@plurnk/plurnk-service 1.28.0 → 2.0.0

package/SPEC.md

@@ -18,7 +18,7 @@ Canonical contracts plurnk-service exposes, architecture it implements, promises
 - [Proposals and client interactions](#proposal-proposals-and-client-interactions)
 - [Stream Model](#stream-stream-model)
 - [Storage Model](#storage-model)
-- [Plugin composition](#core-plugin-composition-plugin-composition)
+- [Extension composition](#core-extension-composition-extension-composition)
 - [Bundled Set](#bundled-set-bundled-set)
 - [Grammar Dependency](#grammar-dependency)
 - [Operator Configuration](#operator-config-operator-configuration)
@@ -55,7 +55,7 @@ flowchart LR
 | **workspace**     | Core                  | Durable user-named shared world. Persists across workers and process restarts. Identity: `workspaces.id` + unique `workspaces.name`. |
 | **worker**        | Core                  | Durable actor and history over one workspace. Owns its loops and log rows, may carry a `parent_worker_id`, and has one process-local cancellation scope while active. |
 | **loop**          | Core                  | Queued-to-terminal unit of model or client work within a worker. Status ∈ {100 pending · 102 running · 200 done · 202 waiting (blocked on a live obligation, {§send}) · 413 input-capacity failure · 429 model-turn ceiling · 499 cancelled · 500 failed · 504 execution timeout ({§operator-config-loop-timeout}) · 508 runaway}. Many loops may belong to one worker. |
-| **turn**          | Core                  | One durable, producer-neutral batch of ordered operations. A turn may be authored by a model, client, plugin, or `_plurnk`; only a model turn assembles a packet and owns an emission call. Many turns may belong to one loop. Identity: `(loop_id, sequence)`. |
+| **turn**          | Core                  | One durable, producer-neutral batch of ordered operations. A turn may be authored by a model, client, or `_plurnk`; only a model turn assembles a packet and owns an emission call. Many turns may belong to one loop. Identity: `(loop_id, sequence)`. |
 | **model call**    | Core/provider         | One logical `provider.generate` invocation. Emission attempts and BARE inferences share this durable accounting owner; provider retries remain cardinal physical requests beneath it. Identity: `(turn_id, sequence)`. |
 | **op**            | Producer/core         | One DSL operation a producer submits, parsed into a `PlurnkStatement`. Admission follows {§turn-ops-admission-path}. |
 | **statement**     | Model/core            | A parsed op: the `PlurnkStatement` AST from `@plurnk/plurnk-contracts`. |
@@ -72,7 +72,7 @@ flowchart LR
 |---|---|
 | **entry** | The unit of canonical state. Identity: `(workspace_id, scheme, authority, pathname)` ({§entry-identity-no-null}). Holds one or more `channels` of content plus scheme-private `attributes`. |
 | **channel** | A named content buffer on an entry. Examples: `body`, `stdout`, `stderr`, `headers`, `symbols`. Each channel has `content`, `mimetype`, curation `weight`, and lifecycle `state`. |
-| **scheme** | An addressed capability family + handler. Built-ins include `worker`, `log`, `ops`, `reasoning`, and bare/file paths; discovered schemes and executor-runtime tags extend that set. Internal `exec` routes executions but is not an addressable model namespace. Consumption surface {§scheme-surface}; author contract: [plurnk-schemes](../plurnk-schemes/SPEC.md). |
+| **scheme** | An addressable namespace and its handler. Built-ins include `worker`, `log`, `ops`, `reasoning`, and bare/file paths; discovered schemes and executor-runtime tags extend that set. Internal `exec` routes executions but is not an addressable model namespace. Consumption surface {§scheme-surface}; author contract: [plurnk-schemes](../plurnk-schemes/SPEC.md). |
 | **mimetype** | A channel's content type. Drives the handler that produces the structural projections (`symbols`, `deepJson`, `deepXml`). Consumption surface {§mimetype}; author contract: [plurnk-mimetypes](../plurnk-mimetypes/SPEC.md). |
 | **provider** | An LLM transport implementing the `@plurnk/plurnk-providers` `Provider` interface. Core supplies an assembled request and generation context; the provider owns endpoint adaptation and normalized response evidence. Consumption surface {§provider-surface}; author contract: [plurnk-providers](../plurnk-providers/SPEC.md). |
 
@@ -91,9 +91,9 @@ Independent axes on entries and channels. Confusion across them is a recurring s
 
 | Term | Meaning |
 |---|---|
-| **writer** | The identity authoring a write. One of `model \| client \| _plurnk \| plugin`. Carried on `ctx.writer` for schemes; engine enforces `manifest.writableBy`. |
+| **writer** | The identity authoring a write. One of `model \| client \| _plurnk`. Carried on `ctx.writer` for schemes; engine enforces `manifest.writableBy`. |
 | **origin** | Synonym for writer in log_entries (`log_entries.origin`). Synonym for writer. |
-| **writable_by** | The set of writers a scheme accepts. Subset of `{model, client, _plurnk, plugin}`. Engine rejects writes outside the set with 403; the rejection is logged as the action-entry ({§subscriptions} action-entry-as-outcome). |
+| **writable_by** | The set of writers a scheme accepts. Subset of `{model, client, _plurnk}`; empty means no operation writes the scheme. Engine rejects writes outside the set with 403; the rejection is logged as the action-entry ({§subscriptions} action-entry-as-outcome). |
 
 ### Execution terms
 
@@ -133,7 +133,7 @@ package map. The default installed composition is specified in {§bundled-set}.
 
 OpenTelemetry may observe PLURNK; it never becomes product state, failure transport, scheduler input, model teaching, or client protocol. Domain and client activity remain on AG-UI. Reusable packages depend on the OTel API only; the daemon constructs only the explicitly configured trace and metric providers. An unconfigured or standards-valid disabled process loads no SDK or exporter implementation and keeps the API's no-op behavior with bounded overhead. OTel Logs have no provider or initialization path.
 
-Configuration uses the standard `OTEL_*` environment: `OTEL_TRACES_EXPORTER` / `OTEL_METRICS_EXPORTER` select `otlp` or `console` per signal (a missing or `none` value keeps that signal off; no SDK default selects an exporter), `OTEL_SERVICE_NAME` names the service (default `plurnk-service`), case-insensitive `true` in `OTEL_SDK_DISABLED` turns the boundary off, and OTLP exporters honor `OTEL_EXPORTER_OTLP_*`. An unknown exporter name makes observability unavailable with a configuration diagnostic ({§configuration-repair-path}); offline checking rejects the same input before loading an SDK. OTel Logs and direct draft semantic-convention use are excluded. HTTP spans carry only an AG-UI-owned bounded route class, never an input pathname or query. Spans otherwise carry high-cardinality identifiers; metric labels stay low-cardinality. Prompts, reasoning, file bodies, arbitrary URLs, secrets, and plugin payloads are never recorded as attributes or metric values by default. Exporter failure cannot change product results or client lifecycle. Daemon, telemetry, and database teardown are independent reverse-ownership phases; every phase runs and aggregate failure preserves every cause.
+Configuration uses the standard `OTEL_*` environment: `OTEL_TRACES_EXPORTER` / `OTEL_METRICS_EXPORTER` select `otlp` or `console` per signal (a missing or `none` value keeps that signal off; no SDK default selects an exporter), `OTEL_SERVICE_NAME` names the service (default `plurnk-service`), case-insensitive `true` in `OTEL_SDK_DISABLED` turns the boundary off, and OTLP exporters honor `OTEL_EXPORTER_OTLP_*`. An unknown exporter name makes observability unavailable with a configuration diagnostic ({§configuration-repair-path}); offline checking rejects the same input before loading an SDK. OTel Logs and direct draft semantic-convention use are excluded. HTTP spans carry only an AG-UI-owned bounded route class, never an input pathname or query. Spans otherwise carry high-cardinality identifiers; metric labels stay low-cardinality. Prompts, reasoning, file bodies, arbitrary URLs, secrets, and extension payloads are never recorded as attributes or metric values by default. Exporter failure cannot change product results or client lifecycle. Daemon, telemetry, and database teardown are independent reverse-ownership phases; every phase runs and aggregate failure preserves every cause.
 
 §observability-genai-conventions **GenAI convention projection.** Provider
 request spans follow the [GenAI registry at `c88d504`](https://github.com/open-telemetry/semantic-conventions-genai/tree/c88d504ab3d9879f8e50d3cc87e69775e11db234),
@@ -157,39 +157,39 @@ draft convention is projected.
 The process and package map is ARCHITECTURE.md's; this package's AGENTS.md maps core's internal
 owners. Capability-specific behavior remains with the owning plug point.
 
-§service-worker-composition The service launcher and the live/demo workspace
-helper share one registration of default worker-facing modules: MCP, outbound
-A2A, and Schedule. Their management families and readable reference documents are
+§service-worker-composition The service launcher composes no module: it and the live/demo
+workspace helper both discover AG-UI, A2A, MCP, Schedule and command hooks ({§module-discovery}). The
+management families and readable reference documents are
 present even with no enabled definitions. Workspace capability policy controls every actor's
 surface; registering a family does not enable its definitions. The real-model
 profile ({§operator-config-real-model-profile}) leaves ambient MCP attachments and
 service schedules disabled by default; specimens may add their own through the
-ordinary management surface. Client and
-inbound-A2A listeners and host hooks remain launcher-owned.
+ordinary management surface. The one listener is the launcher's ({§http-host}); the helper binds
+none, so its daemon leaves out AG-UI ({§module-http-mounts}).
 
 ### §service-package-exports Package export surface
 
 | Export path                           | Current contract                                                                                                                                                        |
 |---------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| `@plurnk/plurnk-service`              | Frozen 1.x compatibility barrel of the exports below. It gains no new APIs and is not the client boundary. Removal is SemVer-major. |
-| `@plurnk/plurnk-service/digest`       | Supported programmatic forensic surface owned by {§digest-programmatic-surface}.                                                                                         |
+| `@plurnk/plurnk-service`              | Legacy internal exports listed below. It gains no new APIs and is not the client boundary. Extracted capabilities belong to their owning packages, without compatibility aliases. |
+| `@plurnk/plurnk-service/evidence` | Canonical evidence reader consumed by the separate report package ({§digest-evidence-reader}).                                                                                         |
 | `@plurnk/plurnk-service/package.json` | Supported package metadata surface.                                                                                                                                      |
 
 | Root exports | Names |
 |--------------|-------|
-| Runtime | `Daemon`, `Engine`, `EnvFlags`, `Exec`, `File`, `Log`, `Mimetypes`, `Mock`, `Paths`, `SchemeRegistry`, `Skill` |
+| Runtime | `Daemon`, `Engine`, `EnvFlags`, `Exec`, `File`, `Log`, `Mimetypes`, `Mock`, `Paths`, `SchemeRegistry` |
 | Types | `ChatMessage`, `EditResult`, `FlagDescriptor`, `MockAssistant`, `MockResponse`, `OpenFoldResult`, `ReadResult` |
 
 New clients use AG-UI. A new library contract belongs in its owning package or
-an explicitly specified subpath, not in the frozen root barrel.
+an explicitly specified subpath, not in the legacy root barrel.
 
 ### §startup-admission Startup admission
 
 ```mermaid
 flowchart LR
-    LISTENER["Bind client listener<br/>unready: HTTP 503"] --> DB["Acquire daemon lock<br/>and admit SQLite schema"]
-    DB --> DAEMON["Construct and start<br/>daemon composition"]
-    DAEMON --> CLIENT["Activate client transport"]
+    LISTENER["Bind the daemon's listener<br/>unadmitted: HTTP 503"] --> DB["Acquire daemon lock<br/>and admit SQLite schema"]
+    DB --> DAEMON["Start the daemon:<br/>discover and start modules"]
+    DAEMON --> CLIENT["Admit the listener"]
     CLIENT --> SELECT["Worker selects or first uses a model"]
     SELECT --> PROVIDER["Construct and verify<br/>selected provider"]
     LISTENER -. failure .-> FAIL["Fail startup<br/>durable state untouched"]
@@ -202,9 +202,9 @@ flowchart LR
 ({§http-host}) before creating, opening, replacing, rotating, migrating, or
 otherwise mutating anything in the durable data directory. A process that loses
 the listener race fails with the originating address error and byte-identical
-durable storage. Core owns the socket continuously; it answers 503 until the
-client-interface module mounts the root at daemon activation, so early
-ownership introduces neither traffic nor a close/rebind race.
+durable storage. Core owns the socket continuously; it answers 503 until daemon
+activation admits it after every module has started ({§module-http-mounts}), so
+early ownership introduces neither traffic nor a close/rebind race.
 
 §http-host **The daemon opens exactly one transport.** Core binds the HTTP
 listener on `PLURNK_HOST:PLURNK_PORT` and offers it to every exterior adapter as
@@ -212,11 +212,11 @@ listener on `PLURNK_HOST:PLURNK_PORT` and offers it to every exterior adapter as
 ({§application-port}). A prefix is an absolute pathname. Each request goes to the
 longest mounted prefix; a prefix claims itself and the subtree beneath it, never
 a longer sibling name; `/` is the root and receives whatever nothing more
-specific claimed. Until a root is mounted the listener answers `503
+specific claimed. Until daemon activation admits it the listener answers `503
 service-starting` to every request: the service has not admitted its client
-interface. Adapters mount at `start()`, after durable lifecycle recovery, and
-none opens a socket of its own under the daemon — a module hosted *without* a
-daemon may bind a private one, which is outside this contract. The standards
+interface. Adapters claim their prefixes before setup and mount them at
+`start()`, after durable lifecycle recovery ({§module-http-mounts}), and
+none opens a socket of its own. The standards
 address by URL, never by port (#641): AG-UI mounts `/` and `/agui`, A2A the
 well-known card and its endpoint path, on the same address.
 
@@ -277,7 +277,7 @@ filter a row.
 
 §actor-boundary-attached-functionality **Attachment selects a conversation,
 not an environment owner.** Client management commands mutate workspace
-Functionality ({§module-workspace-capabilities}); executable families, runtime
+Functionality ({§module-workspace-capabilities}); runtimes, runtime
 schemes, and tools resolve by `workspaceId`. Operations journal in the
 submitting actor's `workerId` ({§connection-lifecycle}), which must belong to
 the workspace. Runtime and policy resolution require no second worker identity.
@@ -363,7 +363,6 @@ narrow or omit the reference catalogs under {§capability-admission}.
 | Project filesystem | `*` | File cap below; `project root member files` |
 | Workspace entries | `worker:///*` | Markerless; `workspace knowledgebase entries` |
 | Named scratch entries | `worker://<worker>/*` | Markerless; `worker knowledgebase entries` |
-| The worker's own reasoning | `reasoning://<worker>/**` | Markerless; `this worker's reasoning, by loop and turn` |
 
 Only the three namespace surveys carry asides; the other targets name
 their surface. The word `skills` names Agent Skills and nothing else.
@@ -371,7 +370,7 @@ Catalogs select documents independently of their authored bodies; ordinary READ
 supplies examples and complete instructions on demand. A shallow
 result renders direct entries normally and every deeper first-segment directory
 as an actionable `dir/**` summary with its recursive `items` and `tokens`;
-tool-family rows also carry the concise `{§scheme-catalog-aside}` that drives
+runtime rows also carry the concise `{§scheme-catalog-aside}` that drives
 on-demand capability discovery. Ordinary surveys use FIND without a scope
 ({§markerless-first-page}), whose range metadata reports the returned set against the
 complete result total; only the small capability-reference surfaces
@@ -460,7 +459,7 @@ existing workspace worker in its own right.
 
 §machine-processes-model-worker-readable **Packet membership is per-worker, not an access policy.** A packet contains its worker's log plus explicitly delivered activity ({§actor-boundary}). `readLog({ workspaceId, workerId })` may inspect any worker belonging to that workspace, and `listWorkers` enumerates them. A client-interface module chooses its conversation binding. Inspection does not inject another log into a model's packet.
 
-§machine-processes-worker-origin **A worker carries its actor.** Each worker records its `origin` — `model` (a conversation), `client` (a client-interface actor), or `_plurnk` (the runtime's self-hosting worker) — set once at creation and inherited by WORK/FORK from the parent. A turn's producer is independent: a plugin-produced program in a model worker still delegates model workers. `listWorkers` returns actor class without interpreting names; a retained worker's name is immutable ({§machine-processes-worker-is-its-log}).
+§machine-processes-worker-origin **A worker carries its actor.** Each worker records its `origin` — `model` (a conversation), `client` (a client-interface actor), or `_plurnk` (the runtime's self-hosting worker) — set once at creation and inherited by WORK/FORK from the parent. A turn's producer is independent: a client-produced program in a model worker still delegates model workers. `listWorkers` returns actor class without interpreting names; a retained worker's name is immutable ({§machine-processes-worker-is-its-log}).
 
 §worker-provider-identity **A worker owns a durable provider identity distinct
 from its database id.** Creation mints a globally unique, opaque 128-bit value;
@@ -914,12 +913,6 @@ move it. The digest reports, per loop, the claim time and how long after it the
 first model turn started, so a stall between claim and inference (a heartbeat has
 waited 7.5 h, #703) is a number rather than a gap.
 
-§digest-storage **The digest states the file's health.** Beside the database path it
-reports the file size, the free pages it holds, its `auto_vacuum` mode, and the six
-largest tables and indexes by allocated bytes (`dbstat`), so growth is a number in
-every digest (#764). The digest reads loops as stored, so it tolerates databases
-missing later lifecycle columns.
-
 §loop-execution-allowance **One task has one execution allowance.** The first
 execution snapshots `PLURNK_SERVICE_LOOP_TIMEOUT` on the loop. Active segments
 consume that allowance cumulatively, measured with a monotonic clock; waits and
@@ -1093,11 +1086,11 @@ boundary.
 
 A turn is the durable container for one producer's ordered operations. Packet
 and provider fields are optional evidence belonging only to model inference;
-their absence never makes a client, plugin, or `_plurnk` turn exceptional.
+their absence never makes a client or `_plurnk` turn exceptional.
 
 | Field | Contract |
 |---|---|
-| `producer` | Required actor class: `model`, `client`, `plugin`, or `_plurnk`. |
+| `producer` | Required actor class: `model`, `client`, or `_plurnk`. |
 | `kind` | Required purpose: `inference`, `initialization`, `operation`, or `maintenance`. Model iff inference; initialization and maintenance require `_plurnk`. Producer and kind are immutable. A maintenance turn's successful rows are packet-suppressed — a receipt answers an asker, and maintenance has none ({§actor-boundary-doc-injection}). |
 | `status`, `completed_at` | A new turn is open at status 102 with `completed_at=NULL`. Completion records the program outcome and timestamp; a completed 102 is distinct from an open 102. A successful administrative program completes at 200 without concluding its host model loop. |
 | Operations | Ordered by `(turn_id, sequence)` on one exact worker/loop/turn chain. Each row's `origin` is the turn producer or `_plurnk` making a system observation; the observation does not impersonate the producer. |
@@ -1106,9 +1099,8 @@ their absence never makes a client, plugin, or `_plurnk` turn exceptional.
 
 One lifecycle owner opens, optionally records inference evidence, and completes
 every turn. Initialization, maintenance, client dispatch, and model
-inference use that same path. `plugin` is the producer identity for
-plugin-authored operation turns; exposing that path must not introduce a
-parallel record or lifecycle. Producer and kind never change. Process-restart
+inference use that same path; a new producer joins it without a parallel
+record or lifecycle. Producer and kind never change. Process-restart
 recovery completes any turn whose producer vanished.
 
 §turn-exception-outcome An exceptional inference exit completes every still-open
@@ -1122,7 +1114,7 @@ The turn owner propagates the original exception unchanged.
 | An `AggregateError` combining cancellation with other failures | 500; cancellation does not conceal another failure. |
 
 §turn-ops-admission-path **Source acquisition varies; admitted-turn execution does not.**
-A provider response, deterministic `_plurnk` program, or future client/plugin
+A provider response, deterministic `_plurnk` program, or future client
 program crosses one admission boundary into the same executor. That executor
 parses once, dispatches the admitted statements in order, records their ordinary
 outcomes, and completes the turn from its lifecycle ruling. Exact source is retained before dispatch.
@@ -1333,7 +1325,11 @@ Provider interruption is owned by {§provider-interrupted-attempt}. Accepted sou
 and positions remain exact; execution follows {§op-execution-order}. WAIT remains
 optional, with no omission warning or invented operation ({§turn-shape}).
 
-§safe-uri-target-groups After source and authored-command admission, Core expands one target group on READ or KILL into one ordinary statement per member, each with an independent dispatch outcome and log row, in authored member order at that operation's position under {§op-execution-order}. A group is either the heading's slot group ({§target-group}) — any target kind, each member with the scope, metadata and matcher its own slot carried, the heading's naked pattern every member's, and a distilling body landing once with the first member — or one slot whose raw target splits at top-level comma or whitespace separators into at least two members that each independently parse as an explicit `scheme://` URI, the selection shared; request-metadata blocks are opaque to that split, and otherwise the slot's target remains exactly singular, including local filenames containing spaces or commas. The same expansion meets a client-authored group at the client seam. The stored `turnOps` and authored command count remain unexpanded, a group never reaches dispatch unexpanded, and no other operation admits target groups.
+The parser compiles target groups ({§target-group}, {§safe-uri-target-groups}) into ordinary
+statements before model or client admission. Core does not reinterpret target syntax. Each
+admitted member receives its independent dispatch outcome and log row, in authored order under
+{§op-execution-order}; one member's runtime failure does not suppress later members. The original
+emission in `turn_sources` remains exact and unexpanded.
 
 Core retries a rejected emission against the exact same packet beneath the same engine turn, up to `PLURNK_SERVICE_EMISSION_ATTEMPTS`. Rejected bytes never dispatch or reach the engine strike rail. Before each `generate`, Core opens one durable logical `inference_calls` row with its `model_calls` specialization and emission-specific `turn_attempts` admission row. A call that ends without response evidence leaves that admission row unclassified (`accepted IS NULL`) and does not consume the emission-attempt ceiling. Beneath the logical call, every provider observer invocation opens one cardinal `provider_requests` occurrence immediately before physical I/O and settles it as response or error. Adapter retries and capacity failover append requests in issue order; a response-less failure therefore remains an accounted occurrence rather than disappearing. Normalized response evidence is durable before parser classification and does not duplicate the separately owned accounting. The accepted exchange alone extends `turns.packet` with response evidence; every physical request remains in turn and loop accounting, while the context gauge reads the latest settled emission request on the latest turn. Digest exposes rejected response evidence as `<stem>.attemptNNN.rejected.*` and every physical request in its machine-readable ledger.
 
@@ -1371,10 +1367,10 @@ interrupted response evidence, Core stores it unaccepted without duplicating its
 accounting. The failed turn still stores the exact request and never fabricates
 an assistant or a zero-valued observation.
 
-### §attribution Plugin-authored attribution folksonomy
+### §attribution Extension-authored attribution folksonomy
 
-A plugin may declare opaque attribution tags statically or at runtime under the
-shared contract {§plugin-attribution}:
+An extension may declare opaque attribution tags statically or at runtime under the
+shared contract {§extension-attribution}:
 
 ```jsonc
 { "plurnk": { "attribution": "@acme/widgets" } }   // always-on string or string[]
@@ -1382,14 +1378,14 @@ shared contract {§plugin-attribution}:
 
 | Stage                | Contract                                                                                                                                                                                                                                      |
 | -------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Collection           | Immediately before each emission attempt, Core pulls the admitted scheme, executor, loaded mimetype-handler, and selected provider sources. A BARE call pulls only its selected provider source because it admits no other plugin capability.       |
+| Collection           | Immediately before each emission attempt, Core pulls the admitted scheme, executor, loaded mimetype-handler, and selected provider sources. A BARE call pulls only its selected provider source because it admits no other extension.       |
 | Composition          | Core flattens, deduplicates, and sorts the tags. The resulting non-empty array rides `generate({ attributions })`; an empty set omits that provider field.                                                                                      |
-| Meaning              | Core neither verifies nor infers contribution. Tags are plugin-authored folksonomy for telemetry, optimization, attribution, or downstream rules. The `@plurnk/` reservation is the only namespace policy ({§plugin-attribution}).             |
+| Meaning              | Core neither verifies nor infers contribution. Tags are extension-authored folksonomy for telemetry, optimization, attribution, or downstream rules. The `@plurnk/` reservation is the only namespace policy ({§extension-attribution}).             |
 | Request evidence     | The stored request packet carries the exact set most recently forwarded for that turn. Every generation-kind `inference_calls` row carries that call's exact set, including response-less failures. |
 | Derived reporting    | Turn, loop, digest, and client views project the recorded sets. `loop/terminated.attributions` is their deduplicated sorted union and remains separate from provider usage and charge evidence.                                                 |
 
-Runtime hooks are synchronous and receive only the attempt coordinates. A hook
-failure is an internal plugin-contract failure; Core does not silently discard
+Runtime `attributions` functions are synchronous and receive only the attempt coordinates.
+A function's failure is an internal extension-contract failure; Core does not silently discard
 it or reinterpret a malformed tag list.
 
 §client-metadata **The workspace records which frontend opened it.** A frontend self-identifies (e.g. `@plurnk/plurnk-tui/1.4.0`) at `workspace.create({ settings: { client } })` and the daemon stores it with the workspace. It is validated on write, never forwarded to a provider, and never model-facing. Workspace-stable and self-reported — distinct from attribution's install-grounded tags — and omitted when unset.
@@ -1402,7 +1398,7 @@ it or reinterpret a malformed tag list.
 service-side caching, per-loop selection, context-cap handling, and admission
 of an operator's grammar. Cataloged providers use Models.dev metadata and official AI SDK
 bindings; an operator declaration covers an uncataloged compatible endpoint;
-plugin discovery is the last protocol-extension seam. Cache identity includes
+a provider extension is the last seam for a new protocol. Cache identity includes
 the alias, wire route, and complete provider-knob projection; a registered
 preconstructed handle occupies that same identity and cannot shadow changed
 tuning.
@@ -1445,7 +1441,7 @@ First path segment = provider name; rest = provider-native model id.
 
 ### Mock provider (sibling fixture)
 
-§mock-provider-mock-fixture `Mock` (exported from `@plurnk/plurnk-providers`) — intg fixture + reference implementation. `{ contextWindow, responses }` constructor; `generate` shifts from the queue. `MockResponse.assistant.ops?: PlurnkStatement[]` is a pre-parsed escape hatch the engine consumes directly when present; production providers don't expose this — and being a plugin export, this contract has no service-side `§`-ref.
+§mock-provider-mock-fixture `Mock` (exported from `@plurnk/plurnk-providers`) — intg fixture + reference implementation. `{ contextWindow, responses }` constructor; `generate` shifts from the queue. `MockResponse.assistant.ops?: PlurnkStatement[]` is a pre-parsed escape hatch the engine consumes directly when present; production providers don't expose this — and being a package export, this contract has no service-side `§`-ref.
 
 ---
 
@@ -1528,7 +1524,7 @@ Folders and globs select members in those same filesystem coordinates. Parent-di
 
 ### File scheme: creation and misses
 
-§fs-write-surface **The write surface — one admission and incorporation path.** Existing writes remain membership-gated. An absent path additionally crosses the effective creation scope and the complete constraint/Git policy before a proposal is issued. EDIT, COPY destinations, and MOVE destinations use this same path regardless of whether the producer is a model, client, plugin, or `_plurnk`. A COPY or MOVE destination scope on an absent channel resolves against its empty pre-mutation value under {§empty-mutation-scope}; a valid scope creates the channel with the selected source as its complete value. A coordinate outside that empty value is 416. Binary scopes remain numeric byte positions or ranges under {§binary-parity}.
+§fs-write-surface **The write surface — one admission and incorporation path.** Existing writes remain membership-gated. An absent path additionally crosses the effective creation scope and the complete constraint/Git policy before a proposal is issued. EDIT, COPY destinations, and MOVE destinations use this same path regardless of whether the producer is a model, client, or `_plurnk`. A COPY or MOVE destination scope on an absent channel resolves against its empty pre-mutation value under {§empty-mutation-scope}; a valid scope creates the channel with the selected source as its complete value. A coordinate outside that empty value is 416. Binary scopes remain numeric byte positions or ranges under {§binary-parity}.
 
 | Case | Required admission | Accepted result |
 |------|--------------------|-----------------|
@@ -1583,7 +1579,7 @@ Every fact names the canonical key, never the host root or an echo of the
 model's spelling. These classes let a caller distinguish a wrong address, an
 invalid range, read-only authority, and occupied hidden state without guessing.
 
-§membership-read-refusal **A file miss speaks of membership, never of the disk.** A file is read only as a member, so every `file` miss — READ, FIND of an exact path, KILL, a COPY or MOVE source — is 404 `entry-not-found`, `No member of this workspace is at '<key>'.` Recovery treats path correction with FIND, creation with EDIT, and admission with `members (add)` as alternatives; it must not presume a missing READ requires creation or admission. Admission takes a `{"glob": "<path>"}` body. The sentence is about the address and is true whether or not a file is there: it neither claims absence nor hints at presence. Beyond the root the engine does not look at the disk at all, so two reads of `../` paths differ only in the name they echo. Inside the root occupancy is not secret ({§fs-write-nonmember}), so an exact-path READ of a path that exists on disk but is not a member says so instead — 404 `entry-not-member`, `'<key>' exists on disk but is not a member of this workspace.`, with admission-only recovery. Occupancy may surface there; content never does ({§membership}).
+§membership-read-refusal **A file miss speaks of membership, never of the disk.** A file is read only as a member, so every `file` miss — READ, FIND of an exact path, KILL, a pattern EDIT's source, a COPY or MOVE source — is 404 `entry-not-found`, `No member of this workspace is at '<key>'.`, its target rendered as the member key, never a `file://` URI. Recovery treats path correction with FIND, creation with EDIT, and admission with `members (add)` as alternatives; it must not presume a missing READ requires creation or admission. Admission takes a `{"glob": "<path>"}` body. The sentence is about the address and is true whether or not a file is there: it neither claims absence nor hints at presence. Beyond the root the engine does not look at the disk at all, so two reads of `../` paths differ only in the name they echo, and their recovery speaks of the address too, true under every members scope: `'<key>' is outside the project root: only a members definition under the operator's namespace scope admits it, so keep working files inside the root.` Inside the root occupancy is not secret ({§fs-write-nonmember}), so an exact-path READ of a path that exists on disk but is not a member says so instead — 404 `entry-not-member`, `'<key>' exists on disk but is not a member of this workspace.`, with admission-only recovery; a path the repository ignores, which no model definition admits, carries the members discovery verdict instead: `The repository ignores it: a client or operator members definition can include it, a model definition cannot.` Occupancy may surface there; content never does ({§membership}).
 
 §file-directory-target **A directory is named as a directory.** Inside the root, a READ (or other exact-path read), KILL or EDIT whose target is a directory on disk — with or without a trailing slash — is refused `path-is-directory`, never as a missing or non-member file, since admitting it is not what the model needs: READ and KILL answer 404, EDIT 403. The detail is `'<key>' is a directory, not a file; <OP> reads/removes/writes one file.` and the recovery names the listing that reaches its files, `` List its files with `FIND (<key>/)`, then READ one by its path. `` (KILL: `then KILL each by its path`; EDIT: `` Name a file inside it, as `EDIT (<key>/<file>)`; list its files with `FIND (<key>/)`. ``). Beyond the root the disk stays dark and {§membership-read-refusal} holds unchanged.
 
@@ -2425,28 +2421,29 @@ like any other row.
 | When | An inference turn that admitted at least one content statement. Reasoning-only turns, including initialization ({§worker-initialization-entry}), a programmatic batch, an empty turn ({§empty-turn}), a client operation and a rejected attempt ({§rejected-emission-entry}) announce nothing. |
 | Place | After the turn's inputs (arrivals, deltas, open-path READs) and before its reasoning NOTEs and operations, written after the selection snapshot ({§turn-ops-selection-snapshot}): the emission sits between what the worker had seen and what it caused. |
 | Row | A `_plurnk` READ of the turn's own source, `ops://<worker>/L/T`, with `attrs.kind="emission"` and the canonical leaf `/emission`: `### log:///L/T/S/emission → ops://<worker>/L/T · N`. It renders its author, the turn's producer, as `origin`, so a model's row carries none. It is no operation: no receipt, tool call or strike, and outside the op mix. |
-| Body | Frozen at announcement: the canonical rendering ({§statement-rendering}) of admitted content statements, each in a closed fence. Each body appears as its head, about a hundred tokens of curation weight — enough to recognise the turn, never enough to matter to the budget ({§context-fit}) — and a longer body ends in an ellipsis (`…`) with its closing fence carrying `<!-- … READ (ops://<worker>/L/T) -->`; nothing the harness writes enters a fence. Absent and empty bodies remain empty. All heading operands, scopes, metadata, patterns and asides remain. Free text and unadmitted forms are absent; a recovered native call ({§native-tool-calls}) appears as the operation it was read as; an operation whose receipt failed stays. Reasoning operations retain their own source and normal receipts, never an assistant-content copy. No body text is inspected for nested operations. |
-| Sources and memory | Dispatch and immutable `ops://` sources retain complete bodies ({§turn-source-resources}); an explicit source READ returns them normally. The wire omits NOTE and WAIT blocks, whose own rows show them whole ({§body-projection}), so curating a NOTE row removes its text; an emission of only NOTE and WAIT delivers nothing, its row stands, and no assistant message follows it ({§packet-wire-envelope}); reasoning-only NOTEs never enter this projection. |
+| Body | Frozen at announcement: the canonical rendering ({§statement-rendering}) of the admitted content statements, each whole in a closed fence. All heading operands, scopes, metadata, patterns and asides remain. Free text and unadmitted forms are absent; a recovered native call ({§native-tool-calls}) appears as the operation it was read as; an operation whose receipt failed stays. Reasoning operations retain their own source and normal receipts, never an assistant-content copy. No body text is inspected for nested operations. |
+| Wire | Bodies are logged, never replayed (#1018). The wire shows a statement with a body as its heading and an empty closer, and one without a body as its heading closed on the same line, so the shape says whether a body was left out. A NOTE or WAIT, and a parameterless KILL or SEND, is not replayed at all, since its own row shows it whole ({§body-projection}); an emission of only those delivers nothing, its row stands, and no assistant message follows it ({§packet-wire-envelope}). Dispatch and the immutable `ops://` source keep complete bodies ({§turn-source-resources}); an explicit READ returns them, as it returns a receipt. |
 | Stability | The projection is fixed from its first appearance, never aged or resized under budget pressure. Already frozen announcements and historical request captures are not rewritten. |
 | Presentation | Born folded: the record shows its header, and its body follows the record as the worker's assistant message. |
-| Accounting | `tokens` charges the record and the emission the wire delivers, truncation asides included, never the omitted NOTE and WAIT blocks or the cut remainder ({§packet-token-accounting}). An explicit source READ has its own ordinary charge. |
+| Accounting | `tokens` charges the record and the emission the wire delivers, never what the wire leaves out ({§packet-token-accounting}). An explicit source READ has its own ordinary charge. |
 | Curation | Curated whole ({§log-kill-scope}): KILL retires it, and so does a scope covering every line (`<1,-1>`); on its exact coordinate a narrower scope is 422 `emission-curated-whole`, and a sweep whose scope would only trim it leaves it intact. |
 | Schema | Migration 12 admits `kind="emission"` only on this shape: one per turn, the turn's newest row when written, frozen, and curated whole. A database from before version 12 keeps its rows and gains no announcement. FORK copies it with the inherited turns, still naming its writer. |
-| Echoes | A worker that repeats the heading in its own text is tolerated ({§fabricated-log-entry}); the digest counts the echoes. A worker that copies the truncation aside onto its own closer keeps its body intact; the aside is outside text ({§outside-text}). |
+| Echoes | A worker that repeats the heading in its own text is tolerated ({§fabricated-log-entry}); the digest counts the echoes. |
 
 ### §reasoning-row The reasoning row
 
 The model's memory of its own reasoning, behind `PLURNK_SERVICE_REASONING_ROWS` (default `1`):
 when it is `1`, every model turn that reasoned lands its reasoning as one row of its
 own, `log:///<loop>/<turn>/<sequence>/reasoning → reasoning://<worker>/<loop>/<turn>`, the harness's
-READ of the turn's reasoning source, immediately before the turn's emission row, so the transcript
+READ of the turn's reasoning source, immediately before the turn's emission row (or its first
+operation or diagnostic when there is no content emission), so the transcript
 reads what the model thought and then what it emitted, and the assistant message that follows stays
 the canonical program ({§emission-row}, {§packet-wire-envelope}).
 
 | Concern | Rule |
 |---|---|
-| Room | The row lands whole only when the packet has room for it after everything else the turn lands, one receipt's reserve kept for the emission row's head ({§context-fit}); without room, no row lands and nothing else in the turn changes: no prefix, no receipt, no other row touched. |
-| Body | The model's own text, complete ({§markerless-first-page}); the complete reasoning stays readable at its address by any scope ({§turn-source-resources}). |
+| Room | Admission occurs after all mandatory turn rows, including the emission and diagnostics, using the remaining room under {§context-fit}. Its earlier chronological coordinate is reserved without inserting a placeholder; if it does not fit, that coordinate remains unused. Nothing else changes: no partial preview, refusal, or other row touched. Reasoning-only and empty model turns follow the same rule; content operations are not required. |
+| Body | The model's own text when it fits the row's page — `PLURNK_SERVICE_REASONING_TRAILING_LINES` lines, unset meaning the shared `PLURNK_SERVICE_PREVIEW_LINES`, within `PLURNK_SERVICE_PREVIEW_CHARS` — and otherwise its **last page**. Keep complete final lines where possible; if the last line alone exceeds the character bound, select its suffix with the ordinary exact column scope. Unicode code points count once and CRLF is one indivisible separator, as in {§body-projection}. The statement carries the scope it took and the receipt its `range` ({§packet-extent-metadata}); the complete reasoning stays readable at its address by any scope ({§turn-source-resources}). |
 | Weight | Charged like any row, visible in the gauge and its `largest` ({§context-gauge}). |
 | Curation | The verbs alone: a KILL retires it like any row ({§context-verbs}); the daemon reorders nothing and un-bodies nothing on its account. |
 | Absence | Means no room or no reasoning; the model tells them apart by reading `reasoning://` for the turn. |
@@ -2456,7 +2453,7 @@ the canonical program ({§emission-row}, {§packet-wire-envelope}).
 | Surface | Contract |
 |---|---|
 | Identity | `ops://<worker>/<loop>/<turn>`, `reasoning://<worker>/<loop>/<turn>`, and `note://<worker>/<loop>/<turn>/<item>` name a worker in the current workspace and its durable coordinates. A note's item is its dispatched NOTE ordinal. The `outside` source ({§outside-text}) has no address: no `outside://` scheme exists, and it is reached only through `outside/event`, FORK and the digest. The worker authority is required and case-sensitive; userinfo, ports, and queries are invalid. Source identity never depends on the reading worker. `log:///` remains local; READ, FIND and KILL reject log authorities, userinfo, ports and queries with 400, never substitute the caller's log. |
-| Source | `ops` is exact admitted `text/vnd.plurnk`, and its turn's emission row carries the preview-bounded projection ({§emission-row}); `reasoning` is `text/plain` containing the selected original provider reasoning or a non-model producer's authored rationale. Producer identity comes from the owning turn; a harness rationale is not provider evidence. The turn decides existence and the source decides content: a turn that exists but has no source of that kind reads as the ordinary empty resource (204, empty body), never a fabricated one; a worker or turn that does not exist is 404. |
+| Source | `ops` is exact admitted `text/vnd.plurnk`, and its turn's emission row carries its canonical projection ({§emission-row}); `reasoning` is `text/plain` containing the selected original provider reasoning or a non-model producer's authored rationale. Producer identity comes from the owning turn; a harness rationale is not provider evidence. The turn decides existence and the source decides content: a turn that exists but has no source of that kind reads as the ordinary empty resource (204, empty body), never a fabricated one; a worker or turn that does not exist is 404. |
 | Notes | Each dispatched NOTE stores its exact literal body as an immutable `text/plain` source and returns its worker-qualified address. There may be multiple notes in a turn, from reasoning, content, or another producer. A missing note is 404, not an empty invented note. Sharing its URI uses ordinary SEND; the receiver deliberately READs it. NOTE itself sends no ambient update. |
 | Retention | One ops source, one reasoning source and one outside source per turn; one note source per NOTE ordinal. An optional inference-call link records provenance. Source removal follows deletion of its owning turn, never log curation. |
 | Operations | Ordinary scoped READ, FIND, content search and COPY from any named worker's source within the workspace. FIND accepts authority and path patterns, retaining complete worker-qualified identities in results and folder selectors. READ returns data and never executes it. Sources are read-only for every actor and have no edit hashes. |
@@ -2467,6 +2464,7 @@ the canonical program ({§emission-row}, {§packet-wire-envelope}).
 §rejected-emission-entry A rejected provider response is not `turnOps`: it never became an admitted turn program, and no emission row announces it ({§emission-row}). The one bounded invalid-emission recovery item under {§emission-admission} has `attrs.kind="emissionAttempt"`, `origin="model"`, the canonical model-facing `/attempt` leaf, and the exact latest rejected response. The packet does not duplicate that identity as `kind` metadata. It is born durably body-suppressed and projected visibly only in the informed recovery packet; every other rejected attempt remains forensic-only.
 
 - §log-coordinate-hierarchy **Log coordinates are a hierarchical prefix; the trailing slash is optional** — a coordinate is `loop/turn/sequence`, and a PARTIAL coordinate selects its descendants: `log:///1` = loop 1's rows, `log:///1/2` = turn 1/2's rows, `log:///1/2/3` = the one row. A full coordinate is always three parts, so a one- or two-part path is unambiguously a prefix — the trailing slash is an optional alias (`log:///1/2` ≡ `log:///1/2/`), uniform with ```` ```READ (worker:///docs/) ````. A complete `[start-end]` segment in any numeric coordinate slot selects that inclusive decimal interval; brackets elsewhere retain ordinary path-glob meaning. Every rendered row appends one canonical model-facing leaf: the native operation name or invoked executor name, `/attempt` for a rejected emission, `/emission` for an admitted one's announcement ({§emission-row}). An executor leaf is derived from the durable submitted statement (its `runtime`), never an internal dispatch type or the current tool registry. Digits and punctuation in executor names remain part of the leaf. The leaf names identity rather than adding a resource level. Exact consumers tolerate the unsuffixed three-part shorthand; when supplied, the case-insensitive leaf is authoritative and a disagreement resolves 404. READ anchors use the canonical suffixed identity even when addressed by shorthand. Typed entry materialization therefore resolves as `/READ` while retaining its durable `EDIT` event ({§exec-entry-sink}). `log:///1/2/*` still selects the turn's item rows, while `log:///**/READ`, `log:///**/python3`, `log:///**/attempt`, and `log:///**/emission` deliberately filter canonical leaves. Executor outputs instead use workspace-wide claims such as `sh:///ab3d5678#stdout` ({§execution-output-identity}); their source operation has log coordinates, but resource lifetime and identity are independent of that observation. Error pointers, Problem instances, source attribution, and search use this same identity; client stream coordinates retain the numeric triple. Within a turn, sequence is arrival order. Inbound SEND rows publish before the program runs ({§message-arrival}); a turn receiving messages holds the first at `log:///L/T/1/SEND`, followed by further arrivals oldest first, then its emission's announcement, then the model's operations ({§packet-current-turn} names `L/T`).
+- §log-near-miss **A log miss beside rows that exist names them.** A READ, FIND or KILL of an exact coordinate that names no row carries a recovery from the worker's own active rows: the turn's rows carrying the leaf written come first, since the leaf is what the model asked for and the sequence its guess, followed by the row at that coordinate under its own leaf (`` Turn 1/44's reasoning is `log:///1/44/2/reasoning`; the entry at log:///1/44/1 is `log:///1/44/1/READ`. ``); with no row of that leaf, the row at the coordinate alone (`` The entry at log:///1/25/8 is `log:///1/25/8/sh`. ``), else the turn's rows, at most six named, else the loop's latest turn. A coordinate in a loop with no rows carries none. Recorded misses were near misses every time: a READ of `1/25/8/READ` when the row was `sh`, an EDIT one sequence off, and a KILL under the 413 that must curate (#1005).
 - §log-curation-folder-idiom **Log curation speaks the folder idiom; a zero-match sweep is a no-op success** — KILL takes a concrete coordinate or a path-glob, and a **trailing slash or a partial coordinate means "the contents"** ({§log-coordinate-hierarchy}), like a folder-scoped FIND: ```` ```KILL (log:///1/2) <1,-1> ```` suppresses turn 1/2's bodies and retires its emission ({§emission-row}). A **well-formed selection that matches nothing is 204 with `matched: 0`**; a successful sweep's rx carries `matched: N`. Parameterless KILL instead requests completion ({§kill-conclusion}).
 - §log-curation-set-selection **Row selection and body scope are independent** — target/glob and an optional heading pattern (```` ```KILL (log:///**) [{"pattern": "~stale"}] ````, every dialect a FIND over rows accepts) compose by intersection into the affected row set. An optional `<L>` or `<SL,EL>` then intersects each selected canonical body; it never paginates or changes the selected set. An emission row is curated whole instead: the scope retires it when it covers every line and otherwise leaves it ({§emission-row}). Thus ```` ```KILL (log:///**/READ) <17,-1> ```` may change long READs and no-op on short ones while reporting every selected row in `matched`.
 
@@ -2686,12 +2684,12 @@ Log history preserved — `log_entries` stores path tuple as text, not FK to `en
 
 ### §find FIND
 
-- §log-uniform-query **Log speaks the universal query contract** — ```` ```FIND (log://…) ```` works like every scheme's FIND. Candidates are worker rows scoped by the coordinate hierarchy ({§log-coordinate-hierarchy}) and projected exactly as READ shows them. Content dialects use `Matcher.matchCandidates`; `~` full-text and `&graph` use the same persistent derivation artifacts and candidate rankers as entries. Broad results are one-channel catalog groups whose `[0].path` is `log:///loop/turn/seq/OP`; exact matcher results are flat locations ({§find-result-projection}). Log remains the core event ledger rather than duplicating rows into `entries`; its core-private storage adapter supplies one complete channel representation to the same READ projector. That adapter is not a plugin seam and grants no protocol scheme an alternate READ path.
+- §log-uniform-query **Log speaks the universal query contract** — ```` ```FIND (log://…) ```` works like every scheme's FIND. Candidates are worker rows scoped by the coordinate hierarchy ({§log-coordinate-hierarchy}) and projected exactly as READ shows them. Content dialects use `Matcher.matchCandidates`; `~` full-text and `&graph` use the same persistent derivation artifacts and candidate rankers as entries. Broad results are one-channel catalog groups whose `[0].path` is `log:///loop/turn/seq/OP`; exact matcher results are flat locations ({§find-result-projection}). Log remains the core event ledger rather than duplicating rows into `entries`; its core-private storage adapter supplies one complete channel representation to the same READ projector. That adapter is not an extension seam and grants no protocol scheme an alternate READ path.
 - §find-source-agnostic **The content matcher is source-agnostic** — `Matcher.matchCandidates(body, candidates, mimetypes)` applies a content matcher (regex/jsonpath/xpath/glob) to candidates from ANY source, keyed by the caller's own identity (a pathname for entries, a `loop/turn/seq` coordinate for log). The matcher never cares what table the content came from, so FIND works uniformly across schemes by construction: `EntryFind` and `Log.find` run the one shared primitive rather than re-implementing it per scheme. Log stays its own event stream, but its rows are candidates the shared matcher covers like any entry's content.
 - §find-line-anchors **A FIND regex anchors each line**, as READ, EDIT and KILL do ({§read-pattern}, {§edit-pattern}): `^` and `$` are a line's ends in every FIND content match — over entries, log rows, turn sources and a binary channel's bytes — so ```` ```FIND (django/urls/resolvers.py) /^from|^import/ ```` locates the same import lines a READ with that pattern shows, never a false 204.
 - §find-candidate-containment **One candidate's crash is that candidate's problem** — arbitrary member content can crash a mimetype handler mid-match (an unbalanced template partial crashed Readability and killed a 1,916-file FIND as a blank 500, #449). `Matcher.matchCandidates` contains a per-candidate handler throw: the candidate drops out exactly like unsupported content, the cause goes to daemon stderr, and only a FIND whose every candidate crashed reports a 415 whose Problem names the first crashing member and handler. The operation's other candidates always answer.
 
-- §find-scope-prefix-filter Filters entries within scope. A **bare** path is the exact entry unless the file scheme resolves a directory under {§file-find-directory}; an explicit **shell glob**, classified once by {§path-glob}, expands to a scope. Path globs use segment semantics: `*` and `?` never cross `/`; `**` does — in every spelling: a `**` glued to a name (`**.go`, `src/**.ts`) is matched as `**/*.go` / `src/**/*.ts`, never demoted to a one-level `*` the way a native matcher reads it. Terminal `*` and `**` are structural catalog selectors and include dot-prefixed entries, so a complete map does not hide `.env.defaults` or `.github`; richer patterns retain native shell behavior. SQLite prefix queries may reduce the candidate set but never decide the match. A trailing slash is a recursive FIND scope only for a scheme whose manifest declares `folderScopes: true`; otherwise it is ordinary resource syntax. This is an explicit plugin contract, never inferred from URL punctuation.
+- §find-scope-prefix-filter Filters entries within scope. A **bare** path is the exact entry unless the file scheme resolves a directory under {§file-find-directory}; an explicit **shell glob**, classified once by {§path-glob}, expands to a scope. Path globs use segment semantics: `*` and `?` never cross `/`; `**` does — in every spelling: a `**` glued to a name (`**.go`, `src/**.ts`) is matched as `**/*.go` / `src/**/*.ts`, never demoted to a one-level `*` the way a native matcher reads it. Terminal `*` and `**` are structural catalog selectors and include dot-prefixed entries, so a complete map does not hide `.env.defaults` or `.github`; richer patterns retain native shell behavior. SQLite prefix queries may reduce the candidate set but never decide the match. A trailing slash is a recursive FIND scope only for a scheme whose manifest declares `folderScopes: true`; otherwise it is ordinary resource syntax. This is an explicit extension contract, never inferred from URL punctuation.
 
   Resource-authority globs select authorities independently of the path scope.
   Matching resources retain their full addresses through pattern matching,
@@ -2706,7 +2704,7 @@ Log history preserved — `log_entries` stores path tuple as text, not FK to `en
   matches the selected channel's content or derivation; path globs select
   resources through `(target)` ({§path-glob}).
 - §find-fulltext-selection Every matcher operates only over the candidate set selected by `(target)`; indexed matchers do not bypass that selection. `~query` passes the native FTS5 expression to SQLite and ranks matching candidates by ascending BM25, with resource identity breaking ties. Native BM25 uses the shared index's term statistics; candidate visibility, owner, channel and target filters determine which resources can be returned. The ordinary FIND pager selects resources for broad targets or match locations for exact targets: markerless search uses {§markerless-first-page}, `<N>` selects position N and `<N,M>` selects an inclusive range. Fractions are invalid result coordinates, not similarity thresholds. Results expose addressable matched text regions; neither cosine scores nor percentage similarity is invented. Native query-syntax failures return 400 with SQLite's diagnostic; database and implementation failures propagate.
-- §fts-word-phrase **A word with inner punctuation is the phrase of its tokens.** FTS5 barewords hold only letters, digits, `_` and non-ASCII, so before the query reaches SQLite each word outside a quoted string or `NEAR(…)` group that is not a bareword (with optional leading `^` and trailing `*`) is quoted as a phrase: `~inherited-members` searches `"inherited-members"` — the adjacent tokens `inherited members` — instead of failing as `no such column: members`, and `c++`, `x.y`, `a/b` likewise. FTS5's own syntax passes untouched: `AND`/`OR`/`NOT`/`NEAR`, `+`, quoted phrases, parentheses, and column filters (a word containing `:`, `{` or `}`, or opening with `-`). A column-filter failure keeps SQLite's diagnostic and its recovery says what the filter is and gives the bare-word and `NOT` forms: `` `members:` and `-members` are FTS5 column filters, and the index has one column; to search for a word write it bare, as `~members`, and to exclude one write `NOT` between terms, as `~a NOT members`. ``
+- §fts-word-phrase **A word with inner punctuation is the phrase of its tokens.** FTS5 barewords hold only letters, digits, `_` and non-ASCII, so before the query reaches SQLite each word outside a quoted string or `NEAR(…)` group that is not a bareword (with optional leading `^` and trailing `*`) is quoted as a phrase: `~inherited-members` searches `"inherited-members"` — the adjacent tokens `inherited members` — instead of failing as `no such column: members`, and `c++`, `x.y`, `a/b` likewise. FTS5's own syntax passes untouched: `AND`/`OR`/`NOT`/`NEAR`, `+`, quoted phrases, parentheses, and column filters (a word containing `:`, `{` or `}`, or opening with `-`). A column-filter failure keeps SQLite's diagnostic and its recovery says what the filter is and gives the bare-word and `NOT` forms: `` `members:` and `-members` are FTS5 column filters, and the index has one column; to search for a word write it bare, as `~members`, and to exclude one write `NOT` between terms, as `~a NOT members`. `` A syntax error over parentheses or quotes, which FTS5 reads as its own syntax, recovers to the phrase and to the regex for the same characters: `` FTS5 reads parentheses and quotes as query syntax: quote the phrase, as `~"all("`, or match the characters with a regex, as `/all\(/`. `` (#1005).
 - §find-scoped-isolation Workspace + scheme scoped — no cross-workspace/cross-scheme leakage.
 - §find-result-projection **The resolved target selection determines the result unit; result cardinality never changes it** ({§find-result-unit}). Returns `FindResult { status, content, mimetype, results, range, matchingPathCount, matchLocationCount, itemsWeightTotal, returnedItemsWeightTotal }`:
 
@@ -2741,7 +2739,7 @@ Log history preserved — `log_entries` stores path tuple as text, not FK to `en
   derivation's `{§mimetype-summary}`. Prose is clipped to at most `PLURNK_SERVICE_CATALOG_SUMMARY_CHARS` Unicode
   code points including a visible terminal ellipsis, so a row stays one line
   of orientation; an invocation-form witness — a summary that is one fenced
-  operation, the shape every tool family's summary takes
+  operation, the shape a runtime's tool summary takes
   ({§tools-resource-materialization}) — is shown whole, every tool named,
   because the discovery row exists so the model can invoke without a READ and
   a menu that is cut is no menu. Absent metadata is omitted.
@@ -2967,7 +2965,7 @@ of which Worker launched it ({§execution-output-identity}).
 | Backpressure | `PLURNK_SERVICE_EXEC_INPUT_TIMEOUT_MS` bounds each accepted delivery, including its queue residence. Expiry returns `504 input-timeout`; cancellation returns `499 input-cancelled`. Once delivery has begun, retire and abort input on either; delivery may be partial and is never replayed. The execution itself is not implicitly killed. |
 | Settlement or teardown | Retire and abort input immediately when the execution settles or is cancelled. Existing stream completion and worker wake mechanics remain the only completion path. |
 
-Stored runtime entries retain plugin-only writers. Input and termination are
+No operation writes a stored runtime entry: its scheme's `writableBy` is empty, and the execution writes its own streams. Input and termination are
 control capabilities, not exceptions granting write access to stdout/resources.
 
 ### §exec Executions
@@ -3125,6 +3123,11 @@ catalogue.
 
 Per-tool programs such as `go`, `cargo`, `make`, and `npm` do not earn executor tags merely because they are executables; they are complete shell commands in a `sh` executable fence. Registered tags exist only for tools that own a distinct body, target, or output contract. {§exec-registry-resolves}
 
+§exec-near-miss **An execution id under the wrong runtime names its address.** A KILL or input
+addressed to `<runtime>:///<id>` when the id holds an execution only under another runtime refuses
+`stream-not-found` as before, and its recovery names every address the id holds:
+`` The execution at /5e8ea474 is `python3:///5e8ea474`. `` (#1005).
+
 §exec-lifetime **How long a spawn may live is the fence's metadata, one field.**
 `[{"lifetime": …}]` takes a duration (`30s`, `30m`, `2h`), or one of three words;
 absent is `loop`. The key is one of the service's reserved metadata keys, withheld
@@ -3133,7 +3136,7 @@ executor target is refused `scope-unsupported` (400), naming the field.
 
 | `lifetime`   | The spawn |
 | ------------ | --------- |
-| a duration   | Aborted at the deadline — a bounded reap, polite signal then SIGKILL after `PLURNK_SERVICE_EXEC_KILL_GRACE_MS` — and the stream is stamped **504**, distinct from a deliberate kill (499) or a clean exit (200). |
+| a duration   | Aborted at the deadline — a bounded reap, polite signal then SIGKILL after `PLURNK_SERVICE_EXEC_KILL_GRACE_MS` — and the stream is stamped **504** `execution-timeout`, distinct from a deliberate kill (499) or a clean exit (200): `` Execution of '*runtime*' outlived its *lifetime* lifetime. `` Recovery: `` Run it again with a longer lifetime, such as [{"lifetime": "30m"}], or with none to let it run as long as the loop. `` |
 | `loop` (absent) | Loop-life bounded: reaped on every loop terminal except 202, the background-stream behavior. |
 | `turn`       | Reaped at the worker's next pre-turn via the registry abort, before the turn's own spawns, so it never survives into the subsequent turn; its terminal output surfaces born visible like any close ({§exec-stream}). |
 | `detached`   | Outlives its loop's terminal, 200 included. It never binds to the loop's teardown and is nobody's obligation — completion is not gated by it, WAIT does not park on it, optimistic settlement looks past it — and it ends only by KILL, the worker's total reap, or daemon shutdown; its late conclusion surfaces without opening a loop. |
@@ -3339,7 +3342,7 @@ body prefixes.
   wholesale ({§log-sensitive-request-evidence}); the spawn's record names each such value's
   provenance as the modifier's.
 - §exec-hold-until-concluded **The turn-hold exception** — for runtimes in `PLURNK_SERVICE_EXEC_HOLD` (a decision-table env), an in-flight stream **pauses the cycle**: the next packet does not assemble until the stream concludes, so the model never burns a turn asking "are we there yet" about a result the engine controls end-to-end. This exception is limited to seconds-bounded runtimes whose final result the engine controls end-to-end. Bounded by `PLURNK_SERVICE_EXEC_HOLD_MS` and **fail-open**: at the cap the standard cycle resumes untouched (waits, wakes, polls). Zero grammar or teaching surface — the model emits an executor fence, optionally followed by WAIT; the wake-shaped world simply arrives one packet sooner. It extends selected runtimes beyond the ordinary {§worker-optimistic-settlement} cap before the next packet assembles. A bare entry holds ALL of a runtime's spawns; a `<runtime>:<effect>` suffix (`github:read`) holds only that effect-class — an MCP server is one runtime whose tools split (a `read` `get_issue` is instant; a `host` `run_migration` is a slow mutation), so an operator opts the known-fast read-class in without parking on the mutation. Conservative stays default: an arbitrary third-party server's latency never parks the engine unless a suffix opts a class in.
-- §exec-entry-sink **The entry() sink** implements {§executor-entry-sink} over ordinary scheme-owned entries. Core owns allocation, materialization, and persistence; executors receive only the returned resource address. Web acquisition and materialization are the `https` handler's {§web-materialization-contract}, reached through the scheme registry; core names no leaf package.
+- §exec-entry-sink **The entry() sink** implements {§executor-entry-sink} over ordinary scheme-owned entries. Core owns allocation, materialization, and persistence; executors receive only the returned resource address. Web acquisition and materialization are the `https` handler's {§web-materialization-contract}, reached through the scheme registry; core names no extension package.
 
   | Input / effect | Consumer behavior |
   | --- | --- |
@@ -3347,7 +3350,7 @@ body prefixes.
   | Null path + supplied content | Publish beneath the invocation's `resources/` using {§resource-publication-names}, owned by the calling Worker. |
   | Supplied bytes | Retain the original bytes and declared mimetype in an ordinary channel ({§binary-parity}). |
   | Supplied text | Preserve text resources; HTTP/HTML materialization retains source and derived channels under {§html-materialization}. |
-  | Null content | Acquire an HTTP(S) resource through the checked WebFetcher, using the same configured materializers as exact HTTP acquisition ({§http-materializer-plugins}). |
+  | Null content | Acquire an HTTP(S) resource through the checked WebFetcher, using the same configured materializers as exact HTTP acquisition ({§http-materializer-extensions}). |
   | Durable evidence | One typed EDIT event in the runtime actor, with the calling Worker as causal source. Binary evidence describes the resource; its complete bytes live in the resource channel. |
   | Model orientation | The executor includes returned addresses in its result. Publication does not independently wake inference or broadcast an observer row ({§env-delta-entry-materialization}). READ controls content acquisition and native delivery. |
 
@@ -3532,7 +3535,7 @@ Capability admission precedes this decision, so proposal disposition cannot gran
 
 ### §subscriptions Subscriptions
 
-§subscriptions-subscription-registry-routes-cancellation READ on a streaming scheme is a subscription, not a one-shot. The scheme establishes its protocol-specific acquisition boundary, returns `102 Processing`, and stays alive through the `StreamSubscription` returned by `subscriptions.open()`. The service commits that initial operation result normally; later chunk and terminal work cannot rewrite it. Durable terminal truth lives on the subscription and its channels. The service records durable subscription identity and metadata in SQLite and retains the callable `SubscriptionHandle` only in its process-local live registry. Worker cancellation, turn-scoped reap, and shutdown all route through that one live registry; no handler-specific cancellation hook or database access is part of the plugin contract.
+§subscriptions-subscription-registry-routes-cancellation READ on a streaming scheme is a subscription, not a one-shot. The scheme establishes its protocol-specific acquisition boundary, returns `102 Processing`, and stays alive through the `StreamSubscription` returned by `subscriptions.open()`. The service commits that initial operation result normally; later chunk and terminal work cannot rewrite it. Durable terminal truth lives on the subscription and its channels. The service records durable subscription identity and metadata in SQLite and retains the callable `SubscriptionHandle` only in its process-local live registry. Worker cancellation, turn-scoped reap, and shutdown all route through that one live registry; no handler-specific cancellation hook or database access is part of the extension contract.
 
 The durable row is lifecycle evidence and the lookup key, not a serialized callback. `subscriptions.open()` establishes both halves before yielding a composed `StreamSubscription`: an `AbortSignal` whose fused `notifyChunk` and terminal `close` methods are safe to retain without the operation's general `SchemeCtx`. `close(result, summary?, channelResults?)` validates one universal terminal producer result plus exact named channel overrides. One SQLite transition closes the subscription and installs each channel's terminal `producerResult`; its lifecycle state derives from that result. The transition then wakes the worker when appropriate and unregisters the live handle. `close_status` is a constrained relational projection of `close_result.status`, never an independent result, while `channel_results` preserves historical overrides after a later subscription replaces the channel's current evidence. A durable open row without a live handle is an explicit lifecycle failure, never a fabricated cancellation success. Channel state ({§channel-state}) + log entries ({§no-chunk-rows}) carry lifecycle.
 
@@ -3553,7 +3556,7 @@ the producer's already obtained outcome into a fictitious cancellation result.
 At process restart every still-open row is necessarily missing its callable owner. Boot
 settles it as interruption (`500`) and errors active channels before evaluating parked
 loops ({§worker-lifecycle-restart-recovery}); it never reports cancellation (`499`) or
-pretends to reconstruct an opaque plugin connection.
+pretends to reconstruct an opaque extension connection.
 
 §subscriptions-causal-resource A subscription's causal Worker belongs to the
 entry's workspace. The active entry has
@@ -3639,7 +3642,7 @@ No generator. SQLite-optimal: STRICT (3.37+), `INTEGER PRIMARY KEY` aliasing, ex
 - Tokenization (provider-bound; hot-swap re-tokenizes per {§tokenomics}).
 - Provider dispatch, request-accounting validation, and exact-decimal aggregate projection through the shared contracts-owned path.
 - Scheme-handler invocation (connections, subprocesses, fetch).
-- Plugin loading ({§plugin-discovery}).
+- Extension loading ({§extension-discovery}).
 - Stream AbortController lifecycle.
 - CLI + daemon.
 
@@ -3647,16 +3650,16 @@ When SQL becomes onerous for a specific case, retreat for that case and document
 
 ---
 
-## §core-plugin-composition Plugin composition
+## §core-extension-composition Extension composition
 
 The metaproject contract owns installed membership, the one-family manifest
-shape, and the shared pre-import trust boundary ({§plugin-discovery}). Each
-capability framework owns its typed discovery result and trusted loading path.
+shape, and the shared pre-import trust boundary ({§extension-discovery}). Each
+framework owns its typed discovery result and trusted loading path.
 Core owns only cross-family composition, arbitration, and operator presentation
 of skipped-package evidence.
 
-§plugin-namespace-arbitration **Every addressable scheme name has one claim.**
-For an installed plugin, claim identity is the capability family plus its npm
+§extension-namespace-arbitration **Every addressable scheme name has one claim.**
+For an installed extension, claim identity is its kind plus its npm
 package name. Core's bundled names are reserved claims. A daemon module's
 runtime registration names its module owner and makes one composite executor
 claim: its ordinary output scheme and optional resource facet do not compete
@@ -3667,8 +3670,8 @@ claiming either name, for process-wide and workspace-scoped registrations alike.
 |--------------------------------|---------------------------------------------------------|---------|
 | None                           | Any valid claim                                         | Register it. |
 | Same installed family/package | Rescan of the same name                                 | No-op; retain the one registered handler. |
-| Reserved core name             | Any plugin or module                                    | Fail naming the reserved owner and claimant. |
-| Any plugin/module              | A different owner, including scheme/executor either way | Fail naming both owners. |
+| Reserved core name             | Any extension, a module included                        | Fail naming the reserved owner and claimant. |
+| Any extension                  | A different owner, including scheme/executor either way | Fail naming both owners. |
 | Module runtime                 | Its optional same-registration scheme facet             | Compose one handler under the runtime's single claim. |
 
 Arbitration precedes host registry mutation. External scheme descriptors are
@@ -3684,15 +3687,21 @@ registration.
 
 ## §bundled-set Bundled Set
 
-Family discovery ({§plugin-discovery}) scans installed scoped and unscoped
+Family discovery ({§extension-discovery}) scans installed scoped and unscoped
 packages carrying the applicable `plurnk.kind` declaration.
 
-§default-plugin-ownership `@plurnk/plurnk-service` is the sole manifest owner
-of the default leaf set. Capability frameworks own contracts, discovery, and
-loading; their runtime dependency graphs contain no leaf consumers. A required
-default leaf missing from a service install is a broken install. A direct
+§default-extension-ownership `@plurnk/plurnk-service` is the sole manifest owner
+of the default extensions. Frameworks own contracts, discovery, and loading;
+their runtime dependency graphs contain no extension of their kind. A required
+default extension missing from a service install is a broken install. A direct
 framework consumer may intentionally omit leaves and receives that framework's
 documented unavailable-capability behavior.
+
+`@plurnk/plurnk-tavily-plugin` is the separately installed, opt-in plugin showcase,
+not a service dependency. Its own tests own installation, native discovery,
+configuration, and HTTP materialization; service installation coverage proves it
+is absent from the default composition.
+
 Packed executor coverage distinguishes installation from enablement: verify
 the package floor, explicit opt-in, and composed allowlist/disable behavior
 through discovery and registration outside the development dependency graph
@@ -3705,19 +3714,19 @@ the checkout's development dependency graph, and proves each optional language
 degrades by name when its leaf is absent.
 
 §install-root-advisory-ownership **The composed service install owns
-third-party advisory detection.** Only that install resolves the default leaves
+third-party advisory detection.** Only that install resolves the default extensions
 and their combined transitive tree. Its audit reports advisories at the
 moderate floor without blocking by default; strict mode makes the same floor a
 gate. A chain rooted through an `@plurnk/*` dependency routes to that package's
 owner, while other direct roots remain service-owned. First-party package-pin
 freshness remains the owning family's concern.
 
-| Family    | Lean framework                     | Service-owned default leaves                                                                                                     |
+| Kind      | Lean framework                     | Service-owned default extensions                                                                                                     |
 |-----------|------------------------------------|----------------------------------------------------------------------------------------------------------------------------------|
 | Schemes   | `@plurnk/plurnk-schemes`           | `@plurnk/plurnk-schemes-http`                                                                                                    |
 | Mimetypes | `@plurnk/plurnk-mimetypes`         | `application-ipynb`, `application-json`, `application-jsonl`, and `application-xml` format leaves.                                |
 |           |                                    | `text-csv`, `text-diff`, `text-dotenv`, `text-html`, `text-ini`, `text-markdown`, and `text-plain` format leaves.                 |
-|           |                                    | `image`, `application-pdf` (header-only, {§mimetype-pdf-facts}), and every `grammar-{slug}` leaf in the framework's tree-sitter registry ({§mimetype-grammar-leaves}), all under `@plurnk/plurnk-mimetypes-*`. |
+|           |                                    | `image`, `application-pdf` (header-only, {§mimetype-pdf-facts}), and every `grammar-{slug}` package in the framework's tree-sitter registry ({§mimetype-grammar-packages}), all under `@plurnk/plurnk-mimetypes-*`. |
 | Executors | `@plurnk/plurnk-execs`             | `common`, `jq`, and `sqlite` leaves under the `@plurnk/plurnk-execs-*` prefix.                                               |
 
 The independently published `tokenizers` artifact is an opt-in leaf. Installing
@@ -3727,7 +3736,7 @@ native attachment like an image, and the daemon does no extraction (#542).
 
 **Providers:** `@plurnk/plurnk-providers` resolves the Models.dev catalog,
 operator declarations, local adapters, and finally installed AI SDK provider
-plugins. `Mock` is its integration fixture. Core contains no vendor protocol.
+extensions. `Mock` is its integration fixture. Core contains no vendor protocol.
 
 **Core schemes:** `file`, `log`, `prompt`, `skill`, and `worker` expose daemon
 state or filesystem orchestration owned by core. `exec` is internal dispatch
@@ -3738,8 +3747,8 @@ dispatcher contract.
 
 The executor registry discovers installed runtimes, probes availability, and
 routes ```` ```<runtime> ````; core contributes orchestration and the output-scheme
-adapter, not runtime implementations. Optional and third-party leaves extend
-each family by installation and discovery; they never require a framework or
+adapter, not runtime implementations. Optional and third-party extensions extend
+each kind by installation and discovery; they never require a framework or
 service manifest edit.
 
 ---
@@ -3807,11 +3816,11 @@ Node's pre-script env-file form and the executable's post-script form share the
 
 | Source | Panel | Admission |
 |---|---|---|
-| Platform capability package | `.env.defaults` at the package root | `@plurnk/*` or a `plurnk` package field; {§plugin-trust-boundary} |
-| Agent Plugin native extension | `ai.plurnk/.env.defaults` | The winning daemon-wide plugin in {§agent-plugins-hosting}, a valid native declaration, and the same trust gate |
+| Extension package | `.env.defaults` at the package root | `@plurnk/*` or a `plurnk` package field; {§extension-trust-boundary} |
+| Agent Plugin extension | `ai.plurnk/.env.defaults` | The winning daemon-wide plugin in {§agent-plugins-hosting}, a valid native declaration, and the same trust gate |
 
 Root and trust flags apply before collection. A project plugin contributes no native panel.
-Non-module native panels follow their npm-only family discovery ({§plugin-manifest-read});
+Non-module native panels follow their npm-only family discovery ({§extension-manifest-read});
 a plain-folder declaration does not suppress an installed capability's panel.
 Linked packages resolve panels against the same canonical root as native code;
 an absent panel is optional, but a panel escaping that root is rejected.
@@ -3865,6 +3874,7 @@ names the offending variable or file/entry and retains its cause.
 | A2A | Whole outbound definitions and controls, timeout/diagnostic bounds, configured inbound exposure |
 | Schedule | Whole definitions and controls, recurrence syntax, time zone and preview count |
 | Hooks | Command/argument/event configuration and delivery bounds |
+| Discovered modules | Each module's own configuration, as its factory constructs it ({§module-self-activation}) |
 
 Disabled definitions and controls without a resource are validated, not skipped.
 Checking creates no database, starts no process or listener, arms no schedule,
@@ -3893,7 +3903,7 @@ Each knob's value lives on its panel and nowhere else (`plurnk-service config de
 | §operator-config-file-create-scope `PLURNK_SERVICE_FILE_CREATE_SCOPE` | Hard file-creation ceiling: `none < root < namespace`. `none` denies new filesystem files, `root` admits only paths inside `project_root`, and `namespace` also admits canonical outside-root paths. Existing-member writes are unaffected. |
 | `PLURNK_SERVICE_FILE_MATERIALIZE_MAX_BYTES` | Byte ceiling in `1..104857600` for one workspace-file snapshot ({§membership-materialization-limit}). |
 | `PLURNK_SERVICE_MAX_TURNS` | Operator model-call **ceiling** — `-1` = no cap; a positive value clamps `runLoop({maxTurns})`. The durable worker-tree budget includes descendant calls, BARE, and park/resume under {§turn-cap-counts-the-tree}; non-model chronology consumes none. |
-| `PLURNK_SERVICE_MAX_COMMANDS` | Per-emission action ceiling; `-1` = no cap — every generated op dispatches. A positive value caps dispatched actions: overflow ops drop with one durable `max-commands-exceeded` error row on the next packet. The final disposition always dispatch. Tightened per workspace via `settings.maxCommands` (min wins). |
+| `PLURNK_SERVICE_MAX_COMMANDS` | Per-emission action ceiling; `-1` = no cap — every compiled op dispatches. Each resolved target statement counts once, whether authored separately or in a group ({§target-group}). Overflow ops drop with one durable `max-commands-exceeded` error row on the next packet. Lifecycle operations remain exempt ({§operator-config-workspace-max-commands-floor}). Tightened per workspace via `settings.maxCommands` (min wins). |
 | §operator-config-loop-timeout `PLURNK_SERVICE_LOOP_TIMEOUT` | Positive ms of cumulative active execution per loop ({§loop-execution-allowance}); excludes parked/queued time. Snapshotted on first execution, retained across wakes. Exhaustion aborts in-flight work and terminates `504 loop_timeout`, including a stuck provider call. |
 | `PLURNK_SERVICE_PROVIDER_RECOVERY` | ms of recovery after the first recoverable provider failure; `0` disables reissue. Expiry parks attended loops, concludes unattended loops, or returns BARE's failure under {§provider-recovery}. |
 | `PLURNK_SERVICE_PROVIDER_RECOVERY_BACKOFF` | First recovery delay (ms); doubles per failure up to `PLURNK_SERVICE_PROVIDER_RECOVERY_BACKOFF_MAX` ({§provider-recovery}). |
@@ -3904,8 +3914,6 @@ Each knob's value lives on its panel and nowhere else (`plurnk-service config de
 | `PLURNK_SERVICE_EDIT_RECEIPT_CONTEXT_LINES` | Surrounding and landed lines shown at each EDIT result boundary ({§edit-result-receipt-projection}). |
 | `PLURNK_SERVICE_MIN_CYCLES` | Min repetitions before cycle detection fires ({§engine-rails}). |
 | `PLURNK_SERVICE_MAX_CYCLE_PERIOD` | Max period length cycle detection examines ({§engine-rails}). |
-| `PLURNK_SERVICE_REQUIEM_MAX_TOKENS` | Initial forensic witness output allowance ({§digest-requiem}). |
-| `PLURNK_SERVICE_REQUIEM_RETRY_MAX_TOKENS` | Retry allowance; must be at least the initial requiem allowance ({§digest-requiem}). |
 | `PLURNK_SERVICE_FILES_ITEMS` | Turn-0 catalog preview. Folder-capable schemes render a one-level `*` map with `dir/**` rollups; kernel docs remain recursive and explicitly complete. `-1` = markerless first pages; positive `N` explicitly caps only file-map rows; `0` / unset = off ({§actor-boundary-catalog-preview}). |
 | `PLURNK_SERVICE_MEMBERS_MODEL_SCOPE` | Ceiling for a model's `members` definitions in the lattice `none < root < namespace`; `none` refuses every model definition ({§members-model-scope}). |
 | `PLURNK_SERVICE_EXEC_CONCURRENCY` | Executions admitted at once per workspace; the rest queue FIFO with `202 queued` receipts; `-1` unbounded ({§exec-concurrency}). |
@@ -3929,9 +3937,9 @@ instead of a user's boot, and a dead knob cannot ship.
 
 Feature-flag bools use `process.env.X === "1"` exactly — never `=== "true"`.
 
-External plugins declare their own env vars in their own `.env.defaults`, assembled at boot ({§operator-config-env-defaults}).
+External extensions declare their own env vars in their own `.env.defaults`, assembled at boot ({§operator-config-env-defaults}).
 
-§operator-config-cli-flags **Admin CLI flags derive only from the service package's `.env.defaults`.** Every `PLURNK_*` declared there becomes `--<kebab-cased-name>` (prefix stripped, lowercased, underscores → dashes). A comment immediately above the declaration becomes its `-h` description. Installed plugin defaults join the environment floor and catalog but do not implicitly expand the service executable's flag surface.
+§operator-config-cli-flags **Admin CLI flags derive only from the service package's `.env.defaults`.** Every `PLURNK_*` declared there becomes `--<kebab-cased-name>` (prefix stripped, lowercased, underscores → dashes). A comment immediately above the declaration becomes its `-h` description. Installed extension defaults join the environment floor and catalog but do not implicitly expand the service executable's flag surface.
 
 ### Loop limits
 
@@ -3978,9 +3986,9 @@ leak into another.
   workspace: a client tightens the runaway-op guard and never raises it past
   the operator's.
 - §operator-config-workspace-max-commands-floor The cap bounds *actions* only.
-  The final disposition (`102`, `200`, `202`,
-  `300`, or `499`) are never counted and always dispatch, so `0` is a valid
-  floor — the tightest — admitting a plan and disposition with zero actions.
+  WAIT and parameterless KILL are never counted and always dispatch, so `0` is a valid
+  floor, admitting lifecycle intent with zero actions. Dropped actions still prevent
+  successful completion under {§turn-disposition}.
 - §operator-config-workspace-git `settings.git` (`false`) **denies** git for the workspace (`PLURNK_SERVICE_GIT_ALLOWED` AND workspace) — the client opts its workspace out of git membership and working-tree status; it can never re-enable git past the operator's service-wide lockout.
 - §operator-config-workspace-file-create-scope `settings.fileCreateScope` narrows `PLURNK_SERVICE_FILE_CREATE_SCOPE` by the ordered lattice `none < root < namespace`; a workspace may disable creation or confine a namespace-enabled service to its root, but never widen the operator's ceiling. Unknown service values fail configuration validation and unknown workspace values fail `workspace.create`.
 - `settings.membersModelScope` narrows `PLURNK_SERVICE_MEMBERS_MODEL_SCOPE` ({§members-model-scope}).
@@ -4037,9 +4045,10 @@ a fresh-user configuration.
 
 ## §rpc Module seam
 
-Core implements the contracts-owned {§application-port} and owns the typed
-module setup seam. It owns no external listener, public
-action-name catalog, or generic string-dispatched method registry. A
+Core implements the contracts-owned {§application-port} and hosts the module
+contract published in `@plurnk/plurnk-modules` ({§module-contract}). It owns the one
+listener modules mount on ({§http-host}), but no public action-name catalog or generic
+string-dispatched method registry. A
 client-interface module such as `plurnk-agui` owns its public protocol, action
 names, request validation, discovery result, and event projection.
 
@@ -4047,13 +4056,13 @@ names, request validation, discovery result, and event projection.
 
 ```mermaid
 flowchart LR
-    bind["Host may pre-bind client-interface listener<br/>unready"] --> register
-    register["Daemon.registerModule"] --> setup["module.setup(ModuleSetupSeam)"]
+    bind["Host binds the daemon's listener<br/>unadmitted"] --> register
+    register["Register explicit, then discovered modules"] --> setup["module.setup(ModuleSetupSeam)"]
     setup --> capabilities["Register static capabilities,<br/>workspace activators, and actions"]
     capabilities --> ready["Process-wide schemes ready"]
     ready --> recovery["Reconcile durable lifecycle"]
     recovery --> start["module.start(ApplicationPort)"]
-    start --> interface["Module-owned client protocol<br/>ready"]
+    start --> interface["Listener admitted:<br/>module-owned client protocol ready"]
     recovery -->|durable workspace work| demand["First workspace demand"]
     interface -->|client workspace work| demand
     demand --> lease["Acquire capability residency"]
@@ -4070,17 +4079,17 @@ flowchart LR
 ```
 
 Every registered module's `setup` runs in registration order before any
-module's `start`. Core then readies process-wide schemes, reconciles durable
-lifecycle, and starts modules in registration order. The production
-client-interface module may already own its socket under
-{§startup-listener-admission}; its `start` activates request handling without
-rebinding. Persisted workspaces with
+module's `start` ({§module-phases}; failures follow {§module-failure}). Core
+then readies process-wide schemes, reconciles durable lifecycle, and starts
+modules in registration order. The daemon's listener is bound before durable admission
+({§startup-listener-admission}) and admitted once every module has started
+({§module-http-mounts}). Persisted workspaces with
 no durable work stay passive until first demand; activation publishes their
 complete capabilities and documentation before the demanding operation
 proceeds. `setup` is the readiness boundary for every capability registered
-with Core: recovery may demand a workspace provider before `start`. For a
-pre-bound client interface, requests remain unavailable until `start`; every
-other module opens its module-owned exterior ingress only after recovery. No
+with Core: recovery may demand a workspace provider before `start`. Requests on
+the listener remain unavailable until it is admitted; a module opens any other exterior
+ingress only after recovery. No
 registered capability may depend on exterior ingress. A module, and any distinct
 lifetime object returned by `start`, may implement the following phases:
 
@@ -4097,21 +4106,26 @@ even if setup fails. A returned object identical to its module is tracked once.
 
 | Source | Declaration | Lifetime |
 |---|---|---|
-| Platform capability package | `package.json#plurnk` with `kind: "module"` and `module` | Daemon-wide |
+| Extension package | `package.json#plurnk` with `kind: "module"` and `module`, an export subpath resolved through the package's own exports as in {§executor-dynamic-runtimes} | Daemon-wide; the form every first-party default module uses |
 | Agent Plugin | `plugin.json#extensions.ai.plurnk` with `kind: "module"` and a `module` path under `ai.plurnk/` | Daemon-wide; npm and selected user roots only |
 | Project Agent Plugin | Portable components only | Workspace-scoped; native code is not imported |
 
-The export is one DaemonModule object or no-argument factory. Standard bundles follow
+The export is one DaemonModule ({§module-contract}) object or no-argument factory. The host
+records each module's owner, the package it came from, and its diagnostics name that owner. The
+service registers no module itself; a host that registers one explicitly, such as a test
+substituting a package, names it by its package the same way. Standard bundles follow
 {§agent-plugins-hosting} source order, then other installed module packages load in package-name
-order. All trusted modules register before setup. The service's explicit AG-UI, hooks and MCP
-composition is never duplicated. Untrusted modules are reported and not imported. Invalid
+order. All trusted modules register before setup; a daemon without a listener then leaves out
+every one that declares mounts ({§module-http-mounts}). A package the host registered explicitly is
+never also discovered: discovery skips that owner before importing it. Untrusted modules are reported and not imported. Invalid
 declarations, unavailable module files and configuration errors during construction are diagnosed
-at the affected native extension; healthy siblings remain available. A factory validates startup
+at the affected extension, a declaration's error owned by `extensions` and a
+module's own configuration error by `module:<package>`; healthy siblings remain available. A factory validates startup
 configuration before `setup` acquires resources. Failures after registration begins follow
 {§module-lifecycle} cleanup, not a partial-registration fallback.
 An invalid module object, factory result or lifecycle member is an implementation contract failure,
-not configuration, and fails loudly. Native capabilities register through their owning public
-interfaces and release registrations during {§module-lifecycle} resource teardown.
+not configuration, and fails loudly. What a module contributes registers through its owning public
+interfaces and is released during {§module-lifecycle} resource teardown.
 
 §module-shutdown-order `Daemon.stop()` first rejects new capability demand and
 aborts proposals, branches, derivations, and worker scopes. It begins module
@@ -4157,18 +4171,21 @@ flowchart LR
     observers --> database[Maintain and release database]
 ```
 
+§module-host-capabilities **The coordinator's host interface is core's own.**
+The daemon passes one object implementing every published slice
+({§module-seam-slices}); these functions are on it too, for core's
+Functionality coordinator and core's own witnesses, and are not part of the
+published module contract.
+
 | Setup function | Contract |
 |---|---|
 | `registerRuntimes([{ decl, executor, availability, scheme? }, ...])` | Validates the complete canonical tag set under {§executor-runtime-declaration}, then publishes every process-wide executor and optional claimed scheme facet atomically. |
-| `registerScheme(name, handler)` | Adds one process-wide addressable scheme handler; scheme readiness and model-facing capability publication remain core-owned. |
-| §module-action-registration `registerModuleAction({ name, scope, residency, inputSchema, outputSchema, handler })` | Adds one non-empty, extension-unique action with resolvable JSON Schemas. `scope` is exactly `worldless`, `workspace`, or `worker`; the handler receives schema-validated params and a separate matching context. `residency` is explicitly `required` or `none`: only the former acquires workspace capabilities and reconciles worker documents. Worldless actions require `none`. Scoped contexts contain trusted bound identifiers, never client parameters. A client-interface module decides whether and how the name becomes public, validates successful output, and owns collisions with its built-ins. |
 | §module-workspace-provider `registerWorkspaceCapabilityProvider(namespaceOwner, provider)` | Registers one extension-unique Functionality provider. `activate({ workspaceId, retain })` reconstructs the workspace snapshot; idempotent `deactivate({ workspaceId })` releases process resources. Core coalesces demand and supplies residency leases for work that outlives its caller. |
 | §module-workspace-state `readWorkspaceModuleState(workspaceId, namespaceOwner)` | Reads one nullable JSON state value per workspace and provider. Core owns storage and lifecycle; the provider owns its schema. Store symbolic credential references, not copied secrets. A worker-scoped family's coordinator reads and replaces the same shape per worker in `worker_module_state` ({§functionality-scope}). |
-| `readWorkspaceEnvironment(workspaceId)` | Captures the workspace env layer ({§workspace-env}) and returns its composer. No argument uses admitted host values; a supplied environment supplies a module's reference-resolution context. Both apply the same captured values and masks, without worker overrides. |
-| §module-workspace-directory `workspaceStateDirectory(workspaceId, namespaceOwner)` | Returns and creates the module's absolute operational-state directory under the daemon's XDG state home. Core owns path resolution and a stable random workspace storage key in its own `workspace_module_state` row. The key survives workspace renames and daemon restarts; independently created workspaces, including in other databases, receive different keys. The module owns its contents and child-directory lifetimes. |
-| §module-functionality-adapter `registerFunctionalityAdapter(adapter)` | Registers one family beneath the shared coordinator ({§functionality-coordinator}). |
 | §module-workspace-capabilities `replaceWorkspaceCapabilities({ workspaceId, namespaceOwner, state, runtimes })` | Atomically replaces one provider's durable state and runtime/scheme snapshot at the workspace operation boundary. Namespace claims are validated before mutation. Failure restores the prior state and publication. |
 
+Core keys each {§module-workspace-directory} by a stable random workspace
+storage key in its own `workspace_module_state` row.
 Module directory allocation is lazy, atomic in SQLite, and independent of the
 project root, daemon CWD, and workspace/worker environment overrides. New
 directories use mode `0700`; existing permissions are not rewritten. Module
@@ -4180,6 +4197,14 @@ workspace forgets its storage key through the existing foreign key; old disk
 state is not reassigned or automatically purged. A database copy preserves its
 storage identities; the directory is operational state, not a backup of it.
 
+§skills-storage-upgrade **Skills ownership upgrades without a second identity.**
+The database migration renames the family state to `@plurnk/plurnk-skills`.
+Before module setup, core renames the former skills directory within each storage root
+recorded by this database. Fetched bytes are not refetched or deleted. A missing former
+directory needs no work; a completed rename is repeatable. Conflicting destinations and
+filesystem failures stop admission without replacing either directory. No runtime alias
+recognizes the former owner.
+
 §workspace-environment-sharing **The workspace owns its shared environment.**
 Workers own their logs; delegation retains its existing lifecycle.
 Creating, attaching, forking, cancelling, or deleting a worker does not create,
@@ -4319,7 +4344,10 @@ composition boundaries, not arbitrary exceptions:
 | Internal invariant, state, or implementation failure | Preserve the exception; never reclassify it as an operator configuration error. |
 
 Client discovery and passive synchronization report startup diagnostics through the
-existing Notice channel, even without a usable model. The first turn of a drain, and a changed diagnostic
+existing Notice channel, even without a usable model. Each is a Notice from `engine:configuration`
+of kind `configuration_unavailable` that names the failed setting's `key` and its `owner`: the
+setting's reader (such as `packet`, `model` or `executor:<runtime>`), a family, `extensions` for an
+extension declaration, or a module as `module:<package>`. The first turn of a drain, and a changed diagnostic
 thereafter, reports unresolved configuration to both client and model. An
 unchanged diagnostic is not repeated every turn. Operation failures remain Problems.
 
@@ -4350,32 +4378,6 @@ publication contract, and creates no log entries or model Notices. Published
 failures retain their exact Problems in `list`. Concurrent consumers share the
 workspace activity; a client disconnect does not clear another consumer's work.
 
-§functionality-adapter **An adapter owns protocol truth.** It declares its
-family, namespace owner, definition schema, contributed defaults, discovery,
-admission, preparation, and teardown, and its alias grammar when that is not
-the shared lowercase-hyphen one: the coordinator enforces whichever grammar the
-family declares, at admission, in the service projection, and on persisted
-state, so an environment variable's name is an alias exactly as a skill name
-is. Admission distinguishes explicit client
-actions from model operations where the family contract requires it
-({§members-model-scope}). Preparation receives each complete definition with optional
-adapter-owned interpretation context. Context is source semantics, not policy or provenance;
-it participates in runtime identity and hot-load comparisons, is never projected as configuration
-or persisted into a workspace override, and cannot survive replacement by a local definition.
-Removing that override restores the current inherited definition and context together.
-Descriptive provenance alone does not change runtime identity. Preparation returns runtimes, documents, per-alias
-outcomes, and a snapshot with `commit`/`abort`. Successful publication commits;
-failure aborts; cooling tears down. Protocol continuations remain ordinary
-module actions. Optional `forget` releases an installed or provisioned
-definition before removal; failure rejects removal. The
-seam's shapes — the identity a verb acts under, its options, definition
-sources, outcomes, preparation, the prepared result and the family handle —
-are declared once in `plurnk-contracts` and imported by core and every
-module; core adds only its own face of the seam, the runtime registration a
-resident family prepares and the scheme facet it may expose.
-An adapter may expose current partial-source `configurationNotices`; these join the ordinary
-workspace diagnostics without preventing independently valid definitions from preparing.
-
 §functionality-hotload **Out-of-band state is admitted before the next turn.** An adapter whose
 `available` reads state that changes outside the daemon, such as skill roots ({§skills-hotload}) or
 installed plugins ({§agent-plugins-hosting}), implements `refreshIfChanged`. Turn admission calls it
@@ -4415,9 +4417,10 @@ its discovery roots explicitly ({§operator-config-real-model-profile}), so
 operator roots do not shape a gate. Root selection does not restrict explicit
 source definitions. Skills mutations change workspace bindings, not these roots
 ({§skills-functionality}); MCP mutations likewise remain workspace-owned. The module setup seam's
-`workspaceConfigurationDirectories` supplies selected `<project>/.agents`,
-`$XDG_CONFIG_HOME/plurnk`, and `~/.agents` directories in precedence order, omitting
-project when no project is bound. Modules own their file formats; core owns discovery roots.
+`workspacePaths` supplies selected `<project>/.agents`, `$XDG_CONFIG_HOME/plurnk`,
+and `~/.agents` directories in precedence order with their scopes, omitting project
+when no project is bound ({§module-workspace-paths}). Modules own their file formats;
+core owns discovery roots.
 
 An adapter may expose a `scheme` facet beneath its family's runtime namespace
 ({§runtime-resource-binding}). A facet claims a path subtree and is the scheme's
@@ -4853,13 +4856,13 @@ adding a loop to it. LOOK text anchors resolve through the same
 | §notifications-loop-interaction `loop/interaction`           | contracts-owned `ClientInteractionProjection` | An operation is paused on client input. Live delivery and reconnect discovery share {§client-interactions}; workspace scope remains the event envelope. |
 | §notifications-workspace-created `workspace/created`         | `{ id, name, projectRoot }` | A workspace is created. This is the only current global event. |
 | `workspace/preparation` | `{ workspaceId, preparation: FunctionalityPreparationActivity[] }` | Workspace capability preparation changes; snapshot and clearing semantics follow {§functionality-preparation-visibility}. |
-| §notifications-stream-event-on-channel-change `stream/event` | `{ entryId, workerId, target, channel, state, contentLength, mimetype?, loop_seq?, turn_seq?, sequence? }` | Channel content grows or channel state transitions. `workerId` is the initiating actor used for conversation routing, never entry ownership or access control. `target` is the canonical resource URI. Optional numeric coordinates identify the causal log item, independently of that URI. Core-managed channel writes include the current stored `mimetype`, which may change per call ({§channel-mimetype}); the generic plugin notification capability does not require it. It carries metadata, not content; consumers read bytes by canonical workspace address. |
+| §notifications-stream-event-on-channel-change `stream/event` | `{ entryId, workerId, target, channel, state, contentLength, mimetype?, loop_seq?, turn_seq?, sequence? }` | Channel content grows or channel state transitions. `workerId` is the initiating actor used for conversation routing, never entry ownership or access control. `target` is the canonical resource URI. Optional numeric coordinates identify the causal log item, independently of that URI. Core-managed channel writes include the current stored `mimetype`, which may change per call ({§channel-mimetype}); the generic extension notification capability does not require it. It carries metadata, not content; consumers read bytes by canonical workspace address. |
 | §notifications-stream-concluded `stream/concluded`           | `{ entryId, workerId, target, subscriptionId, scheme, result, summary, wakeAction, loop_seq?, turn_seq?, sequence? }` | A subscription closes. `workerId` identifies the initiating actor; `target` is the canonical resource URI. Optional numeric fields identify the causal log item, never parsed from `target`. Exact result truth is preserved. `wakeAction` reports `wake-pending` before settlement, `no-op-active-loop` when work is already executing, `no-loop`, or `skipped-aborted`/`skipped-cancelled` for an aborted worker scope. A pending wake predicts neither execution nor recipient count; subsequent ordinary loop events report actual progress and completion. |
 | §notifications-notice-event `notice/event`                   | `{ workerId, loopId, notice: Notice }` | A transient observation or progress notice occurs. `workerId` owns loop activity; only workspace derivation progress uses `null` with `loopId=0`. It cannot alter durable history, scheduling, recovery, or model-visible failure truth. |
 | §notifications-outside-event `outside/event`                 | `{ workerId, loopId, turnId, coordinate, text, tokens }` | An admitted emission carried text outside every operation ({§outside-text}): once per admitted emission, the exact stored text, its packet weight, and the turn's `<worker>-<loop>-<turn>` coordinate. It is transient presentation evidence; the turn's `outside` source remains the durable authority. |
 | §notifications-reasoning-event `reasoning/event`             | `{ workerId, loopId, turnId, modelCallId, requestSequence, phase, delta? }` | A main emission call exposes readable reasoning. Each physical request that emits reasoning owns a distinct positive `requestSequence` and balanced start/content/end stream; opening a retry closes the preceding stream before any retry delta. Only content carries a nonempty exact delta. It is transient presentation evidence, never a log row, Notice, packet field, or BARE/child channel. The settled provider response remains the durable authority. |
 
-§notifications-stream-event-failure-isolation The plugin-facing
+§notifications-stream-event-failure-isolation The extension-facing
 `NotifyCaps.streamEvent()` remains a synchronous advisory call while core
 resolves its entry identity asynchronously.
 
@@ -4897,7 +4900,7 @@ without an origin filter ({§actor-boundary-isolation}).
 ## §packet-assembly Packet assembly
 
 `PacketBuilder.buildRequestPacket` owns the engine's default ordered section
-list. Trusted scheme plugins may transform that first-class list before it is
+list. Trusted scheme extensions may transform that first-class list before it is
 rendered or measured; {§context-fit} remains an engine-owned post-build rail.
 
 ```mermaid
@@ -4922,11 +4925,12 @@ The packet reaches the provider as a transcript, under the roles the model was t
 Only role boundaries are added: joined by blank lines, the user messages are the user slot's
 bytes, in record order. An emission is placed exactly when its row is present in the final log
 section, so curation governs the transcript: a KILLed emission row, or one a trusted transform
-removed ({§packet-plugin-transform}), takes its emission with it, and a log without emission rows
+removed ({§packet-extension-transform}), takes its emission with it, and a log without emission rows
 is one user message. An emission of only NOTE and WAIT delivers nothing, so its record runs on
 into the next user message. The Worker block and the status clump always follow the log, so a
 request never ends on an emission, and the projection refuses one that would. The digest's packet
-artifacts record the sections, and `.wire.json` the messages ({§share-packet-names}).
+artifacts record the sections, and `.wire.json` reconstructs their text-message
+envelope ({§share-packet-names}); it is not a serialized HTTP capture.
 
 ### §packet-cache-monotone Default order and cache locality
 
@@ -4957,7 +4961,7 @@ operator notes and policies can change. Trust is a separate
 admission rule. The system slot contains trusted control-plane material;
 attacker-reachable content stays in the user slot.
 
-### §packet-plugin-transform Trusted whole-list extension seam
+### §packet-extension-transform Trusted whole-list extension seam
 
 `SchemeRegistry.transformSections` pipes the complete default list through
 every registered scheme implementing `transformSections(sections) -> sections`,
@@ -4970,7 +4974,7 @@ sections. It receives no separate engine, database, actor, or request context.
 Emission placement reads the final log section, so a transform that removes an
 emission row's record removes its emission from the transcript ({§packet-wire-envelope}).
 
-This is strictly a trusted in-process seam, admitted through the common plugin
+This is strictly a trusted in-process seam, admitted through the common extension
 trust gate; an external client action cannot invoke it. Whole-list transformation is
 the fork-avoidance valve for alternate packet shapes, while
 overflow recovery and packet projection remain closed engine concerns.
@@ -5123,8 +5127,8 @@ header. A null header renders only its content. Empty content is omitted, traili
 newlines are removed from each section, and rendered sections are separated by one
 blank line. Any node whose content is empty is absent from the wire, except the
 child-orientation sections, which state emptiness as `[]` ({§packet-empty-sections}).
-Core owns the order at {§packet-cache-monotone}; a trusted plugin may transform the
-section list before rendering ({§packet-plugin-transform}). The projection preserves
+Core owns the order at {§packet-cache-monotone}; a trusted extension may transform the
+section list before rendering ({§packet-extension-transform}). The projection preserves
 the evidence section owners supply: paths, URI fragments, log coordinates, scopes and
 coordinate-prefixed body lines remain usable without translation; curation and log-row
 measurements stay attached to what they measure ({§tokenomics-agnostic-ruler});
@@ -5173,7 +5177,7 @@ whose INSTEAD OF trigger refuses a turn that is not an open model inference turn
 items, the composition, the bag, and the provider metadata together. Readers of a whole packet
 select from `turn_packets`, which assembles `sections` back into the bag byte for byte (the digest,
 and every test that inspects a stored packet); statements that need one field read the bag
-directly with `json_extract`. A packet transformed by a plugin, or any non-log section, is one
+directly with `json_extract`. A packet transformed by an extension, or any non-log section, is one
 item. Items no composition references are transient data: `retention_collect_packet_items`
 collects them under the retention policy ({§retention-policy}), which is how a deleted worker's or
 workspace's packets release their space while shared items survive. A fork copies the composition
@@ -5197,42 +5201,12 @@ operation turns and therefore store `NULL`. Digest projects exact operation
 source independently from this optional model-exchange record; a request-only
 turn receives a note instead of a fabricated response.
 
-§digest-turn-artifact-identity **Digest packet artifacts project durable turns.**
-After selectors are applied, digest retains every turn with exact content or reasoning source, a
-valid stored provider request, or malformed stored packet evidence; orders those
-turns by durable chronology; and names each by its log coordinate ({§share-packet-names}). The
-producer does not affect projection.
-
-§share-packet-names **Packet artifacts carry the coordinate the log uses.** A turn's files are named
-`<worker>-<loop>-<turn>`, the worker's name and the loop and turn sequences that `log:///<loop>/<turn>/…`
-addresses: the model's first turn in its first loop is `<worker>-1-2`, because the initialization
-survey is turn 1 and writes no packet. A digest spanning several workspaces nests each workspace's
-files in a folder named for it. `digest.json` records each turn's stem as `artifact`, so no
-consumer reconstructs a name. A name that cannot be a file name, or two turns sharing one, fails.
-
-| Artifact | Present when | Authority |
-|----------|--------------|-----------|
-| `<stem>.assistant.md` | The turn has an `ops` source | Exact `turn_sources.content`, independent of log rows |
-| `<stem>.reasoning.md` | The turn has a `reasoning` source | Exact `turn_sources.content`, without relabeling it as content |
-| `<stem>.system.md`, `<stem>.user.md` | The turn stored a provider request | Stored text sections projected through `PacketWire`; native parts are not Markdown |
-| `<stem>.wire.json` | The turn stored a provider request | The request's text messages in order, its worker's emission rows placed ({§packet-wire-envelope}); `<stem>.wire.invalid.json` names a stored log that cannot be projected |
-| `digest.json` turn `attachments` | Every turn | Stored native attachment descriptors; `[]` means a request without attachments, `null` means no valid stored request. Selection is not proof of provider acceptance. |
-| `<stem>.assistantRaw.json` | The request has an admitted provider response | Stored opaque provider response |
-| `<stem>.response.md`, attempt artifacts | The request received no admitted response | Stored request and attempt state |
-| `<stem>.packet.raw.txt` | The stored packet fails typed validation | Exact stored packet text |
-| `<stem>.packet.invalid.json` | The stored packet fails typed validation | Turn identity and complete validation error chain |
-
-A source-backed turn without provider participation produces only its source-channel
-artifacts; a request-only turn produces no fabricated assistant. A
-source-less programmatic turn with no provider request has no forensic payload
-to project and writes no files.
-
-The external tokenless draft and transformation boundary is owned by
+he external tokenless draft and transformation boundary is owned by
 {§scheme-packet-transform}. Core alone extends each validated draft with its
 measured `weight` field for storage. #74 tracks coverage that mistakes the sum
 of section weights for the rendered request weight.
 
-§definition-table-projection The authored `plurnk.md` remains human-aligned. Its `definition` section deterministically removes Markdown table-cell padding and shortens separator cells to three dashes before plugin transforms, measurement, storage, and wire rendering; alignment colons survive, while fenced blocks and all non-table whitespace remain exact.
+§definition-table-projection The authored `plurnk.md` remains human-aligned. Its `definition` section deterministically removes Markdown table-cell padding and shortens separator cells to three dashes before extension transforms, measurement, storage, and wire rendering; alignment colons survive, while fenced blocks and all non-table whitespace remain exact.
 
 §lexicon **Vocabulary follows the standard of its audience.**
 
@@ -5261,11 +5235,11 @@ Retired terms stay retired: the lexicon guard rejects `thinking`, the unqualifie
 | inbound `SEND` from outside the workspace | the operator's: complete when it fit, otherwise its size and address ({§context-fit}, {§message-projection}); a peer worker's: its first page ({§markerless-first-page}) |
 | structured `EDIT` receipt or textual `COPY`/`MOVE` effects | complete receipt-owned join context |
 | every other nonempty body | the model's own: complete; what it did not author: its first page ({§markerless-first-page}); then {§context-fit} |
-| the `reasoning` row | the model's own reasoning, complete, or no row at all ({§reasoning-row}) |
+| the `reasoning` row | the optional reasoning preview under {§reasoning-row} |
 | a row the wall took | its size and address, no body and no native part ({§context-own-rows-fit}) |
 | bodyless row | heading and any facts; no coordinate lines; `tokens` includes any selected native part |
 
-§markerless-first-page **What the model did not ask for in size arrives as its first page.** A READ or FIND without a scope, a stream delivered when a command closes, a peer worker's message, an environment delta, an extension's body and a rejected emission shown back all arrive as their first page: `PLURNK_SERVICE_PREVIEW_LINES` lines and at most `PLURNK_SERVICE_PREVIEW_CHARS` characters, in the projection's own units — lines of text, bytes of a byte view ({§read-bytes}), results of a FIND — with one fact in one notation stating the page and the whole, `<1,100> of 4812 lines` (`range` on a retrieval, `preview` on a stored body, {§packet-extent-metadata}). What the model authored stands whole: a NOTE, a WAIT, the body of its SEND, the prompt of its WORK or FORK, the command it handed an executor, and its own reasoning when it lands as a row ({§reasoning-row}). What it asked for exactly stands whole: an explicit scope — `<a,b>`, `<1,-1>`, a pattern — and an EDIT receipt, bounded by its own rule ({§edit-result-receipt-truth}). The operator's message keeps its own rule ({§message-projection}) and an emission row its head ({§emission-row}); those are the only exceptions, so the model can reason about every page the same way. A page lands under {§context-fit} like any result: whole when it fits the remaining budget, otherwise the prefix and receipt. Retrievals take their page at the source, before storage, and the packet applies no second cut to a stored result; a stored body takes its page in the packet, and the rest stays readable at the row's address. No operation carries a page size of its own.
+§markerless-first-page **What the model did not ask for in size arrives as its first page.** A READ or FIND without a scope, a stream delivered when a command closes, a peer worker's message, an environment delta, an extension's body and a rejected emission shown back all arrive as their first page: `PLURNK_SERVICE_PREVIEW_LINES` lines and at most `PLURNK_SERVICE_PREVIEW_CHARS` characters, in the projection's own units — lines of text, bytes of a byte view ({§read-bytes}), results of a FIND — with one fact in one notation stating the page and the whole, `<1,100> of 4812 lines` (`range` on a retrieval, `preview` on a stored body, {§packet-extent-metadata}). What the model authored stands whole: a NOTE, a WAIT, the body of its SEND, the prompt of its WORK or FORK, and the command it handed an executor. Its own reasoning, when it lands as a row, stands whole only when it fits the row's page and otherwise takes its last page ({§reasoning-row}). What it asked for exactly stands whole: an explicit scope — `<a,b>`, `<1,-1>`, a pattern — and an EDIT receipt, bounded by its own rule ({§edit-result-receipt-truth}). The operator's message keeps its own rule ({§message-projection}) and an emission row its head ({§emission-row}); those are the only exceptions, so the model can reason about every page the same way. A page lands under {§context-fit} like any result: whole when it fits the remaining budget, otherwise the prefix and receipt. Retrievals take their page at the source, before storage, and the packet applies no second cut to a stored result; a stored body takes its page in the packet, and the rest stays readable at the row's address. No operation carries a page size of its own.
 
 READ and FIND own their range or pagination before packet rendering; the packet never applies a second hidden substring bound to their selected result. Reasoning arrives through ordinary scoped READs ({§reasoning-history}). When a visible projection differs from its canonical body, metadata carries `preview` under {§packet-extent-metadata}; complete and fully suppressed bodies omit it. ```` ```READ (log:///<coordinate>/<OP>) ```` selects untrimmed lines in original coordinates under {§log-readable-projection}; the unsuffixed exact shorthand and authoritative suffix behavior are defined by {§log-coordinate-hierarchy}. ```` ```FIND (log:///...) ```` and search match that same readable view. System/policy sections are not log bodies. Notices are transient non-log observations; they share the ordinary line/character bounds but have no durable body or recovery URI.
 
@@ -5416,83 +5390,14 @@ the same deadline through {§application-loop-observation}, not a restarted cloc
 
 §share **A share is the database's record, ready to send.** `plurnk-service share [<file.db>] [<folder>]`, and `npm run share` from a checkout, take a consistent copy of the database (`VACUUM INTO`; a live database is never read in place), and write its digest into `<folder>`, an ordinary folder the user archives or attaches however they like. Without a database the service's own is shared. Nothing is overwritten: a folder that exists and is not empty is refused, and a caller reusing a place removes it first. The share is the user's bug report and our dogfood, benchmark and forensics artifact alike.
 
-§share-snapshot **A database is copied by SQLite, never by the filesystem.** `Share.snapshot(dbPath, copy)`, exported as `@plurnk/plurnk-service/share` with `Share.write`, is the one consistent copy: a byte copy of a WAL-mode database drops every committed page still in its `-wal` file. A harness that keeps the database beside its digest takes it through `snapshot`; an existing `copy` is refused.
-
 §share-scope **A share is unredacted.** `--workspace=<id>` limits a share to one workspace; without it the whole database is shared. Nothing is filtered, redacted or scanned: a share holds what the models saw and wrote in scope, including prompts, file contents read, command output and reasoning, and the command says so. `--requiem` adds the forensic interview ({§digest-requiem}), which calls a model; `plurnk-service requiem <file.db> <folder>` adds it later to a digest already written.
 
 §share-folder **Shares land in one place.** With no folder named, a share is a stamped child, `share-<UTC stamp>`, of `PLURNK_SERVICE_SHARE_FOLDER` (a leading `~/` expands, as for every explicit Plurnk path) or of `$XDG_STATE_HOME/plurnk/shares`.
 
-§digest-programmatic-surface **The digest is an importable forensic surface.**
-
-| Surface                                | Contract                                                                                                                                            |
-| -------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Import `@plurnk/plurnk-service/digest` | Ships `Digest` and its package-owned SqlRite statements; importing performs no I/O or process action. The CLI wrapper alone invokes it.             |
-| `run({ dbPath })`                      | Reads the required database and writes a complete digest to `./test/digest` relative to the caller's working directory.                             |
-| `digestDir`                            | Selects a nonempty output path. `run` refuses a folder that exists and is not empty, and `requiem` refuses an existing `requiem.json` or `requiem.md`, before database or provider I/O; neither deletes ({§share}). Concurrent callers use distinct folders. |
-| Reader lifetime                       | `run` reads heavy evidence on demand while rendering, then closes its reader on success or failure. `requiem` closes its reader before awaiting witness inference. |
-| §candidate-pinned-runtime Candidate runtime | At launch, after its optional build, the candidate copies every workspace's package projection (`files`) into `<state>/runtime`, links third-party dependencies, and resolves `@plurnk/*` to those copies. Its daemon and its digest export both run from that copy, never the shared checkout, so neither source edits nor a concurrent candidate's or developer's rebuild after launch changes the code a run finishes on. The copy is removed once the digest is written. |
-| Export completion                     | Packet and response bodies are read and serialized one record at a time, without discarding evidence. `digest.json` is promoted from a partial file only after every artifact is written; its absence identifies an incomplete export. |
-| `workerId`                             | Narrows workers and every dependent loop, turn, turn-attached logical inference, specialization, physical request, and log row to that one worker. |
-| `workspaceId`                          | Narrows workers plus every logical inference and dependent evidence owned by one workspace, when both selectors are present they intersect. |
-
-§digest-cost-kind **Cost basis named.** A rendered Cost line carries the basis of its dollar figure: `(charged)` only when every settled request's cost is provider-charged; `(estimated — catalog rates)` when any settled request's cost is an estimate, because a mixed sum is no more trustworthy than its weakest term. A dollar figure without its basis reads as billed truth, and an estimate must never impersonate a charge.
+§candidate-pinned-runtime **Candidate runtime stays pinned.** At launch, after its optional build, the candidate copies every workspace's package projection (`files`) into `<state>/runtime`, links third-party dependencies, and resolves `@plurnk/*` to those copies. Its daemon and its digest export both run from that copy, never the shared checkout, so neither source edits nor a concurrent candidate's or developer's rebuild after launch changes the code a run finishes on. The copy is removed once the digest is written.
 
 §output-allowance-notice **The output allowance is not disclosed; a ceiling cut names its cause.** The packet's budget section carries the curation state and no response allowance: a model does not plan in tokens and no harness tells it its output ceiling, so the number is a fact without a use (#826). Overflow tolerance (#482) is likewise never advertised; a cut's notice names the true per-call grant from the response's own capacity record. When a provider finish is `length`, the engine emits an `output_truncated` notice (source `engine:capacity`) naming the allowance — the fact alone, never advice on what to do about it — on every path — railed or not — and the rails verdict never blames the model's grammar for a cut the engine's own ceiling made. The same precedence governs a cut so deep no operation parses: the rejection notice names the truncation as the cause, not the parser's symptom, overriding {§invalid-emission-attempts}'s parser diagnostic for `length` finishes.
 
-§digest-wire-line **Wire health aggregated.** Each worker summary renders a `Wire:` line — total physical provider requests, error-outcome count, and the error percentage when nonzero. Provider-level failures are absorbed by retries below the packet stream, so without this aggregate a rate-limit storm is invisible in every summary while the model's experience stays clean.
-
-§digest-cache-ledger **Measured cache reuse and estimated prompt overlap are separate.**
-
-| Projection | Meaning |
-|---|---|
-| `digest.json` provider-request `cachedTokens`, `inputTokens` | Exact provider-reported cache reads and input tokens; absent quantities remain `null`, reported zero remains zero. Every physical request counts, including retries and first requests of new loops. Stored packet availability is irrelevant to these counters. |
-| Turn `cache=<cached>/<input>` | Sum each measured quantity over that turn's requests. If any request omits a quantity, that sum is `?`. |
-| Workspace `Cache: <cached> of <input> reported input tokens read from cache (<pct>%) over <n> requests` | Sum only requests reporting both counters. Percentage is cache reads / input, rounded to one decimal; zero input is `n/a`. Requests missing either counter are counted separately as `missing input or cache usage (excluded)`. |
-| `digest.json` provider-request `adjacentPrefixTokensEstimate` | Optional loop-local diagnostic: the longest common character prefix with the preceding request, weighted under {§tokenomics-agnostic-ruler} as a share of the current stored prompt, multiplied by reported input tokens. First request: `0`; missing current/preceding packet or current input: `null`. Empty prompts have zero overlap. |
-
-The prefix estimate uses the stored emission packet's wire message order, roles
-and content. A BARE request's input is not that packet; its prefix estimate and
-the following request's comparison are unknown. The estimate is
-neither provider tokenization nor a cache ceiling, and never supplies a cache-ratio
-denominator. Caching across loops or against other provider-resident prefixes
-does not make the measured counters inconsistent.
-
-§digest-edit-census **Every model EDIT by the form it authored, how it landed, and whether it came back.** For each worker the digest reads every model-authored EDIT row and classifies the form from the row's stored marker and the durable statement's pattern: `hash` (one anchor), `line` (one line number), `range` (two marks), `insert` (the zero-width `<L,1,L,1>` form, {§zero-width-column-one-insert}), `column` (any other four-mark region), `prepend` / `append` (`<0>` / `<-1>`), `offset` (a tolerated anchor offset, {§anchor-offset}), `pattern` (a selection matcher), `whole` (no marker: a creation when it lands 201). It counts the EDITs, those refused (status ≥ 400), and the *revisits*: an EDIT of a path the same worker had edited within its previous two model turns — the shape of a repair without the claim of one. Each worker summary renders `EDITs: <n> · <form>=<count>… · refused=<k> · revisits=<r>` (`(no edits)` for none); `digest.json` carries the census as `edit_census` on every worker and stamps every EDIT log entry with its `edit_form` and `edit_revisit`. A form is a fact about what was written, never about intent; the bench sheet reads the counts as friction and leaves the judgement to the reader.
-
-§digest-forensic-fidelity **Forensic fidelity and cardinality.** The digest's machine-readable JSON preserves every log event with its initial and current projection, causal `source`, and structured `attrs`; every exact log-KILL target effect; the exact Problem on every failed row; each loop's exact terminal result, settlement time, scheduled due time, recurring interval, and recurrence lineage; and every ordered physical provider request. Programs still produce chronological `assistant.md` artifacts after every READ receipt is KILLed; source is independent of log curation. Each worker summary's `Emissions:` line counts its announced emission rows, those the worker KILLed, and the headings it echoed ({§emission-row}); its `Reasonings:` line counts its landed reasoning rows, those the worker KILLed, and the turns that reasoned ({§reasoning-row}); the op mix leaves both harness rows out. Each stored packet validates independently: one malformed historical packet remains exact raw evidence with its complete validation error chain and never prevents healthy turns from being projected. Accounting on broader rows is the shared exact derivation from that ledger, never a second stored fact. A worker's Cost line names how many settled requests carry no usage at all (errored or aborted exchanges) — their server-side spend is unrecorded rather than silently priced as zero. The reasoning chronology distinguishes readable reasoning content from provider-reported reasoning usage: when tokens were reported but no readable content was returned, it states both facts instead of implying that no reasoning occurred. The human Markdown waterfall shows a present causal source and may preview only the Problem detail because it remains a triage projection, not the machine record. Targets reconstruct the model-visible address, including hostname, port, serialized query, and fragment; an authority-bearing URL must never degrade from `https://host/path` to `https:///path`, and durable resource coordinates render back to their authority form. Its human Markdown waterfall groups consecutive identical per-turn op outcomes and typed `entry_materialized` narrations, reporting the exact count and sequence span (`xN (seq A-B)`). Grouping keys include source and the complete target, so distinct causes, authorities, or channels never collapse, and non-consecutive events preserve their chronological order. Thus amplification is conspicuous without making the diagnostic artifact itself pathological; valid packet files remain byte-identical records of what the model saw.
-
-Unrecognized actionless log rows are retained and labelled as such, not
-interpreted as executable turnOps or allowed to prevent the remaining digest.
-
-§digest-executor-evidence **A red command is work, not a defect.** Engine-materialized
-completion rows for a failed command carry the executor's problem identity
-(`https://problems.plurnk.xyz/executor/*`), and the digest classifies them as
-evidence: they render like any row but never count toward a loop's error total,
-its health verdict, or the per-turn `errs=` badge — a loop that concluded green
-over red test runs is CLEAN, not DEGENERATE-WIN. This is the digest mirror of the
-strike rail's exemption ({§engine-rails}, #425 F1): structural violations count,
-executor evidence never does.
-
-§digest-requiem **A requiem is an out-of-band forensic interview, not a worker
-turn.** It cannot execute operations or alter the audited history.
-
-| Aspect    | Contract                                                                                                                                                        |
-|-----------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| Scope     | One interview for each worker with model-bearing inference turns; workers without inference evidence are omitted.                                                |
-| Evidence  | The worker's final packet plus every attempt's exact normalized response and admission evidence; opaque raw transport remains in durable forensic artifacts. Quoted evidence is budgeted to the witness window ({§digest-requiem-evidence-budget}). |
-| Witness   | An explicitly supplied provider or the active configured provider; absence fails hard.                                                                          |
-| Identity  | The worker's durable provider identity ({§worker-provider-identity}) is sent as the `workerId`, without asserting a live worker topology. |
-| Attempts  | One call at `PLURNK_SERVICE_REQUIEM_MAX_TOKENS`; only an empty length-limited response receives one retry at `PLURNK_SERVICE_REQUIEM_RETRY_MAX_TOKENS`.         |
-| Artifacts | `requiem.md` carries testimony and exact nullable USD accounting. `requiem.json` is durably materialized before each call and preserves logical call state, messages, normalized responses, every physical request's state and accounting, and their shared aggregate projection. |
-
-§digest-requiem-evidence-budget **Quoted evidence fits the witness.** The
-interview's user message is budgeted against the witness provider's context
-window minus the retry output allowance and system framing (chars/2, the
-capacity gate's own estimator). Overflow elides the oldest provider attempts
-behind an explicit `elidedOldestAttempts` count marker, never silently; the
-final packet and the newest attempts always testify. A windowless witness
-(`contextWindow` null) quotes unbudgeted.
-
 §turn-lifecycle **Turn-lifecycle liveness.** Provider generation is the long, opaque window in a turn — one or more same-packet emission attempts may occur before the first committed op. A static client screen there is indistinguishable from a hang. The engine brackets the complete attempt window with two `notice/event` notices (`source: "engine:turn"`, `level: "info"`): `turn_awaiting_model` before the first call and `turn_generated` when an emission is accepted or the attempt budget is exhausted. The completion beat carries the spend ({§turn-accounting-notice}). Rejected content never rides the notice channel. Both are suppressed on an aborted loop and broadcast to the workspace like any notice ({§notice-event-notify}).
 
 §turn-accounting-notice **The completion beat carries the spend.** `turn_generated`
@@ -5510,9 +5415,9 @@ content-offset position: reasoning coordinates do not address the content source
 §tools-resource-discovery **Executable capability discovery uses ordinary
 Plurnk resources.** No generated tool table rides the system packet. Every
 runtime enabled for the current worker with an admitted invocation materializes one
-family document at `worker:///_plurnk/plurnk/<runtime>.md`. A general runtime's
+runtime document at `worker:///_plurnk/plurnk/<runtime>.md`. A general runtime's
 document contains its {§executor-tool-document}; a runtime with an exact
-{§executor-tool-registry} materializes a compact catalog at the same address. The family document summarizes
+{§executor-tool-registry} materializes a compact catalog at the same address. The runtime document summarizes
 the server or runtime, lists every enabled target as a directly copyable
 executable fence named for the runtime, with its input preview ({§operation-aside} carries the
 target one-liner; no invocation dispatch would reject is ever advertised).
@@ -5523,13 +5428,13 @@ preserve the full tool description and raw input schema under
 Turn0 rows. A schema-backed general runtime uses `<runtime>/input.md`.
 Non-schema targets retain supplemental details in family sections.
 Tool-result/output schemas remain ordinary evidence, not teaching. Unknown-target
-recovery names the published family document through the same path owner as
+recovery names the published runtime document through the same path owner as
 materialization, including a runtime's declared `resourcesPath`.
 
 ```mermaid
 flowchart LR
-    Survey["Turn 0 FIND<br/>tools/*.md"] --> Families["family paths + summaries"]
-    Families --> Read["READ selected family<br/>only when needed"]
+    Survey["Turn 0 FIND<br/>tools/*.md"] --> Runtimes["runtime paths + summaries"]
+    Runtimes --> Read["READ selected runtime<br/>only when needed"]
     Read --> Exec["execution with an aside"]
     Read --> Schema["READ linked input schema<br/>when the preview is insufficient"]
     Schema --> Exec
@@ -5538,19 +5443,19 @@ flowchart LR
 §tools-resource-materialization The runtime registry, workspace capability policy,
 tool resources, and dispatch use one effective workspace snapshot. A
 disabled, unavailable, detached, replaced, or removed runtime has no
-tool resource; an exact registry's empty set publishes no executable family and
+tool resource; an exact registry's empty set publishes no runtime and
 admits no invocation. Reconciliation deletes stale documents
 before upserting the current set. `PLURNK_SERVICE_DOCS_EXCLUDE` does not hide an
 enabled executable; executor enablement is the sole user-configured filter
 shared by discovery and dispatch. A runtime declaration may carry
 `resourcesPath` — its generated-doc root relative to the workspace's generated
 subtree ({§worker-generated-subtree}). Absent, its docs live in the internal
-`_plurnk/plurnk` namespace; present (attached MCP families: `/tools`),
-the family document materializes at `_plurnk` + that root in the
-shared scratch. Turn 0 surveys the families (`FIND
+`_plurnk/plurnk` namespace; present (attached MCP servers: `/tools`),
+the runtime document materializes at `_plurnk` + that root in the
+shared scratch. Turn 0 surveys the runtimes (`FIND
 (worker:///_plurnk/tools/*.md)`, one row per
 server carrying its summary) and, for each server named in
-`PLURNK_MCP_EXPANDED`, adds one FIND over its family document matching the
+`PLURNK_MCP_EXPANDED`, adds one FIND over its runtime document matching the
 complete executable blocks (`FIND (worker:///_plurnk/tools/<server>.md)`
 with a multiline regex over matching fences), so turn 0 names every tool with its aside and
 signature — one row per tool, paged like every survey. Capability attenuation
@@ -5630,155 +5535,27 @@ definitions ({§actor-boundary-catalog-preview}), so the model sees why a file i
 not a member before it asks. There is no other membership path: the client's `/members`
 verbs are these verbs.
 
-§skills-functionality **Agent Skills are one workspace Functionality family.**
-Core registers the `skills` family with the coordinator ({§functionality-coordinator});
-its adapter owns protocol truth for standard Agent Skills and nothing else. A
-definition is `SkillDefinition`: the standard skill `name`, its `source`, and
-optional Git `ref`/resolved `commit` ({§skills-sources}). Only a host-provided
-resource tree omits `source`. Source location is not mutation ownership: standard
-project/global roots are read-only configuration inputs; live changes belong to
-the workspace. Plurnk neither installs into nor deletes from those roots.
-
-*Available definitions.* The filesystem is the only truth about installation:
-every `<root>/<name>/SKILL.md` directory under the project, plurnk, then global
-root is one service-origin definition, a nearer root shadowing a farther one and
-all of them shadowing host-provided trees by name. Each filesystem definition
-names its actual source directory. The workspace's durable state owns
-enablement ({§functionality-state}); a disabled skill stays client-visible and
-leaves no model-facing trace.
-
-§skills-configuration **Skills use the shared definition cascade.**
-
-| Layer, low to high | Definition source |
-|---|---|
-| Service | Host-provided trees |
-| Standard locations | Global, plurnk, then project roots selected by {§agent-roots} |
-| Cascading environment | `PLURNK_SKILLS_<name>={"name":"<name>","source":"…","ref"?:"…"}` replaces the complete definition |
-| Live workspace | `skills (add)` creates a workspace definition through {§functionality-coordinator} |
-
-`PLURNK_SKILLS_ENABLED` supplies default enabledness; `<name>_ENABLED` overrides
-it independently ({§resource-environment}). The decoded environment alias must
-equal the standard skill name, including digit-leading and Unicode names.
-Blank definitions are invalid; controls may precede a definition. Environment
-validation checks shape, names, remote URL rules, and Git-only `ref` without
-fetching or opening a source; `commit` is service-recorded, not an input.
-
-*Discovery is inert.* `discover {source}` lists the standard skills one source
-carries, each a candidate with `source` provenance and the exact definition to
-add; it never installs, persists, or enables. Agent Skills have no standard
-registry, so `discover {query}` is 400 `query-unsupported`, naming the source
-forms. Client `configuration` contributes nothing and is refused with 400.
-
-*Admission.* `add {alias, definition}` requires `alias = name` and a `source`;
-the workspace definition may shadow a service skill of the same name. Relative
-sources require a project root; absolute sources work in headless workspaces.
-A local source is recorded as its absolute path.
-A git source records the `commit` its `ref` names at admission, or its default
-branch's when no `ref` is given; `ref` belongs to git sources, and a supplied
-`commit` is refused because the service records it. The family's aliases use
-the standard skill-name grammar ({§agent-skills-name}), including digit-leading
-and Unicode names, rather than the coordinator's generic default.
-
-*Preparation.* For each enabled alias the adapter selects the host-provided
-tree or resolves the complete source definition ({§skills-sources}). Local
-folders and their `SKILL.md` files remain live references, including supporting
-resources and symlink retargeting. Git/archive sources are materialized only
-inside {§module-workspace-directory}; different workspaces and complete source
-definitions cannot reuse each other's materializations accidentally.
-The first fetched Git/archive copy remains stable across enable, cooling, and
-restart until the complete source definition changes. In particular, an
-operator-configured symbolic Git ref is not an implicit update subscription.
-Each admitted skill requires standard `name` and `description` frontmatter
-with `name` matching its directory. A missing, uninstallable, or invalid skill
-is `unavailable` with its exact Problem ({§problems-functionality}) under the
-coordinator's failure policy ({§functionality-model-mutation}); one bad skill
-never fails the family.
-
-Removal follows {§skills-remove}.
-
-§skills-sources **A source is a git remote, a folder, or a file, read with standard tools.**
-Fetching runs nothing it fetched. Materialized copies cannot contain references
-outside their skill; live resources retain {§agent-skills-directory} containment.
-
-| Source | How it is read |
-|---|---|
-| Git remote: a full `https://` or `ssh://` URL, or `user@host:path` | `git ls-remote` resolves the ref at admission; preparation shallow-clones it with hooks and submodules off, and a checkout at any other commit is 409 `source-moved` |
-| Folder: absolute, `~/`, or relative to the project root | Live reference; standard directory/name matching applies |
-| A file named `SKILL.md` | Live reference to its skill directory and supporting resources |
-| A `.zip`, `.tar`, `.tgz`, `.tar.gz`, `.tar.bz2`, `.tar.xz`, or `.tar.zst` archive | Unpacked into private staging with `unzip` or `tar`; a lone top-level directory is the source's root |
-
-Any other scheme, plain `http`, `owner/repo` shorthand, and an https URL carrying
-credentials are refused with `source-invalid` or `source-missing`: shorthand names no
-forge, and a recorded source is listed to every client. Git runs with the
-operator's configuration, credentials, and SSH agent, never plurnk's secrets, and
-never prompts; `PLURNK_SERVICE_SKILLS_FETCH_TIMEOUT_MS` bounds each fetch. The
-retired vendor-installer knobs (`PLURNK_SERVICE_SKILLS_CLI`, `_CLI_TIMEOUT_MS`,
-`_REGISTRY_URL`, `_REGISTRY_LIMIT`, `_REGISTRY_TIMEOUT_MS`) make the skills family
-unavailable when set, each naming what replaced it ({§configuration-repair-path}).
-
-A source's skills are the directories holding a `SKILL.md`, found by walking
-from its root without entering `.git` or a skill already found. A fetched skill at
-the root is named by its frontmatter ({§agent-skills-name}); local references and
-directories below the root use the standard folder rule. A source with `plugin.json` at its root is an
-Agent Plugin and is refused with 422 `source-is-plugin`, so its skills keep the
-plugin's identity. Materialization copies the named skill beside its workspace-owned destination
-and renames it to `<root>/<name>`; a copy that holds a link out of the skill, or
-anything but files, directories, and inward links, is refused with 422
-`source-unsafe` and leaves nothing behind.
-
-§skills-resources **A skill is a resource tree, not a rewritten document.**
-The family exposes enabled, available {§agent-skills-tree} sources through
-`skill://<name>/`. The source owns its bytes; commons entries are demand-loaded
-projections, not writable installations. Filesystem skills retain their original
-directories; service-provided trees need no generated filesystem directory.
-The authority is the name's WHATWG URI representation, including percent-encoding
-for non-ASCII names. Installation names remain unchanged; a raw spelling and its
-serialized URI address the same resource, not separate skill identities.
-
-| Operation | Contract |
-| --- | --- |
-| Turn0 `FIND (skill://*/SKILL.md)` | One ordinary resource catalog: name, address, and standard frontmatter description via {§mimetype-summary}. No synthetic index, body injection, or execution. |
-| `READ (skill://<name>/SKILL.md)` | Original frontmatter and Markdown, unchanged; relative links remain relative to the source layout. |
-| `READ` / `FIND` below the authority | References, scripts, and assets retain their source paths and ordinary pattern, channel, byte, and multimodal semantics. Acquisition observes current source contents, including disappearance. |
-| ```` ```runtime (skill://<name>/scripts/program.ext) ```` | Ordinary resource execution and proposal policy; preserve the native file and its siblings under {§exec-source-temporary}. Discovery and READ never execute scripts. |
-| Model mutation | Read-only; no EDIT, SEND, or KILL of skill resources. Manage definitions and enablement through ```` ```skills ````. |
-| Disable / unavailable / remove | Withdraw the authority from new resource access and discovery. Existing log receipts remain historical evidence. |
-| WORK / FORK | Use the same workspace Functionality, not copied definitions or resource caches. |
-
-Explicit skill URIs address these resources; bare operation paths still address
-project files, with no implicit current-skill directory. Source resolution follows
-{§agent-skills-directory}, including symlinked skill directories and containment of references.
-An uninstalled Git skill is not manufactured by repository detection.
+The skills module owns the Agent Skills family ({§skills-functionality}) and its resource trees
+({§skills-resources}); core supplies the Plurnk reference through {§provided-skills-module-slice}.
 
 §plurnk-skill **Plurnk's own reference is an ordinary service-provided skill.**
 `skill://plurnk/SKILL.md` is the standard frontmatter entry point, catalogued with
-other enabled skills. It links package-owned configuration, model, and COPY/MOVE chapters,
-the complete `.env.defaults` aggregate at `skill://plurnk/.env.defaults`, and the
-Worker's existing tool/resource references. No chapter or defaults body is
-injected merely because the skill is enabled. The defaults bytes come from the
+other enabled skills. It links package-owned configuration, model, COPY/MOVE and extensibility
+chapters, the complete `.env.defaults` aggregate at `skill://plurnk/.env.defaults`, the
+installed contracts at `skill://plurnk/packages/<package name>/SPEC.md`, and the
+Worker's existing tool/resource references. The contracts are the service's own `SPEC.md` and
+each installed ecosystem package's that ships one, the same membership as the defaults
+aggregate, with that package's published type declarations beside it at
+`packages/<package name>/dist/**/*.d.ts`; the service's declarations are its internals and are not
+served. Contracts are listed when the tree is listed and read where each package installed them,
+never through a symbolic link. No chapter, contract or defaults body is injected merely because the
+skill is enabled. The defaults bytes come from the
 same {§operator-config-env-defaults} renderer as the operator command, never the
 effective environment. Native chapter files retain their owners and locations;
 runtime-generated bytes have no invented disk location. Disable/enable,
 shared workspace visibility, and project/global shadowing use the ordinary Skills lifecycle.
 Service-provided skills are not installer targets; removal follows {§skills-remove}.
 
-§skills-remove **`remove` forgets the workspace binding, not the source.**
-It withdraws that definition and restores any inherited definition and enabledness
-({§functionality-coordinator}). External folders are never deleted. Fetched
-materializations remain workspace-owned operational state, reusable only for the
-same complete definition; they confer no availability without a definition.
-Inherited definitions cannot be removed here; their enabledness can be overridden.
-
-§skills-hotload **Skills placed out of band are admitted at the next turn** ({§functionality-hotload}). The
-family keeps one signature of the discovered roots, configured definitions, source locations, and `SKILL.md` sources
-per resident workspace, read before a publication loads the skills it describes. Turn admission
-recomputes it under the workspace gate before packet assembly: a changed signature republishes the
-family, and an unchanged one republishes only when the skills the coordinator would publish differ
-from the published ones. A skill installed, edited or removed by any other tool is therefore
-discoverable in the first subsequent model turn, while an unchanged set dispatches nothing. The model manages skills
-only through the generated ```` ```skills ```` family
-({§functionality-model-projection}); it is never taught a package manager.
-
 The catalog and Turn0 describe Functionality under the current workspace
 capability policy and service ceiling. A direct denied attempt receives the
 same exact 403 from dispatch rather than a second documentation policy.
@@ -5800,7 +5577,7 @@ section because they are language extensions rather than executable tools.
 
 ### §inject system.inject — the operator injection
 
-§packet-inject When `PLURNK_SERVICE_PACKET_INJECT` names a readable markdown file, its content renders as an `## Operator Notes` section in the system slot (definition → policy → inject). Read per-turn so the operator's edits take effect live; a set-but-unreadable path fails the turn hard as {§policy-sections} rules. `~/` expands to home. It's the operator-side complement to the plugin section hook — a pressure valve so reshaping the packet edits operator content, never the core. Unset → no section.
+§packet-inject When `PLURNK_SERVICE_PACKET_INJECT` names a readable markdown file, its content renders as an `## Operator Notes` section in the system slot (definition → policy → inject). Read per-turn so the operator's edits take effect live; a set-but-unreadable path fails the turn hard as {§policy-sections} rules. `~/` expands to home. It's the operator-side complement to the extension packet transform — a pressure valve so reshaping the packet edits operator content, never the core. Unset → no section.
 
 ### §policy system.policy — the client's policy injection
 
@@ -6193,12 +5970,12 @@ caller's own run directory.
 
 Every Problem code core mints is named here under its family ({§problem-error-carrier} carries it); the root lint (`scripts/problem-codes.mjs`) refuses a code no owning SPEC names.
 
-§problems-dispatch **Dispatch Problems.** Every code this family mints, its status, and the sentence that is its contract (placeholders in *italics* are filled at emission; a fixed recovery follows its detail).
+§problems-dispatch **Dispatch Problems.** Every code minted here, its status, and the sentence that is its contract (placeholders in *italics* are filled at emission; a fixed recovery follows its detail).
 
 | code | status | contract |
 |---|---:|---|
 | `target-required` | 400 | *OP* requires a target path. Recovery: Write the target in parentheses on the opening fence line: `OP (path)`. |
-| `scheme-not-found` | 501 | Scheme '*name*' is not registered. |
+| `scheme-not-found` | 501 | Scheme '*name*' is not registered. Recovery: ({§unregistered-scheme-recovery}) `` `*host*` is an executor: run ```*host* (*tool*)``` with its input in the body. `` when the address's authority is one, else `Registered schemes: *names*.` |
 | `scheme-metadata-unsupported` | 400 | *OP* on '*scheme*' does not accept the [metadata] modifier. |
 | `operation-not-implemented` | 501 | Scheme '*name*' does not implement *OP* (or exec). |
 | `entry-read-not-implemented` | 501 | The '*scheme*' scheme does not provide entry reads. |
@@ -6209,7 +5986,7 @@ Every Problem code core mints is named here under its family ({§problem-error-c
 | `exec-source-not-data` | 501 | Scheme '*name*' is not a data source for an execution. |
 | `writer-forbidden` | 403 | Writer '*origin*' cannot modify scheme '*name*'. |
 | `capability-denied` | 403 | Capability '*route*' is denied by *scope* policy. |
-| `spawn-prompt-empty` | 422 | *OP* has no prompt text: the resource is empty and there is no body. |
+| `spawn-prompt-empty` | 422 | *OP* has no prompt text. Recovery: Write the prompt on the lines beneath the *OP* fence line. A prompt resource that is empty with no body says so: *OP* has no prompt text: the resource is empty and there is no body. Recovery: Write the prompt on the lines beneath the *OP* fence line, or name a resource that holds it. |
 | `message-not-found` | 404 | No accepted message exists at *address*. |
 | `edit-collision` | 409 | EDIT collided with the current resource state ({§edit-collision}). Recovery: *n* of *m* edits applied. READ the target for current coordinates. |
 | `edit-target-required` | 400 | A line-anchored EDIT requires a target resource. Recovery: Provide the target that rendered the line anchor. |
@@ -6225,7 +6002,13 @@ Every Problem code core mints is named here under its family ({§problem-error-c
 | `no-operation` | 422 | The turn performed no operation ({§empty-turn}). |
 | `send-target-not-a-recipient` | 400 | The addressed scheme is not a SEND recipient. Recovery: A targetless SEND answers the open messages; a directed SEND requires a recipient that implements SEND. |
 
-§problems-content **Content and transfer Problems.** Every code this family mints, its status, and the sentence that is its contract (placeholders in *italics* are filled at emission; a fixed recovery follows its detail).
+§unregistered-scheme-recovery **An unregistered scheme's refusal names what does exist.** When the
+address's authority is an executor available to the workspace — an MCP server's tool written as
+`tool://gh/get_me` — the recovery is that executor's fence with the address's path as its target;
+otherwise it lists the schemes the workspace registers. READ, FIND, KILL and resource selection share
+the sentence.
+
+§problems-content **Content and transfer Problems.** Every code minted here, its status, and the sentence that is its contract (placeholders in *italics* are filled at emission; a fixed recovery follows its detail).
 
 | code | status | contract |
 |---|---:|---|
@@ -6242,7 +6025,7 @@ Every Problem code core mints is named here under its family ({§problem-error-c
 | `proposal-apply-missing` | 500 | The source scheme accepted its MOVE proposal without applying the source mutation. |
 | `line-anchor-collision` | 409 | READ coordinates collided with current content at *target*. |
 
-§problems-file **File scheme Problems.** Every code this family mints, its status, and the sentence that is its contract (placeholders in *italics* are filled at emission; a fixed recovery follows its detail).
+§problems-file **File scheme Problems.** Every code minted here, its status, and the sentence that is its contract (placeholders in *italics* are filled at emission; a fixed recovery follows its detail).
 
 | code | status | contract |
 |---|---:|---|
@@ -6259,18 +6042,18 @@ Every Problem code core mints is named here under its family ({§problem-error-c
 | `file-create-excluded` | 403 | A members exclusion (`!_glob_`) covers '*path*'. Recovery: Remove or disable the excluding members definition, or choose another path. |
 | `file-create-gitignored` | 403 | Active Git policy ignores '*path*', and no members definition includes it. Recovery: Choose a Git-admitted path or add a members definition that includes it. |
 | `file-materialization-limit` | 413 | The file exceeds the materialization byte limit and is not read into the workspace. |
-| `entry-not-found` | 404 | No member of this workspace is at '*path*'. Recovery: Check the path with FIND. EDIT creates files; `members (add)` admits existing files with a `{"glob": "<path>"}` body. |
+| `entry-not-found` | 404 | No member of this workspace is at '*path*'. Recovery: Check the path with FIND. EDIT creates files; `members (add)` admits existing files with a `{"glob": "<path>"}` body. A path beyond the root recovers instead to: '*path*' is outside the project root: only a members definition under the operator's namespace scope admits it, so keep working files inside the root. |
 
-§problems-exec **Execution Problems.** Every code this family mints, its status, and the sentence that is its contract (placeholders in *italics* are filled at emission; a fixed recovery follows its detail).
+§problems-exec **Execution Problems.** Every code minted here, its status, and the sentence that is its contract (placeholders in *italics* are filled at emission; a fixed recovery follows its detail).
 
 | code | status | contract |
 |---|---:|---|
 | `invalid-input-target` | 400 | SEND input addresses an execution, without a channel or scope. |
 | `input-unavailable` | 409 | This execution's input receiver is no longer enabled. |
-| `stream-not-found` | 404 | No execution exists at the requested address. |
+| `stream-not-found` | 404 | No execution exists at the requested address. Recovery, when the id holds an execution under another runtime ({§exec-near-miss}): The execution at /*id* is `*runtime*:///*id*`. |
 | `input-closed` | 410 | Execution input is closed. |
 
-§problems-entries **Entry scheme Problems (log, worker, entries).** Every code this family mints, its status, and the sentence that is its contract (placeholders in *italics* are filled at emission; a fixed recovery follows its detail).
+§problems-entries **Entry scheme Problems (log, worker, entries).** Every code minted here, its status, and the sentence that is its contract (placeholders in *italics* are filled at emission; a fixed recovery follows its detail).
 
 | code | status | contract |
 |---|---:|---|
@@ -6283,7 +6066,7 @@ Every Problem code core mints is named here under its family ({§problem-error-c
 | `message-empty` | 400 | SEND has no message text or attachments. |
 | `scope-unsupported` | 400 | A worker SEND takes no scope. |
 
-§problems-functionality **Server and Functionality Problems.** Every code this family mints, its status, and the sentence that is its contract (placeholders in *italics* are filled at emission; a fixed recovery follows its detail).
+§problems-functionality **Server and Functionality Problems.** Every code minted here, its status, and the sentence that is its contract (placeholders in *italics* are filled at emission; a fixed recovery follows its detail).
 
 | code | status | contract |
 |---|---:|---|
@@ -6295,21 +6078,8 @@ Every Problem code core mints is named here under its family ({§problem-error-c
 | `env-invalid` | 400 | `env` must be an object of string values; '*name*' is not a name a shell can export. |
 | `query-required` | 400 | discover takes a path or a glob. Recovery: Supply `{ "query": "<path or glob>" }`. |
 | `headless` | 409 | The workspace has no project root, so there are no file members. Recovery: Open the workspace on a project root. |
-| `definition-invalid` | 400 | A members definition is { glob }: a gitignore-style pattern, `!glob` to exclude; a skill definition names an installable skill. |
+| `definition-invalid` | 400 | A members definition is { glob }: a gitignore-style pattern, `!glob` to exclude. |
 | `model-scope` | 403 | The model may not change membership here: the members scope is none. Recovery: `git add` the file so git tracks it, or ask the operator to add it (/members add) or raise PLURNK_SERVICE_MEMBERS_MODEL_SCOPE. |
-| `query-unsupported` | 400 | Agent Skills have no standard registry to search; discover takes a source: a git remote as a full https or ssh URL, a folder, a lone SKILL.md, or a zip or tar archive. |
-| `source-invalid` | 400 | '*source*' is not a valid git remote URL; an https source carries no credentials (git's credential helper supplies them); is not a source: a git remote is a full https or ssh URL; is relative, and this workspace has no project root to resolve it against; or is neither a folder, a SKILL.md, nor a zip or tar archive. |
-| `source-missing` | 404 | No folder or file is at '*source*' (; owner/repo shorthand names no forge, so give the repository's full https or ssh URL). |
-| `source-unreadable` | 422 | '*source*' cannot be read: *cause*; or '*path*' could not be unpacked: *reason*. |
-| `source-unreachable` | 502 | git could not reach '*remote*', or fetch it (at '*ref*'): *reason*. |
-| `ref-missing` | 404 | '*remote*' has no branch or tag '*ref*', or names no default branch. |
-| `source-moved` | 409 | '*source*' *ref* now names *current*; this skill was added at *commit*. Recovery: Remove the skill and add it again to take the current commit. |
-| `source-is-plugin` | 422 | '*source*' is an Agent Plugin; install it as a plugin, so its skills keep the plugin's identity and servers. |
-| `source-unsafe` | 422 | '*path*' links outside its skill, or is neither a file, a directory, nor an inward link. |
-| `skill-not-found` | 404 | '*source*' carries no Agent Skill named '*name*'. |
-| `skill-ambiguous` | 409 | '*source*' carries *count* skills named '*name*'. |
-| `alias-mismatch` | 400 | Alias '*alias*' must equal the skill name '*name*'. |
-| `source-required` | 400 | Adding '*alias*' requires the source that provides it. |
 | `workspace-not-found` | 404 | Workspace *id* does not exist. |
 | `state-not-json` | 400 | Worker module state is not JSON-serializable. |
 | `workspace-busy` | 409 | Workspace *id* is running an operation or another capability change. Recovery: Settle the current operation and retry the capability change. |
@@ -6322,9 +6092,6 @@ Every Problem code core mints is named here under its family ({§problem-error-c
 | `loop-policy-invalid` | 400 | An unattended loop cannot hold a proposal for review: nobody is present to answer. Recovery: State proposals accept or reject, or attend the loop. |
 | `scope-cancelled` | 499 | The worker scope was cancelled: *reason*. |
 | `range-not-satisfiable` | 416 | `Range <0,-1>` starts at 0, which is not a line; lines are numbered from 1. Recovery: Write `<1,-1>` to trim every line of the body; `KILL (log:///…/READ)` with no scope retires the item. |
-| `install-failed` | 500 | Agent Skill '*name*' could not be placed under *root*: *cause*. |
-| `skill-missing` | 404 | Agent Skill '*alias*' is not provided by this service. |
-| `skill-invalid` | 422 | Agent Skill '*alias*' is not a valid standard skill: *cause*. |
 
 §pinned-wording-core **Pinned wording.** Verbatim sentences tests pin: each is contract, and a change here is a change of contract.
 
@@ -6343,3 +6110,4 @@ Every Problem code core mints is named here under its family ({§problem-error-c
 | The execution at ops://*worker*/*loop* has not concluded. | a bare READ of a running worker's result (425) |
 | The child provider failed. | a child's provider failure read back by its parent |
 | '*path*' exists on disk but is not a member of this workspace. Recovery: Admit it with `members (add)` and a `{"glob": "<path>"}` body. | a non-member on disk at the addressed path |
+| '*path*' exists on disk but is not a member of this workspace. Recovery: The repository ignores it: a client or operator members definition can include it, a model definition cannot. | a non-member the repository ignores ({§membership-read-refusal}) |