@plurnk/plurnk-service 1.19.3 → 1.20.0

package/SPEC.md

@@ -527,8 +527,9 @@ Every admitted authority is a literal `workers.name`; self-addressing uses the c
   parent as an `_plurnk` READ of `ops://<name>/<sequence>` ({§loop-answer}), not a message,
   and that row carries what the child said.
   The occurrence retains that loop's exact terminal result; the READ uses ordinary
-  bounded projection. Its body, when present, is initially visible. Replies are
-  independent deliveries ({§message-reply-delivery}), never copied into this outcome. Failures and
+  bounded projection of {§loop-answer}. The original delegated answer reaches the
+  parent here, not as a duplicate reply ({§message-reply-delivery}); other message
+  replies remain independent deliveries. Failures and
   cancellations retain their exact status, Problem, and visible explanation,
   including a spawn that fails before its first turn. Observation and wake-up
   follow {§env-delta-child-termination}; a later child loop cannot replace the
@@ -1023,7 +1024,7 @@ boundary.
 - §worker-lifecycle-wake-liveness **A stream conclusion always reaches its worker.** The stream first persists its terminal state. A worker **blocked on a 202 wait** for that stream ({§wait-obligation-matrix}) then **awakens that loop in place** — the blocked loop *is* the continuation, so there is no fresh loop and no summary-as-prompt fiction. An already-active worker needs no injected prompt or second wake because its next packet reads the durable terminal state. A concluded worker receives no synthetic loop from ambient stream closure. The result remains available in the stream's own state under every case.
 - §worker-lifecycle-child-wake **Each child task completion notifies its parent.** Terminal-task publication, including failure and cancellation of a parked task, notifies the direct parent without injecting a prompt. Other unfinished tasks or streams in that child remain independent obligations; they cannot suppress notification. The parent's eligible waits requeue in place under {§loop-wake-identity} and the bounded {§worker-optimistic-settlement} opportunity. Durable revisioning covers completion-before-park and restart; drain teardown and whole-worker quiescence are not completion identities.
 - §worker-optimistic-settlement **Asynchronous settlement receives one bounded worker-local opportunity before model dispatch.** An initiating turn lets only the streams it started settle before program completion; separately, a stream conclusion, direct-child conclusion or addressed reply persists and publishes immediately but holds eligible parked loops' `202→100` requeues while another stream or direct child remains live. Both use `PLURNK_SERVICE_OPTIMISTIC_WAIT_MS`, shipped at five seconds; zero disables the opportunity. The wake hold ends as soon as no sibling obligation remains, never extends its original deadline, and coalesces arrivals within that window into at most one requeue per eligible loop. With no sibling obligation the wake is immediate; at the deadline, surviving work follows the ordinary monitored lifecycle. An arrival after provider dispatch begins retains its next wake, while poll, new-request and operator wakes never open this hold. Only packet/provider dispatch waits: durable state, client events, cancellation and the replying program do not. One redaction-safe span records elapsed time, quiescence versus deadline, and arrival count without entering the packet.
-- §worker-lifecycle-idle-is-concluded **Idle is not unanswered.** An empty WAIT continues; an answered, observed program without held work concludes under {§wait-obligation-matrix}. A concluded worker retains durable history; a later addressed arrival starts a new loop.
+- §worker-lifecycle-idle-is-concluded **Idle is not unanswered.** An empty WAIT continues; an eligible final response with answered messages, observed results and no held work concludes under {§wait-obligation-matrix}. A concluded worker retains durable history; a later addressed arrival starts a new loop.
 - §worker-lifecycle-no-lost-loop **A loop is never stranded by a drain's exit.** A drain relinquishes its registry slot only after a lock-held re-claim confirms the queue is empty; a loop enqueued during that teardown is either re-claimed by the exiting drain or claimed by a fresh drain that a later inject starts. The relinquish and the start are serialized, so neither the lost-loop hang nor a transient double-drain can occur.
 - §worker-lifecycle-durable-disposition **Durable disposition wins cancellation races.** At a turn boundary, the engine reads the loop's durable status before interpreting a process-local abort. A committed `202` park survives a later daemon-shutdown signal; only a loop still durably running at `102` can be terminalized by that cancellation. Wake selection rechecks shutdown and worker cancellation before requeuing each parked loop.
 - §worker-lifecycle-restart-recovery **Restart is owner-loss reconciliation, not replay.** Before opening client transports, the service holds an exclusive database-adjacent daemon lock; a second live owner fails before touching SQLite, while a dead-PID crash claim is replaced atomically without a timeout lease. Boot preserves accepted `100` loops and restores their drains. A `102` loop belonged to a vanished drain/provider call, so it settles `500` with the interruption on its durable row—never replayed across an unknown effect boundary. Every pending physical provider request first settles as an error with absent usage and explicitly unknown cost; then its logical model call closes. Recovery never fabricates zero evidence. Every durable proposed operation likewise lost its process-local resolution waiter and settles as a visible `500 owner_vanished` occurrence rather than an unresolvable interrupt ({§proposal-list}). A pending client interaction also lost its exact awaiting operation, so boot removes the orphan instead of replaying work or inventing a response ({§client-interactions}). Every durable-open subscription belonged to a vanished callable: active channels become errored and its row closes `500`. A `202` continuation requeues on an unseen completion or when no live obligation remains. Otherwise it stays parked on surviving children; the drain restores inherited stream observation through the same guarded scheduler ({§worker-wait-timing}). Child terminalization wakes its parked parent on every outcome, including provider exceptions, cancellation, and restart interruption, recursively through the durable parent edges. These operations are idempotent, so an interrupted recovery safely repeats.
@@ -1100,11 +1101,18 @@ are excluded from results; the complete note body still distinguishes activity.
 irrelevant; operation and array order are preserved. Only the configured
 `MIN_CYCLES × MAX_CYCLE_PERIOD` history window is retained. Repeated addresses
 alone are not a cycle: changing inputs or observations distinguish activity.
+A turn that executed nothing has no activity to identify, so an empty turn's
+identity is its **text** ({§empty-turn}) — the same principle, applied to the only
+output it produced. Identifying it by its absent program instead makes every empty
+turn identical, and changing words then read as a repeating one.
 This is an exact-repetition backstop, not a semantic judgment of task progress;
 new asynchronous invocation identities do not prove repetition of their eventual
 effects. Ordinary contract strikes and operator budgets remain independent.
 
-§provider-recovery **A recoverable provider failure never ends a loop.** When a model
+§provider-recovery **A recoverable provider failure never ends a loop.** An isolated BARE
+call ({§bare-inference}) takes the same recovery as the loop's own inference: each re-issue
+is its own model call on the ledger, and a spent window leaves the operation's result as the
+provider's exact failure. When a model
 call fails with a network failure, rate limit, deadline, or interrupted resource after
 the provider's own retries, the turn records the exact Problem as a `_plurnk` row,
 notices the client (`engine:provider` / `provider_unavailable`), waits with
@@ -1137,7 +1145,7 @@ The contracts, and the violation of each that strikes:
 | Contract | Violation that strikes |
 |---|---|
 | operation contract | a hard operation failure (status ≥ 400) in an admitted turn — soft statuses below excluded |
-| review contract | none: answered work joins live obligations ({§completion-joins-live-work}) or continues to observe results ({§completion-defers-to-results}) |
+| review contract | none: an eligible final response joins live obligations ({§completion-joins-live-work}) or continues to observe results ({§completion-defers-to-results}) |
 | progress contract | a detected operation cycle (`MIN_CYCLES` × period), or an admitted turn with no operation ({§empty-turn}) |
 | frame contract | emission attempts exhausted with no admissible turn |
 | provider response contract | the provider returned an invalid response |
@@ -1156,6 +1164,17 @@ independent turn ceiling terminates at **429** ({§loop-terminals}). The streak
 and cycle verdict are absent from model packets; only the concrete occurrences
 in the table are shown. The streak never leaves the daemon.
 
+A crossing terminal names the source that struck the crossing turn — `repetition`,
+`no_operation`, then `operation` — in its detail, in that order when a turn matches more
+than one. The three are not interchangeable: a turn that authored no operation did not *fail*
+one, and reporting it as a failed turn misreads a model answering without the fence as a model
+whose operations broke. This is the crossing turn's source, not the streak's composition; the
+rail rules on the crossing and does not retain the kinds behind it. What the crossing turn
+actually said is cited, not discarded ({§terminal-evidence}). Naming the source is not the
+private accounting {§rail-accounting-private} withholds: the streak, the cycle verdict and
+attempt counts stay inside the daemon — this is the terminal telling the truth about its own
+cause, which the reader already sees the shape of.
+
 §loop-rail-continuity Rail state belongs to the durable loop, not its execution
 segment. The strike streak and bounded cycle history survive driver cleanup and
 restart; curation of log evidence cannot alter them.
@@ -1204,7 +1223,21 @@ Three current entry points:
 
 ### §emission-admission Provider emission admission
 
-A completed provider exchange is an **emission attempt**, not necessarily an engine turn. **The harness admits every program whose meaning it can determine, runs what it admitted, and reports — never refuses — what it could not read**; a refusal is for undecidable text alone. ANTLR admits at least one parsed source operation. WAIT is optional under {§turn-shape}; omission invents no operation, diagnostic, warning or strike; any number of WAITs are one park, scheduled last ({§disposition-anywhere}), and statements after them remain admitted in authored order. Bounded operation errors retain useful siblings and participate in the ordinary struck turn. An unfinished heading slot ({§unparsed-tail-boundary}) refuses only what follows it: the statements that closed before it run, and the loss is one more hard diagnostic — a failed row with the lexer's own reason; an exchange that lost its boundary before any statement closed has nothing admissible and is rejected. A missing closer never rejects ({§closer-fallback}). An exchange with no operation and no other hard error is not rejected: it is admitted as an empty turn ({§empty-turn}). Parser warnings remain admissible. `finish=length` is evidence of likely truncation, not an independent rejection rule. Provider-declared interruption never reaches admission ({§provider-interrupted-attempt}). Accepted source bytes and statement positions remain exact in response evidence and `turnOps`. Execution follows {§op-execution-order}.
+A completed provider exchange is an **emission attempt**, not necessarily an engine turn.
+The parser owns its boundaries; core admits determinate work and exposes its failures.
+
+| Parsed response | Admission |
+|---|---|
+| Bounded program, including malformed operations | Admit valid operations and record parser failures; with no authored operation, apply {§empty-turn}. |
+| Outside response text | Keep it as the model's NOTE under {§response-text-note}; never deliver it or infer completion. |
+| Lost boundary after a closed operation | Admit the closed operations and record the boundary diagnostic under {§unparsed-tail-boundary}. |
+| Lost boundary before any closed operation | Reject the attempt; neither outside text nor a reasoning NOTE substitutes for a closed response operation. |
+
+Warnings and closer recovery ({§closer-fallback}) do not reject. `finish=length`
+discloses truncation and precludes completion; it is not independently a rejection.
+Provider interruption is owned by {§provider-interrupted-attempt}. Accepted source
+and positions remain exact; execution follows {§op-execution-order}. WAIT remains
+optional, with no omission warning or invented operation ({§turn-shape}).
 
 §safe-uri-target-groups After source and authored-command admission, Core tolerates one target group on READ or KILL only when splitting its raw target at top-level comma or whitespace separators produces at least two members and every member independently parses as an explicit `scheme://` URI. Request-metadata blocks are opaque to this split. Each member becomes one ordinary statement with an independent dispatch outcome and log row, in authored member order at that operation's position under {§op-execution-order}. Otherwise the target remains exactly singular, including local filenames containing spaces or commas. The stored `turnOps` and authored command count remain unexpanded, and no other operation admits target groups.
 
@@ -1481,7 +1514,7 @@ Registration precedes loop affinity:
 | Registered but inactive under flag | The flag gate returns `403 scheme-unavailable`.                         |
 | Registered and active              | Dispatch continues to the operation owner.                              |
 
-- §op-execution-order **An admitted turn is an ordered program.** Model, client, and harness operations execute in authored order. Only WAIT is deferred until all other admitted operations settle or establish their explicitly asynchronous work ({§disposition-anywhere}). The complete program then settles under {§wait-obligation-matrix}, whether or not it contains WAIT; no completion operation or inventory is invented. Existing cycle, no-operation, and resource rails remain effective. An observation records the resource state at its execution point; the model sees that receipt in the next packet. Exact submitted source and actual operation outcomes remain durable. Earlier successful effects survive a later operation failure; a producer requesting fail-on-error stops before subsequent operations.
+- §op-execution-order **An admitted turn is an ordered program.** Model, client, and harness operations execute in authored order. WAIT and parameterless KILL are deferred until all other admitted operations settle or establish their explicitly asynchronous work ({§disposition-anywhere}). The complete program then settles under {§wait-obligation-matrix}, whether or not it contains a lifecycle request; no completion operation or inventory is invented. Existing cycle, no-operation, and resource rails remain effective. An observation records the resource state at its execution point; the model sees that receipt in the next packet. Exact submitted source and actual operation outcomes remain durable. Earlier successful effects survive a later operation failure; a producer requesting fail-on-error stops before subsequent operations.
 
 §bare-inference **BARE is isolated, synchronous retrieval over the durable child-provider policy.**
 
@@ -2074,7 +2107,7 @@ streaming are independent. No later turn automatically requests reasoning.
 
 AST: `{ op: "KILL", target, matcher: MatcherBody | null, lineMarker: TextLineMarker | null, body: null }` ({§kill-scope} and {§matcher-option} in the contracts SPEC own the grammar).
 
-KILL deletes context from the **log** (`log:///`, {§packet}). Without a scope it retires the selected rows from the active projection ({§log-history-projection}). With a one-line or inclusive two-line scope it removes only that body's intersecting body-relative physical lines from the readable projection, and the row stays active. An anchor may be one published on that body or one returned by READing its `log:///` coordinate ({§line-anchors}); an anchor absent from the current body selects no line, as with an out-of-bounds numeric line. Scoped KILL is one-way: intervals accumulate, the durable body is untouched, and subsequent access follows {§log-readable-projection}. A scoped KILL on a bodyless row is a friendly 200 no-op with `matched` reported. A KILL that addresses no row is 404 on an exact coordinate and 204 on a sweep ({§log-curation-folder-idiom}). Selection composes target/glob with an optional heading pattern ({§log-curation-set-selection}); a targetless KILL is 400.
+KILL deletes context from the **log** (`log:///`, {§packet}). Without a scope it retires the selected rows from the active projection ({§log-history-projection}). With a one-line or inclusive two-line scope it removes only that body's intersecting body-relative physical lines from the readable projection, and the row stays active. An anchor may be one published on that body or one returned by READing its `log:///` coordinate ({§line-anchors}); an anchor absent from the current body selects no line, as with an out-of-bounds numeric line. Scoped KILL is one-way: intervals accumulate, the durable body is untouched, and subsequent access follows {§log-readable-projection}. A scoped KILL on a bodyless row is a friendly 200 no-op with `matched` reported. A KILL that addresses no row is 404 on an exact coordinate and 204 on a sweep ({§log-curation-folder-idiom}). Selection composes target/glob with an optional heading pattern ({§log-curation-set-selection}). Parameterless KILL instead requests completion ({§kill-conclusion}).
 
 A READ carrying active native media is atomic: any KILL scope is ignored and the entire observation is retired, including its native context contribution ({§packet-attachment-parts}). For a model turn, native activity is the attachment selection in its actual input packet; without a model packet, a native observation is atomic by default. Text-only observations in the same selection retain ordinary scoped behavior. Neither form deletes source data or forensic evidence.
 
@@ -2105,21 +2138,29 @@ type and projection facts under {§read-bytes}.
 The `## Log` section is a sequence of ordinary Markdown records separated by one blank line:
 
 ```text
-### log:///<loop>/<turn>/<item>/<leaf>
-{"oneLine":"strict JSON metadata"}
+### log:///<loop>/<turn>/<item>/<leaf> · <logTokens>
+OP (operands) <marks> [metadata] <!-- aside -->
+{"oneLine":"strict JSON result facts"}
 <coordinate-prefixed body lines when visible>
 ```
 
-The H3 is the row's complete model-facing identity and canonical READ address; metadata never repeats that identity or its operation. The following line is one strict JSON object: addressed operands ({§log-address-metadata}) precede `aside`, then all remaining members use stable alphabetical order. Absent fields are not invented. Every physical body line retains its canonical numeric `N:` or anchored `@hash N:` coordinate, so source text cannot create a record boundary. The section contains records only, with no leading prose or enclosing fence.
+| Line | Content | Rule |
+|---|---|---|
+| H3 | The row's complete model-facing identity and canonical READ address, then ` · ` and its `logTokens` charge ({§packet-token-accounting}). | Always present; nothing else repeats the identity, the operation, or the charge. |
+| written | The request as the language writes it ({§heading-slot-order}): the operation or runtime, every operand in the packet's canonical spelling ({§log-address-metadata}), marks, metadata blocks, matcher, aside. No fence, no body. | Present for every operation and execution row; absent on `error` and `extension` rows. |
+| facts | One strict JSON object of result facts in stable alphabetical order. | Present only when a fact exists; it never re-encodes the written line. |
+| body | Coordinate-prefixed lines. | Present when the row is visible. |
+
+The written line is the model's own request, so a matcher such as `/\bhello\b/i` returns exactly as it was written, never JSON-quoted. Absent fields are not invented. Every physical body line retains its canonical numeric `N:` or anchored `@hash N:` coordinate, so source text cannot create a record boundary. The section contains records only, with no leading prose or enclosing fence.
 
 §log-address-metadata **Addresses name their relationship, not the row's producer.**
 
-| Metadata | Meaning | Order |
+| Spelling | Meaning | Where |
 |---|---|---|
-| `path` | The operation's addressed operand, matching `OP (path)`: read resource, mutation subject, message recipient, or executor operand. Explicit and automatic READs use the same field. Pathless operations omit it. | First |
-| `from`, `to` | COPY/MOVE's two operand selections, each retaining its optional scope; neither replaces actor attribution or is repeated as `path`. | First, in that order |
-| `stream` | An executor invocation's separately created output address, never a READ's alternative spelling of `path`. | Remaining facts |
-| `resource` | A distinct returned resource under {§operation-resource-receipt}. | Remaining facts |
+| `OP (path)` | The operation's addressed operand: read resource, mutation subject, message recipient, or executor operand. Explicit and automatic READs are written identically. Pathless operations are written bare. | Written line |
+| `COPY (from) <marks> (to) <marks>` | COPY/MOVE's two operand selections, each retaining its optional scope; neither replaces actor attribution. | Written line |
+| `stream` | An executor invocation's separately created output address, never a READ's alternative spelling of its operand. | Facts |
+| `resource` | A distinct returned resource under {§operation-resource-receipt}. | Facts |
 
 Nested mutation effects and delivered attachments name their resource with `path`.
 These packet spellings do not rename the submitted AST, durable operation results,
@@ -2186,7 +2227,7 @@ Field absence carries defaults: `origin` is omitted for the owning model, `sourc
   records the exact READ coordinates sent without controlling retention. Missing immutable bytes are an
   internal integrity failure, never silently dropped content. No ejection message or permanent teaching is
   added. These stable curation weights are not provider-token measurements ({§tokenomics-render-weight-budget}).
-- §packet-token-accounting Every row reports one `logTokens` charge: its complete materialized H3, metadata, visible body, and selected native attachment. The completed record is measured to a fixed point, including the accounting field itself. No `tokensBody`, `tokensMetadata`, or `tokensActive` field is serialized. Hidden text is not charged; metadata-only rows still have a reclaimable charge. Source/FIND-item `tokens` measure source content, not the observation's context footprint. A FIND's nonzero `itemsTokenTotal` weighs the complete matched set; a nonzero `returnedItemsTokenTotal` appears only when the returned page differs. All use stable curation weights, not provider tokens or dollars. Native component accounting follows {§packet-attachment-parts}; ordinary addressability and truthful errors follow {§log-wire-format}.
+- §packet-token-accounting Every row reports one `logTokens` charge on its H3 ({§log-wire-format}): its complete materialized H3, written request, facts, visible body, and selected native attachment. The completed record is measured to a fixed point, including the accounting field itself. No `tokensBody`, `tokensMetadata`, or `tokensActive` field is serialized. Hidden text is not charged; metadata-only rows still have a reclaimable charge. Source/FIND-item `tokens` measure source content, not the observation's context footprint. A FIND's nonzero `itemsTokenTotal` weighs the complete matched set; a nonzero `returnedItemsTokenTotal` appears only when the returned page differs. All use stable curation weights, not provider tokens or dollars. Native component accounting follows {§packet-attachment-parts}; ordinary addressability and truthful errors follow {§log-wire-format}.
 
 ### §retrieval-packet-metadata READ/FIND packet metadata
 
@@ -2250,7 +2291,7 @@ single line past the end, a reversed range, empty content, a command's log row
 §rejected-emission-entry A rejected provider response is not `turnOps`: it never became an admitted turn program. The one bounded invalid-emission recovery item under {§emission-admission} has `attrs.kind="emissionAttempt"`, `origin="model"`, the canonical model-facing `/attempt` leaf, and the exact latest rejected response. The packet does not duplicate that identity as `kind` metadata. It is born durably body-suppressed and projected visibly only in the informed recovery packet; every other rejected attempt remains forensic-only.
 
 - §log-coordinate-hierarchy **Log coordinates are a hierarchical prefix; the trailing slash is optional** — a coordinate is `loop/turn/sequence`, and a PARTIAL coordinate selects its descendants: `log:///1` = loop 1's rows, `log:///1/2` = turn 1/2's rows, `log:///1/2/3` = the one row. A full coordinate is always three parts, so a one- or two-part path is unambiguously a prefix — the trailing slash is an optional alias (`log:///1/2` ≡ `log:///1/2/`), uniform with ```` ```READ (worker:///docs/) ````. A complete `[start-end]` segment in any numeric coordinate slot selects that inclusive decimal interval; brackets elsewhere retain ordinary path-glob meaning. Every rendered row appends one canonical model-facing leaf: the native operation name or invoked executor name, `/attempt` for a rejected emission. An executor leaf is derived from the durable submitted statement (its `runtime`), never an internal dispatch type or the current tool registry. Digits and punctuation in executor names remain part of the leaf. The leaf names identity rather than adding a resource level. Exact consumers tolerate the unsuffixed three-part shorthand; when supplied, the case-insensitive leaf is authoritative and a disagreement resolves 404. READ anchors use the canonical suffixed identity even when addressed by shorthand. Typed entry materialization therefore resolves as `/READ` while retaining its durable `EDIT` event ({§exec-entry-sink}). `log:///1/2/*` still selects the turn's item rows, while `log:///**/READ`, `log:///**/python3`, and `log:///**/attempt` deliberately filter canonical leaves. Executor outputs instead use workspace-wide claims such as `sh:///ab3d5678#stdout` ({§execution-output-identity}); their source operation has log coordinates, but resource lifetime and identity are independent of that observation. Error pointers, Problem instances, source attribution, and search use this same identity; client stream coordinates retain the numeric triple. Within a turn, sequence is arrival order. Inbound SEND rows publish before the program runs ({§message-arrival}); a turn receiving messages holds the first at `log:///L/T/1/SEND`, followed by further arrivals oldest first, then the model's operations ({§packet-current-turn} names `L/T`).
-- §log-curation-folder-idiom **Log curation speaks the folder idiom; a zero-match sweep is a no-op success** — KILL takes a concrete coordinate or a path-glob, and a **trailing slash or a partial coordinate means "the contents"** ({§log-coordinate-hierarchy}), like a folder-scoped FIND: ```` ```KILL (log:///1/2) <1,-1> ```` suppresses turn 1/2's bodies. A **well-formed selection that matches nothing is 204 with `matched: 0`**; a successful sweep's rx carries `matched: N`. A targetless KILL is 400.
+- §log-curation-folder-idiom **Log curation speaks the folder idiom; a zero-match sweep is a no-op success** — KILL takes a concrete coordinate or a path-glob, and a **trailing slash or a partial coordinate means "the contents"** ({§log-coordinate-hierarchy}), like a folder-scoped FIND: ```` ```KILL (log:///1/2) <1,-1> ```` suppresses turn 1/2's bodies. A **well-formed selection that matches nothing is 204 with `matched: 0`**; a successful sweep's rx carries `matched: N`. Parameterless KILL instead requests completion ({§kill-conclusion}).
 - §log-curation-set-selection **Row selection and body scope are independent** — target/glob and an optional heading pattern (```` ```KILL (log:///**) [{"pattern": "~stale"}] ````, every dialect a FIND over rows accepts) compose by intersection into the affected row set. An optional `<L>` or `<SL,EL>` then intersects each selected canonical body; it never paginates or changes the selected set. Thus ```` ```KILL (log:///**/READ) <17,-1> ```` may change long READs and no-op on short ones while reporting every selected row in `matched`.
 
 §log-kill-meta-operation **A log KILL changes working context, never the underlying resources or execution history.** Receipt visibility depends on the target and result, not the producer, attribution, or age of the turn:
@@ -2559,7 +2600,7 @@ Log history preserved — `log_entries` stores path tuple as text, not FK to `en
 SEND AST: `{ op: "SEND", target: ParsedPath | null, body: SendBody | null, metadata, lineMarker }`.
 
 - **Message:** SEND delivers to an actor, endpoint or exact message address. Targetless SEND answers observed Open Messages.
-- **Workflow:** WAIT yields; successful reply delivery and settled work permit completion at the end of the whole program. NOTE retains memory.
+- **Workflow:** WAIT yields. Parameterless KILL requests successful completion ({§kill-conclusion}). NOTE retains memory.
 
 §worker-obligations A worker holds its unresolved children and open non-detached
 streams (`worker_obligations`); `loop_obligations` names them per loop. The
@@ -2573,17 +2614,20 @@ same durable liveness.
 | Worker or loop already cancelled/terminal | Preserve that result. |
 | Administrative program | Finish its transaction without adjudicating another model loop's work. |
 | New unpublished message | Continue; publish it in the next packet. |
-| Live work and either WAIT or no unanswered messages | Park the same loop; message arrival, child or stream settlement, or stream cadence wakes it. |
-| WAIT without live work | Continue; never invent a future wake. |
+| Fresh operation/parser failure, without an authored WAIT | Continue before any automatic parking. |
+| Neither an authored WAIT nor an eligible completion request ({§kill-conclusion}) | Continue, regardless of earlier replies or live work. |
+| Live work and either WAIT or an eligible completion request | Park the same loop; message arrival, child or stream settlement, or stream cadence wakes it. No final-answer body is delivered while joining. |
+| WAIT without live work | Continue; never invent a future wake. The first such WAIT is an honest yield and its row says only `Nothing is in flight. Continuing.`; a second in the same loop is the model waiting on a wake nothing can send, so its own row instead names what WAIT is for and what to reach for — `WAIT doesn't wait unless there's a child worker or stream to wait on. Use schedule for specific timing decisions.` The correction rides the operation's own result, which is the surface the model is certain to read (operator, 2026-09-22). |
 | Unanswered messages | Continue. |
 | Unobserved operation results, failures, child results or stream conclusions | Continue; the next packet presents them. |
-| No outstanding messages, live work or unobserved results | Conclude successfully, without a synthetic operation. |
+| Eligible completion request with no outstanding messages, live work or unobserved results | Conclude successfully. |
 
-An empty emission is handled by {§empty-turn}, not this completion rule. Ordinary strikes,
-cycles and execution limits remain independent. NOTE and successful KILL do not themselves
-require another observation turn. Failed KILL and every other operational result do.
+An empty emission is handled by {§empty-turn}. Ordinary strikes, cycles and
+execution limits remain independent. NOTE and successful targeted KILL do not themselves
+require another observation turn, but neither requests completion. Failed KILL
+and every other operational result require observation.
 
-§loop-response-messages **A response is a recorded delivery.** A successful SEND reply records
+§loop-response-messages **A response is a recorded delivery.** A successful SEND reply or admitted final KILL answer records
 the exact message addresses it answers. All replies remain independently recoverable in
 message history, in execution order, regardless of producer. An actor-addressed SEND that
 does not answer a message, WAIT, NOTE, asides, inherited rows and ambient observations are
@@ -2598,7 +2642,7 @@ conclusion carries its execution outcome under {§send-undelivered-child-term},
 | `NULL` | The model's own terminal or an engine verdict whose exact result already carries the story. | No authorship marker. |
 | `cancel` | The structured scope was explicitly cancelled, through the client or worker KILL ({§methods-loop-cancel}). | COLLECT and the termination delta prepend a cancellation marker to the exact Problem's presentation, so cancellation cannot masquerade as a deliverable. The model's prior log rows remain untouched. |
 
-The engine's failure terminals — **500** (strike threshold) and **508** (cycle), {§engine-rails} — are never the model's to pick; they are the engine ruling the loop failed. The model answers, waits or cancels its scope; the engine derives the lifecycle outcome from that state.
+The engine's failure terminals — **500** (strike threshold) and **508** (cycle), {§engine-rails} — are never the model's to pick; they are the engine ruling the loop failed. The model answers, waits or cancels its scope; the engine derives the lifecycle outcome from that state. The ruling never softens, and it never destroys the evidence: every terminal cites what the model last left unconcluded ({§terminal-evidence}).
 
 Disposition outcomes follow {§wait-obligation-matrix},
 {§completion-joins-live-work}, and {§completion-defers-to-results}. Strike
@@ -2615,47 +2659,77 @@ accounting and model-visible failure evidence remain separately owned by
   answers its ordinary factual 501 without grafting a guessed recovery onto it.
 - §send-response-receipt **A reply records exactly which messages it answers.** A successful
   reply carries `answers`, the immutable message addresses it answered, not recipient actors. Targetless SEND
-  answers this loop's published, unanswered messages, oldest first. SEND to an exact message
+  answers this loop's published, unanswered messages, oldest first. When none remain,
+  a nonempty targetless SEND replies to the loop's original published message, so a
+  follow-up can revise its answer. A targetless SEND with no body content or attachments
+  delivers nothing, carries no `answers`, and cannot erase an earlier reply. An accepted
+  parameterless KILL answer uses the same reply routing and empty-body rules. SEND to an exact message
   address answers only that message; SEND to an actor endpoint remains ordinary communication
   and answers no assignment implicitly. An unpublished arrival cannot be answered by the
   targetless shorthand. Failed delivery answers nothing. Reply accounting reads executed
   delivery evidence, never log visibility or the mere existence of a later SEND.
-- §prose-conclusion **A markdown answer is the answer, and concluding is deliberate.** An admitted
-  response concludes only when it is wrapped whole in one `markdown` or `md` fence — the form
-  `plurnk.md` teaches — and has no operation, attempts none ({§operation-attempt}), was not cut at
-  the output allowance, is not empty, and says something outside its quotations ({§quotation}: a
-  reply that is nothing but quoted material is a misfenced program) (operator, 2026-09-18, #761;
-  fence required 2026-09-21). A response that merely failed to yield an operation is NOT an answer:
-  it is non-responsive and falls to {§empty-turn}, taking one strike while the loop continues. That
-  asymmetry is the point — a mis-fenced operation costs a turn, never the run, because a weak model
-  under pressure fences badly and a whole rollout must not end on a typo. An offset operation fence
-  is one of those quotations and disqualifies nothing: `plurnk.md` tells the model to offset an
-  example it does not intend to execute (operator, 2026-09-21). The engine
-  admits it as a targetless SEND whose body is the trimmed content, positioned on line 1. It
-  answers the open messages, reaches clients and a parent exactly as a SEND does, and meets the
-  completion barrier as a SEND does ({§completion-joins-live-work},
-  {§completion-defers-to-results}). Reasoning NOTEs ride with it. The model is taught
-  "respond without performing any OPs" and is never taught the SEND. A reply wrapped whole in one
-  `markdown` or `md` fence is delivered as that fence's content ({§quotation}). Its row is stored as the
-  SEND that delivers it (reply accounting, delivery and clients read SEND rows) but carries
-  `attrs.answer = "prose"` and `resource: ops://<worker>/<loop>`, and is addressed and rendered
-  under the leaf `answer` (`log:///1/2/2/answer`), never as a SEND the model did not write.
+- §kill-conclusion **Successful completion requires an explicit parameterless KILL.** The response
+  contains exactly one KILL without a target, scope, matcher or metadata, no hard
+  parse error or lost boundary, and was not cut at the provider's output allowance.
+  The operation limit must admit the entire program.
+  SEND, NOTE (outside text included, {§response-text-note}) and log-targeted KILL may
+  accompany it; every other operation requires continuation. This tolerance is unadvertised:
+  model teaching requests KILL alone. Reasoning-side NOTEs remain ordinary notes.
+  An aside is allowed. After the program settles, {§wait-obligation-matrix} admits the
+  completion or returns a non-striking continuation/parking receipt explaining the
+  outstanding condition. Valid sibling operations always execute. Only an admitted
+  KILL delivers its literal body through {§send-response-receipt}; a deferred body
+  remains forensic evidence, never a stored draft to replay automatically. An empty
+  KILL concludes without repeating an already-delivered answer, but cannot abandon an
+  unanswered message. SEND, NOTE and targeted KILL never request successful
+  completion. New arrivals still guard the terminal transition atomically
+  ({§completion-defers-to-messages}); an arrival concurrent with an accepted reply
+  remains unanswered and keeps the loop running. No implicit successful exit exists.
+- §response-text-note **Text outside the operations is the model's NOTE, never delivered.** Each
+  span {§response-text} supplies becomes an ordinary NOTE in source order, unmarked, so the
+  model's own log files its self-narration where it belongs. It is not an authored operation:
+  {§empty-turn} still strikes a turn that holds only text, and the exact emission is retained.
+  Delivered as a SEND, the text read as an answer and confirmed that speaking outside operations
+  works; reported as a count of invalid characters, it sent a model to repair its prose into
+  live operations (`demo-show-dont-run-qdN9u2` executed the KILL it meant to show). A NOTE
+  neither delivers nor concludes (operator, 2026-09-22). This is the far end of the teaching
+  scale: text outside every operation breaks the first rule of `plurnk.md` — *"YOU MUST ONLY
+  use valid Plurnk OPs"* — and takes the largest reinterpretation, while a
+  departure as small as a missing closer is read as meant ({§closer-fallback}).
 - §loop-answer **A loop's address is what it said.** READ `ops://<worker>/<loop>` resolves to
-  the latest reply the loop gave to the message that started it: a prose conclusion's text or
-  the body of a SEND that targeted that message. A running loop without one is 425; a loop that
-  ended without one is its terminal problem (404 when it ended 2xx). `ops://<worker>/<loop>/<turn>`
-  remains that turn's emission. A concluded child's `loop_termination` row to its parent carries
-  `answer: ops://<child>/<loop>` beside its status. Witness: `test/intg/loop-answer.test.ts`.
-- §empty-turn **A response with no operation that is not an answer is a turn, not a retry.**
-  When the parser finds no operation and no other hard error, and the response is not an
-  answer under {§prose-conclusion} — an operation attempt, prose cut at the output allowance,
-  or an empty response — it is admitted as an empty turn (operator, 2026-09-12): its text and
-  reasoning are stored like any turn's (`ops://<worker>/`, `reasoning://<worker>/`), the model's own message
-  stays in the next packet's history, that packet carries one `turn_no_operations` notice and
-  any {§bare-heading-advisory} notices, the turn continues at 102, and the strike rail counts
-  one progress-contract strike, so a model that only talks strikes out at the ordinary
-  threshold instead of being resampled three times on an identical packet. Its fingerprint is
-  the empty program, so repeated empty turns also trip cycle detection.
+  the latest reply the loop gave to the message that started it: the body of a SEND
+  or accepted final KILL that answered that message. A running loop without one is 425; a loop that
+  ended without one is its terminal problem (404 when it ended 2xx) — and that problem cites what
+  the model last left unconcluded, so the loop's own address never reports silence from a loop that
+  spoke ({§terminal-evidence}). `ops://<worker>/<loop>/<turn>`
+  remains that turn's emission. A concluded child's `loop_termination` row to its parent
+  READs this same loop resource. Witness: `test/intg/loop-answer.test.ts`.
+- §empty-turn **No authored response operation is a recoverable turn, never completion.**
+  Count parsed response operations before outside-text and reasoning NOTEs join them;
+  neither enters the count. When none exist and no boundary was lost, retain the turn and its raw
+  sources and count one progress-contract strike, whether or not the turn carried text
+  ({§response-text-note}). The strike sends no notice of its own; the threshold terminal is
+  where it becomes visible, and it says why ({§engine-rails}). An empty turn uses its exact
+  text as the cycle fingerprint ({§engine-cycle-evidence});
+  different empty programs are not a repeated cycle merely because neither contained
+  operations. Lost-boundary handling remains {§unparsed-tail-boundary}; no confirmation
+  token or private retry is invented here.
+- §terminal-evidence **A terminal rules the loop over; it does not decide the model said nothing.**
+  Every engine terminal — strike threshold (500), cycle (508), turn ceiling (429), loop timeout
+  (504), provider unavailable ({§provider-recovery}) — keeps its status and its authorship: the
+  engine ruled, the model did not conclude, and no terminal is ever softened into a 200 the model
+  never declared. What a terminal may not do is discard the last thing the model said. When the
+  loop's last inference turn performed no authored operation in either response or
+  reasoning and kept text, its Problem Details
+  carries the extension member `unconcluded`, the
+  `ops://<worker>/<loop>/<turn>` address of that emission. It is a citation, never the bytes
+  ({§turn-ops-entry}: the reader READs the source, and an emission of any length never rides
+  wholesale into a parent's packet). The member is named for what it is — an emission left
+  unconcluded — and never `answer`: the harness cannot warrant that text is complete or final,
+  because it did not conclude under {§kill-conclusion}. Earlier deliveries remain delivered;
+  the citation neither sends them again nor destroys them. A terminal whose last inference
+  turn performed authored operations carries no `unconcluded`: an absent member is not an
+  empty one. Attachment is owned by the one terminal seam.
 - §metadata-ignored **Options a scheme does not take are dropped, not refused.** A READ, FIND,
   EDIT or KILL carrying `[metadata]` for a scheme whose manifest takes none runs without it,
   and the packet carries one `metadata_ignored` notice naming the scheme (operator,
@@ -2663,40 +2737,26 @@ accounting and model-visible failure evidence remain separately owned by
   path; it is lifted into the matcher at parse time ({§matcher-option}). SEND recipients,
   executions, WORK and FORK own their input and receive it whole ({§send-resource-attachments},
   {§env-option}); a key they do not take is their own 400.
-- §send-looks-like-operation **A reply never begins with an operation heading.** When a model's
-  untargeted SEND has, as its first non-blank line, a line that parses alone as one clean
-  heading naming an operation this worker could perform — a Plurnk operation, or a registered
-  executor or MCP service — dispatch refuses it 400 `send-looks-like-operation`, naming the
-  `heading`, and delivers nothing. Since the fences chapter's unlabeled-fence SEND was retired
-  ({§interstitial-fence}), this guards only an explicit `SEND` block; a heading written outside
-  any fence is prose with the parser's own advisory ({§bare-heading-advisory}), and an emission
-  made only of such lines is an empty turn carrying those advisories ({§empty-turn}). This is
-  admission, not promotion: the line is never run as the operation it resembles, and the neutral
-  recovery says only where each intent belongs (an operation on the fence line, a quoted example
-  inside a delimited SEND body). A first line that does not parse alone (prose after the word), a
-  name no registry knows, or an inner fence is an ordinary reply; so is a heading whose
-  only irregularity is a multi-word sigil-less matcher after the path (`READ (belfry.md)
-  returned nothing because the file is empty.`), which {§naked-pattern} would otherwise lift
-  as a literal — on a reply's first line that is prose. Origin: the 2026-09-11 dogfood,
-  where four operations on the line after their fences were delivered as four 200 replies and the
-  loop then parked fifteen minutes on receipts that could never arrive.
 - §send-idle-turn **NOTE is memory, not a yield.** NOTE does not imply parking.
-  With unanswered messages it continues; after replies and observation it may be the only
-  operation in the program that concludes. Repetition remains subject to {§engine-cycle-evidence}.
+  A NOTE-only response does not request completion, even after every message is answered.
+  Repetition remains subject to {§engine-cycle-evidence}.
 - §send-premature-terminate **Completion follows observation.** Every fired operation except
   SEND, NOTE, WAIT and successful KILL requires a subsequent packet. This barrier uses durable
   executed evidence, not curated rows. Fast completion, an empty result or curation cannot
   erase it. New arrivals are protected by {§completion-defers-to-messages}; no terminal verb
   or prose overrides this rule.
-- §completion-joins-live-work **Answered work still joins its live obligations.** Once all
-  observed messages are answered, live children, non-detached streams park the same loop
-  as WAIT does. Each ordinary wake presents the newly settled state; completion is evaluated
-  again after the next program. KILL owns cancellation; a reply never cancels work implicitly.
+- §completion-joins-live-work **A completion request joins its live obligations.** An eligible
+  parameterless KILL parks on live children or
+  non-detached streams, as WAIT does. Ordinary programs continue regardless of earlier
+  replies. Each wake presents the newly settled state; the next program expresses its
+  own disposition. Only targeted KILL owns cancellation; parameterless KILL never
+  cancels work and delivers no final answer while joining.
 - §completion-defers-to-results **Results keep the loop running until observed.** Same-turn
   operations and failures, plus undelivered child or stream conclusions, require the next
-  packet. This is ordinary continuation, not a strike or a synthetic refusal receipt.
-  The already-delivered answer remains delivered. If observation warrants no further work
-  or revision, a NOTE or curation-only program can conclude without repeating the answer.
+  packet. This is ordinary continuation, not a strike. A premature parameterless KILL
+  receives a factual continuation receipt without delivering its body. Earlier SEND
+  replies remain delivered. If observation warrants no further work or revision, a
+  lone empty parameterless KILL requests completion without repeating an earlier answer.
 - §send-administrative-terminal **Administrative programs close their own transaction.**
   Their caller closes the administrative loop after execution; no terminal operation is
   manufactured. Initialization runs in the model loop without concluding it.
@@ -2951,14 +3011,14 @@ two states and no others:
 | state | what the model receives |
 |---|---|
 | active | nothing in the Log. The `## Delegation` stream pointer names the stream with each channel's size and its growth since the last packet ({§child-orientation}); the model READs any range it wants, and every READ of a stream channel carries `terminal: false` while it runs and `terminal: true` once it has concluded, so an empty page is never mistaken for a finished command that printed nothing (operator, 2026-09-13). |
-| terminal | ONE `origin=_plurnk` READ at the execution's channel address, born visible, that is exactly a markerless READ of the channel — its bounded first page ({§read-selection-projection}, the whole channel when it fits, the channel's own mimetype), the `range` or `region`, terminal status and Problem, `terminal: true`, and any producer-supplied integer `exitCode`. The packet identifies the read resource with `path`, exactly as an explicit READ does ({§log-address-metadata}). |
+| terminal | ONE `origin=_plurnk` READ at the execution's channel address, born visible, that is exactly a markerless READ of the channel — its bounded first page ({§read-selection-projection}, the whole channel when it fits, the channel's own mimetype), the `range` or `region`, terminal status and Problem, `terminal: true`, and any producer-supplied integer `exitCode`. The packet writes the read resource as its operand, exactly as an explicit READ does ({§log-address-metadata}). |
 
 §stream-observation-result **One liveness fact.** The durable READ result owns
 `terminal`, derived from its selected channel's state, for explicit and automatic
 observations alike, independently of mimetype: `active` gives false, `closed` or
 `errored` gives true, and `static` has no streaming liveness field. Packet
-projection preserves that Boolean and any included
-integer `exitCode`, even for an empty body. An automatic observation's atomic
+projection preserves that Boolean, any included
+integer `exitCode`, and a producer's `page` receipt ({§executor-page-receipt}), even for an empty body. An automatic observation's atomic
 publication transition consumes the same result flag; private log attributes
 retain only the publication offset, not a second liveness value.
 
@@ -3334,10 +3394,10 @@ No generator. SQLite-optimal: STRICT (3.37+), `INTEGER PRIMARY KEY` aliasing, ex
 | §db-process-triggers Processes beside their owners | A trigger that writes rows — a cascade, a capture, an ambient event, a publication cursor, a landed curation — is a process, not shape. It is declared as an `-- INIT: <trigger name>` block in the `.sql` file beside the statements that fire it (`ambient.sql` for the ambient feed, `LoopLifecycle.sql`, `Turn.sql`, `Engine.sql` for model calls, `_entry-crud.sql`, `Log.sql`, `ChannelWrite.sql`), as `DROP TRIGGER IF EXISTS` then `CREATE TRIGGER`, so the definition is current on every open of a database whose shape is current. `MIGRATE` always precedes `INIT` and `INIT` runs on the writer only, so a process may reference any table regardless of file order and never runs on the read pool. `test/intg/schema-composition.test.ts` fails on a baseline trigger that writes, an `INIT` trigger that only guards, a block not named after its trigger or not dropping first, and a live trigger set that differs from the declared set after a first and a second open. |
 | §db-fk-indexes Foreign-key check paths | Every foreign-key column a delete, cascade, or parent replacement can check carries an index (partial where the column is nullable), and no registry statement's plan scans a growing table: `test/intg/schema-query-plans.test.ts` runs `EXPLAIN QUERY PLAN` over every `-- PREP` statement against the baseline and fails on a `SCAN` of a growing table, except statements that read a whole table by design (digest, startup recovery, whole-workspace listings, scheduled-loop claims). An index claim is a plan, never a grep of index names. |
 | §db-index-owners Every index has an owner | An explicit index earns its place one of three ways: a registry statement's plan uses it, its leading column is a foreign key whose check it serves, or it enforces uniqueness. The same test fails on any other index, naming it: an index nobody reads is a write on every insert. Duplicates of a `UNIQUE` constraint's own index and sort-only indexes no plan selects were removed on this rule; a column no statement reads (`symbol_refs.col`, `ambient_events.created_at`) is not stored. |
-| §db-maintenance-optimize Statistics at shutdown | The daemon's last database step before the caller closes SQLite is `PRAGMA optimize` on the writer (`maintenance_optimize`), so `sqlite_stat1` reflects tables the connection planned against, bounded by SQLite's own analysis limit; a failure there is a reported shutdown error, never silent. Retention runs before it under the operator's policy ({§retention-policy}); no explicit checkpoint and no periodic `ANALYZE` run. |
+| §db-maintenance-optimize Statistics at shutdown | The daemon's last database step before the caller closes SQLite is `PRAGMA optimize` on the writer (`maintenance_optimize`), so `sqlite_stat1` reflects tables the connection planned against, bounded by SQLite's own analysis limit; a failure there is a reported shutdown error, never silent. Retention runs before it under the operator's policy ({§retention-policy}) and ends with a WAL truncation ({§db-space-reclamation}); no periodic `ANALYZE` runs. |
 | §db-space-reclamation The daemon keeps its own file healthy | `PLURNK_SERVICE_AUTO_VACUUM` (`incremental`, the default, or `none`) names the mode the daemon keeps its file in. At start, before any drain, a database in another mode is converted (set the mode, one `VACUUM`, which rewrites the file and needs free disk about its size) and the journal says so with page counts before and after. Under `incremental`, every retention pass ends by stepping `PRAGMA incremental_vacuum` to completion once free pages reach `PLURNK_SERVICE_RECLAIM_MIN_FREE_BYTES` (0, the default, = every pass), and reports `reclaimedPages`; below the floor, free pages stay for SQLite to reuse. Under `none` the file never shrinks and freed pages are reused. No operator step is involved beyond the knobs. The WAL stays bounded by SQLite's automatic checkpoint (#764). |
 | §content-store Every body is stored once | `contents` holds each settled body once, addressed by its SHA-256, however many channels, workspaces, forks or derivations carry it; rows are immutable. `entry_channel_rows` points a settled channel at its body and keeps an active stream's body as a private buffer until it settles, when it is interned. Every reader and writer uses the `entry_channels` view, whose `INSTEAD OF` triggers intern bodies, refuse a bound `content_hash` that is not the content's, and write each column group only when it changed, so a search attachment is never a representation write. SQLite counts no changes for a view, so a write that must know whether its channel exists returns the channel's name; an outer join cannot flatten the view, so the two statements that need one read `entry_channel_rows` and `contents` directly. `derivation_fts` is an external-content index over `derivation_texts` (a derivation joined to its body); `derivations.content_id` names the indexed text, and the triggers in `_entry-fts.sql` move the index with it and forget it on delete. A body no channel holds and no derivation indexes is collected by retention under `PLURNK_SERVICE_COLLECT_CONTENTS` (1). Witnesses: `test/intg/retention.test.ts`, `test/intg/entries.test.ts`, `test/intg/fulltext-index.test.ts`. |
-| §retention-policy Retention is the operator's policy; information is kept by default | `Retention` (`src/server/Retention.ts`, statements in `Retention.sql`) reads ten knobs from `.env.defaults` once at daemon construction (the two storage knobs are {§db-space-reclamation}) and runs four set statements in dependency order — on `PLURNK_SERVICE_RETENTION_INTERVAL_MS` cadence while the daemon runs (0 = shutdown only) and once more at shutdown before `PRAGMA optimize`. `PLURNK_SERVICE_RETAIN_PACKET_TURNS` (-1 = every packet) and `PLURNK_SERVICE_RETAIN_PACKET_MS` (-1 = no age limit) retire a completed turn's packet composition (`turn_sections`, {§packet-items}) once it is beyond the newest N packet-bearing turns of its loop or older than the age; the turn, its bag, its log rows and its accounting stay, and an open turn is never retired. `PLURNK_SERVICE_COLLECT_PACKET_ITEMS` (1) collects items no composition references. `PLURNK_SERVICE_COLLECT_CONTENTS` (1) collects stored bodies nothing holds ({§content-store}), after the collectors that release them. `PLURNK_SERVICE_COLLECT_DERIVATIONS` (1) collects derivations no channel, turn source, or log row cites — superseded editions — with their symbols (cascade) and their full-text shadow (`derivations_delete_fts`, a process trigger beside the FTS statements, on every delete path). `PLURNK_SERVICE_RETAIN_RESPONSE_TURNS` (-1) and `PLURNK_SERVICE_RETAIN_RESPONSE_MS` (-1) retire a settled call's response body (`model_call_responses`) once it is beyond the newest N body-bearing calls of its loop or its turn is older than the age; the call's identity, failure, capacity, admission and accounting stay, and the digest renders such a call request-only. Under the shipped defaults nothing that is information leaves; only what no row references. A malformed knob refuses daemon construction. Witness: `test/intg/retention.test.ts`. |
+| §retention-policy Retention is the operator's policy; information is kept by default | `Retention` (`src/server/Retention.ts`, statements in `Retention.sql`) reads ten knobs from `.env.defaults` once at daemon construction (the two storage knobs are {§db-space-reclamation}) and runs four set statements in dependency order — on `PLURNK_SERVICE_RETENTION_INTERVAL_MS` cadence while the daemon runs (0 = shutdown only) and once more at shutdown before `PRAGMA optimize`. `PLURNK_SERVICE_RETAIN_PACKET_TURNS` (-1 = every packet) and `PLURNK_SERVICE_RETAIN_PACKET_MS` (thirty days; -1 = no age limit) retire a completed turn's packet composition (`turn_sections`, {§packet-items}) once it is beyond the newest N packet-bearing turns of its loop or older than the age; the turn, its bag, its log rows and its accounting stay, and an open turn is never retired. `PLURNK_SERVICE_COLLECT_PACKET_ITEMS` (1) collects items no composition references. `PLURNK_SERVICE_COLLECT_CONTENTS` (1) collects stored bodies nothing holds ({§content-store}), after the collectors that release them. `PLURNK_SERVICE_COLLECT_DERIVATIONS` (1) collects derivations no channel, turn source, or log row cites — superseded editions — with their symbols (cascade) and their full-text shadow (`derivations_delete_fts`, a process trigger beside the FTS statements, on every delete path). `PLURNK_SERVICE_RETAIN_RESPONSE_TURNS` (-1) and `PLURNK_SERVICE_RETAIN_RESPONSE_MS` (thirty days) retire a settled call's response body (`model_call_responses`) once it is beyond the newest N body-bearing calls of its loop or its turn is older than the age; the call's identity, failure, capacity, admission and accounting stay, and the digest renders such a call request-only. Under the shipped defaults the durable record is kept forever, while packets and response bodies — transient evidence — are collected after thirty days, so a daemon left running for months stops growing (#788). A malformed knob refuses daemon construction. Witness: `test/intg/retention.test.ts`. |
 
 - DDL = storage truth; JSON Schemas = wire truth. They are allowed to differ where ergonomics demand.
 - §entry-identity-no-null **Identity components are never NULL.** `(workspace_id, scheme, authority, pathname)` is a unique key. `workspace_id` references the workspace directly with cascading deletion. Namespace schemes use empty authority; resource schemes retain their canonical authority. File members use nonempty `scheme="file"` and render as bare paths. Registration refuses `storedScheme: null`.
@@ -3750,7 +3810,10 @@ The database may be released only after the final settlement barrier resolves.
 (`PLURNK_SERVICE_STOP_TIMEOUT_MS`, default 30000): past the deadline each wait
 is abandoned with a named error instead of hanging the daemon on a child that
 never closes. A wedged child costs a forced shutdown; it must never cost an
-unbounded one.
+unbounded one. When the teardown settles, success or failure, the process ends
+itself: `0` after a clean teardown, `1` after a reported one. A handle an abandoned
+wait left alive never keeps a stopped daemon running; the supervisor's kill is a
+backstop, not the exit.
 
 ```mermaid
 flowchart LR
@@ -4487,7 +4550,7 @@ flowchart TD
   | Status | Outcome |
   |---|---|
   | 100 / 102 | Queued / running |
-  | 202 | WAIT or answered work joining a live obligation ({§wait-obligation-matrix}, {§worker-wait-timing}) |
+  | 202 | WAIT or an eligible final response joining a live obligation ({§wait-obligation-matrix}, {§worker-wait-timing}) |
   | 200 | Messages answered, results observed, held work settled |
   | 499 | Worker-scope or client cancellation |
   | 429 | Turn allowance exhausted |
@@ -4496,7 +4559,9 @@ flowchart TD
   | 504 | Loop timeout or exec-timeout restamp |
 
   An empty WAIT continues at 102. The exact terminal result retains its Problem;
-  status classes are not catch-all replacements for that evidence.
+  status classes are not catch-all replacements for that evidence. No failing status
+  here is ever softened because the model wrote something the harness could not read;
+  every one of them cites it instead ({§terminal-evidence}).
 
 ### §env-delta The environment delta: what changed since the model last looked
 
@@ -4549,8 +4614,8 @@ ordinary operation evidence still reaches that child's direct parent.
 
 | Producer / event                                      | Durable occurrence                                                                                     | Observer projection                                                                                                                |
 | ----------------------------------------------------- | ------------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------- |
-| §env-delta-child-activity Direct-child activity       | Child-authored final EDIT, COPY, MOVE, SEND, executor invocation, WORK, FORK, and non-log KILL receipts, including failures. `_plurnk` initialization, maintenance, and operation turns stay with the worker. A reply already delivered to the parent uses its reply occurrence instead ({§message-reply-delivery}). | Direct parent only; one exact attributed row born body-suppressed. Incoming message projections ({§message-arrival}), NOTE, READ (including executor-output READs), FIND, BARE, WAIT, and log KILL never create activity occurrences. Provider reasoning, calls, rejected emissions, and turn sources do not cross automatically. |
-| §env-delta-child-termination Direct-child termination | The child's exact terminal loop result, except loops containing only `_plurnk` operation or maintenance turns. A conclusion before the first turn still reports, including failed spawns. `source` names the actor; the READ target selects its exact loop result ({§worker-loop-result}). | Direct parent only; an ordinary bounded READ projection of the retained occurrence, never a fresh lookup of the child's latest loop. The outcome's own body is visible within the ordinary READ bound; replies are separate messages and are never copied or deduplicated by content ({§worker-scheme-collect}). Excluded administrative loops create no pending child-result edge. |
+| §env-delta-child-activity Direct-child activity       | Child-authored final EDIT, COPY, MOVE, SEND, executor invocation, WORK, FORK, and targeted non-log KILL receipts, including failures. `_plurnk` initialization, maintenance, and operation turns stay with the worker. A reply already delivered to the parent uses its reply occurrence instead ({§message-reply-delivery}). | Direct parent only; one exact attributed row born body-suppressed. Incoming message projections ({§message-arrival}), successful targetless SEND without delivery ({§send-response-receipt}), NOTE, READ (including executor-output READs), FIND, BARE, WAIT, parameterless KILL, and log KILL never create activity occurrences. Provider reasoning, calls, rejected emissions, and turn sources do not cross automatically. |
+| §env-delta-child-termination Direct-child termination | The child's exact terminal loop result, except loops containing only `_plurnk` operation or maintenance turns. A conclusion before the first turn still reports, including failed spawns. `source` names the actor; the READ selects the exact loop ({§loop-answer}). | Direct parent only; bounded, initially visible READ under {§worker-scheme-collect}, never the child's potentially newer loop. Excluded administrative loops create no pending child-result edge. |
 | §env-delta-commons-mutation Commons mutation          | One successful resolved operation whose landed effects touch `worker:///...`.                         | Every existing worker; one body-suppressed row per observer, deduplicated with any lineage audience.                               |
 | §env-delta-filesystem-narration Project-file divergence | Runtime-owned reconciliation evidence remains in the runtime actor's own log.                        | No ambient observer row. Current content remains addressable and stale hash edits reject at their owned boundary.                 |
 | §env-delta-entry-materialization Executor `entry()` sink | The runtime records typed materialization evidence under its owning actor.                           | No ambient observer row unless the resulting operation itself is direct-child activity or a commons mutation ({§exec-entry-sink}). |
@@ -4718,7 +4783,7 @@ Retired terms stay retired: the lexicon guard rejects `thinking`, the unqualifie
 | inbound `SEND` from outside the workspace | budgeted head under {§message-projection} |
 | structured `EDIT` receipt or textual `COPY`/`MOVE` effects | complete receipt-owned join context |
 | every other nonempty body | head bounded independently by `PLURNK_SERVICE_PREVIEW_LINES` and `PLURNK_SERVICE_PREVIEW_CHARS` |
-| bodyless row | metadata only; no coordinate lines; `logTokens` includes any selected native part |
+| bodyless row | heading, written request, and any facts; no coordinate lines; `logTokens` includes any selected native part |
 
 §markerless-first-page **Every markerless retrieval takes the same implicit marker.** A marker's
 unit is whatever its projection counts, so `PLURNK_SERVICE_PREVIEW_LINES` is the first page of
@@ -4743,8 +4808,8 @@ READ and FIND own their range or pagination before packet rendering; the packet
 
 Every accepted message enters its recipient loop's inbox in arrival order, with its selected
 paths, and publishes exactly once at the next turn boundary. **Open Messages** lists the
-unanswered messages by their immutable source address (`path`) and optional causal `source`,
-not a log coordinate. Each arrival receipt's `resource` names that same retained source.
+unanswered messages by their immutable source address (`path`) and their sender — a causal
+`source`, or `"origin": "user"` for the operator's own ({§message-causal-source}) — not a log coordinate. Each arrival receipt's `resource` names that same retained source.
 Trusted protocol modules supply message addresses in their own scheme;
 native arrivals use `message://<recipient>/<opaque-id>`, separate from the worker's
 actor and scratch addresses. Ordinary worker scratch remains writable. Source bodies
@@ -4758,15 +4823,17 @@ another admission is a 409 conflict, not a second message or an implicit content
 | Audience | Delivery | Effect |
 |---|---|---|
 | Assigned worker | Its conversation, even when another actor answered | Visible reply; wakes eligible parked work without a new Open Message or loop. |
-| Original native sender | That worker, if distinct from the assigned worker | The same reply, through the same wake and observation path. |
+| Original native sender | That worker, if distinct from the assigned worker; original delegated-task answers use {§worker-scheme-collect} instead | Other replies use the same wake and observation path. |
 | Exterior sender | The assigned conversation's protocol adapter | The adapter delivers the answer through its standard message channel. |
 | Replying actor | Its own executed SEND | No duplicate ambient occurrence. |
 
 The successful SEND and its addressed occurrences commit together. Reply occurrences use
 the ordinary durable ambient cursor and wake revision; curation cannot revoke delivery or
 replay it. An addressed reply replaces the same parent's generic activity observation.
-Child completion is a separate READ of its execution outcome; replies are not outcome bodies.
-The complete outcome remains available at its {§worker-loop-result} address.
+The child's reply to its original parent-delegated message reaches that parent once,
+through the conclusion READ under {§worker-scheme-collect}; it is not a separate reply
+occurrence. Other replies remain ordinary messages. The exact loop remains addressable
+under {§loop-answer}.
 Unobserved replies prevent conclusion just as unobserved child results do. All operation
 producers notify the same settlement path after durable execution; reply wake-up shares
 {§worker-optimistic-settlement}, without delaying the replying program.
@@ -4780,7 +4847,7 @@ additional alias. Answering either reaches the same message. Origin (operator, 2
 packet showed a 77-character `agui://anonymous/threads/…/messages/<uuid>` twice per open message,
 while the docs taught the short form.
 
-§message-causal-source **Message authorship and delivery are distinct facts.** The harness publishes every arrival row; the row's `source` carries the canonical address of the causal actor. Native WORK, FORK, and directed worker SEND derive `worker://<sender>` from the authenticated sender worker ID. A trusted exterior adapter supplies its own canonical actor address through {§methods-loop-run}: the AG-UI bridge names the client's message under `agui://` ({§agui-run-source}), the inbound A2A adapter under `a2a://`. An absent source means the owning worker itself. Attribution persists with the message through the inbox, parking, orphan recovery, restart, and later log projection; model syntax cannot author it. The wire renders the row's `source` and omits its `origin`, which is constant for every arrival; the Open Messages pointer carries the same source ({§message-arrival}) — except where the source is the transport that minted this very message, which says nothing the address does not ({§message-short-identity}).
+§message-causal-source **Message authorship and delivery are distinct facts.** The harness publishes every arrival row; the row's `source` carries the canonical address of the causal actor. Native WORK, FORK, and directed worker SEND derive `worker://<sender>` from the authenticated sender worker ID. A trusted exterior adapter supplies its own canonical actor address through {§methods-loop-run}: the AG-UI bridge names the client's message under `agui://` ({§agui-run-source}), the inbound A2A adapter under `a2a://`. An absent source is the operator. Attribution persists with the message through the inbox, parking, orphan recovery, restart, and later log projection; model syntax cannot author it. The wire renders the row's `source` in place of its `origin`, which is constant for every arrival, except where the source is the transport that minted this very message, which says nothing the address does not ({§message-short-identity}). The operator's message is then the one arrival with no sender to show, so it renders `"origin": "user"`: left bare, it read as the model's own SEND, and a model that had finished the work could no longer find the request it was answering (operator, 2026-09-22). The Open Messages pointer carries the same attribution ({§message-arrival}).
 
 §message-projection **Message storage is unbounded by model context; automatic materialization is not.** Core persists every accepted message completely before packet assembly. The selected provider's derived `inputCapacity` and the alias-resolved percentage from `PLURNK_SERVICE_PROMPT_PROJECTION` derive one aggregate curation-weight allowance for the visible bodies of arrivals other than a peer worker's — every `source` that is not a `worker://` address, the loop's own assignment included. Complete bodies render when their aggregate weight fits. Otherwise all such visible rows share the allowance: full bodies consume only their required share, unused shares are redistributed, and partial bodies render the largest leading complete-line region that fits their share or an exact character-bound prefix when the first physical line alone is larger. The sum of their rendered body weights never exceeds the allowance. Every partial body carries `preview` under {§packet-extent-metadata}. The row remains complete and READable by coordinate; its `log:///` body additionally obeys deliberate curation under {§log-readable-projection}. A peer worker's message takes the ordinary bounds. When provider input capacity is unknown the percentage is underivable, so arrival rows retain the ordinary bounded projection rather than inventing capacity. This policy never rejects, summarizes, or discards a message because it exceeds a context window.
 
@@ -5388,8 +5455,8 @@ only when its content is already source-numbered, such as an effect receipt.
 An EDIT or scoped entry KILL log row renders its bounded effect receipt (`rx.receipt`) as row
 metadata and join context, not its input statement. Proposal-gated file EDITs
 compute the accepted receipt from what actually lands. Environment-delta EDITs
-render their resulting `rx.span`. COPY/MOVE rows render compact ordered
-`from` and `to` selections ({§log-address-metadata}), compact ordered `effects` metadata, and
+render their resulting `rx.span`. COPY/MOVE rows write both operand
+selections ({§log-address-metadata}), render compact ordered `effects` metadata, and
 any scoped textual receipt contexts under their `log:///` address, never under
 one operand's resource address. All generated bodies remain under
 {§body-projection}. {§edit-result-render}
@@ -5483,7 +5550,6 @@ database is a benchmark artifact like any other: the lane's run directory lives
 checkout holds source only — never run output. `test:intg` stamps `PLURNK_TEST_RUN` once and every
 test process inherits it, so one suite's databases land in one directory without a pretest step, a
 marker file or a sweep; an unstamped invocation is not a special case with its own rules, it is
-simply an unstamped run with its own directory. Nothing counts, reuses, moves, hides or
-conditionally clears an artifact, so a failed suite's evidence is exactly where the run reported
-it. A cross-package test may reuse Core's migration fixture only by passing a path inside the
+simply an unstamped run with its own directory. A stamped run that passes is reclaimed when it
+exits; a failed suite's evidence is never touched and stays exactly where the run reported it. A cross-package test may reuse Core's migration fixture only by passing a path inside the
 caller's own run directory.