The family exposes enabled, available {§agent-skills-tree} sources through
 `skill://<name>/`. The source owns its bytes; commons entries are demand-loaded
 projections, not writable installations. Filesystem skills retain their original
 directories; service-provided trees need no generated filesystem directory.
+The authority is the name's WHATWG URI representation, including percent-encoding
+for non-ASCII names. Installation names remain unchanged; a raw spelling and its
+serialized URI address the same resource, not separate skill identities.
 
 | Operation | Contract |
 | --- | --- |
@@ -4885,7 +5118,7 @@ An uninstalled Git skill is not manufactured by repository detection.
 
 §plurnk-skill **Plurnk's own reference is an ordinary service-provided skill.**
 `skill://plurnk/SKILL.md` is the standard frontmatter entry point, catalogued with
-other enabled skills. It links package-owned configuration and model chapters,
+other enabled skills. It links package-owned configuration, model, and COPY/MOVE chapters,
 the complete `.env.defaults` aggregate at `skill://plurnk/.env.defaults`, and the
 Worker's existing tool/resource references. No chapter or defaults body is
 injected merely because the skill is enabled. The defaults bytes come from the
@@ -4920,7 +5153,7 @@ same exact 403 from dispatch rather than a second documentation policy.
 Optional non-execution operations remain a separate `## Enabled Optional Operations`
 section because they are language extensions rather than executable tools.
 
-### §schemes Scheme-reference discovery
+### Scheme-reference discovery
 
 §schemes-directory Scheme references are ordinary workspace entries at `worker:///_plurnk/plurnk/<scheme>.md`. Turn0's FIND survey projects their summaries ({§worker-initialization-entry}); the model READs details on demand. No Resources section or separate example catalog is injected into the system packet.
 
@@ -4938,7 +5171,7 @@ section because they are language extensions rather than executable tools.
 
 ### §policy system.policy — the client's policy injection
 
-§policy-sections One section rides the system slot **after the definition**: the contents of `PLURNK_SERVICE_POLICY` (default `$XDG_CONFIG_HOME/plurnk/AGENTS.md`, {§host-path-layout}), with no engine-generated heading. The policy document owns its Markdown structure. Policy is the client's authoritative rules promoted into the privileged zone — NOT a log entry; the model cannot READ or KILL it. A default-absent path is silent (the section is omitted); an explicit override (env set) that fails to read fails the turn hard — a deliberate setting with a broken path is a misconfig, surfaced not hidden. Read per-turn so edits take effect live. The PROJECT `AGENTS.md` is local guidance, not policy: it rides turn 0 as the foisted `worker:///_plurnk/agents.md` entry ({§turn0-agents-stunt}); references and skills use native discovery ({§skills-functionality}).
+§policy-sections One section rides the system slot **after the definition**: the contents of `PLURNK_SERVICE_POLICY` (default `$XDG_CONFIG_HOME/plurnk/AGENTS.md`, {§host-path-layout}), with no engine-generated heading. The policy document owns its Markdown structure. Policy is the client's authoritative rules promoted into the privileged zone — NOT a log entry; the model cannot READ or KILL it. A default-absent path is silent (the section is omitted); an explicit override (env set) that fails to read fails the turn hard — a deliberate setting with a broken path is a misconfig, surfaced not hidden. Read per-turn so edits take effect live. The PROJECT `AGENTS.md` is local guidance, not policy: it rides turn 0 as the foisted `worker:///_plurnk/AGENTS.md` entry ({§turn0-agents-stunt}); references and skills use native discovery ({§skills-functionality}).
 
 On first run, and only when `$XDG_CONFIG_HOME/plurnk` itself is absent, the service seeds
 `AGENTS.md` from `@plurnk/plurnk-meta/POLICY.md` ({§teaching-corpus}).
@@ -4966,7 +5199,7 @@ the transition.
 When Git is admitted for the workspace, `## Git Status` contains a Markdown
 `> [!NOTE]` block. Its quoted lines report the current
 branch, upstream ahead/behind counts, and staged/unstaged/untracked totals, then
-one bounded line per non-empty class (at most eight paths, `+K more`): staged,
+one bounded line per non-empty class (at most `PLURNK_SERVICE_GIT_STATUS_PATHS` paths, `+K more`): staged,
 unstaged, `untracked members` — each path with the inclusion pattern that admits it or
 `created` for a creation record — and `untracked (not members)`, named because such a
 file is not a member ({§membership-baseline}) and a human must `git add` it or add a
@@ -4976,6 +5209,10 @@ the runtime actor's durable causal evidence: its `source=file` row carries
 the exact two-character porcelain `XY` value as `git` metadata when the status
 snapshot names that path. The engine takes one snapshot after membership
 reconciliation and uses it for both projections; no per-file Git process exists.
+Porcelain v2 NUL-delimited records supply these facts: an unborn branch retains
+its actual name with `no commits`; detached HEAD is identified as detached,
+never as a branch named `HEAD`. Pathnames and rename sources retain their exact
+bytes; the internal two-character status uses spaces for unchanged coordinates.
 
 ### §recap Optional Recap footer
 
@@ -4988,7 +5225,7 @@ one dormant authored source. A failed read fails packet assembly with its cause.
 The footer is one projection path and one authored source, not a second language
 contract.
 
-## §matcher Matcher selection and text regions
+## Matcher selection and text regions
 
 Matchers select resources and report evidence; text scopes independently
 address the exact readable text, regardless of mimetype. Syntax belongs to
@@ -5050,7 +5287,7 @@ one binary marker to fail a repository-wide text search.
 Glob anchoring (`TODO*` starts-with, `*TODO*` contains, `*.log` ends-with,
 `[Tt]odo*` character class) lives in the mimetypes framework.
 
-### §matcher-result Matcher selection and evidence
+### Matcher selection and evidence
 
 - §matcher-selection-signal **Matching carries navigation evidence** - a matcher is a boolean resource predicate. Internally, each selected resource carries `matches: MatchEvidence[]`, where `MatchEvidence` is `{channel?,locator?,region?}`; `channel` names the entry channel the finding was located in and is absent for channel-less resources such as log rows, so line coordinates cannot be mis-attributed across channels of the same resource ({§channel-selection-visibility}). `locator` preserves a structural address without overloading the resource row's `path`; `region` is a complete four-coordinate `TextRegion` only when the finding maps honestly into the exact text the model can READ. Exact duplicate evidence deduplicates. Relation findings map their indexed source spans through the same readable text coordinate index. FIND alone decides whether that grouped selection projects as resource rows or flat locations ({§find-result-projection}); the engine never fabricates a region or guesses which surgical READ the model wants.
 
@@ -5132,7 +5369,7 @@ an existing channel retain its stored type. Effective mimetype is stored in
 `entry_channels.mimetype` and drives matcher, projection, and binary handling.
 Text scope meaning does not vary by mimetype.
 
-### §render-rule Render rule
+### Render rule
 
 §render-rule-line-navigable-prefix Every textual content body with a source
 `startLine` renders with a coordinate prefix on each physical line, independent
@@ -5147,13 +5384,13 @@ presentation aid, never part of canonical content; matchers and mutations
 consume canonical bytes before rendering. A producer may set `startLine: null`
 only when its content is already source-numbered, such as an effect receipt.
 
-§render-rule-find-renders-result A log row's canonical full body is resolved once by `LogBody`: READ/FIND, actionless source artifacts, prompt, and extension result content comes from `rx.content`; EDIT and scoped entry KILL use their structured receipt, while environment-delta EDIT uses its resulting span; COPY/MOVE concatenate the textual receipt contexts in their ordered `effects`; TASK serializes their canonical inventory through the shared {§json-result-rendering} spread as `application/json`; executions and SEND/WORK/FORK use their statement body. Whole-channel COPY/MOVE effects are bodyless rather than fabricating a text projection. Packet rendering applies {§body-projection} and the coordinate projection in {§render-rule-line-navigable-prefix}. READ/FIND over `log:///` and search use the same body with deliberate trims applied under {§log-readable-projection}, without packet-only suppression or preview limits. Status and content are orthogonal: a failed terminal stream READ retains its Problem Details and failure status while rendering captured diagnostic output; failure never erases evidence.
+§render-rule-find-renders-result A log row's canonical full body is resolved once by `LogBody`: READ/FIND, actionless source artifacts, prompt, and extension result content comes from `rx.content`; EDIT and scoped entry KILL use their structured receipt, while environment-delta EDIT uses its resulting span; COPY/MOVE concatenate the textual receipt contexts in their ordered `effects`; NOTE and lifecycle operations retain their literal `text/plain` bodies; executions and SEND/WORK/FORK use their statement body. Whole-channel COPY/MOVE effects are bodyless rather than fabricating a text projection. Packet rendering applies {§body-projection} and the coordinate projection in {§render-rule-line-navigable-prefix}. READ/FIND over `log:///` and search use the same body with deliberate trims applied under {§log-readable-projection}, without packet-only suppression or preview limits. Status and content are orthogonal: a failed terminal stream READ retains its Problem Details and failure status while rendering captured diagnostic output; failure never erases evidence.
 
 An EDIT or scoped entry KILL log row renders its bounded effect receipt (`rx.receipt`) as row
 metadata and join context, not its input statement. Proposal-gated file EDITs
 compute the accepted receipt from what actually lands. Environment-delta EDITs
 render their resulting `rx.span`. COPY/MOVE rows render compact ordered
-`source` and `destination` selections, compact ordered `effects` metadata, and
+`from` and `to` selections ({§log-address-metadata}), compact ordered `effects` metadata, and
 any scoped textual receipt contexts under their `log:///` address, never under
 one operand's resource address. All generated bodies remain under
 {§body-projection}. {§edit-result-render}
@@ -5195,7 +5432,7 @@ Carried from the contract walk; durable.
   Any scoped textual transfer materializes create/update receipts; whole-channel
   changes do not. Operand selections remain independently visible per
   {§copy-move-observation}.
-- **READ rx** prefixes every textual line under {§render-rule}; eligible
+- **READ rx** prefixes every textual line under {§render-rule-line-navigable-prefix}; eligible
   editable resources carry `@hash N:`, and all others carry `N:`.
 - **FIND pattern** (`[{"pattern": …}]` in the heading, {§matcher-option}) applies to the addressed entry channel (all dialects), per-candidate via the in-tree `Matcher.matchAgainstContent` ({§matcher-dispatch}; status 200 = content hit → entry selected). The target scope and channel select candidates; the path-glob is the (target). On READ, EDIT, KILL, COPY and MOVE the same heading pattern selects lines within one resource ({§read-pattern}, {§edit-pattern}, {§kill-pattern}, {§copy-move-pattern}).
 - **Scoped KILL** on the **log** (`log:///`) removes a body span from its readable projection ({§log-kill-scope}); on an entry it deletes that span through the EDIT path ({§kill-scope-entry}). A whole-entry KILL deletes the entry, or one `#fragment` channel.
@@ -5209,7 +5446,7 @@ A KILL with a text-coordinate scope aimed at an entry-bearing scheme deletes exa
 
 ---
 
-## §test-taxonomy Testing and evidence
+## Testing and evidence
 
 | Tier | Location | LLM | Substrate |
 |---|---|---|---|
@@ -5241,15 +5478,13 @@ execution. The ledger and classification taxonomy live in
 distinct from model failures and repeated stochastic failures separately from
 stable ones, never with weakened assertions.
 
-§test-artifact-retention **File-backed test databases use lane-local current-run
-retention.** Each workspace's normal intg runner clears its own
-`test/intg/.tmp/` once before the suite, reports that forensic directory, and
-retains every artifact the current run creates; a direct `node --test <file>` run bypasses that
-runner, so each test process prunes artifacts older than a day once, and never the current run's. A cross-package test may reuse
-Core's migration fixture only by passing a path inside the caller's artifact
-directory; independently scheduled lanes never share a reset target. A failed
-suite therefore leaves its own evidence intact, and the next normal run of that
-lane removes it before creating anything. Direct `node --test` invocations
-bypass the runner boundary and must invoke the same cleanup procedure
-explicitly when isolation matters. Live/demo run directories are benchmark
-artifacts outside `.tmp` and retain their separate lifecycle.
+§test-artifact-retention **Every harness writes its run into one home.** A file-backed test
+database is a benchmark artifact like any other: the lane's run directory lives under
+`PLURNK_BENCHMARKS` (`~/benchmarks` by default) beside live, demo and benchlet runs, and the
+checkout holds source only — never run output. `test:intg` stamps `PLURNK_TEST_RUN` once and every
+test process inherits it, so one suite's databases land in one directory without a pretest step, a
+marker file or a sweep; an unstamped invocation is not a special case with its own rules, it is
+simply an unstamped run with its own directory. Nothing counts, reuses, moves, hides or
+conditionally clears an artifact, so a failed suite's evidence is exactly where the run reported
+it. A cross-package test may reuse Core's migration fixture only by passing a path inside the
+caller's own run directory.