@plurnk/plurnk-service 1.3.12 → 1.4.0

package/dist/core/Dispatcher.js

@@ -1,37 +1,46 @@
 var _a;
-import { parsePath } from "@plurnk/plurnk-grammar";
 import Owner from "./Owner.js";
-import { foldAuthorityIntoPath, schemeNameOf } from "./plurnk-uri.js";
+import WorkerName, { WorkerNameError } from "./WorkerName.js";
+import WorkerControlAddress from "./WorkerControlAddress.js";
+import { entryPathnameOf, foldAuthorityIntoPath, renderAddress, renderTarget, schemeNameOf } from "./plurnk-uri.js";
 import Fork from "./fork.js";
 import WorkerCap from "./worker-cap.js";
-import { decodePathParens } from "./path-decode.js";
+import { parsePath, PathSyntax } from "@plurnk/plurnk-contracts";
 import Namespace from "./namespace.js";
-import { DEFAULT_LOOP_FLAGS } from "./scheme-types.js";
+import LoopFlagsReader from "./LoopFlagsReader.js";
 import ChannelWrite from "./ChannelWrite.js";
-import { LineMarkerOps, MimetypeBinary } from "../content/index.js";
+import { assertEditBatchReceipt, assertEditReceipt, assertResourceEffects, editReceipt, LineMarkerOps, MimetypeBinary, PathMimetype, projectEditReceipt, } from "../content/index.js";
 import SchemeCtxImpl from "./caps/SchemeCtxImpl.js";
 import EntryCrud from "../schemes/_entry-crud.js";
-import EntryFind from "../schemes/_entry-find.js";
 import EntryOps from "../schemes/_entry-ops.js";
 import WorkspaceSettings from "./workspace-settings.js";
 import LoopLifecycle from "./LoopLifecycle.js";
-// SPEC §scheme-surface: writer must be in target scheme's manifest.writableBy.
+import Results from "./results.js";
+import { OperationFailureError } from "./results.js";
+import EffectPolicy from "../schemes/EffectPolicy.js";
+import { CoreSchemeAdapterBase } from "./CoreSchemeServices.js";
+import { InvalidOperationResultError, NetworkAddress, } from "@plurnk/plurnk-schemes";
+import DurableStatement from "./DurableStatement.js";
+// SPEC {§scheme-surface}: writer must be in target scheme's manifest.writableBy.
 // OPEN/FOLD/READ/FIND are not gated — they curate the log or read, never mutating an entry.
 const MUTATING_OPS = new Set(["EDIT", "SEND", "COPY", "MOVE", "EXEC", "KILL", "FORK", "WORK"]);
-const pathnameFromPath = (path) => {
-    if (path.kind === "regex")
-        return path.raw; // regex source — parens are syntax, never encoded
-    return decodePathParens(path.kind === "url" ? path.pathname : path.raw); // #239 item 4
-};
-// Op dispatch (§op-methods-op-dispatch): gates (writableBy, loop flags), the
+// Op dispatch ({§op-methods-op-dispatch}): gates (writableBy, loop flags), the
 // engine-owned op orchestrations (COPY/MOVE/KILL/SEND/READ-fanout), scheme
 // routing, the durable log write, and the proposal pause.
 class Dispatcher {
+    static #failure(code, status, detail, fields = {}, extensions = {}) {
+        return Results.failure("engine:dispatcher", code, status, detail, fields, extensions);
+    }
+    static #statusResult(status, code, detail, fields = {}) {
+        return status >= 400
+            ? _a.#failure(code, status, detail, fields, { retryable: false })
+            : { ...fields, status };
+    }
     #db;
     #schemes;
     #mimetypes;
     #tokenize;
-    #telemetry;
+    #notices;
     #proposals;
     // Boot-discovered runtime executors, late-injected on Engine — thunked.
     #executors;
@@ -40,30 +49,33 @@ class Dispatcher {
     #streamEventNotify;
     #wakeWorkerNotify;
     #injectWorker;
+    #branchWorker;
+    #branchCompletionGate;
     #cancelWorker;
     #cancelDescendants;
-    // §send-premature-terminate/[102]<T> — the engine-owned park-deadline registry (loopId → seconds;
+    // {§send-premature-terminate}/SEND[202]<T> — the engine-owned park-deadline registry (loopId → seconds;
     // -1 = indefinite). The dispatcher WRITES at park; the daemon's drain park-exit consumes.
     #parkDeadlines;
     #searchGate;
-    // §join-blocking-collect (#354) — loops with a READ(worker://running-child) armed this turn; a bare
-    // SEND[102] parks on it (blocking join). Engine-owned, twin of #parkDeadlines.
+    // Per-turn running-worker READ obligations. {§join-blocking-collect}
     #joinTargets;
     #liveSubscriptions;
     #lifecycle;
     #preparedEdits = new WeakMap();
-    constructor({ db, schemes, mimetypes, tokenize, telemetry, proposals, executors, loopSignal, streamEventNotify, wakeWorkerNotify, injectWorker, cancelWorker, cancelDescendants, searchGate, parkDeadlines, joinTargets, liveSubscriptions }) {
+    constructor({ db, schemes, mimetypes, tokenize, notices, proposals, executors, loopSignal, streamEventNotify, wakeWorkerNotify, injectWorker, branchWorker, branchCompletionGate, cancelWorker, cancelDescendants, searchGate, parkDeadlines, joinTargets, liveSubscriptions }) {
         this.#db = db;
         this.#schemes = schemes;
         this.#mimetypes = mimetypes;
         this.#tokenize = tokenize;
-        this.#telemetry = telemetry;
+        this.#notices = notices;
         this.#proposals = proposals;
         this.#executors = executors;
         this.#loopSignal = loopSignal;
         this.#streamEventNotify = streamEventNotify;
         this.#wakeWorkerNotify = wakeWorkerNotify;
         this.#injectWorker = injectWorker;
+        this.#branchWorker = branchWorker;
+        this.#branchCompletionGate = branchCompletionGate;
         this.#cancelWorker = cancelWorker;
         this.#cancelDescendants = cancelDescendants;
         this.#parkDeadlines = parkDeadlines ?? new Map();
@@ -86,36 +98,78 @@ class Dispatcher {
     async #readEntry(scheme, pathname, ctx) {
         const handler = this.#schemes.get(scheme);
         const handlerCtx = this.#entryContext(scheme, ctx);
-        if (typeof handler?.readEntry === "function" && handlerCtx !== null)
-            return handler.readEntry(pathname, handlerCtx);
+        if (typeof handler?.readEntry === "function" && handlerCtx !== null) {
+            return Results.assert(await handler.readEntry(pathname, handlerCtx));
+        }
         const caps = handlerCtx?.entries;
-        if (caps === undefined)
-            return { status: 501, entry: null };
-        const result = await caps.read(pathname, scheme === "prompt" ? "worker" : "commons");
-        return {
+        if (caps === undefined) {
+            return _a.#failure("entry-read-not-implemented", 501, `The '${scheme}' scheme does not provide entry reads.`, { entry: null }, {
+                stage: "entry-read",
+                scheme,
+                target: renderAddress(scheme, pathname),
+                retryable: false,
+            });
+        }
+        const result = Results.assert(await caps.read(pathname, scheme === "prompt" ? "worker" : "commons"));
+        return Results.assert({
+            ...result,
             status: result.status,
             entry: result.entry === null
                 ? null
                 : { channels: { ...result.entry.channels }, tags: [...result.entry.tags] },
-        };
+        });
     }
     async #writeEntry(scheme, pathname, entry, ctx) {
         const handler = this.#schemes.get(scheme);
         const handlerCtx = this.#entryContext(scheme, ctx);
-        if (typeof handler?.writeEntry === "function" && handlerCtx !== null)
-            return handler.writeEntry(pathname, entry, handlerCtx);
+        if (typeof handler?.writeEntry === "function" && handlerCtx !== null) {
+            return Results.assert(await handler.writeEntry(pathname, entry, handlerCtx));
+        }
         const caps = handlerCtx?.entries;
-        if (caps === undefined)
-            return { status: 501, created: false, entryId: null };
-        return caps.write(pathname, entry);
+        if (caps === undefined) {
+            return _a.#failure("entry-write-not-implemented", 501, `The '${scheme}' scheme does not provide entry writes.`, { created: false, entryId: null }, {
+                stage: "entry-write",
+                scheme,
+                target: renderAddress(scheme, pathname),
+                retryable: false,
+            });
+        }
+        return Results.assert(await caps.write(pathname, entry, scheme === "prompt" ? "worker" : "commons"));
     }
     async #deleteEntry(scheme, pathname, ctx) {
         const handler = this.#schemes.get(scheme);
         const handlerCtx = this.#entryContext(scheme, ctx);
-        if (typeof handler?.deleteEntry === "function" && handlerCtx !== null)
-            return handler.deleteEntry(pathname, handlerCtx);
+        if (typeof handler?.deleteEntry === "function" && handlerCtx !== null) {
+            return Results.assert(await handler.deleteEntry(pathname, handlerCtx));
+        }
+        const caps = handlerCtx?.entries;
+        if (caps === undefined) {
+            return _a.#failure("entry-delete-not-implemented", 501, `The '${scheme}' scheme does not provide entry deletion.`, {}, {
+                stage: "entry-delete",
+                scheme,
+                target: renderAddress(scheme, pathname),
+                retryable: false,
+            });
+        }
+        return Results.assert(await caps.delete(pathname, scheme === "prompt" ? "worker" : "commons"));
+    }
+    async #deleteChannel(scheme, pathname, channel, ctx) {
+        const handler = this.#schemes.get(scheme);
+        const handlerCtx = this.#entryContext(scheme, ctx);
+        if (typeof handler?.deleteChannel === "function" && handlerCtx !== null) {
+            return Results.assert(await handler.deleteChannel(pathname, channel, handlerCtx));
+        }
         const caps = handlerCtx?.entries;
-        return caps === undefined ? { status: 501 } : caps.delete(pathname);
+        if (caps === undefined) {
+            return _a.#failure("channel-delete-not-implemented", 501, `The '${scheme}' scheme does not provide channel deletion.`, {}, {
+                stage: "channel-delete",
+                scheme,
+                target: renderAddress(scheme, pathname),
+                channel,
+                retryable: false,
+            });
+        }
+        return Results.assert(await caps.delete(pathname, scheme === "prompt" ? "worker" : "commons", channel));
     }
     async #workspaceRoot(workspaceId) {
         if (this.#rootCache.has(workspaceId))
@@ -126,9 +180,8 @@ class Dispatcher {
         return root;
     }
     // {§fs-answer-in-canon} — a file-class target's engine-authored address COLUMNS carry
-    // the canonical key; the tx JSON keeps the model's verbatim statement (history is never
-    // rewritten — the one surviving spelling). An un-canonicalizable spelling keeps its raw
-    // form: the row must still faithfully exist for the op that happened.
+    // the canonical key; tx keeps the operation spelling after the one durable request-evidence
+    // projection. An un-canonicalizable spelling keeps its raw form.
     async #canonColumns(target, workspaceId) {
         if (target.scheme !== null || target.pathname === null)
             return;
@@ -172,37 +225,61 @@ class Dispatcher {
                 initial = denial;
             }
             else if (schemeName === null) {
-                initial = { status: 400 };
+                initial = _a.#failure("target-required", 400, "EDIT requires a target scheme.", {}, { retryable: false });
             }
             else {
                 const handler = this.#schemes.get(schemeName);
                 const method = handler?.editBatch;
                 const manifest = this.#schemes.manifestFor(schemeName);
                 if (typeof method !== "function" || manifest === undefined) {
-                    initial = { status: 501 };
+                    initial = _a.#failure("operation-not-implemented", 501, `Scheme '${schemeName}' does not implement EDIT batches.`, {}, {
+                        scheme: schemeName,
+                        operation: "EDIT",
+                        retryable: false,
+                    });
                 }
                 else {
                     try {
                         const addressedScheme = first.target?.kind === "url" ? first.target.scheme : schemeName;
-                        initial = await method.call(handler, group, new SchemeCtxImpl(schemeCtx, addressedScheme ?? schemeName, manifest, this.#liveSubscriptions));
+                        initial = Results.assert(await method.call(handler, group, new SchemeCtxImpl(schemeCtx, addressedScheme ?? schemeName, manifest, this.#liveSubscriptions)));
                     }
                     catch (err) {
-                        initial = { status: 500, error: err instanceof Error ? err.message : String(err) };
+                        if (err instanceof InvalidOperationResultError)
+                            throw err;
+                        console.error(`Scheme '${schemeName}' EDIT batch threw outside its operation result contract:`, err);
+                        initial = _a.#failure("scheme-handler-threw", 500, `The '${schemeName}' scheme did not produce an EDIT result.`, {}, {
+                            stage: "scheme-dispatch",
+                            scheme: schemeName,
+                            operation: "EDIT",
+                        });
                     }
                 }
             }
             let resolveSettled;
             const settled = new Promise((resolve) => { resolveSettled = resolve; });
-            const prepared = {
-                first: true,
-                index: 0,
+            const candidate = initial.editReceipt;
+            const expectedNormalizations = group.filter(({ lineMarker }) => lineMarker?.marks.length === 3).length;
+            if (initial.status < 400
+                && (initial.scopeNormalizations?.length ?? 0) !== expectedNormalizations) {
+                throw new InvalidOperationResultError(`EDIT batch normalized ${initial.scopeNormalizations?.length ?? 0} scope(s), expected ${expectedNormalizations}.`);
+            }
+            const batch = {
                 initial,
                 settled,
+                aggregate: candidate === undefined || candidate === null
+                    ? undefined
+                    : assertEditBatchReceipt(candidate),
                 settle: resolveSettled,
             };
-            this.#preparedEdits.set(first, prepared);
-            for (const [index, statement] of group.slice(1).entries()) {
-                this.#preparedEdits.set(statement, { ...prepared, first: false, index: index + 1 });
+            let normalizationIndex = 0;
+            for (const [index, statement] of group.entries()) {
+                const ownsNormalization = statement.lineMarker?.marks.length === 3 && initial.status < 400;
+                this.#preparedEdits.set(statement, {
+                    first: index === 0,
+                    index,
+                    normalizationIndex: ownsNormalization ? normalizationIndex++ : null,
+                    batch,
+                });
             }
         }
     }
@@ -210,29 +287,43 @@ class Dispatcher {
         const result = await this.#dispatchOne(context);
         if (context.statement.op === "EDIT") {
             const prepared = this.#preparedEdits.get(context.statement);
-            if (prepared?.first === true)
-                prepared.settle(result);
+            if (prepared?.first === true) {
+                const normalizations = prepared.batch.initial.scopeNormalizations;
+                prepared.batch.settle(normalizations === undefined
+                    ? result
+                    : Results.assert({ ...result, scopeNormalizations: normalizations }));
+            }
         }
         return result;
     }
     async #dispatchOne(context) {
-        const { statement, workspaceId, workerId, loopId, turnId, sequence, origin, onDispatch, turnParseErrors } = context;
+        const { statement, workspaceId, workerId, loopId, turnId, sequence, origin, onDispatch, operationConstraint, } = context;
         const schemeCtx = this.#buildSchemeCtx({ workspaceId, workerId, loopId, turnId, origin });
         let result;
-        let denial = this.#checkWritable(statement, origin);
+        let denial = operationConstraint !== undefined
+            && !operationConstraint.allowedOperations.includes(statement.op)
+            ? _a.#failure("operation-not-allowed", 409, `${statement.op} was not executed because ${operationConstraint.detail}.`, {}, {
+                constraint: operationConstraint.code,
+                allowedOperations: [...operationConstraint.allowedOperations],
+                retryable: false,
+            })
+            : null;
+        if (denial === null)
+            denial = this.#checkWritable(statement, origin);
         if (denial === null)
             denial = await this.#checkFlagsGate(statement, loopId);
         if (denial !== null) {
             result = denial;
         }
         else if (this.#readFansOut(statement)) {
-            // READ honors FIND: a glob/folder scope or a matcher fans out to one log row per MATCH
-            // (its own writeLogs), returning early. A READ never proposes, so it bypasses the
-            // single-row path below. A bare entry, body-less, falls through to the direct read. #286
+            // Multi-resource scopes, relation matchers, and acquisition-scheme
+            // matchers use FIND for selection and write their own rows. An exact
+            // stored-resource content matcher remains a direct READ, preserving
+            // content-level outcomes such as 203.
             return await this.#handleReadFanout(statement, schemeCtx, { workerId, loopId, turnId, sequence, origin, onDispatch });
         }
         else {
-            // SPEC §scheme-surface + plurnk-schemes#1: action-entry-as-outcome. Scheme-handler
+            // {§scheme-surface-exception-500} Scheme-handler
             // exceptions become the action-entry's outcome (status 500), not a
             // thrown bubble. The log_entry is the durable record; engine never
             // skips it. Logging failures (#writeLog throws) are NOT caught —
@@ -241,35 +332,38 @@ class Dispatcher {
                 if (statement.op === "EDIT") {
                     const prepared = this.#preparedEdits.get(statement);
                     if (prepared === undefined) {
-                        result = { status: 500, error: "EDIT reached dispatch without a prepared resource batch" };
+                        throw new InvalidOperationResultError("EDIT reached dispatch without a prepared resource batch.");
                     }
                     else {
-                        const settled = prepared.first ? prepared.initial : await prepared.settled;
-                        const aggregate = settled.editReceipt ?? prepared.initial.editReceipt;
-                        if (aggregate !== null && typeof aggregate === "object") {
-                            const receipt = aggregate;
-                            const effect = receipt.effects[prepared.index];
-                            if (effect === undefined)
-                                throw new Error(`EDIT receipt has no effect at index ${prepared.index}`);
-                            const { editReceipt: _editReceipt, ...withoutAggregate } = settled;
+                        const settled = prepared.first
+                            ? prepared.batch.initial
+                            : await prepared.batch.settled;
+                        const normalization = prepared.normalizationIndex === null
+                            ? undefined
+                            : settled.scopeNormalizations?.[prepared.normalizationIndex];
+                        const { scopeNormalizations: _scopeNormalizations, ...projectedSettlement } = settled;
+                        const statementResult = normalization === undefined
+                            ? projectedSettlement
+                            : { ...projectedSettlement, scopeNormalizations: [normalization] };
+                        const aggregate = prepared.batch.aggregate;
+                        if (aggregate !== undefined) {
+                            const receipt = assertEditBatchReceipt(aggregate);
+                            const { editReceipt: _editReceipt, ...withoutAggregate } = statementResult;
                             result = {
                                 ...withoutAggregate,
-                                receipt: {
-                                    revision: receipt.revision,
-                                    unit: receipt.unit,
-                                    before: receipt.before,
-                                    after: receipt.after,
-                                    effect,
-                                },
+                                receipt: projectEditReceipt(receipt, prepared.index),
                             };
                         }
                         else {
-                            result = settled;
+                            result = statementResult;
                         }
                     }
                 }
                 else if (statement.op === "SEND" && statement.target === null) {
-                    result = await this.#handleSendBroadcast(statement, { workspaceId, workerId, loopId, turnId, turnParseErrors });
+                    result = await this.#handleSendBroadcast(statement, { workspaceId, workerId, loopId, turnId, sequence });
+                }
+                else if (statement.op === "OPEN" || statement.op === "FOLD") {
+                    result = await this.#runLogCuration(statement, schemeCtx);
                 }
                 else if (statement.op === "FORK" || statement.op === "WORK") {
                     result = await this.#handleWorkerControl(statement, schemeCtx);
@@ -294,26 +388,31 @@ class Dispatcher {
                     result = await this.#gatedExec(statement, schemeCtx, loopId, turnId);
                 }
                 else {
-                    result = await this.#run(schemeNameOf(statement.target), statement, schemeCtx); // §op-methods-op-dispatch
+                    result = await this.#run(schemeNameOf(statement.target), statement, schemeCtx); // {§op-methods-op-dispatch}
                 }
             }
-            catch (err) { // a scheme exception becomes the op's 500 outcome — §scheme-surface-exception-500
-                result = {
-                    status: 500,
-                    error: err instanceof Error ? err.message : String(err),
-                };
+            catch (err) { // a scheme exception becomes the op's 500 outcome — {§scheme-surface-exception-500}
+                if (err instanceof InvalidOperationResultError)
+                    throw err;
+                const scheme = schemeNameOf(statement.target);
+                console.error(`Scheme '${scheme ?? "unknown"}' ${statement.op} threw outside its operation result contract:`, err);
+                result = err instanceof OperationFailureError
+                    ? err.result
+                    : _a.#failure("scheme-handler-threw", 500, `The '${scheme ?? "unknown"}' scheme did not produce a ${statement.op} result.`, {}, {
+                        stage: "scheme-dispatch",
+                        scheme,
+                        operation: statement.op,
+                    });
             }
         }
-        // §fold-open-meta-operations — OPEN/FOLD are render directives, not actions. They ARE
-        // recorded (#382 — a curation act with no forensic trace is how run43's task-frame fold
-        // stayed invisible), but engine_render_log suppresses them from the packet, so the receipt
-        // rents zero model-facing space — the original clutter concern, resolved by hide-not-drop.
-        // §join-blocking-collect (#354) — Run.read on a still-running child returns an awaitWorker signal;
-        // arm the join so THIS turn's bare SEND[102] parks (the blocking collect) instead of spinning.
+        // {§fold-open-meta-operations} — persist OPEN/FOLD for forensics;
+        // packet rendering suppresses their successful receipts.
+        // A running-worker READ arms this turn's blocking collect.
+        // {§join-blocking-collect}
         if (typeof result.awaitWorker === "string")
             this.#joinTargets.add(loopId);
         const logEntryId = await this.#writeLog({ statement, result, workspaceId, workerId, loopId, turnId, sequence, origin });
-        // §search-gate — register successful searches AFTER #writeLog stamps the runtime
+        // {§search-gate} — register successful searches AFTER #writeLog stamps the runtime
         // entry's coordinate onto result.attrs.pathname (the gate's dedup serves from it).
         if (statement.op === "EXEC" && result.status < 400) {
             const rt = ("signal" in statement && typeof statement.signal === "string" && statement.signal.length > 0) ? statement.signal : "sh";
@@ -323,19 +422,36 @@ class Dispatcher {
                 this.#searchGate?.registerPending(loopId, turnId, rt, cmd, attrPath);
         }
         onDispatch?.(logEntryId);
-        // Proposal lifecycle (SPEC.md §engine-rails + §methods loop.resolve; §proposal-202-pauses). When a
+        // Proposal lifecycle (SPEC.md {§engine-rails} + {§methods-proposal-resolve}; {§proposal-202-pauses}). When a
         // side-effecting op returns status 202 (a broadcast SEND[202] park is model
-        // speech, not a proposal — #isProposal, #255), the entry is written
+        // speech, not a proposal — #isProposal), the entry is written
         // state='proposed'; dispatch then PAUSES on a per-entry waiter until
-        // resolution arrives via Engine.resolveProposal (from the loop/resolve RPC,
-        // auto listener, or timeout). The post-resolution status replaces 202 in the
+        // resolution arrives via Engine.resolveProposal (from a client-interface resume,
+        // core-owned disposition, or timeout). The post-resolution status replaces 202 in the
         // result the caller sees, so runTurn never branches on a pending state.
         if (_a.#isProposal(statement, result)) {
-            // Effect-gated auto-run (read/pure runtimes, plurnk-service#182):
-            // no human gate, no loop/proposal notification. Accept + apply
-            // in-process; the model sees the outcome directly, never a review.
-            if (result.attrs?.inline === true) {
-                const effective = await this.#proposals.workerApply(statement, result, { decision: "accept" }, { workspaceId, workerId, loopId, turnId });
+            // Effect-gated auto-run (read/pure runtimes, {§exec-readpure-ungated}):
+            // EXEC stores its one canonical effect fact before admission. Reuse
+            // that exact fact here; no human gate or loop/proposal notification.
+            const effect = result.attrs?.effect;
+            let autoAccept = false;
+            if (statement.op === "EXEC") {
+                if (!EffectPolicy.isEffect(effect)) {
+                    throw new InvalidOperationResultError("EXEC proposal omitted its canonical effect fact.");
+                }
+                autoAccept = EffectPolicy.decide(effect) === "auto";
+            }
+            if (autoAccept) {
+                const initialSettlement = await this.#proposals.workerApply(statement, result, { decision: "accept" }, { workspaceId, workerId, loopId, turnId });
+                const settlement = _a.#settleProposalEffects(result, initialSettlement);
+                const effective = await this.#settleMoveProposal({
+                    statement,
+                    result,
+                    settlement,
+                    ctx: schemeCtx,
+                    ids: { workspaceId, workerId, loopId, turnId },
+                });
+                this.#recordEditSettlement(statement, effective);
                 return this.#proposals.applyResolution(logEntryId, effective);
             }
             // Register the resolution waiter SYNCHRONOUSLY before any await
@@ -343,56 +459,43 @@ class Dispatcher {
             // awaits the onDispatch callback and immediately resolves) must
             // find the waiter registered — adding an await between insert
             // and waiter-registration would open a race window.
-            const resolutionPromise = this.#proposals.awaitResolution(logEntryId);
-            // Notify external listeners (Daemon broadcasts loop/proposal;
-            // auto listener auto-resolves) BEFORE awaiting — they may
-            // resolve synchronously inside their handlers.
-            const target = this.#extractTarget(statement.target);
-            await this.#canonColumns(target, workspaceId); // {§fs-answer-in-canon} — compare in the same canon the rows store
-            const flags = await this.#loadLoopFlags(loopId); // the proposal carries loop authority — §proposal-ownership-notification
-            // #note10 — if the target diverged on disk this turn, the model's EDIT is based
-            // on a stale read; flag it so a auto resolution rejects instead of clobbering.
-            const diverged = await this.#db.engine_target_diverged_this_turn.get({ worker_id: workerId, turn_id: turnId, scheme: target.scheme, pathname: target.pathname });
-            const event = {
-                logEntryId, workspaceId, workerId, loopId, turnId,
-                op: statement.op,
-                target: { scheme: target.scheme, pathname: target.pathname },
-                body: typeof result.body === "string" ? result.body : "",
-                attrs: (result.attrs ?? {}),
-                flags,
-                staleClobberRisk: diverged !== undefined,
-            };
-            this.#proposals.notifyPending(event);
+            // Core derives one validated projection from the durable row for both
+            // this live event and reconnect discovery ({§proposal-projection}). Its
+            // disposition is also the one automatic settlement decision: policy is
+            // not an observer and cannot silently degrade into client ownership.
+            let resolutionPromise;
+            try {
+                resolutionPromise = this.#proposals.awaitResolution(logEntryId);
+                const event = await this.#proposals.pending(logEntryId);
+                this.#proposals.settleOwned(event);
+                this.#proposals.notifyPending(event);
+            }
+            catch (cause) {
+                await this.#proposals.failPreparation(logEntryId, cause);
+                throw cause;
+            }
             const resolution = await resolutionPromise;
             // Run the scheme's applyResolution hook on accept (writes the
-            // file, spawns the process, etc.). If applyResolution returns a
-            // 4xx/5xx or throws, the resolution is downgraded to a reject
-            // with the failure outcome — engine treats it like a client
-            // rejection.
-            const effective = await this.#proposals.workerApply(statement, result, resolution, { workspaceId, workerId, loopId, turnId });
-            // MOVE into a proposed dest: the deferred source-delete fires ONLY now,
-            // after the dest write landed (accept). On reject the source survives.
-            if (effective.decision === "accept") {
-                const moveSource = result.attrs?.moveSource;
-                if (moveSource !== undefined) {
-                    const srcHandler = this.#schemes.get(moveSource.scheme);
-                    if (srcHandler !== undefined) {
-                        const del = await this.#deleteEntry(moveSource.scheme, moveSource.pathname, schemeCtx);
-                        // A host-effecting source-delete PROPOSES (202); the MOVE proposal already gated the whole
-                        // create+kill, so apply the source-delete now — never raise a second review for one MOVE.
-                        const sourceCtx = this.#handlerContext(moveSource.scheme, schemeCtx);
-                        if (del.status === 202 && del.attrs !== undefined && typeof srcHandler.applyResolution === "function" && sourceCtx !== null)
-                            await srcHandler.applyResolution({ attrs: del.attrs }, sourceCtx);
-                    }
-                }
-            }
+            // file, spawns the process, etc.). Its operation result is
+            // preserved: an apply failure keeps its original status and
+            // Problem Details instead of masquerading as a client rejection.
+            const initialSettlement = await this.#proposals.workerApply(statement, result, resolution, { workspaceId, workerId, loopId, turnId });
+            const settlement = _a.#settleProposalEffects(result, initialSettlement);
+            const effective = await this.#settleMoveProposal({
+                statement,
+                result,
+                settlement,
+                ctx: schemeCtx,
+                ids: { workspaceId, workerId, loopId, turnId },
+            });
+            this.#recordEditSettlement(statement, effective);
             const post = await this.#proposals.applyResolution(logEntryId, effective);
             return post;
         }
         return result;
     }
-    // op.look (#283) — resolve a READ and return its content WITHOUT writing a
-    // log_entries row: the client's off-run inspection primitive (LOOK → READ,
+    // {§op-look}: resolve a READ and return its content without writing a
+    // log_entries row: the client's out-of-band inspection primitive (LOOK → READ,
     // invisible to the model). READ never mutates and never proposes, so this is
     // dispatch's resolve path minus #writeLog. Runs on the client loop, so the
     // human's inspection is never constrained by a model loop's flags. {§op-look}
@@ -407,6 +510,80 @@ class Dispatcher {
             return denial;
         return this.#run(schemeNameOf(statement.target), statement, schemeCtx);
     }
+    // Resolve the client selector through the owning scheme before persistence
+    // is consulted. Public schemes choose a semantic owner; core-owned authority
+    // schemes may return the already-authorized principal key.
+    async resolveEntryAddress(context) {
+        const { target, workspaceId, workerId } = context;
+        const routedScheme = schemeNameOf(target);
+        if (routedScheme === null)
+            return null;
+        const handler = this.#schemes.get(routedScheme);
+        const manifest = this.#schemes.manifestFor(routedScheme);
+        if (handler === undefined || manifest?.category !== "data")
+            return null;
+        const addressedScheme = target.kind === "url" ? target.scheme : routedScheme;
+        const coreCtx = this.#buildSchemeCtx({
+            workspaceId,
+            workerId,
+            loopId: 0,
+            turnId: 0,
+            origin: "client",
+        });
+        const schemeCtx = new SchemeCtxImpl(coreCtx, addressedScheme, manifest, this.#liveSubscriptions);
+        const resolved = handler.resolveEntryAddress === undefined
+            ? { pathname: entryPathnameOf(target), owner: "commons" }
+            : await handler.resolveEntryAddress(target, schemeCtx);
+        if (resolved === null)
+            return null;
+        if (typeof resolved.pathname !== "string") {
+            throw new TypeError(`Scheme '${routedScheme}' returned an invalid entry pathname.`);
+        }
+        let ownerId;
+        if ("ownerId" in resolved) {
+            if (!(handler instanceof CoreSchemeAdapterBase)) {
+                throw new TypeError(`Scheme '${routedScheme}' returned a core-only entry owner id.`);
+            }
+            ownerId = resolved.ownerId;
+        }
+        else if (resolved.owner === "worker") {
+            ownerId = workerId;
+        }
+        else if (resolved.owner === "commons") {
+            ownerId = await Owner.commonsId(this.#db, workspaceId);
+        }
+        else {
+            throw new TypeError(`Scheme '${routedScheme}' returned an invalid entry owner.`);
+        }
+        if (!Number.isSafeInteger(ownerId) || ownerId < 1) {
+            throw new TypeError(`Scheme '${routedScheme}' returned an invalid entry owner id.`);
+        }
+        const rendered = target.kind === "url"
+            ? renderTarget({ ...target, fragment: null })
+            : renderTarget({ scheme: null, pathname: target.raw, fragment: null });
+        if (rendered === null)
+            throw new TypeError("Resolved entry target did not render.");
+        return {
+            ownerId,
+            scheme: manifest.storedScheme ?? addressedScheme,
+            pathname: resolved.pathname,
+            target: rendered,
+        };
+    }
+    // An accepted EXEC reads a non-file source through the same registered
+    // handler and addressed context as an authored READ. {§exec-target-routing}
+    async readExecSource(statement, ctx) {
+        const schemeName = schemeNameOf(statement.target);
+        const manifest = schemeName === null ? undefined : this.#schemes.manifestFor(schemeName);
+        if (manifest !== undefined && manifest.category !== "data") {
+            return _a.#failure("exec-source-not-data", 501, `Scheme '${schemeName}' is not a data source for EXEC.`, {}, {
+                scheme: schemeName,
+                category: manifest.category,
+                retryable: false,
+            });
+        }
+        return Results.assertReadResult(await this.#run(schemeName, statement, ctx));
+    }
     #buildSchemeCtx(ids) {
         const { workspaceId, workerId, loopId, turnId, origin } = ids;
         return {
@@ -419,33 +596,16 @@ class Dispatcher {
             injectWorker: this.#injectWorker,
             mimetypes: this.#mimetypes,
             tokenize: this.#tokenize,
-            pushTelemetry: (event) => this.#telemetry.push(workspaceId, loopId, event),
+            pushNotice: (notice) => this.#notices.push(workspaceId, loopId, notice),
             executors: this.#executors(),
         };
     }
-    // Loads loops.flags (json column) and merges over DEFAULT_LOOP_FLAGS so
-    // missing keys read as their documented defaults. Single read site —
-    // ProposalPendingEvent.flags is constructed from this, and listeners
-    // (Daemon broadcast, loop auto) share the result.
-    async #loadLoopFlags(loopId) {
-        const row = await this.#db.engine_get_loop_flags.get({ loop_id: loopId });
-        if (row === undefined)
-            return DEFAULT_LOOP_FLAGS;
-        try {
-            const parsed = JSON.parse(row.flags);
-            return { ...DEFAULT_LOOP_FLAGS, ...parsed };
-        }
-        catch {
-            return DEFAULT_LOOP_FLAGS;
-        }
-    }
-    // SPEC §scheme-surface: engine rejects writes whose origin is outside the target
+    // SPEC {§scheme-surface}: engine rejects writes whose origin is outside the target
     // scheme's manifest.writableBy.
     // - Read-side ops (READ, FIND, OPEN, FOLD) are not gated.
     // - SEND broadcast (path=null) has no target scheme; not gated.
     // - COPY: dst scheme writableBy applies.
     // - MOVE: both src (delete) and dst (write) schemes' writableBy apply.
-    // - Schemes without a manifest are not gated (legacy / future allowance).
     #checkWritable(statement, origin) {
         if (!MUTATING_OPS.has(statement.op))
             return null;
@@ -456,13 +616,13 @@ class Dispatcher {
         if (statement.op === "EXEC") {
             return this.#denyIfDisallowed("exec", origin);
         }
-        // Run control (FORK/WORK → worker://<name>, spawn or fork) is gated by worker://'s writableBy — its
+        // Worker control (FORK/WORK → worker://<name>, spawn or fork) is gated by worker://'s writableBy — its
         // body is a seed prompt, not a dst path, so the entry-COPY dst-parse below doesn't apply.
-        // §machine-processes
+        // {§machine-processes}
         if (this.#isWorkerControl(statement))
             return this.#denyIfDisallowed("worker", origin);
         if (statement.op === "COPY" || statement.op === "MOVE") {
-            const dst = statement.op === "COPY" ? (statement.body === null ? null : parsePath(statement.body)) : statement.body;
+            const dst = statement.body?.target ?? null;
             const dstScheme = schemeNameOf(dst);
             const dstDenial = this.#denyIfDisallowed(dstScheme, origin);
             if (dstDenial !== null)
@@ -480,17 +640,19 @@ class Dispatcher {
         const target = schemeNameOf(statement.target);
         return this.#denyIfDisallowed(target, origin);
     }
-    // §search-gate (#406, owner ruling) — search runtimes only; everything else dispatches
-    // untouched. A DUPLICATE (same runtime+command this loop) STRIKES AND SERVES: 409 (the
-    // strike rail counts the turn failure; the failed-ops gate holds the terminal a turn)
-    // carrying the prior ranked digest re-read live — the model sees its results again, the
-    // engine never re-fetches, no provenance prose. The per-turn CAP is flood control: 429.
+    // {§search-gate} — gate only configured search runtimes; duplicates serve
+    // the prior durable digest and the per-turn cap refuses without execution.
     async #gatedExec(statement, ctx, loopId, turnId) {
         const runtime = ("signal" in statement && typeof statement.signal === "string" && statement.signal.length > 0) ? statement.signal : "sh";
         const command = ("body" in statement && typeof statement.body === "string") ? statement.body : "";
         const verdict = this.#searchGate?.check(loopId, turnId, runtime, command) ?? { verdict: "pass" };
         if (verdict.verdict === "capped") {
-            return { status: 429, error: `Per-turn search limit reached (${verdict.cap}).` };
+            return _a.#failure("search-limit-reached", 429, `This turn already used its ${verdict.cap} permitted searches.`, {}, {
+                searchLimit: verdict.cap,
+                stage: "search-admission",
+                recovery: "Continue without another search in this turn.",
+                retryable: false,
+            });
         }
         if (verdict.verdict === "duplicate") {
             // {§stream-owner-scoped} — the prior ranked digest is the CALLER's own stream entry.
@@ -501,7 +663,10 @@ class Dispatcher {
                 results = JSON.parse(raw);
             }
             catch { /* non-JSON results serve verbatim */ }
-            return { status: 409, results };
+            return _a.#failure("duplicate-search", 409, "This search already ran in the current loop; the prior results are attached.", { results }, {
+                recovery: "Use the attached prior results.",
+                retryable: false,
+            });
         }
         return this.#run("exec", statement, ctx);
     }
@@ -511,115 +676,156 @@ class Dispatcher {
         const handler = this.#schemes.get(schemeName);
         if (handler === undefined)
             return null;
-        const manifest = handler.constructor.manifest;
+        const manifest = this.#schemes.manifestFor(schemeName);
         if (manifest === undefined)
-            return null;
+            throw new Error(`registered scheme '${schemeName}' has no manifest`);
         if (manifest.writableBy.includes(origin))
             return null;
-        return { status: 403, error: `writer '${origin}' is not in writableBy for scheme '${schemeName}'` }; // §scheme-surface-writableby-403
+        return _a.#failure("writer-forbidden", 403, `Writer '${origin}' cannot modify scheme '${schemeName}'.`, {}, {
+            writer: origin,
+            scheme: schemeName,
+            allowedWriters: [...manifest.writableBy],
+            retryable: false,
+        }); // {§scheme-surface-writableby-403}
     }
     // Per-loop flag gating. Schemes self-declare their flag affinity in
     // their manifest (excludedInAsk / requiresWeb /
     // requiresInteraction); SchemeRegistry.resolveForLoop returns the
-    // active set under the loop's persisted flags. Anything outside the
-    // set returns 403 — action-entry-as-outcome carries the rejection.
+    // active set under the loop's persisted flags. A registered scheme outside
+    // that set returns 403; unknown names continue to their operation owner for
+    // the ordinary registration failure. Action-entry-as-outcome carries either.
     async #checkFlagsGate(statement, loopId) {
         // Broadcast SEND has no scheme to gate.
         if (statement.op === "SEND" && statement.target === null)
             return null;
-        const flags = await this.#loadLoopFlags(loopId);
+        const flags = await LoopFlagsReader.read(this.#db, loopId);
         // Fast path: default flags gate nothing. (auto never gates.)
         if (!flags.noWeb && !flags.noInteraction && flags.mode === "act")
             return null;
-        // §mode-ask-read-only — the ancient contract: an ask-mode loop NEVER changes the world. The
+        // {§mode-ask-read-only} — the ancient contract: an ask-mode loop NEVER changes the world. The
         // filesystem writes (EDIT/COPY-dest/MOVE/KILL touching the `file` scheme — each proposes disk
-        // egress, §membership) are refused HERE, regardless of the scheme's read-activity, because
+        // egress, {§membership}) are refused HERE, regardless of the scheme's read-activity, because
         // `file` stays active for READs. The EXEC host runtime is refused by its excludedInAsk scheme
         // below. This lived only in SPEC (line 65) with no anchor → no guard → it silently regressed.
         if (flags.mode === "ask") {
             const isFile = (t) => schemeNameOf(t) === "file";
             // Each branch narrows statement.op so statement.body is correctly typed (COPY dest is a
-            // string to parse; MOVE dest is already a path). EDIT/KILL write the target; COPY writes
-            // the dest; MOVE deletes the source AND writes the dest — any `file` touch is a write.
+            // resource selection). EDIT/KILL write the target; COPY writes the dest;
+            // MOVE deletes the source AND writes the dest - any `file` touch is a write.
             let writesFilesystem = false;
             if (statement.op === "EDIT" || statement.op === "KILL")
                 writesFilesystem = isFile(statement.target);
             else if (statement.op === "COPY")
-                writesFilesystem = isFile(statement.body === null ? null : parsePath(statement.body));
+                writesFilesystem = isFile(statement.body?.target ?? null);
             else if (statement.op === "MOVE")
-                writesFilesystem = isFile(statement.target) || isFile(statement.body);
+                writesFilesystem = isFile(statement.target) || isFile(statement.body?.target ?? null);
             if (writesFilesystem) {
-                return { status: 403, error: `'${statement.op}' cannot change the filesystem in an ask-mode loop — ask is read-only (no side-effecting ops). Answer or advise the user directly; an act-mode loop is required to edit files.` };
+                return _a.#failure("ask-mode-read-only", 403, `${statement.op} cannot change the filesystem in an ask-mode loop.`, {}, {
+                    mode: flags.mode,
+                    operation: statement.op,
+                    recovery: "Answer or advise the user without changing the filesystem.",
+                    retryable: false,
+                });
             }
         }
         const active = this.#schemes.resolveForLoop(flags);
-        // #367 — the steer NAMES the restriction and says DO NOT RETRY: the old vague "inactive under
-        // current loop flags" invited an identical re-emit each turn → the StrikeRail's 508. An
-        // unavailable op is not a failing one; the model must change course, not repeat.
+        // {§tools-loop-affinity}: name the non-retryable restriction so the model changes course.
         const restriction = flags.mode === "ask"
             ? "this is an ask-mode (read-only) loop — you cannot run commands or take host actions here"
             : flags.noWeb && flags.noInteraction ? "web and interaction are disabled for this loop"
                 : flags.noWeb ? "web access is disabled for this loop"
                     : "interaction is disabled for this loop";
-        const check = (target) => {
-            const scheme = schemeNameOf(target);
-            if (scheme === null)
+        const checkScheme = (scheme) => {
+            if (scheme === null || !this.#schemes.has(scheme))
                 return null;
             if (active.has(scheme))
                 return null;
-            return { status: 403, error: `'${scheme}' is unavailable: ${restriction}. Do NOT retry it — it is unavailable, not failing; answer or advise the user directly (an act-mode loop is required to use it).` };
+            return _a.#failure("scheme-unavailable", 403, `Scheme '${scheme}' is unavailable because ${restriction}.`, {}, {
+                scheme,
+                recovery: "Answer or advise the user without using the unavailable scheme.",
+                retryable: false,
+            });
         };
+        const check = (target) => checkScheme(schemeNameOf(target));
         if (this.#isWorkerControl(statement))
             return check(statement.target); // body is a spawn/fork task, not a dst path
         if (statement.op === "COPY" || statement.op === "MOVE") {
-            return check(statement.target) ?? check(statement.op === "COPY" ? (statement.body === null ? null : parsePath(statement.body)) : statement.body);
+            return check(statement.target) ?? check(statement.body?.target ?? null);
+        }
+        // {§exec-target-routing} — the operation owner and a non-file source
+        // are independent authorities; local/file targets stay executor-local.
+        if (statement.op === "EXEC") {
+            const operationDenial = checkScheme("exec");
+            if (operationDenial !== null)
+                return operationDenial;
+            const sourceScheme = schemeNameOf(statement.target);
+            return sourceScheme === null || sourceScheme === "file" ? null : checkScheme(sourceScheme);
         }
         return check(statement.target);
     }
-    // Run control is FORK/WORK (grammar 0.74.55), not COPY — its body
+    // Worker control is FORK/WORK (grammar 0.74.55), not COPY — its body
     // is the new worker's seed prompt, not a destination path. The COPY gates and #handleCopy
     // branch on this so they never parse the prompt as a dst path.
     #isWorkerControl(statement) {
-        return statement.op === "FORK" || statement.op === "WORK"; // run control targets worker://<name> (grammar 0.74.55)
-    }
-    // FORK/WORK(worker://<name>):task — run control (grammar 0.74.55):
-    //   • worker://self   → FORK: deep-copy the current worker's log into a new sister (Fork), then
-    //     continue it with the prompt (§machine-processes-fork-copies-the-log).
-    //   • worker://<name> → SPAWN: a fresh sister (empty log) named <name>, started on the prompt.
-    //     A LIVE sister already holding <name> is a 409 conflict; a free or terminated name is
-    //     reclaimed (§worker-scheme-spawn). The self form is fork; only a name spawns.
-    // Both ride the daemon inject and obey the active-runs cap (508, §worker-scheme-cap).
-    // FORK/WORK — run control (grammar 0.74.55). Both name a NEW run in the target authority
-    // (worker://<name>) and carry its seed task in the body. WORK spawns a fresh worker; FORK branches
-    // the current worker's log into a named sister. Replaces the COPY(worker://) overload — one verb, one
-    // intent, so the model never conflates the target slot with the body (grammar#52).
+        return statement.op === "FORK" || statement.op === "WORK"; // worker control targets worker://<name> (grammar 0.74.55)
+    }
+    // WORK and FORK name the new worker in the target authority and carry its seed task in the body.
+    // Their distinct fresh/branched histories are specified by {§worker-scheme-spawn} and {§worker-scheme-fork}.
     async #handleWorkerControl(statement, ctx) {
-        const target = statement.target;
-        if (target === null)
-            return { status: 400, error: `${statement.op} requires a worker target (${statement.op}(worker://<name>))` };
-        const name = target.kind === "url" ? (target.hostname ?? "") : ""; // §worker-scheme — run is the AUTHORITY (worker://<name>), not the path
-        if (name === "")
-            return { status: 400, error: `${statement.op} requires a worker name (worker://<name>)` };
-        if (name === "self")
-            return { status: 400, error: `'self' is the current run — ${statement.op} names a NEW run (worker://<name>)` };
-        // {§entry-owner} — 'commons'/'plurnk' are the reserved owner rows, '~' the self-sigil; no spawn takes them.
-        if (Owner.RESERVED.has(name))
-            return { status: 400, error: `'${name}' is a reserved worker name` };
+        const address = WorkerControlAddress.resolve(statement.target, statement.op);
+        if (!address.ok)
+            return address.result;
+        const name = address.authority;
+        try {
+            WorkerName.assert(name); // {§worker-name-minting}
+        }
+        catch (error) {
+            if (!(error instanceof WorkerNameError))
+                throw error;
+            return _a.#failure(`worker-${error.code}`, 400, error.message, {}, {
+                operation: statement.op,
+                worker: error.workerName,
+                recovery: error.recovery,
+                retryable: false,
+            });
+        }
         if (ctx.injectWorker === undefined)
-            throw new Error("run control: injectWorker capability absent");
+            throw new Error("worker control: injectWorker capability absent");
         const denied = await WorkerCap.deny(this.#db, ctx.workspaceId);
         if (denied !== null)
             return denied;
-        const prompt = typeof statement.body === "string" ? statement.body : "";
-        // §worker-delegation-inherits-flags — authority flows down the delegation edge: the child's live
+        const prompt = statement.body;
+        // {§worker-delegation-inherits-flags} — authority flows down the delegation edge: the child's live
         // loop runs with ITS DELEGATOR'S flags. A flagless (non-auto) child's every side-effecting op
         // proposes into a resolver-less void — 300s auto-cancel per attempt was the fan-out wedge.
-        const flags = await this.#loadLoopFlags(ctx.loopId);
-        // A name is frozen per worker but reclaimable across time (§machine-processes-worker-origin): a LIVE
+        const flags = await LoopFlagsReader.read(this.#db, ctx.loopId);
+        // A name is frozen per worker but reclaimable across time ({§machine-processes-worker-origin}): a LIVE
         // sister holding it is a 409 (legible, never a raw UNIQUE 500); a free/terminated name reclaims.
         const live = await this.#db.worker_live_by_name.get({ workspace_id: ctx.workspaceId, name });
-        if (live !== undefined)
-            return { status: 409, error: `worker '${name}' is already running` };
+        if (live !== undefined) {
+            return _a.#failure("worker-already-running", 409, `Worker '${name}' is already running.`, {}, { worker: name, retryable: false });
+        }
+        if (typeof statement.signal === "string") {
+            if (this.#branchWorker === undefined)
+                throw new Error("branch worker control: branchWorker capability absent");
+            const child = await this.#branchWorker({
+                workspaceId: ctx.workspaceId,
+                parentWorkerId: ctx.workerId,
+                parentLoopId: ctx.loopId,
+                parentTurnId: ctx.turnId,
+                op: statement.op,
+                name,
+                branch: statement.signal,
+                prompt,
+                flags,
+                origin: ctx.writer,
+            });
+            return {
+                status: 200,
+                body: name,
+                attrs: { branch: statement.signal, workerId: child.workerId, loopId: child.loopId },
+            };
+        }
         if (statement.op === "FORK") {
             // Branch the current worker's log into a named sister.
             const branchWorkerId = await Fork.fork(this.#db, ctx.workerId, name);
@@ -631,154 +837,164 @@ class Dispatcher {
             workspace_id: ctx.workspaceId, name, parent_worker_id: ctx.workerId, origin: ctx.writer,
         });
         if (row === undefined)
-            throw new Error("run spawn: run insert returned no row");
+            throw new Error("worker spawn: worker insert returned no row");
         await ctx.injectWorker({ workspaceId: ctx.workspaceId, workerId: row.id, prompt, flags });
         return { status: 200, body: name };
     }
     async #handleCopy(statement, ctx) {
-        if (statement.op !== "COPY")
-            throw new Error("unreachable");
-        const srcPath = statement.target;
-        // COPY is entry-copy only — run control (spawn/fork) moved to the FORK/WORK verbs
-        // (grammar 0.74.55). COPY's body is a dest path (grammar §COPY); an unparseable dest → 400.
-        const dstPath = statement.body === null ? null : parsePath(statement.body);
-        if (srcPath === null)
-            return { status: 400, error: "COPY requires source path" };
-        if (dstPath === null)
-            return { status: 400, error: "COPY destination must be a parseable path in the body slot" };
-        return await this.#copyOrchestration({ statement, srcPath, dstPath, ctx });
+        if (statement.target === null) {
+            return _a.#failure("copy-source-required", 400, "COPY requires a source path.", {}, { retryable: false });
+        }
+        if (statement.body === null) {
+            return _a.#failure("copy-destination-required", 400, "COPY requires a destination.", {}, { retryable: false });
+        }
+        return this.#copyOrchestration({
+            statement,
+            source: {
+                target: statement.target,
+                lineMarker: statement.lineMarker,
+            },
+            destination: statement.body,
+            ctx,
+        });
     }
     async #handleMove(statement, ctx) {
-        if (statement.op !== "MOVE")
-            throw new Error("unreachable");
-        const srcPath = statement.target;
-        const dstPath = statement.body;
-        if (srcPath === null)
-            return { status: 400, error: "MOVE requires source path" };
-        // MOVE is relocation only — deletion is KILL's job (§move, §move-dev-null-not-special). The /dev/null
-        // and null-body delete-by-MOVE back-compat is retired: no silent debt.
-        if (dstPath === null)
-            return { status: 400, error: "MOVE requires a destination; use KILL to delete" }; // §move-null-body-400
-        const srcSchemeName = schemeNameOf(srcPath);
-        if (srcSchemeName === null)
-            return { status: 400, error: "MOVE source must be a URL path with a scheme" };
-        if (!this.#schemes.has(srcSchemeName))
-            return { status: 501 };
-        // Relocation: COPY then DELETE source (§move-relocation-deletes-source).
-        const copyResult = await this.#copyOrchestration({ statement, srcPath, dstPath, ctx });
-        if (copyResult.status >= 400)
-            return copyResult;
-        const srcPathname = pathnameFromPath(srcPath);
-        // If the dest write is a pending proposal (file dest → §membership review), the
-        // source-delete MUST wait until the dest actually lands — a rejected
-        // proposal would otherwise lose the source. Thread it into the resolution:
-        // dispatch deletes the source AFTER the dest applies on accept.
-        if (copyResult.status === 202) {
-            return { ...copyResult, attrs: { ...copyResult.attrs, moveSource: { scheme: srcSchemeName, pathname: srcPathname } } };
-        }
-        const delResult = await this.#deleteEntry(srcSchemeName, srcPathname, ctx);
-        if (delResult.status >= 400)
-            return { status: delResult.status };
-        return copyResult;
-    }
-    // KILL — scheme-polymorphic destroy (plurnk-grammar#203 / 0.28.0). Entry-KILL
-    // permanently deletes the entry: the canonical delete now, MOVE→/dev/null
-    // retired from the model's vocabulary. Process-KILL (exec:///) aborts the
-    // running spawn's controller (the same teardown loop.cancel rides), addressed
-    // by coordinate pathname (#203). The KILL body is an opaque
-    // annotation with no runtime meaning; it survives into the log row's tx for
-    // free via the statement serialization. Status: 200 killed · 404 unknown ·
-    // 405 log:/// (append-only) · 403 writableBy (the #checkWritable gate, KILL ∈
-    // MUTATING_OPS) · 200/410/304/404 exec (killed / killed-earlier / exited / unknown) · 501 no-kill/delete scheme.
+        if (statement.target === null) {
+            return _a.#failure("move-source-required", 400, "MOVE requires a source path.", {}, { retryable: false });
+        }
+        // MOVE is relocation only - deletion is KILL's job ({§move}, {§move-dev-null-not-special}). The /dev/null
+        // and null-body delete-by-MOVE has no alternate meaning.
+        if (statement.body === null) {
+            return _a.#failure("move-destination-required", 400, "MOVE requires a destination.", {}, {
+                recovery: "Use KILL when the intended operation is deletion.",
+                retryable: false,
+            });
+        }
+        return this.#moveOrchestration({
+            statement,
+            source: {
+                target: statement.target,
+                lineMarker: statement.lineMarker,
+            },
+            destination: statement.body,
+            ctx,
+        });
+    }
+    // KILL is target-polymorphic. Scheme handlers own the optional numeric code's
+    // meaning; core retains worker and entry dispatch. {§operation-code-polymorphism}
     async #handleKill(statement, ctx) {
         if (statement.op !== "KILL")
             throw new Error("unreachable");
         const path = statement.target;
-        if (path === null)
-            return { status: 400, error: "KILL requires a target path" };
+        if (path === null) {
+            return _a.#failure("kill-target-required", 400, "KILL requires a target path.", {}, { retryable: false });
+        }
         const schemeName = schemeNameOf(path);
-        if (schemeName === null)
-            return { status: 400, error: "KILL target must be a URL path with a scheme" };
-        // KILL on log:/// erases the log row(s) — the model's DB-storage curation lever
-        // (plurnk.md:36, :98), routed to Log.kill below via the killable.kill path. The old
-        // "append-only" 405 forbade what the grammar requires; FOLD only collapses the render.
+        if (schemeName === null) {
+            return _a.#failure("kill-target-scheme-required", 400, "KILL target requires a scheme.", {}, { retryable: false });
+        }
+        // Log targets use the same killable dispatch as streams; erasure is their
+        // permanent curation operation. {§model-entry-log-curation}
         // Process-KILL: any scheme whose handler exposes kill() aborts a live stream — the
         // exec handler, registered as "exec" + under every runtime tag (sh/node), so a tag-
-        // addressed stream (sh:///l/t/s) routes here, not to deleteEntry. §exec
+        // addressed stream (sh:///l/t/s) routes here, not to deleteEntry. {§exec}
         const killable = this.#schemes.get(schemeName);
         if (killable !== undefined && typeof killable.kill === "function") {
             // Pass the model's OWN scheme so a stream-KILL error answers in the runtime tag the
             // model addressed (sh:///…), not the internal `exec` ({§fs-answer-in-canon}).
             const handlerCtx = this.#handlerContext(schemeName, ctx);
-            return handlerCtx === null ? { status: 501 } : await killable.kill(pathnameFromPath(path), statement.signal, handlerCtx, schemeName);
+            if (handlerCtx === null) {
+                throw new InvalidOperationResultError(`Registered scheme '${schemeName}' has no dispatch context.`);
+            }
+            return await killable.kill(entryPathnameOf(path), statement.signal, handlerCtx, schemeName);
         }
         if (schemeName === "worker") {
-            // Entry-path present → KILL a worker-scope scratch ENTRY (delete it), self-only —
-            // NOT run cancellation. The authority (hostname) names the owner, the pathname the
-            // entry; only the path-ABSENT form (worker://<name>) terminates the run-as-actor. §worker-scheme
+            // Entry-path present → KILL a private owner-held entry (delete it), self-only —
+            // NOT worker cancellation. The authority (hostname) names the owner, the pathname the
+            // entry; only the path-ABSENT form (worker://<name>) terminates the worker-as-actor. {§worker-scheme}
             const entryPath = path.kind === "url" ? (path.pathname ?? "") : "";
             if (entryPath !== "" && entryPath !== "/") {
                 const workerHandler = this.#schemes.get("worker");
                 const handlerCtx = this.#handlerContext("worker", ctx);
-                return handlerCtx === null ? { status: 501 } : await workerHandler.killEntry(statement, handlerCtx);
+                if (handlerCtx === null) {
+                    throw new InvalidOperationResultError("Registered scheme 'worker' has no dispatch context.");
+                }
+                return await workerHandler.killEntry(statement, handlerCtx);
             }
-            // Terminate an addressed worker's structured scope. `worker://self` = self.
-            // An idle worker is a no-op 200; a missing worker is 404.
-            const name = path.kind === "url" ? (path.hostname ?? "") : ""; // §worker-scheme — the worker is the AUTHORITY
-            if (name === "")
-                return { status: 400, error: "worker:// kill requires a worker name or ~ (worker://<name>)" };
+            const address = WorkerControlAddress.resolve(path, "KILL");
+            if (!address.ok)
+                return address.result;
+            // `~` is the sole current-worker sigil; every other authority is a literal name.
+            // An idle worker is a no-op 200; a missing named worker is 404. {§worker-control-addressing}
+            const name = address.authority;
             let workerId = ctx.workerId;
             if (name !== "~") {
                 const row = await this.#db.worker_resolve_by_name.get({ workspace_id: ctx.workspaceId, name });
-                if (row === undefined)
-                    return { status: 404, error: `worker://${name} not found in this workspace` };
+                if (row === undefined) {
+                    return _a.#failure("worker-not-found", 404, `Worker '${name}' does not exist in this workspace.`, {}, { worker: name, retryable: false });
+                }
                 workerId = row.id;
             }
             if (this.#cancelWorker === undefined)
-                throw new Error("run kill: cancelWorker capability absent");
-            // §op-synchronous — KILL is decisive. Await the one lifecycle owner so the
+                throw new Error("worker kill: cancelWorker capability absent");
+            // {§op-synchronous} — KILL is decisive. Await the one lifecycle owner so the
             // same-turn pending-work gate observes the complete subtree as terminal.
             await this.#cancelWorker(workerId, "killed via worker:// KILL");
             return { status: 200 };
         }
-        if (!this.#schemes.has(schemeName))
-            return { status: 501 };
+        if (!this.#schemes.has(schemeName)) {
+            return _a.#failure("scheme-not-found", 501, `Scheme '${schemeName}' is not registered.`, {}, { scheme: schemeName, retryable: false });
+        }
         // A host-effecting delete (file) returns 202 to PROPOSE — pass its attrs through so the proposal
-        // carries the delete target to review (§isProposal fires on 202). Plurnk-internal deletes execute inline.
-        const delResult = await this.#deleteEntry(schemeName, pathnameFromPath(path), ctx);
-        return delResult.attrs !== undefined ? { status: delResult.status, attrs: delResult.attrs } : { status: delResult.status };
-    }
-    // Multi-file READ fan-out (SPEC §matcher-result — "the companion to FIND's survey"). A glob
-    // READ target resolves to MANY files; READ returns one log row per file that matches, each
-    // holding that file's matching lines. The matched SET is exactly FIND's survey (which files
-    // + where — matchLines), so we reuse the scheme's own find, then READ each matched file. One
-    // model command, N log rows — each row addresses its concrete file, so it folds/kills/re-READs
-    // on its own. The running sequence counter in runTurn advances by rowsWritten.
-    // A READ fans out (honors FIND) when it resolves to more than the single exact entry: a glob
-    // or folder scope, OR a matcher (which selects per-match within whatever the target resolved).
-    // A bare entry, body-less, is the one direct read. #286
+        // carries the delete target to review (#isProposal fires on 202). Plurnk-internal deletes execute inline.
+        return this.#deleteEntry(schemeName, entryPathnameOf(path), ctx);
+    }
+    // A multi-resource READ uses FIND as its resource selector, then writes one
+    // READ row per selected resource. Match coordinates remain metadata on that
+    // resource; they never create extra rows or replace its content.
     #readFansOut(statement) {
         if (statement.op !== "READ")
             return false;
-        if ("body" in statement && statement.body !== null)
-            return true; // a matcher → per-match fan-out
+        const body = statement.body;
+        if (body?.dialect === "semantic" || body?.dialect === "graph")
+            return true;
+        const schemeName = schemeNameOf(statement.target);
+        const handler = schemeName === null
+            ? undefined
+            : this.#schemes.get(schemeName);
+        if (body !== null && typeof handler?.prepareFind === "function")
+            return true;
         const t = statement.target;
         const p = t === null ? "" : (t.kind === "url" ? t.pathname : t.raw);
-        if (p.includes("*"))
+        if (PathSyntax.hasGlob(p))
             return true;
-        const schemeName = schemeNameOf(t);
         return p.endsWith("/") && schemeName !== null && this.#schemes.manifestFor(schemeName)?.folderScopes === true;
     }
-    // Clone the READ onto one concrete match — the FIND already matched, so strip the body
-    // (no re-match) and set <L> to its readable-row span. A null span (body-less folder/glob
-    // fan-out) reads the whole entry. #286
-    static #retargetRead(statement, pathname, span) {
+    static #retargetRead(statement, pathname, lineMarker, body) {
         const t = statement.target;
         const target = t !== null && t.kind === "url"
             ? { ...t, pathname, raw: `${t.scheme}://${pathname}` }
             : { ...t, raw: pathname };
-        const lineMarker = span !== null ? { marks: [span.rowStart, span.rowEnd] } : null;
-        return { ...statement, target: target, lineMarker, body: null };
+        return { ...statement, target: target, lineMarker, body };
+    }
+    // READ scope always projects text. Semantic READ reserves a leading decimal
+    // for similarity selection; any remaining integers are the text projection.
+    // FIND retains its own public result-range interpretation.
+    static #readMarkers(statement) {
+        const marker = statement.lineMarker;
+        if (statement.body?.dialect !== "semantic") {
+            return { selection: null, projection: marker };
+        }
+        if (marker === null)
+            return { selection: null, projection: null };
+        const [first, ...rest] = marker.marks;
+        if (Number.isInteger(first)) {
+            return { selection: null, projection: marker };
+        }
+        return {
+            selection: { marks: [first] },
+            projection: rest.length === 0 ? null : { marks: rest },
+        };
     }
     #standardEntryManifest(schemeName, statement) {
         const handler = this.#schemes.get(schemeName);
@@ -790,118 +1006,108 @@ class Dispatcher {
         const manifest = this.#schemes.manifestFor(schemeName);
         return manifest === undefined ? null : { ...manifest, name: target.scheme };
     }
-    static #foldStoredEntryAuthority(statement) {
+    static #storedEntryRead(statement, pathname, lineMarker, body, storage) {
         const target = statement.target;
         if (target === null || target.kind !== "url")
-            return statement;
-        const pathname = foldAuthorityIntoPath(target.hostname, target.pathname);
-        return {
-            ...statement,
-            target: { ...target, hostname: null, pathname, raw: `${target.scheme}://${pathname}` },
-        };
-    }
-    static #storedEntryMatchRead(statement, pathname, span, storage) {
-        const target = statement.target;
-        if (target === null || target.kind !== "url")
-            return _a.#retargetRead(statement, pathname, span);
+            return _a.#retargetRead(statement, pathname, lineMarker, body);
+        if (NetworkAddress.supports(target.scheme)) {
+            const parsed = parsePath(renderAddress(target.scheme, pathname));
+            if (parsed === null || parsed.kind !== "url") {
+                throw new Error(`failed to reconstruct network entry target for ${target.scheme}:${pathname}`);
+            }
+            const reconstructed = { ...parsed, fragment: target.fragment };
+            const raw = renderTarget(reconstructed);
+            if (raw === null)
+                throw new Error(`failed to render network entry target for ${target.scheme}:${pathname}`);
+            return {
+                ...statement,
+                target: { ...reconstructed, raw },
+                lineMarker,
+                body,
+            };
+        }
         const hostPrefix = target.hostname === null ? null : `/${target.hostname}`;
         const displayPath = hostPrefix !== null && pathname.startsWith(`${hostPrefix}/`)
             ? pathname.slice(hostPrefix.length)
             : pathname;
-        const lineMarker = span === null ? null : { marks: [span.rowStart, span.rowEnd] };
         return {
             ...statement,
             target: storage
                 ? { ...target, hostname: null, pathname, raw: `${target.scheme}://${pathname}` }
                 : { ...target, pathname: displayPath, raw: `${target.scheme}://${target.hostname ?? ""}${displayPath}` },
             lineMarker,
-            body: null,
+            body,
         };
     }
     async #handleReadFanout(statement, ctx, ids) {
         const { workerId, loopId, turnId, sequence, origin, onDispatch } = ids;
         const schemeName = schemeNameOf(statement.target);
-        const findStatement = { ...statement, op: "FIND" };
+        const read = statement;
+        const markers = _a.#readMarkers(read);
+        const findStatement = {
+            ...statement,
+            op: "FIND",
+            lineMarker: markers.selection,
+        };
         const standardEntryManifest = schemeName === null ? null : this.#standardEntryManifest(schemeName, statement);
-        const found = standardEntryManifest === null
-            ? await this.#run(schemeName, findStatement, ctx)
-            : await EntryFind.findWorkspaceEntries(_a.#foldStoredEntryAuthority(findStatement), ctx, standardEntryManifest);
+        const found = await this.#run(schemeName, findStatement, ctx);
         const matches = found.matches ?? [];
-        const overflow = typeof found.overflow === "number" ? found.overflow : null;
-        // §find-count-not-contents applies to WORK as well as rendering. A READ
-        // over an over-budget selection writes the bounded FIND summary plus one
-        // loud refusal; it never silently truncates and never materializes a
-        // hidden prefix/suffix of the set.
-        if (overflow !== null) {
-            const findRowId = await this.#writeLog({ statement: { ...statement, op: "FIND" }, result: found, workspaceId: ctx.workspaceId, workerId, loopId, turnId, sequence, origin });
-            onDispatch?.(findRowId);
-            const result = {
-                status: 413,
-                error: `${overflow} matches exceed the READ materialization budget — narrow the target or matcher.`,
-            };
-            const readRowId = await this.#writeLog({ statement, result, workspaceId: ctx.workspaceId, workerId, loopId, turnId, sequence: sequence + 1, origin });
+        const omittedItems = typeof found.omittedItems === "number" ? found.omittedItems : null;
+        if (omittedItems !== null) {
+            const maximumItems = typeof found.maximumItems === "number" ? found.maximumItems : null;
+            const result = _a.#failure("read-materialization-too-large", 413, `READ selected ${omittedItems} resources, exceeding the materialization limit${maximumItems === null ? "" : ` of ${maximumItems}`}.`, {}, {
+                resources: omittedItems,
+                ...(maximumItems === null ? {} : { maximumResources: maximumItems }),
+                stage: "materialization",
+                recovery: "Narrow the target or matcher.",
+                retryable: false,
+            });
+            const readRowId = await this.#writeLog({ statement, result, workspaceId: ctx.workspaceId, workerId, loopId, turnId, sequence, origin });
             onDispatch?.(readRowId);
-            return { ...result, rowsWritten: 2 };
+            return { ...result, rowsWritten: 1 };
         }
         // Find-less scheme, a matcher/scope error, or zero matches → a single row carrying the
         // status, exactly like a non-fanned READ. The model sees the empty/failed result, not silence.
         if (found.status !== 200 || matches.length === 0) {
-            const result = { status: found.status === 200 ? 204 : found.status };
+            const result = found.status === 200
+                ? { status: 204, ...(read.body === null ? {} : { matches: [] }) }
+                : found;
             const id = await this.#writeLog({ statement, result, workspaceId: ctx.workspaceId, workerId, loopId, turnId, sequence, origin });
             onDispatch?.(id);
             return { ...result, rowsWritten: 1 };
         }
-        // One READ row per MATCH — deliver its source lines (or the whole entry for a body-less
-        // folder/glob) while the logged statement carries the corresponding readable-row scope.
-        // The delivery uses a raw line-slice rather than reinterpreting provenance as the scheme's
-        // structural <L>. Read each distinct entry's content once, then line-slice per match. #286
-        // §matcher-selection-signal — the SELECTION SUMMARY row: the internal FIND that located
-        // the matches is WRITTEN (op=FIND, its full result — per-hit matchSpan + matchPath, the
-        // canonical dialect coordinate) before the per-match deliveries, exactly as if the model
-        // had FINDed then READ. On a degenerate single-line document the N delivery rows are
-        // identical whole-file lines; the summary row is what tells the model its query hit N
-        // times and WHERE (run30: two hits indistinguishable from failure; 17 retries, 508).
-        const findRowId = await this.#writeLog({ statement: { ...statement, op: "FIND" }, result: found, workspaceId: ctx.workspaceId, workerId, loopId, turnId, sequence, origin });
-        onDispatch?.(findRowId);
-        const wholeByPath = new Map();
         const fannedStatuses = [];
-        let written = 1;
-        for (const m of matches) {
+        const scopeNormalizations = [];
+        let written = 0;
+        for (const match of matches) {
             ctx.signal?.throwIfAborted();
-            let whole = wholeByPath.get(m.pathname);
-            if (whole === undefined) {
-                const retargeted = standardEntryManifest === null
-                    ? _a.#retargetRead(statement, m.pathname, null)
-                    : _a.#storedEntryMatchRead(statement, m.pathname, null, true);
-                whole = standardEntryManifest === null
-                    ? await this.#run(schemeName, retargeted, ctx)
-                    : await EntryOps.readWorkspaceEntry(retargeted, ctx, standardEntryManifest);
-                wholeByPath.set(m.pathname, whole);
-            }
-            const result = _a.#sliceMatch(whole, m.span);
-            const deliveredStatement = standardEntryManifest === null
-                ? _a.#retargetRead(statement, m.pathname, m.span)
-                : _a.#storedEntryMatchRead(statement, m.pathname, m.span, false);
-            const id = await this.#writeLog({ statement: deliveredStatement, result, workspaceId: ctx.workspaceId, workerId, loopId, turnId, sequence: sequence + written, origin });
+            const executionStatement = standardEntryManifest === null
+                ? _a.#retargetRead(statement, match.pathname, markers.projection, null)
+                : _a.#storedEntryRead(statement, match.pathname, markers.projection, null, true);
+            const readResult = standardEntryManifest === null
+                ? await this.#run(schemeName, executionStatement, ctx)
+                : await EntryOps.readWorkspaceEntry(executionStatement, ctx, standardEntryManifest);
+            const result = read.body === null
+                ? readResult
+                : { ...readResult, matches: match.matches };
+            const loggedStatement = standardEntryManifest === null
+                ? _a.#retargetRead(statement, match.pathname, statement.lineMarker, read.body)
+                : _a.#storedEntryRead(statement, match.pathname, statement.lineMarker, read.body, false);
+            const id = await this.#writeLog({ statement: loggedStatement, result, workspaceId: ctx.workspaceId, workerId, loopId, turnId, sequence: sequence + written, origin });
             onDispatch?.(id);
             fannedStatuses.push(result.status);
+            scopeNormalizations.push(...(result.scopeNormalizations ?? []));
             written++;
         }
-        return { status: 200, rowsWritten: written, fannedStatuses };
-    }
-    // Deliver one match: the whole entry (body-less, span null) or the source lines at the span —
-    // a RAW line-slice, so a structural mimetype (json item-index / xml) doesn't mis-slice a span
-    // that is, by construction, source line numbers (#286).
-    static #sliceMatch(whole, span) {
-        if (whole.status !== 200 || span === null)
-            return whole;
-        const sliced = LineMarkerOps.sliceLines(typeof whole.content === "string" ? whole.content : "", { marks: [span.lineStart, span.lineEnd] });
-        if (sliced.status !== 200)
-            return { status: sliced.status, error: sliced.error };
-        return { status: 200, content: sliced.text ?? "", mimetype: "text/markdown", startLine: sliced.startLine ?? span.lineStart };
-    }
-    // §model-entry — mirror a verbatim model emission back as an actionless `model` log row, so
-    // the model can finally SEE its own prior output (and reason through its own syntax errors).
+        return {
+            status: 200,
+            rowsWritten: written,
+            fannedStatuses,
+            ...(scopeNormalizations.length === 0 ? {} : { scopeNormalizations }),
+        };
+    }
+    // {§model-entry} — mirror an admitted model emission back as an actionless `model` log row, so
+    // the model can inspect and curate its own prior behavior.
     // Born FOLDED by default (budget-neutral until OPENed); the turn-0 exemplar passes folded:false
     // (born open — the one worked example the model orients on, thinning the grammar). text/vnd.plurnk.
     async writeModelEntry({ verbatim, workerId, loopId, turnId, sequence, folded, origin = "model", reasoningItems }) {
@@ -909,7 +1115,7 @@ class Dispatcher {
             worker_id: workerId, loop_id: loopId, turn_id: turnId, sequence,
             origin, source: null, op: "model", suffix: "", signal: null,
             scheme: null, username: null, password: null, hostname: null, port: null,
-            pathname: null, params: null, fragment: null, lineMarker: null,
+            pathname: null, query: null, fragment: null, lineMarker: null,
             tx: "", mimetype_tx: "text/vnd.plurnk",
             rx: JSON.stringify({ content: verbatim, mimetype: "text/vnd.plurnk" }),
             mimetype_rx: "application/json",
@@ -922,7 +1128,7 @@ class Dispatcher {
             await this.#db.engine_fold_log_entry.run({ id: row.id });
         return row.id;
     }
-    // PLAN — the model's reasoning op (the 11th op). An ordinary op: dispatched like any
+    // PLAN — the model's intended-goals op. An ordinary op: dispatched like any
     // other, logged, and broadcast to the client as a log entry — but a pure no-op for
     // state (PLAN ∉ MUTATING_OPS); its body serializes into the log row's tx, no effect.
     #handlePlan(statement) {
@@ -930,93 +1136,708 @@ class Dispatcher {
             throw new Error("unreachable");
         return { status: 200 };
     }
-    // Same- and cross-scheme COPY share one orchestrator — §copy-cross-scheme-copy §move-cross-scheme-move
-    async #copyOrchestration({ statement, srcPath, dstPath, ctx }) {
-        const srcSchemeName = schemeNameOf(srcPath);
-        const dstSchemeName = schemeNameOf(dstPath);
-        if (srcSchemeName === null || dstSchemeName === null)
-            return { status: 400, error: "COPY/MOVE require URL paths with schemes" };
-        // {§worker-authority-carving} — the entry-copy seam is pathname-keyed; on worker:// it
-        // addresses the COMMONS. A space's content moves via READ + EDIT, not COPY.
-        for (const p of [srcPath, dstPath]) {
-            if (p.kind === "url" && p.scheme === "worker" && (p.hostname ?? "") !== "") {
-                return { status: 400, error: "COPY/MOVE address the commons (worker:///…); a space's content moves via READ + EDIT" };
-            }
+    static #isDispatchResult(value) {
+        return "status" in value;
+    }
+    async #resolveResourceSelection(selection, ctx) {
+        const { target, lineMarker } = selection;
+        const scheme = schemeNameOf(target);
+        if (scheme === null) {
+            return _a.#failure("resource-scheme-required", 400, "COPY and MOVE resources require a scheme.", {}, { retryable: false });
+        }
+        if (target.kind === "url" && target.scheme === "worker" && (target.hostname ?? "") !== "") {
+            return _a.#failure("worker-copy-address-invalid", 400, "COPY and MOVE do not address named worker spaces.", {}, {
+                recovery: "Move worker-space content with READ and EDIT.",
+                retryable: false,
+            });
+        }
+        const handler = this.#schemes.get(scheme);
+        const manifest = this.#schemes.manifestFor(scheme);
+        if (handler === undefined || manifest === undefined) {
+            return _a.#failure("scheme-not-found", 501, `COPY or MOVE addressed the unregistered scheme '${scheme}'.`, {}, {
+                scheme,
+                retryable: false,
+            });
+        }
+        if (manifest.category !== "data") {
+            return _a.#failure("entry-operation-unsupported", 400, `COPY and MOVE require entry-bearing resources; '${scheme}' is a ${manifest.category} scheme.`, {}, {
+                scheme,
+                category: manifest.category,
+                retryable: false,
+            });
+        }
+        const fragment = target.kind === "url" ? target.fragment : null;
+        const channel = fragment ?? manifest.defaultChannel;
+        if (channel.length === 0) {
+            return _a.#failure("channel-required", 400, `The '${scheme}' scheme has no default channel.`, {}, {
+                scheme,
+                recovery: "Address a named channel with a URI fragment.",
+                retryable: false,
+            });
+        }
+        if (fragment !== null
+            && fragment !== manifest.defaultChannel
+            && !Object.hasOwn(manifest.channels, fragment)) {
+            const availableChannels = [
+                ...new Set([manifest.defaultChannel, ...Object.keys(manifest.channels)]),
+            ].filter((candidate) => candidate.length > 0);
+            return _a.#failure("channel-not-found", 400, `Channel #${fragment} is not declared by the '${scheme}' scheme.`, {}, {
+                requestedChannel: fragment,
+                availableChannels,
+                retryable: false,
+            });
+        }
+        const pathname = entryPathnameOf(target);
+        const canonicalFilePath = scheme === "file"
+            ? Namespace.canonicalizeSpelling(pathname, await this.#workspaceRoot(ctx.workspaceId))
+            : pathname;
+        return {
+            target,
+            lineMarker,
+            scheme,
+            pathname,
+            identityPathname: canonicalFilePath ?? pathname,
+            channel,
+            manifest,
+        };
+    }
+    async #selectSource(selection, ctx) {
+        const read = await this.#readEntry(selection.scheme, selection.pathname, ctx);
+        if (read.status >= 400)
+            return read;
+        if (read.status !== 200 || read.entry === null) {
+            throw new InvalidOperationResultError(`The '${selection.scheme}' scheme returned status ${read.status} without a COPY/MOVE source entry.`);
+        }
+        const selected = read.entry.channels[selection.channel];
+        if (selected === undefined) {
+            return _a.#failure("channel-not-found", 404, `No channel named #${selection.channel} exists at ${renderAddress(selection.scheme, selection.identityPathname)}.`, {}, {
+                target: renderAddress(selection.scheme, selection.identityPathname),
+                requestedChannel: selection.channel,
+                availableChannels: Object.keys(read.entry.channels),
+                retryable: false,
+            });
+        }
+        let content = selected.content;
+        let scopeNormalizations;
+        if (await MimetypeBinary.isBinaryMimetype(selected.mimetype, ctx.mimetypes)) {
+            return _a.#failure("binary-source-unsupported", 415, `Channel #${selection.channel} is a binary marker and cannot be copied or moved.`, {}, {
+                channel: selection.channel,
+                mimetype: selected.mimetype,
+                recovery: "Use a source with a readable text projection.",
+                retryable: false,
+            });
+        }
+        if (selection.lineMarker !== null) {
+            const sliced = LineMarkerOps.sliceLinesRaw(content, selection.lineMarker);
+            if (sliced.status !== 200)
+                return Results.assert(sliced);
+            content = sliced.text ?? "";
+            scopeNormalizations = sliced.scopeNormalizations;
+        }
+        return {
+            ...selection,
+            content,
+            mimetype: selected.mimetype,
+            ...(scopeNormalizations === undefined ? {} : { scopeNormalizations }),
+        };
+    }
+    static #prependScopeNormalizations(result, scopeNormalizations) {
+        if (scopeNormalizations === undefined)
+            return result;
+        return Results.assert({
+            ...result,
+            scopeNormalizations: [
+                ...scopeNormalizations,
+                ...(result.scopeNormalizations ?? []),
+            ],
+        });
+    }
+    #resourceAddress(selection) {
+        const address = renderTarget({
+            scheme: selection.scheme === "file" ? null : selection.scheme,
+            pathname: selection.scheme === "file"
+                ? selection.identityPathname.replace(/^\//, "")
+                : selection.identityPathname,
+            fragment: selection.channel === selection.manifest.defaultChannel
+                ? null
+                : selection.channel,
+        });
+        if (address === null)
+            throw new Error("resolved resource selection has no renderable address");
+        return address;
+    }
+    #pendingEffect(selection, action) {
+        return {
+            target: this.#resourceAddress(selection),
+            action,
+        };
+    }
+    static #appliedEffects(result, pending) {
+        // {§edit-result-copy-move-effects} — only an applied mutation earns
+        // engine-composed effects; native scheme receipts remain internal input.
+        const exact = Results.assert(result);
+        if (exact.status === 304 || exact.status === 202 || exact.status >= 300)
+            return exact;
+        if (exact.effects !== undefined) {
+            throw new InvalidOperationResultError("A COPY/MOVE mutation result supplied effects before engine composition.");
+        }
+        const batch = exact.editReceipt === undefined
+            ? undefined
+            : assertEditBatchReceipt(exact.editReceipt);
+        const single = batch === undefined && exact.receipt !== undefined
+            ? assertEditReceipt(exact.receipt)
+            : undefined;
+        const batchSize = batch === undefined
+            ? undefined
+            : "disposition" in batch
+                ? batch.superseded.length
+                : batch.effects.length;
+        if (batchSize !== undefined && batchSize !== pending.length) {
+            throw new InvalidOperationResultError(`COPY/MOVE expected ${pending.length} receipt projections, got ${batchSize}.`);
         }
-        const srcHandler = this.#schemes.get(srcSchemeName);
-        const dstHandler = this.#schemes.get(dstSchemeName);
-        if (srcHandler === undefined || dstHandler === undefined)
-            return { status: 501 };
-        const srcPathname = pathnameFromPath(srcPath);
-        const dstPathname = pathnameFromPath(dstPath);
-        const srcResult = await this.#readEntry(srcSchemeName, srcPathname, ctx);
-        if (srcResult.status !== 200 || srcResult.entry === null)
-            return { status: 404, error: `COPY/MOVE source not found: ${srcSchemeName}://${srcPathname}` }; // §copy-missing-source-404 §move-missing-source-404
-        const entry = srcResult.entry;
-        // Destination read — the conflict/no-op verdict is deferred until the
-        // to-be-written content is known (after <L> slice + tag resolution below),
-        // so an identical re-copy resolves to 304 instead of a phantom 409.
-        const dstExisting = await this.#readEntry(dstSchemeName, dstPathname, ctx);
-        // Mimetype compatibility check against the destination scheme's manifest
-        const dstManifest = dstHandler.constructor.manifest;
-        const dstChannels = dstManifest?.channels ?? {};
-        for (const [channelName, channelData] of Object.entries(entry.channels)) {
-            const expectedMimetype = dstChannels[channelName];
-            if (expectedMimetype !== undefined && expectedMimetype !== channelData.mimetype) {
-                return { status: 415, error: `mimetype mismatch on channel '${channelName}': ${channelData.mimetype} vs ${expectedMimetype}` }; // cross-mimetype COPY/MOVE → 415, never coerce — §channel-mimetype-cross-mimetype-415
+        if (single !== undefined && pending.length !== 1) {
+            throw new InvalidOperationResultError(`COPY/MOVE received one receipt for ${pending.length} resource effects.`);
+        }
+        let effects;
+        if (batch !== undefined && "disposition" in batch) {
+            const replacement = pending[0];
+            if (replacement === undefined) {
+                throw new InvalidOperationResultError("A reviewer-replaced COPY/MOVE batch has no resource effect.");
+            }
+            if (pending.some(({ target, action }) => target !== replacement.target || action !== replacement.action)) {
+                throw new InvalidOperationResultError("A reviewer-replaced COPY/MOVE batch spans incompatible resource effects.");
             }
+            effects = [{
+                    ...replacement,
+                    receipt: projectEditReceipt(batch, 0),
+                }];
         }
-        // `<L>` source range slicing per SPEC.md §op-invariants (symmetric with READ
-        // `<L>` — source range, no line-number prefix).
-        // Applied to every channel of the source entry. Binary channels return
-        // 415 since line semantics don't apply.
-        const lineMarker = statement.lineMarker ?? null;
-        let channels = entry.channels;
-        if (lineMarker !== null) {
-            const sliced = {};
-            for (const [channelName, channelData] of Object.entries(entry.channels)) {
-                if (MimetypeBinary.isBinaryMimetype(channelData.mimetype)) {
-                    return { status: 415, error: `cannot slice <L> on binary channel '${channelName}' (${channelData.mimetype})` };
+        else {
+            effects = pending.map((effect, index) => ({
+                ...effect,
+                ...(batch !== undefined
+                    ? { receipt: projectEditReceipt(batch, index) }
+                    : single !== undefined
+                        ? { receipt: single }
+                        : {}),
+            }));
+        }
+        assertResourceEffects(effects);
+        const { editReceipt: _editReceipt, receipt: _receipt, ...withoutInternalReceipts } = exact;
+        return {
+            ...withoutInternalReceipts,
+            effects,
+        };
+    }
+    // {§copy-move-observation} {§edit-result-copy-move-effects} — scoped
+    // COPY/MOVE into an unscoped channel is a text materialization even when
+    // CRUD creates the channel wholesale. Carry the receipt through synchronous
+    // writes and proposals; the destination scheme owns reviewed output.
+    static #withEditMaterialization(result, receipt) {
+        const exact = Results.assert(result);
+        if (exact.status !== 200 && exact.status !== 201 && exact.status !== 202)
+            return exact;
+        const materialized = exact.editReceipt === undefined
+            ? assertEditBatchReceipt(receipt)
+            : assertEditBatchReceipt(exact.editReceipt);
+        return {
+            ...exact,
+            editReceipt: materialized,
+            ...(exact.status === 202
+                ? {
+                    attrs: {
+                        ...exact.attrs,
+                        editReceipt: materialized,
+                    },
                 }
-                const r = LineMarkerOps.sliceLinesRaw(channelData.content ?? "", lineMarker);
-                if (r.status !== 200)
-                    return { status: r.status, error: r.error };
-                sliced[channelName] = { ...channelData, content: r.text ?? "" };
+                : {}),
+        };
+    }
+    #finalizeEffects(result, selection, pending) {
+        const routed = this.#withProposalRoute(result, selection);
+        if (routed.status !== 202)
+            return _a.#appliedEffects(routed, pending);
+        return {
+            ...routed,
+            attrs: {
+                ...routed.attrs,
+                proposalEffects: pending,
+            },
+        };
+    }
+    static #effectsOf(result) {
+        return result.effects === undefined
+            ? []
+            : assertResourceEffects(result.effects);
+    }
+    static #withCombinedEffects(result, ...additional) {
+        const existing = _a.#effectsOf(result);
+        const effects = [...existing, ...additional.flat()];
+        const { effects: _effects, ...withoutEffects } = result;
+        return effects.length === 0
+            ? withoutEffects
+            : { ...withoutEffects, effects: assertResourceEffects(effects) };
+    }
+    static #settleProposalEffects(original, settlement) {
+        const pending = original.attrs
+            ?.proposalEffects;
+        if (pending === undefined
+            || settlement.resolution.decision !== "accept"
+            || settlement.applied === undefined
+            || settlement.applied.status >= 300) {
+            return settlement;
+        }
+        const projected = settlement.resolution.result ?? {};
+        const aggregate = settlement.applied.editReceipt;
+        const applied = _a.#appliedEffects({
+            ...projected,
+            status: settlement.applied.status,
+            ...(aggregate === undefined ? {} : { editReceipt: aggregate }),
+        }, pending);
+        const { status: _status, body: _body, ...result } = applied;
+        const { body: _resolutionBody, ...resolution } = settlement.resolution;
+        return {
+            ...settlement,
+            resolution: {
+                ...resolution,
+                result,
+            },
+        };
+    }
+    #recordEditSettlement(statement, settlement) {
+        if (statement.op !== "EDIT")
+            return;
+        const prepared = this.#preparedEdits.get(statement);
+        if (prepared === undefined || !prepared.first) {
+            throw new InvalidOperationResultError("An EDIT proposal settled without its prepared batch owner.");
+        }
+        const { resolution, applied } = settlement;
+        if (resolution.decision !== "accept"
+            || applied === undefined
+            || applied.status >= 300) {
+            prepared.batch.aggregate = undefined;
+            return;
+        }
+        if (applied.editReceipt === null) {
+            prepared.batch.aggregate = undefined;
+            return;
+        }
+        if (applied.editReceipt !== undefined) {
+            prepared.batch.aggregate = assertEditBatchReceipt(applied.editReceipt);
+            return;
+        }
+        if (resolution.body !== undefined)
+            prepared.batch.aggregate = undefined;
+    }
+    static #settlementEffects(settlement) {
+        const effects = settlement.resolution.result
+            ?.effects;
+        return effects === undefined ? [] : assertResourceEffects(effects);
+    }
+    static #withSettlementEffects(settlement, effects) {
+        const projected = (settlement.resolution.result ?? {});
+        const { effects: _effects, ...withoutEffects } = projected;
+        const result = effects.length === 0
+            ? withoutEffects
+            : {
+                ...withoutEffects,
+                effects: assertResourceEffects(effects),
+            };
+        return {
+            ...settlement,
+            resolution: {
+                ...settlement.resolution,
+                result,
+            },
+        };
+    }
+    #sameChannel(left, right) {
+        return left.scheme === right.scheme
+            && left.identityPathname === right.identityPathname
+            && left.channel === right.channel;
+    }
+    #withProposalRoute(result, selection) {
+        if (result.status !== 202)
+            return result;
+        return {
+            ...result,
+            attrs: {
+                ...result.attrs,
+                proposalScheme: selection.scheme,
+                proposalTarget: {
+                    scheme: selection.scheme,
+                    pathname: selection.identityPathname,
+                },
+            },
+        };
+    }
+    async #invokeEditBatch(selection, edits, ctx) {
+        const handler = this.#schemes.get(selection.scheme);
+        if (typeof handler?.editBatch !== "function") {
+            return _a.#failure("operation-not-implemented", 501, `Scheme '${selection.scheme}' does not implement EDIT batches.`, {}, {
+                scheme: selection.scheme,
+                operation: "EDIT",
+                retryable: false,
+            });
+        }
+        const statements = edits.map(({ marker, body, tags, position }) => ({
+            op: "EDIT",
+            suffix: "",
+            signal: tags,
+            target: selection.target,
+            lineMarker: marker,
+            body,
+            position,
+        }));
+        const addressedScheme = selection.target.kind === "url"
+            ? selection.target.scheme
+            : selection.scheme;
+        try {
+            const result = Results.assert(await handler.editBatch(statements, new SchemeCtxImpl(ctx, addressedScheme, selection.manifest, this.#liveSubscriptions)));
+            return this.#withProposalRoute(result, selection);
+        }
+        catch (err) {
+            if (err instanceof InvalidOperationResultError)
+                throw err;
+            console.error(`Scheme '${selection.scheme}' COPY/MOVE edit threw outside its operation result contract:`, err);
+            return _a.#failure("scheme-handler-threw", 500, `The '${selection.scheme}' scheme did not produce a COPY/MOVE edit result.`, {}, {
+                stage: "scheme-dispatch",
+                scheme: selection.scheme,
+                operation: "EDIT",
+            });
+        }
+    }
+    async #writeDestination(statement, source, destination, ctx) {
+        const existingResult = await this.#readEntry(destination.scheme, destination.pathname, ctx);
+        if (existingResult.status >= 400 && existingResult.status !== 404) {
+            return existingResult;
+        }
+        const existing = existingResult.status === 200
+            ? existingResult.entry
+            : null;
+        if (existingResult.status === 200 && existing === null) {
+            throw new InvalidOperationResultError(`The '${destination.scheme}' scheme returned 200 without a destination entry.`);
+        }
+        const destinationChannel = existing?.channels[destination.channel];
+        const expectedMimetype = destinationChannel?.mimetype
+            ?? await PathMimetype.resolveEntryMimetype(destination.pathname, destination.manifest.channels[destination.channel] ?? source.mimetype, ctx.mimetypes);
+        if (source.mimetype !== expectedMimetype) {
+            return _a.#failure("mimetype-mismatch", 415, `COPY or MOVE cannot write '${source.mimetype}' into a '${expectedMimetype}' channel.`, {}, {
+                channel: destination.channel,
+                sourceMimetype: source.mimetype,
+                destinationMimetype: expectedMimetype,
+                retryable: false,
+            });
+        }
+        const tags = Array.isArray(statement.signal) ? statement.signal : [];
+        const destinationEffect = this.#pendingEffect(destination, destinationChannel === undefined ? "create" : "update");
+        if (destination.lineMarker !== null) {
+            if (destinationChannel === undefined) {
+                return _a.#failure("destination-region-not-found", 404, `A destination region requires an existing #${destination.channel} channel.`, {}, {
+                    destination: this.#resourceAddress(destination),
+                    retryable: false,
+                });
+            }
+            if (await MimetypeBinary.isBinaryMimetype(destinationChannel.mimetype, ctx.mimetypes)) {
+                return _a.#failure("binary-region-unsupported", 415, `Channel #${destination.channel} is binary and cannot receive a textual region.`, {}, {
+                    channel: destination.channel,
+                    mimetype: destinationChannel.mimetype,
+                    retryable: false,
+                });
             }
-            channels = sliced;
-        }
-        // Tag resolution: signal = replace (§copy-signal-replaces-source-tags); absent/empty = carry from source (§copy-no-signal-carries-source-tags)
-        const tags = (Array.isArray(statement.signal) && statement.signal.length > 0)
-            ? statement.signal
-            : entry.tags;
-        // 304/409 on an existing destination (SPEC §copy): a re-copy that would write
-        // exactly what's already there — same channel contents, same tags — is a no-op
-        // (304), mirroring EDIT's 304-on-noop (§edit). A divergent destination is a real
-        // collision (409); COPY/MOVE never clobbers.
-        if (dstExisting !== null && dstExisting.status === 200 && dstExisting.entry !== null) {
-            const dstChannels = dstExisting.entry.channels;
-            const writeNames = Object.keys(channels).sort();
-            const dstNames = Object.keys(dstChannels).sort();
-            const sameContent = writeNames.length === dstNames.length
-                && writeNames.every((n, i) => n === dstNames[i] && (channels[n]?.content ?? "") === (dstChannels[n]?.content ?? ""));
-            const sameTags = [...tags].sort().join("") === [...dstExisting.entry.tags].sort().join("");
-            if (sameContent && sameTags)
-                return { status: 304 }; // identical → §copy-noop-304
-            return { status: 409, error: `COPY/MOVE destination exists: ${dstSchemeName}://${dstPathname}` }; // §copy-conflict-409
-        }
-        const writeResult = await this.#writeEntry(dstSchemeName, dstPathname, { channels, tags }, ctx);
-        // A file dest returns 202 (disk write → §membership review): propagate the
-        // proposal so dispatch runs the gate + routes applyResolution to the dest.
-        if (writeResult.status === 202)
-            return { status: 202, attrs: writeResult.attrs, body: writeResult.body };
-        return { status: writeResult.status, entryId: writeResult.entryId, created: writeResult.created };
-    }
-    // §send-premature-terminate — the unified PENDING SET, judged at the terminal's OWN dispatch
+            const edited = await this.#invokeEditBatch(destination, [{
+                    marker: destination.lineMarker,
+                    body: source.content,
+                    tags,
+                    position: statement.position,
+                }], ctx);
+            return this.#finalizeEffects(edited, destination, [destinationEffect]);
+        }
+        if (destinationChannel !== undefined
+            && destinationChannel.content !== source.content) {
+            return _a.#failure("copy-destination-exists", 409, `COPY or MOVE destination ${this.#resourceAddress(destination)} already contains different content.`, {}, {
+                destination: this.#resourceAddress(destination),
+                retryable: false,
+            });
+        }
+        const priorTags = existing?.tags ?? [];
+        const mergedTags = [...new Set([...priorTags, ...tags])];
+        const addsTags = mergedTags.length !== priorTags.length;
+        if (destinationChannel !== undefined && !addsTags)
+            return { status: 304 };
+        const channels = {
+            ...(existing?.channels ?? {}),
+            [destination.channel]: {
+                content: source.content,
+                mimetype: source.mimetype,
+            },
+        };
+        const written = await this.#writeEntry(destination.scheme, destination.pathname, { channels, tags: mergedTags }, ctx);
+        const exactWritten = Results.assert(written);
+        const materialized = source.lineMarker === null
+            || (exactWritten.status !== 200 && exactWritten.status !== 201 && exactWritten.status !== 202)
+            ? exactWritten
+            : _a.#withEditMaterialization(exactWritten, editReceipt(destinationChannel?.content ?? "", source.content, [{
+                    marker: { marks: [1, -1] },
+                    body: source.content,
+                }]));
+        return this.#finalizeEffects(materialized, destination, [destinationEffect]);
+    }
+    async #copyOrchestration({ statement, source, destination, ctx, }) {
+        const resolvedSource = await this.#resolveResourceSelection(source, ctx);
+        if (_a.#isDispatchResult(resolvedSource))
+            return resolvedSource;
+        const resolvedDestination = await this.#resolveResourceSelection(destination, ctx);
+        if (_a.#isDispatchResult(resolvedDestination))
+            return resolvedDestination;
+        const selected = await this.#selectSource(resolvedSource, ctx);
+        if (_a.#isDispatchResult(selected))
+            return selected;
+        const result = await this.#writeDestination(statement, selected, resolvedDestination, ctx);
+        return _a.#prependScopeNormalizations(result, selected.scopeNormalizations);
+    }
+    #deferredMoveSource(source, destination) {
+        return {
+            target: source.target,
+            lineMarker: source.lineMarker,
+            scheme: source.scheme,
+            pathname: source.pathname,
+            channel: source.channel,
+            destination: this.#resourceAddress(destination),
+        };
+    }
+    #moveFailureAfterDestination(result, destination, destinationEffects) {
+        const exact = Results.assert(result);
+        if (exact.status < 400) {
+            throw new InvalidOperationResultError("A successful MOVE source result was classified as a partial failure.");
+        }
+        if (exact.problem === undefined) {
+            throw new InvalidOperationResultError("A failed MOVE source mutation has no Problem Details.");
+        }
+        const failed = Results.assert({
+            ...exact,
+            problem: {
+                ...exact.problem,
+                operation: "MOVE",
+                destinationWritten: true,
+                destination,
+            },
+        });
+        return _a.#withCombinedEffects(failed, destinationEffects);
+    }
+    async #removeMoveSource(statement, source, ctx) {
+        const effect = this.#pendingEffect(source, source.lineMarker === null ? "delete" : "update");
+        if (source.lineMarker === null) {
+            const deleted = await this.#deleteChannel(source.scheme, source.pathname, source.channel, ctx);
+            return this.#finalizeEffects(Results.assert(deleted), source, [effect]);
+        }
+        const edited = await this.#invokeEditBatch(source, [{
+                marker: source.lineMarker,
+                body: "",
+                tags: null,
+                position: statement.position,
+            }], ctx);
+        return this.#finalizeEffects(edited, source, [effect]);
+    }
+    async #moveWithinChannel(statement, source, destination, ctx) {
+        if (source.lineMarker === null) {
+            if (destination.lineMarker !== null) {
+                return _a.#failure("move-region-overlap", 409, "MOVE cannot insert a whole channel into itself and then remove that channel.", {}, {
+                    source: this.#resourceAddress(source),
+                    destination: this.#resourceAddress(destination),
+                    retryable: false,
+                });
+            }
+            return this.#writeDestination(statement, source, destination, ctx);
+        }
+        if (destination.lineMarker === null) {
+            return this.#writeDestination(statement, source, destination, ctx);
+        }
+        const moved = await this.#invokeEditBatch(destination, [
+            {
+                marker: destination.lineMarker,
+                body: source.content,
+                tags: Array.isArray(statement.signal) ? statement.signal : [],
+                position: statement.position,
+            },
+            {
+                marker: source.lineMarker,
+                body: "",
+                tags: null,
+                position: statement.position,
+            },
+        ], ctx);
+        const effect = this.#pendingEffect(destination, "update");
+        return this.#finalizeEffects(moved, destination, [effect, effect]);
+    }
+    async #moveOrchestration({ statement, source, destination, ctx, }) {
+        const resolvedSource = await this.#resolveResourceSelection(source, ctx);
+        if (_a.#isDispatchResult(resolvedSource))
+            return resolvedSource;
+        const resolvedDestination = await this.#resolveResourceSelection(destination, ctx);
+        if (_a.#isDispatchResult(resolvedDestination))
+            return resolvedDestination;
+        const selected = await this.#selectSource(resolvedSource, ctx);
+        if (_a.#isDispatchResult(selected))
+            return selected;
+        if (this.#sameChannel(resolvedSource, resolvedDestination)) {
+            const result = await this.#moveWithinChannel(statement, selected, resolvedDestination, ctx);
+            return resolvedDestination.lineMarker === null
+                ? _a.#prependScopeNormalizations(result, selected.scopeNormalizations)
+                : result;
+        }
+        const destinationResult = _a.#prependScopeNormalizations(await this.#writeDestination(statement, selected, resolvedDestination, ctx), selected.scopeNormalizations);
+        if (destinationResult.status >= 400)
+            return destinationResult;
+        const destinationAddress = this.#resourceAddress(resolvedDestination);
+        const destinationEffects = _a.#effectsOf(destinationResult);
+        if (destinationResult.status === 202) {
+            return {
+                ...destinationResult,
+                attrs: {
+                    ...destinationResult.attrs,
+                    moveSource: this.#deferredMoveSource(resolvedSource, resolvedDestination),
+                },
+            };
+        }
+        const sourceResult = await this.#removeMoveSource(statement, resolvedSource, ctx);
+        if (sourceResult.status === 202) {
+            return {
+                ...sourceResult,
+                ...(destinationResult.scopeNormalizations === undefined
+                    ? {}
+                    : { scopeNormalizations: destinationResult.scopeNormalizations }),
+                attrs: {
+                    ...sourceResult.attrs,
+                    moveDestinationWritten: destinationAddress,
+                    moveDestinationEffects: destinationEffects,
+                },
+            };
+        }
+        if (sourceResult.status >= 400) {
+            return this.#moveFailureAfterDestination(destinationResult.scopeNormalizations === undefined
+                ? sourceResult
+                : Results.assert({
+                    ...sourceResult,
+                    scopeNormalizations: destinationResult.scopeNormalizations,
+                }), destinationAddress, destinationEffects);
+        }
+        const base = destinationResult.status === 304
+            ? { ...destinationResult, status: 200 }
+            : destinationResult;
+        return _a.#withCombinedEffects(base, _a.#effectsOf(sourceResult));
+    }
+    async #settleMoveProposal({ statement, result, settlement, ctx, ids, }) {
+        if (statement.op !== "MOVE")
+            return settlement;
+        const attrs = result.attrs;
+        const destinationWritten = attrs?.moveDestinationWritten;
+        if (destinationWritten !== undefined) {
+            const destinationEffects = attrs?.moveDestinationEffects === undefined
+                ? []
+                : assertResourceEffects(attrs.moveDestinationEffects);
+            if (settlement.resolution.decision !== "accept") {
+                const decision = settlement.resolution.decision;
+                return {
+                    resolution: settlement.resolution,
+                    applied: this.#moveFailureAfterDestination(_a.#failure("move-source-not-applied", decision === "cancel" ? 499 : 409, `The MOVE destination was written, but source removal was ${decision === "cancel" ? "cancelled" : "rejected"}.`, {}, {
+                        retryable: false,
+                    }), destinationWritten, destinationEffects),
+                };
+            }
+            if (settlement.applied === undefined) {
+                return {
+                    resolution: settlement.resolution,
+                    applied: this.#moveFailureAfterDestination(_a.#failure("proposal-apply-missing", 500, "The source scheme accepted its MOVE proposal without applying the source mutation.", {}, {
+                        stage: "proposal-application",
+                        retryable: false,
+                    }), destinationWritten, destinationEffects),
+                };
+            }
+            if (settlement.applied.status >= 400) {
+                return {
+                    resolution: settlement.resolution,
+                    applied: this.#moveFailureAfterDestination(settlement.applied, destinationWritten, destinationEffects),
+                };
+            }
+            return _a.#withSettlementEffects(settlement, [
+                ...destinationEffects,
+                ..._a.#settlementEffects(settlement),
+            ]);
+        }
+        const deferred = attrs?.moveSource;
+        if (deferred === undefined
+            || settlement.resolution.decision !== "accept"
+            || (settlement.applied?.status ?? 200) >= 400) {
+            return settlement;
+        }
+        if (settlement.applied === undefined) {
+            return {
+                resolution: settlement.resolution,
+                applied: _a.#failure("proposal-apply-missing", 500, "The destination scheme accepted its MOVE proposal without applying the destination mutation.", {}, {
+                    stage: "proposal-application",
+                    retryable: false,
+                }),
+            };
+        }
+        const destinationEffects = _a.#settlementEffects(settlement);
+        const resolvedSource = await this.#resolveResourceSelection({
+            target: deferred.target,
+            lineMarker: deferred.lineMarker,
+        }, ctx);
+        if (_a.#isDispatchResult(resolvedSource)) {
+            return {
+                resolution: settlement.resolution,
+                applied: this.#moveFailureAfterDestination(resolvedSource, deferred.destination, destinationEffects),
+            };
+        }
+        if (resolvedSource.scheme !== deferred.scheme
+            || resolvedSource.pathname !== deferred.pathname
+            || resolvedSource.channel !== deferred.channel) {
+            throw new InvalidOperationResultError("A deferred MOVE source no longer resolves to its recorded identity.");
+        }
+        const removed = await this.#removeMoveSource(statement, resolvedSource, ctx);
+        if (removed.status >= 400) {
+            return {
+                resolution: settlement.resolution,
+                applied: this.#moveFailureAfterDestination(removed, deferred.destination, destinationEffects),
+            };
+        }
+        if (removed.status !== 202) {
+            return _a.#withSettlementEffects(settlement, [
+                ...destinationEffects,
+                ..._a.#effectsOf(removed),
+            ]);
+        }
+        const initialSourceSettlement = await this.#proposals.workerApply(statement, removed, { decision: "accept" }, ids);
+        const sourceSettlement = _a.#settleProposalEffects(removed, initialSourceSettlement);
+        if (sourceSettlement.applied === undefined) {
+            return {
+                resolution: settlement.resolution,
+                applied: this.#moveFailureAfterDestination(_a.#failure("proposal-apply-missing", 500, "The source scheme accepted its MOVE proposal without applying the source mutation.", {}, {
+                    stage: "proposal-application",
+                    retryable: false,
+                }), deferred.destination, destinationEffects),
+            };
+        }
+        if (sourceSettlement.applied.status >= 400) {
+            return {
+                resolution: settlement.resolution,
+                applied: this.#moveFailureAfterDestination(sourceSettlement.applied, deferred.destination, destinationEffects),
+            };
+        }
+        return _a.#withSettlementEffects(settlement, [
+            ...destinationEffects,
+            ..._a.#settlementEffects(sourceSettlement),
+        ]);
+    }
+    // {§send-premature-terminate} — the unified PENDING SET, judged at the terminal's OWN dispatch
     // (post-batch: the emission's earlier ops already executed, so a same-turn KILL+[200] repairs in
     // ONE turn, and a same-turn WORK+[200] is caught — the spawn is live by the time the SEND lands).
     // pending = open streams ∪ live children ∪ THIS turn's retrievals (READ/FIND/OPEN, results unseen
-    // until next packet). One rule, one steer, one repair family: nothing pending may be silently
-    // discarded; 499 discards BY STATED INTENT and is never gated.
+    // until next packet). Failed operations are the separate next-packet leg shared by explicit
+    // completion and empty-join completion. Nothing pending may be silently discarded; 499 discards
+    // BY STATED INTENT and is never gated.
     async #pendingSet(workerId, turnId) {
         const pending = [];
         const openSubs = await this.#db.find_open_subscriptions_for_worker.all({ worker_id: workerId });
@@ -1046,7 +1867,7 @@ class Dispatcher {
             this.#db.engine_worker_has_undelivered_stream_term
                 .get({ worker_id: workerId }),
             this.#db.engine_worker_has_undelivered_child_term
-                .get({ worker_id: workerId, turn_id: turnId }),
+                .get({ worker_id: workerId }),
         ]);
         return {
             retrievals: retrievals.length > 0,
@@ -1054,8 +1875,24 @@ class Dispatcher {
             childTerminations: childTermination !== undefined,
         };
     }
+    // A failed operation is also an unobserved result: it does not enter the
+    // model's Log until the next packet. Both explicit completion and an
+    // already-drained join must cross that observation boundary before they
+    // can honestly finish the loop.
+    async #unobservedFailureCount(turnId) {
+        const failedRows = await this.#db.engine_turn_failures.all({ turn_id: turnId });
+        return failedRows.length;
+    }
+    static #unobservedFailures(failCount) {
+        return _a.#failure("unobserved-failures", 409, `Completion was refused because ${failCount} failed operation(s) from this turn have not been observed.`, {}, {
+            failures: failCount,
+            stage: "completion",
+            recovery: "Review the failed log items before concluding.",
+            retryable: false,
+        });
+    }
     // J — a live obligation to WAIT on: a spawned child or an open stream (NOT retrievals, which land
-    // next turn regardless). The wait-side twin of #pendingSet's stream+child legs (§wait-obligation-matrix).
+    // next turn regardless). The wait-side twin of #pendingSet's stream+child legs ({§wait-obligation-matrix}).
     async #hasLiveWork(workerId) {
         const openSubs = await this.#db.find_open_subscriptions_for_worker.all({ worker_id: workerId });
         if (openSubs.length > 0)
@@ -1071,40 +1908,42 @@ class Dispatcher {
             throw new Error("unreachable");
         const { workerId, loopId, turnId } = ctx;
         const status = statement.signal;
-        if (status === null)
-            return { status: 400 };
+        if (status === null) {
+            return _a.#failure("send-status-required", 400, "SEND requires a numeric status.", {}, { retryable: false });
+        }
         const raw = statement.body === null ? "" : typeof statement.body === "string" ? statement.body : statement.body.raw;
-        // [102]<T> — waiting is a mode of CONTINUING (grammar 0.75.0, the terminal redesign): park
-        // up to T seconds, woken early by any arrival (stream/child conclusion, irc, inject), woken
-        // at T regardless — a park ALWAYS has a next turn, so nothing can be orphaned. <-1> parks
-        // indefinitely (the butler/worker pattern — owner-ruled ungated; the instrumentation renders
-        // it legibly). Internally the parked state remains loops.status=202: the model-facing SIGNAL
-        // retired, the engine's park state did not.
-        // §join-blocking-collect (#354) — a READ(worker://running-child) this turn armed a join. A BARE
-        // continue becomes an indefinite PARK: the blocking collect, on the same park machinery <-1>
-        // uses. The armed READ said "I want this result"; parking IS the collect (the model never had
-        // to know the park syntax — the engine holds the join). Any SEND clears the per-turn arm; a
-        // terminal with a live child stays the existing premature-terminate steer (#354 decision #1).
+        // The park rides SEND[202] only ({§park-202-only}). A scoped SEND[102] is neither
+        // a wait nor a meaningful continuation, so reject it instead of preserving the
+        // retired dual spelling.
+        if (status === 102 && statement.lineMarker !== null) {
+            return _a.#failure("send-scope-invalid", 400, "SEND[102] does not accept a scope.", {}, {
+                requestedStatus: 102,
+                scope: statement.lineMarker,
+                recovery: "Use SEND[202] with a scope to wait, or remove the scope to continue.",
+                retryable: false,
+            });
+        }
+        // A bare continue after an armed running-worker READ becomes an
+        // indefinite park. {§join-blocking-collect}
         const joinArmed = this.#joinTargets.delete(loopId);
         if (status === 102 && statement.lineMarker === null && joinArmed) {
             if (!await this.#lifecycle.park(loopId, raw.length > 0 ? raw : "parked — awaiting a worker's result (blocking collect)")) {
-                return { status: await this.#lifecycle.status(loopId) };
+                return _a.#statusResult(await this.#lifecycle.status(loopId), "loop-already-terminal", "The loop was already terminal when SEND attempted to park it.");
             }
             this.#parkDeadlines.set(loopId, -1); // indefinite: the bounded child's terminal is the wake edge
             return { status: 102, attrs: { parked: -1, join: true } };
         }
-        // §wait-obligation-matrix — SEND[202] and the legacy SEND[102]<T> are one
-        // obligation-checked join. A live
+        // {§wait-obligation-matrix} — SEND[202] is the obligation-checked join. A live
         // obligation (a spawned child or open stream, J) BLOCKS the loop until it concludes and
-        // reawakens it (§worker-lifecycle-child-wake); a wait on nothing (∅) is already satisfied and
+        // reawakens it ({§worker-lifecycle-child-wake}); a wait on nothing (∅) is already satisfied and
         // resolves like 200, so <-1>+∅ self-resolves rather than hang the agent; a pending own
         // retrieval (R) just lands next turn, so the wait continues.
-        if (status === 202 || (status === 102 && statement.lineMarker !== null)) {
+        if (status === 202) {
             const marks = statement.lineMarker?.marks[0];
             const seconds = typeof marks === "number" ? marks : -1; // bare 202 / absent T = indefinite, bounded by the join
             if (await this.#hasLiveWork(workerId)) {
                 if (!await this.#lifecycle.park(loopId, raw.length > 0 ? raw : "waiting on live work")) {
-                    return { status: await this.#lifecycle.status(loopId) };
+                    return _a.#statusResult(await this.#lifecycle.status(loopId), "loop-already-terminal", "The loop was already terminal when SEND attempted to wait.");
                 }
                 this.#parkDeadlines.set(loopId, seconds);
                 return { status: 202, attrs: { waiting: seconds } };
@@ -1117,15 +1956,21 @@ class Dispatcher {
             if (observations.retrievals || observations.streamTerminations || observations.childTerminations) {
                 return { status: 102 };
             }
+            const failCount = await this.#unobservedFailureCount(turnId);
+            if (failCount > 0)
+                return _a.#unobservedFailures(failCount);
+            const branchDenial = await this.#branchCompletionGate?.(workerId) ?? null;
+            if (branchDenial !== null)
+                return branchDenial;
             // The joined set is already drained. Awaiting an empty task group completes
             // immediately; it never parks and needs no corrective model turn.
-            const finished = await this.#lifecycle.finish(loopId, 200, raw === "" ? null : raw);
+            const finished = await this.#lifecycle.finish(loopId, { status: 200 }, { message: raw === "" ? null : raw });
             return {
-                status: finished ? 200 : await this.#lifecycle.status(loopId),
+                status: finished !== null ? 200 : await this.#lifecycle.status(loopId),
                 attrs: { joined: true, pending: 0 },
             };
         }
-        // §send-300-choices — ask the operator and park (the answer returns via loop.inject).
+        // {§send-300-choices} — ask the operator and park (the answer returns via loop.inject).
         // The three-state cascade (owner design): PLURNK_QUESTIONS unset = ALLOWED (not enabled);
         // =0 = DENIED servicewide (a ceiling the client cannot override); ENABLED requires the
         // client to affirmatively pass it per workspace (settings.questions — the interactive client
@@ -1134,14 +1979,13 @@ class Dispatcher {
         // Disabled → refused with a self-decide steer, never a park into the void.
         if (status === 300) {
             if (!(await WorkspaceSettings.questionsEnabled(this.#db, ctx.workspaceId))) {
-                return { status: 409, error: "Operator asks ([300]) are not enabled in this environment — no one is watching to answer. Decide yourself and proceed: SEND[102] to continue, or [200] to conclude." };
+                return _a.#failure("operator-questions-disabled", 409, "Operator questions are disabled in this workspace.", {}, {
+                    recovery: "Decide from the available evidence and continue or conclude.",
+                    retryable: false,
+                });
             }
-            // Owner ruling (#346): the question rides the SAME proposal system as file edits and
-            // MCP auths — stop the world. Returning 202 here routes through the proposal seam
-            // (#isProposal admits signal-300 SENDs): loop/proposal carries {question, choices},
-            // loop.resolve's accept body IS the answer, and applyResolution writes it into the
-            // model-facing rx — the answer arrives as the result of the ask itself. Timeout is
-            // the standard §proposal-timeout-cancels. Zero options = an open question.
+            // {§send-300-choices} — return a proposal whose accepted body becomes
+            // the answer; zero choices denotes an open question.
             const parts = raw.split(";").map((x) => x.trim()).filter((x) => x.length > 0);
             const [question = "", ...choices] = parts;
             return { status: 202, attrs: choices.length > 0 ? { question, choices } : { question } };
@@ -1150,77 +1994,90 @@ class Dispatcher {
         // attempt faithfully (status_rx=409, never erased); the loop stays a continue; the strike
         // couples in runTurn. [499] abandons and cancels the descendant scope.
         if (status === 200) {
-            // §send-200-failed-ops (#363, owner ruling: never 200 over a failed op) — the failure
-            // twin of the pending set: this turn's failed op results (and this emission's parse
-            // errors, threaded — they mint as rows only after dispatch) are UNSEEN until the next
-            // packet, so concluding over them is concluding blind. Refused 409; next turn, the
-            // errors in-log and weighed, [200] stands. [499] below is never gated — declaring
-            // failure IS weighing it.
-            const failedRows = await this.#db.engine_turn_failures.all({ turn_id: turnId });
-            const failCount = failedRows.length + (ctx.turnParseErrors ?? 0);
-            if (failCount > 0) {
-                return { status: 409, error: `Termination attempted despite ${failCount} failed operation(s) this turn. The errors land in your log next turn — weigh them, then conclude (or SEND[499] to abandon).` };
-            }
+            // {§send-premature-terminate} — same-turn failures are unobserved
+            // pending results and therefore refuse completion.
+            const failCount = await this.#unobservedFailureCount(turnId);
+            if (failCount > 0)
+                return _a.#unobservedFailures(failCount);
             const pending = await this.#pendingSet(workerId, turnId);
             if (pending.length > 0) {
-                // Kind-specific steer (owner wording, xpath/topo forensics): retrievals-only is
-                // gemma's read-and-conclude idiom — no lever to pull, the results simply arrive;
-                // KILL/park advice only muddies it. Streams/children keep the remedy steer.
+                // A retrieval-only refusal needs no KILL/park remedy menu: the results simply
+                // arrive in the next packet. Streams and children retain their remedy steer.
                 const retrievalsOnly = pending.every((k) => k.startsWith("this turn's retrieval results"));
                 if (retrievalsOnly) {
-                    // attrs.retrievalOnly — the strike decoupler (owner ruling): atomic-turn-
-                    // pretrained models pair fetch-and-answer by habit; the refusal teaches,
-                    // the strike executed. Engine reads this to skip the strike.
-                    // #384 (owner wording, run48 requiem) — three lessons in one steer: it narrates
-                    // "last turn" as HISTORY (the model reads log rows in the third person and never
-                    // took "you"-steers as self-addressed), states the mechanism as law (retrievals
-                    // FORCE an additional turn — not blame, physics), and prescribes the concluding
-                    // emission's legal SHAPE (PLAN + SEND[200] only — no room for the justify-READ
-                    // that re-armed this gate four times while she held the correct answer).
-                    return { status: 409, error: "Last turn both performed retrieval operations and attempted to terminate. Retrieval operations force an additional turn to receive results for review and reaction. To conclude, only use PLAN and SEND[200] operations.", attrs: { retrievalOnly: true } };
+                    return _a.#failure("retrieval-results-unobserved", 409, "Last turn both performed retrieval operations and attempted to terminate. Retrieval operations force an additional turn so their results can be reviewed.", {}, {
+                        pending: [...pending],
+                        stage: "completion",
+                        recovery: "Review the results, then use only PLAN and SEND[200] to conclude.",
+                        retryable: false,
+                    });
                 }
-                return { status: 409, error: `Attempted [200] termination in a turn that performs retrieval or has surviving work: ${pending.join("; ")}. KILL what you no longer need; SEND[102] (or [102]<seconds>) to receive the rest; then conclude.` };
+                return _a.#failure("work-remains", 409, `Completion was refused while work remains: ${pending.join("; ")}.`, {}, {
+                    pending: [...pending],
+                    stage: "completion",
+                    recovery: "Resolve the listed pending work before concluding.",
+                    retryable: false,
+                });
             }
-            const finished = await this.#lifecycle.finish(loopId, 200, raw === "" ? null : raw);
-            return { status: finished ? 200 : await this.#lifecycle.status(loopId) };
+            const branchDenial = await this.#branchCompletionGate?.(workerId) ?? null;
+            if (branchDenial !== null)
+                return branchDenial;
+            const finished = await this.#lifecycle.finish(loopId, { status: 200 }, { message: raw === "" ? null : raw });
+            return _a.#statusResult(finished !== null ? 200 : await this.#lifecycle.status(loopId), "loop-already-terminal", "The loop was already terminal when SEND attempted to conclude it.");
         }
         if (status === 499) {
-            const finished = await this.#lifecycle.finish(loopId, 499, raw === "" ? null : raw);
-            if (!finished)
-                return { status: await this.#lifecycle.status(loopId) };
+            const branchDenial = await this.#branchCompletionGate?.(workerId) ?? null;
+            if (branchDenial !== null)
+                return branchDenial;
+            const failure = _a.#failure("scope-abandoned", 499, raw === "" ? "The worker abandoned its scope." : raw);
+            const seqs = await this.#db.engine_loop_turn_seqs.get({
+                loop_id: loopId,
+                turn_id: turnId,
+            });
+            if (seqs === undefined) {
+                throw new Error(`SEND[499]: no coordinate for loop=${loopId} turn=${turnId}`);
+            }
+            Results.attachInstance(failure, `log:///${seqs.loop_seq}/${seqs.turn_seq}/${ctx.sequence}/SEND`);
+            const finished = await this.#lifecycle.finish(loopId, failure);
+            if (finished === null)
+                return _a.#statusResult(await this.#lifecycle.status(loopId), "loop-already-terminal", "The loop was already terminal when SEND attempted to abandon it.");
             await this.#cancelDescendants?.(workerId, raw === "" ? "parent abandoned its scope" : raw);
-            return { status: 499 };
+            return failure;
         }
         // Every other signal — 102 bare, 202 (retired as a terminal; now ordinary mid-comms), 1xx —
         // is a plain broadcast row: no loop transition.
-        return { status };
+        return _a.#statusResult(status, "send-broadcast-failed", raw === "" ? `SEND broadcast reported status ${status}.` : raw);
     }
     async #run(schemeName, statement, ctx) {
-        if (schemeName === null)
-            return { status: 400 };
+        if (schemeName === null) {
+            return _a.#failure("target-scheme-required", 400, `${statement.op} requires a target scheme.`, {}, { operation: statement.op, retryable: false });
+        }
         if (statement.op === "SEND" && statement.signal === 499 && statement.target?.kind === "url") {
+            const addressedScheme = statement.target.scheme;
             const entry = await this.#db.crud_find_workspace_entry.get({
                 workspace_id: ctx.workspaceId,
                 owner_id: await Owner.commonsId(this.#db, ctx.workspaceId),
-                scheme: schemeName,
-                pathname: pathnameFromPath(statement.target),
+                scheme: addressedScheme,
+                pathname: entryPathnameOf(statement.target),
             });
             if (entry !== undefined) {
                 const subscription = await ChannelWrite.findActiveSubscription(this.#db, {
                     workerId: ctx.workerId,
                     entryId: entry.id,
                 });
-                if (subscription !== null && subscription.scheme === schemeName) {
+                if (subscription !== null && subscription.scheme === addressedScheme) {
                     const cancelled = await this.#liveSubscriptions.cancel(subscription.id);
-                    return cancelled
-                        ? { status: 200 }
-                        : { status: 500, error: `subscription ${subscription.id} is durable but has no live cancellation handle` };
+                    if (!cancelled) {
+                        throw new InvalidOperationResultError(`Subscription ${subscription.id} is durable but has no live cancellation handle.`);
+                    }
+                    return { status: 200 };
                 }
             }
         }
         const handler = this.#schemes.get(schemeName);
-        if (handler === undefined)
-            return { status: 501 };
+        if (handler === undefined) {
+            return _a.#failure("scheme-not-found", 501, `Scheme '${schemeName}' is not registered.`, {}, { scheme: schemeName, retryable: false });
+        }
         const methodName = statement.op.toLowerCase();
         const method = handler[methodName];
         const addressedScheme = statement.target?.kind === "url" ? statement.target.scheme : null;
@@ -1229,26 +2086,45 @@ class Dispatcher {
             throw new Error(`scheme '${schemeName}' has no manifest`);
         const schemeCtx = new SchemeCtxImpl(ctx, addressedScheme ?? schemeName, manifest, this.#liveSubscriptions);
         if (typeof method === "function")
-            return method.call(handler, statement, schemeCtx);
-        if (statement.op !== "FIND" || manifest.category !== "data")
-            return { status: 501 };
+            return Results.assert(await method.call(handler, statement, schemeCtx));
+        if (statement.op !== "FIND" || manifest.category !== "data") {
+            return _a.#failure("operation-not-implemented", 501, `Scheme '${schemeName}' does not implement ${statement.op}.`, {}, {
+                scheme: schemeName,
+                operation: statement.op,
+                retryable: false,
+            });
+        }
         const prepareFind = handler.prepareFind;
         if (typeof prepareFind === "function") {
             const prepared = await prepareFind.call(handler, statement, schemeCtx);
             if (prepared.status >= 300)
-                return prepared;
+                return Results.assert(prepared);
         }
-        return schemeCtx.entries.operations.find(statement);
+        return Results.assert(await schemeCtx.entries.operations.find(statement));
     }
-    // A status-202 result is a reviewable PROPOSAL (a side-effecting op — EDIT/EXEC/
-    // directed write — paused for client resolution) UNLESS it is a broadcast SEND.
-    // A broadcast SEND[202] is the model PARKING the loop (a terminal disposition,
-    // plurnk.md), never a side-effect — #255: gating the propose/await path on the
-    // bare 202 surfaced model speech as a loop/proposal and froze clients. The 202
-    // is overloaded (proposal-pause vs parked-terminal); the op disambiguates it.
+    async #runLogCuration(statement, ctx) {
+        const addressedScheme = schemeNameOf(statement.target);
+        if (addressedScheme !== null && addressedScheme !== "log") {
+            return _a.#failure("operation-not-implemented", 501, `Scheme '${addressedScheme}' does not implement ${statement.op}.`, {}, {
+                scheme: addressedScheme,
+                operation: statement.op,
+                retryable: false,
+            });
+        }
+        const handler = this.#schemes.get("log");
+        const manifest = this.#schemes.manifestFor("log");
+        if (handler === undefined || manifest === undefined) {
+            throw new Error("the core log curation owner is not registered");
+        }
+        const schemeCtx = new SchemeCtxImpl(ctx, "log", manifest, this.#liveSubscriptions);
+        return statement.op === "OPEN"
+            ? Results.assert(await handler.open(statement, schemeCtx))
+            : Results.assert(await handler.fold(statement, schemeCtx));
+    }
+    // {§proposal}/{§send} — status 202 is a proposal except for broadcast
+    // SEND[202], which parks the loop. The operation disambiguates the status.
     static #isProposal(statement, result) {
-        // A broadcast SEND park is model speech, not a proposal (#255) — EXCEPT a [300] question,
-        // which IS a proposal by owner ruling (#346: the same stop-the-world system as file edits).
+        // {§send-300-choices} — SEND[300] is the proposal exception.
         if (result.status !== 202)
             return false;
         if (statement.op === "SEND" && statement.signal === 300)
@@ -1256,21 +2132,39 @@ class Dispatcher {
         return !(statement.op === "SEND" && statement.target === null);
     }
     async #writeLog({ statement, result, workspaceId, workerId, loopId, turnId, sequence, origin, }) {
-        const target = this.#extractTarget(statement.target);
-        await this.#canonColumns(target, workspaceId); // {§fs-answer-in-canon} — columns speak canon; tx below stays verbatim
-        const lineMarkerJson = "lineMarker" in statement && statement.lineMarker !== null
-            ? JSON.stringify(statement.lineMarker)
+        const durableStatement = DurableStatement.project(statement);
+        const target = this.#extractTarget(durableStatement.target);
+        await this.#canonColumns(target, workspaceId); // {§fs-answer-in-canon}
+        const lineMarkerJson = "lineMarker" in durableStatement && durableStatement.lineMarker !== null
+            ? JSON.stringify(durableStatement.lineMarker)
             : null;
         // A proposal (status 202 from a side-effecting op) is written to the log in
         // state='proposed' until the proposal lifecycle resolves it; attrs holds the
         // scheme-supplied payload (file diff, exec command, etc.) the client renders
         // for review and the scheme consumes on accept. A broadcast SEND[202] is a
-        // parked-terminal, NOT a proposal (#isProposal / #255) → state='resolved'.
+        // parked-terminal, not a proposal (#isProposal) → state='resolved'.
         const isProposed = _a.#isProposal(statement, result);
         let attrsObj = (result.attrs !== undefined && result.attrs !== null)
             ? { ...result.attrs }
             : {};
-        // EXEC produces a stream entry addressed by RUNTIME TAG as authority (§exec): it lives
+        const seqs = statement.op === "EXEC" || result.problem !== undefined
+            ? await this.#db.engine_loop_turn_seqs.get({
+                loop_id: loopId,
+                turn_id: turnId,
+            })
+            : undefined;
+        if ((statement.op === "EXEC" || result.problem !== undefined) && seqs === undefined) {
+            throw new Error(`Dispatcher.#writeLog: loop_turn_seqs returned no row for loop=${loopId} turn=${turnId}`);
+        }
+        if (statement.op === "READ")
+            Results.assertReadResult(result);
+        if (result.problem !== undefined && seqs !== undefined) {
+            Results.attachInstance(result, `log:///${seqs.loop_seq}/${seqs.turn_seq}/${sequence}/${statement.op}`);
+        }
+        else {
+            Results.assert(result);
+        }
+        // EXEC produces a stream entry addressed by RUNTIME TAG as authority ({§exec}): it lives
         // at <runtime>:///<loop_seq>/<turn_seq>/<sequence> (e.g. sh:///1/1/2). That address is a
         // SEPARATE `stream` link in attrs — NOT an overload of `target`, which stays faithful to
         // the EXEC's own slot (the cwd, or the path to the executable). The log:/// coordinate
@@ -1278,11 +2172,8 @@ class Dispatcher {
         // Runtime comes from statement.signal (EXEC's runtime slot), resolvable for failed execs
         // too; empty/absent = the default shell.
         if (statement.op === "EXEC") {
-            const seqs = await this.#db.engine_loop_turn_seqs.get({
-                loop_id: loopId, turn_id: turnId,
-            });
             if (seqs === undefined)
-                throw new Error(`Dispatcher.#writeLog: loop_turn_seqs returned no row for loop=${loopId} turn=${turnId}`);
+                throw new Error("Dispatcher.#writeLog: EXEC coordinate was not resolved");
             const runtime = (typeof statement.signal === "string" && statement.signal.length > 0) ? statement.signal : "sh";
             const coordPathname = `/${seqs.loop_seq}/${seqs.turn_seq}/${sequence}`;
             attrsObj.pathname = coordPathname;
@@ -1297,7 +2188,7 @@ class Dispatcher {
             }
         }
         const attrs = JSON.stringify(attrsObj);
-        const txJson = JSON.stringify(statement);
+        const txJson = JSON.stringify(durableStatement);
         const rxJson = JSON.stringify(result);
         const row = await this.#db.engine_insert_log_entry.get({
             worker_id: workerId,
@@ -1305,17 +2196,17 @@ class Dispatcher {
             turn_id: turnId,
             sequence: sequence,
             origin,
-            source: null, // dispatch entries are self-authored; §env-delta deltas set this
-            op: statement.op,
-            suffix: statement.suffix,
-            signal: this.#signalToJson(statement.signal),
+            source: null, // dispatch entries are self-authored; {§env-delta} deltas set this
+            op: durableStatement.op,
+            suffix: durableStatement.suffix,
+            signal: this.#signalToJson(durableStatement.signal),
             scheme: target.scheme,
             username: target.username,
             password: target.password,
             hostname: target.hostname,
             port: target.port,
             pathname: target.pathname,
-            params: target.params,
+            query: target.query,
             fragment: target.fragment,
             lineMarker: lineMarkerJson,
             tx: txJson,
@@ -1332,31 +2223,29 @@ class Dispatcher {
             throw new Error("Dispatcher.#writeLog: INSERT ... RETURNING produced no row");
         return row.id;
     }
-    // Normalize a parsed path for storage. The `file` scheme is a routing
-    // internal — never stored, never rendered to the model. Both bare paths
-    // and `file:///...` inputs collapse to scheme=null at this boundary, so
-    // entries.scheme / log_entries.scheme never carry the string "file".
+    // Normalize a parsed target for log storage. Bare paths and `file:///...`
+    // inputs collapse to scheme=null in log target metadata because both render
+    // as bare paths. Addressable file entries separately persist under the
+    // reserved `file` identity scheme ({§entry-identity-no-null}).
     #extractTarget(path) {
         if (path === null)
-            return { scheme: null, username: null, password: null, hostname: null, port: null, pathname: null, params: null, fragment: null };
-        // `local` (bare path) and `regex` (grammar 0.46 `#pattern#flags` target) carry no URL parts — store the raw text as the pathname for the log record, scheme=null.
-        if (path.kind === "regex")
-            return { scheme: null, username: null, password: null, hostname: null, port: null, pathname: path.raw, params: null, fragment: null }; // regex source — no decode
+            return { scheme: null, username: null, password: null, hostname: null, port: null, pathname: null, query: null, fragment: null };
+        // `local` (bare path) carries no URL parts — store the raw text as the pathname for the log record, scheme=null.
         if (path.kind === "local")
-            return { scheme: null, username: null, password: null, hostname: null, port: null, pathname: decodePathParens(path.raw), params: null, fragment: null }; // #239 item 4
+            return { scheme: null, username: null, password: null, hostname: null, port: null, pathname: PathSyntax.decodeParens(path.raw), query: null, fragment: null }; // {§path-parentheses}
         const scheme = path.scheme === "file" ? null : path.scheme;
-        // Every registered (plurnk-namespace) scheme uses its authority as a namespace segment — fold
-        // it into the canonical pathname so known://x ≡ known:///x ≡ /x and the log keys identically to
-        // the entry (/prompt/<run>/<loop>/<N>, /docs/x.md). A foreign web host (http://, unregistered) is NOT a
-        // namespace: keep it in hostname. worker:// is the one registered EXCEPTION — its authority IS the
-        // run selector (§worker-scheme), and worker://self must stay distinct from worker://name, so Run.ts
-        // folds the owner into the storage path itself, never here.
-        const foldNs = scheme !== null && scheme !== "worker" && this.#schemes.has(scheme);
+        // {§scheme-address-namespace-fold} — a registered non-network scheme folds its
+        // namespace authority into the canonical pathname. Network authorities remain hosts;
+        // worker:// is the registered exception because its authority selects the owner.
+        const foldNs = scheme !== null
+            && scheme !== "worker"
+            && !NetworkAddress.supports(scheme)
+            && this.#schemes.has(scheme);
         return {
             scheme, username: path.username, password: path.password,
             hostname: foldNs ? null : path.hostname, port: path.port,
-            pathname: decodePathParens(foldNs ? foldAuthorityIntoPath(path.hostname, path.pathname) : path.pathname), // #239 item 4
-            params: JSON.stringify(path.params), fragment: path.fragment,
+            pathname: PathSyntax.decodeParens(foldNs ? foldAuthorityIntoPath(path.hostname, path.pathname) : path.pathname), // {§path-parentheses}
+            query: path.query, fragment: path.fragment,
         };
     }
     #signalToJson(signal) {