@plurnk/plurnk-service 1.7.0 → 1.8.0

package/SPEC.md

@@ -26,18 +26,51 @@ flowchart LR
 | **agent**         | PLURNK                | The plurnk runtime. Acts in-workspace as the reserved `plurnk` worker ({§actor-boundary} self-hosting), never a privileged singleton owning its own entries ({§entry-owner}, {§machine-processes}). |
 | **workspace**     | Core                  | Durable user-named shared world. Persists across workers and process restarts. Identity: `workspaces.id` + unique `workspaces.name`. |
 | **worker**        | Core                  | Durable actor and private history over one workspace. Owns its loops and log rows, may carry a `parent_worker_id`, and has one process-local cancellation scope while active. |
-| **loop**          | Core                  | Queued-to-terminal unit of model or client work within a worker. Status ∈ {100 pending · 102 running · 200 done · 202 waiting (blocked on a live obligation, {§send}) · 413 provider input-capacity failure · 429 turn-ceiling · 499 cancelled · 500 failed · 504 wall-clock timeout ({§operator-config-loop-timeout}) · 508 runaway}. Many loops may belong to one worker. |
-| **turn**          | Core                  | One engine scheduling unit (or one client-op scheduling unit). A model turn sends one assembled prompt through one or more emission attempts and admits at most one response. Many turns may belong to one loop. Identity: `(loop_id, sequence)`. |
+| **loop**          | Core                  | Queued-to-terminal unit of model or client work within a worker. Status ∈ {100 pending · 102 running · 200 done · 202 waiting (blocked on a live obligation, {§send}) · 413 input-capacity failure · 429 model-turn ceiling · 499 cancelled · 500 failed · 504 wall-clock timeout ({§operator-config-loop-timeout}) · 508 runaway}. Many loops may belong to one worker. |
+| **turn**          | Core                  | One durable, producer-neutral batch of ordered operations. A turn may be authored by a model, client, plugin, or `_plurnk`; only a model turn assembles a packet and owns an emission call. Many turns may belong to one loop. Identity: `(loop_id, sequence)`. |
 | **model call**    | Core/provider         | One logical `provider.generate` invocation. Emission attempts and BARE inferences share this durable accounting owner; provider retries remain cardinal physical requests beneath it. Identity: `(turn_id, sequence)`. |
-| **op**            | Model/core            | One DSL operation the model emits, parsed into a `PlurnkStatement`. One admitted turn produces zero or more ops. |
+| **op**            | Producer/core         | One DSL operation a producer submits, parsed into a `PlurnkStatement`. One admitted source-backed turn produces an ordered PLAN…SEND program. |
 | **statement**     | Model/core            | A parsed op: the `PlurnkStatement` AST from `@plurnk/plurnk-contracts`. |
-| **action**        | Core                  | One executed op. Execution normally produces a `log_entries` row at `log:///<L>/<T>/<S>/<op>`; an engine rail may instead record an actionless `op='error'` row ({§operation-results}). Actionless artifacts carry no fabricated operation. |
+| **action**        | Core                  | One executed op. Execution normally produces a `log_entries` row at `log:///<L>/<T>/<S>/<op>`; an engine rail may instead record an `op='error'` row ({§operation-results}). A source artifact carries no fabricated operation. |
 | **dispatch**      | Core                  | Routing a statement to its scheme's op handler. |
 | **AG-UI Run**     | AG-UI protocol        | A client request/stream envelope identified by the client's `runId`. A message or resume AG-UI Run binds to one core loop; a management-action AG-UI Run may complete without creating a core loop. |
 | **AG-UI thread**  | AG-UI protocol        | Conversation identity. Within an explicitly selected workspace, `threadId` resolves to one conversation worker. |
 | **`--run`**       | Client compatibility  | A compatibility-sensitive client spelling, not an internal entity. |
 | **session**       | Retired/unqualified   | Not a PLURNK lifecycle noun. Use the actual core noun; a third-party standard may use only its explicitly qualified protocol term. <!-- lexicon-allow: this row defines the retired noun --> |
 
+### §turn-record Producer-neutral turn record
+
+A turn is the durable container for one producer's ordered operations. Packet
+and provider fields are optional evidence belonging only to model inference;
+their absence never makes a client, plugin, or `_plurnk` turn exceptional.
+
+| Field | Contract |
+|---|---|
+| `producer` | Required actor class: `model`, `client`, `plugin`, or `_plurnk`. |
+| `kind` | Required purpose: `inference`, `initialization`, `overflow`, or `operation`. Model iff inference; initialization and overflow require `_plurnk`. |
+| `status`, `completed_at` | A new turn is open at status 102 with `completed_at=NULL`. Completion records the exact terminal SEND/operation disposition and timestamp; a completed 102 is therefore distinct from an open 102. |
+| Operations | Ordered by `(turn_id, sequence)` on one exact worker/loop/turn chain. Each row's `origin` is the turn producer or `_plurnk` making a system observation; the observation does not impersonate the producer. |
+| `turnOps` | Every admitted source-backed turn preserves its exact PLAN…SEND program as one undecorated actionless log item under {§turn-ops-entry}. The item supplements rather than replaces the executed operation rows. |
+| Inference evidence | Model calls, `packet`, model, finish reason, and provider metadata belong only to model/inference turns. Turn fields are nullable until recorded and remain NULL for every other kind. |
+
+One lifecycle owner opens, optionally records inference evidence, and completes
+every turn. Initialization, overflow recovery, client dispatch, and model
+inference use that same path. `plugin` is the producer identity for
+plugin-authored operation turns; exposing that path must not introduce a
+parallel record or lifecycle. The sole identity transition is an open,
+evidence-free model/inference candidate becoming `_plurnk`/overflow before
+provider admission. Process-restart recovery completes any turn whose producer
+vanished.
+
+§turn-ops-admission-path **Source acquisition varies; admitted-turn execution does not.**
+A provider response, deterministic `_plurnk` program, or future client/plugin
+program crosses one admission boundary into the same executor. That executor
+parses once, dispatches the admitted statements in order, records their ordinary
+outcomes and the exact `turnOps`, and completes the turn from its SEND ruling.
+Provider attempts, grammar recovery, reasoning, and accounting end before this
+shared seam. A programmatic operation batch that supplied no Plurnk source does
+not fabricate verbatim source.
+
 ### §storage-terms Storage terms
 
 | Term | Meaning |
@@ -64,9 +97,9 @@ Independent axes on entries and channels. Confusion across them is a recurring s
 
 | Term | Meaning |
 |---|---|
-| **writer** | The identity authoring a write. One of `model \| client \| plurnk \| plugin`. Carried on `ctx.writer` for schemes; engine enforces `manifest.writableBy`. |
+| **writer** | The identity authoring a write. One of `model \| client \| _plurnk \| plugin`. Carried on `ctx.writer` for schemes; engine enforces `manifest.writableBy`. |
 | **origin** | Synonym for writer in log_entries (`log_entries.origin`). Historical naming; treat as equivalent. |
-| **writable_by** | The set of writers a scheme accepts. Subset of `{model, client, plurnk, plugin}`. Engine rejects writes outside the set with 403; the rejection is logged as the action-entry ({§subscriptions} action-entry-as-outcome). |
+| **writable_by** | The set of writers a scheme accepts. Subset of `{model, client, _plurnk, plugin}`. Engine rejects writes outside the set with 403; the rejection is logged as the action-entry ({§subscriptions} action-entry-as-outcome). |
 
 ### §engine-rails Engine rails
 
@@ -183,6 +216,19 @@ OpenTelemetry may observe PLURNK; it never becomes product state, failure transp
 
 Configuration uses the standard `OTEL_*` environment: `OTEL_TRACES_EXPORTER` / `OTEL_METRICS_EXPORTER` select `otlp` or `console` per signal (a missing or `none` value keeps that signal off; no SDK default selects an exporter), `OTEL_SERVICE_NAME` names the service (default `plurnk-service`), case-insensitive `true` in `OTEL_SDK_DISABLED` turns the boundary off, and OTLP exporters honor `OTEL_EXPORTER_OTLP_*`. An unknown exporter name fails daemon boot; a typo never silently disables observation. OTel Logs and direct draft semantic-convention use are excluded. HTTP spans carry only an AG-UI-owned bounded route class, never an input pathname or query. Spans otherwise carry high-cardinality identifiers; metric labels stay low-cardinality. Prompts, reasoning, file bodies, arbitrary URLs, secrets, and plugin payloads are never recorded as attributes or metric values by default. Exporter failure cannot change product results or client lifecycle. Daemon, telemetry, and database teardown are independent reverse-ownership phases; every phase runs and aggregate failure preserves every cause.
 
+§observability-genai-conventions **GenAI convention projection.** Provider
+request spans use the OpenTelemetry GenAI semantic conventions: a
+CLIENT-kind `gen_ai.client.request` span carrying `gen_ai.operation.name`
+(`chat`), `gen_ai.system` (the provider alias), and `gen_ai.request.model`;
+on settlement it gains `gen_ai.usage.input_tokens` and
+`gen_ai.usage.output_tokens` from validated accounting plus
+`gen_ai.response.finish_reasons`; failures carry `error.type` as the class
+name only. Plurnk custom attributes (attempt, kind, status, loop/turn ids)
+ride alongside and never replace the convention attributes. The redaction
+boundary is unchanged — no prompts, reasoning, bodies, or URLs. This is the
+sanctioned exception to the blanket draft-convention exclusion; no other
+draft convention is projected.
+
 ### §in-process In-process architecture
 
 Composed daemon internals + admin CLI. Four plug points:
@@ -190,7 +236,7 @@ Composed daemon internals + admin CLI. Four plug points:
 - **Providers** ({§provider}) — LLM transports. Engine sends a turn's messages, receives raw content + usage; engine parses the content into `PlurnkStatement[]`.
 - **Schemes** ({§scheme}) — addressed capabilities. A scheme handler interprets targets under its prefix and owns its storage substrate.
 - **Mimetypes** ({§mimetype}) — content interpretation. Render-time handlers consume channel content; framework owns the dispatch.
-- **Executors** ({§exec} / {§bundled-set}) — EXEC runtime dispatch for subprocess, search, data, and pure-computation runtimes.
+- **Executors** ({§exec} / {§bundled-set}) — EXEC runtime dispatch for subprocess, data, and pure-computation runtimes; web discovery rides the ordinary MCP surface.
 
 Core's internal owners compose without becoming new package or public seams:
 
@@ -199,7 +245,7 @@ Core's internal owners compose without becoming new package or public seams:
 | `Daemon` | Process/module lifecycle, dependency composition, provider policy, notifications, and the external client façade. |
 | `DrainSupervisor` | One worker's queue consumer, drain identity, wake obligations, cancellation scope, poll/park timers, and terminal cleanup. |
 | `Engine` | Loop lifecycle and the public turn, dispatch, derivation, and proposal façades. |
-| `TurnRunner` | One durable model turn from materialization through provider admission, operation scheduling, and settlement. |
+| `TurnRunner` | Model inference plus `_plurnk` initialization/overflow turns from materialization through operation settlement. |
 | `Dispatcher` | Operation admission/routing, scheme execution, proposal waiting, curation, and durable log writes. |
 | `ResourceMutations` | EDIT/COPY/MOVE selection, anchor preconditions, cross-scheme effects, and mutation settlement. |
 
@@ -294,17 +340,49 @@ ambient shared-state changes still cross only through the environment door.
 Git membership includes tracked and untracked-but-not-ignored project files
 ({§membership-auto-add}); it does not stage them or run `git add`.
 
-§actor-boundary-doc-injection **Operator reference documents use the actor
-path.** `PLURNK_SERVICE_MD_<ALIAS>=<path>` ({§operator-config}) materializes
-`<path>` as `worker://plurnk/<ALIAS>.md` through a `DispatchAsPlurnk` EDIT, then
-foists a READ into each model worker's turn 0. The materializing EDIT remains in
-the `plurnk` worker's log; the model sees the shared entry through its own READ.
-Client-provided workspace documents union with the operator set at the same
-entry surface.
-
-§actor-boundary-catalog-preview **Catalog preview.** `PLURNK_SERVICE_FILES_ITEMS` foists turn-0 FINDs into the worker's first turn, so a worker opens with a navigable map instead of blank. An enabled preview executes exactly four orienting surveys in order: project files (`## FIND0 [+init] (*)`), workspace commons (`## FIND0 [+init] (worker:///*)`), the worker's own space (`## FIND0 [+init] (worker://~/*)`), and kernel docs (`## FIND0 [+init,+docs] (worker://plurnk/docs/**) <1,-1>`). Their log classifications make the opening survey one `init` set while retaining `docs` on its documentation row ({§log-item-tags}). A shallow result renders direct entries normally and every deeper first-segment directory as an actionable `dir/**` summary with its recursive `items` and `tokens`. Ordinary surveys use FIND's markerless first-16 page, whose range metadata reports the requested and returned page against the complete result total; only the small curated kernel-doc surface explicitly selects all. The opening exemplar therefore demonstrates both `*` and `**` without normalizing an all-results override. Every survey executes even when empty because zero results are useful orientation. A positive `N` explicitly caps only the file map's rendered rows, using the map's actual direct-entry-plus-directory count; `-1` enables the ordinary markerless page; unset / `0` disables previews. `log://` is absent because the current worker's log already renders in present mode.
-
-§worker-initialization-entry **Worker initialization is not model output.** A worker's first loop begins with one born-OPEN actionless row at `log:///1/1/1`: `origin="plurnk"`, `op` null, and `attrs.kind="initialization"`. Its `text/vnd.plurnk` body dynamically mirrors the turn-zero PLAN, the orienting operations actually dispatched, and terminal `SEND0 [102]`. The PLAN states `* Initialization complete.` and `* Next: address the prompt.`; SEND hands off with `Next, address the prompt.`
+§turn0-agents-stunt **The project AGENTS.md is a turn-0 stunt.** When
+`<projectRoot>/AGENTS.md` exists, LoopDocs materializes it as the kernel-owned
+`worker://plurnk/agents.md` entry and the engine foists one READ of it into
+each model worker's first turn — visible, logged, line-addressable. Absent
+file: no entry, no stunt, nothing 404s. The global XDG configuration `AGENTS.md`
+remains system-prompt policy ({§policy-sections}); the stunt carries only
+local repo guidance.
+
+§actor-boundary-doc-injection **The project AGENTS.md uses the actor
+path.** The project's `AGENTS.md` is materialized as
+`worker://plurnk/agents.md` through a `DispatchAsPlurnk` EDIT, then foisted as
+one READ into each model worker's turn 0 ({§turn0-agents-stunt}). The
+materializing EDIT remains in the `plurnk` worker's log; the model sees the
+shared entry through its own READ.
+
+§actor-boundary-catalog-preview **Catalog preview.** `PLURNK_SERVICE_FILES_ITEMS`
+foists turn-0 discovery into the worker's first turn, so a worker opens with a
+navigable map instead of blank. An enabled preview executes exactly six baseline
+bodyless FIND surveys in order: authored skills (`## FIND0 [+init,+skills]
+(worker://plurnk/skills/*.md) <1,-1>`), Plurnk-generated reference families
+(`## FIND0 [+init,+skills] (worker://plurnk/skills/plurnk/*.md) <1,-1>`), enabled
+tool families (`## FIND0 [+init,+tools] (worker://plurnk/tools/*.md) <1,-1>`),
+project files (`## FIND0 [+init] (*)`), workspace commons (`## FIND0 [+init]
+(worker:///*)`), and the worker's own space (`## FIND0 [+init] (worker://~/*)`).
+The catalogs select every direct document independently of its authored body;
+ordinary READ supplies its examples and complete instructions on demand. Their
+log classifications make the opening discovery one `init` set while retaining
+`skills` or `tools` on the corresponding rows ({§log-item-tags}). A shallow
+result renders direct entries normally and every deeper first-segment directory
+as an actionable `dir/**` summary with its recursive `items` and `tokens`;
+tool-family rows also carry the concise `{§scheme-catalog-summary}` that drives
+on-demand capability discovery. Ordinary surveys use FIND's markerless first-16
+page, whose range metadata reports the requested and returned page against the
+complete result total; only the small curated skills and tools surfaces
+explicitly select all. The opening survey demonstrates both `*` and `**` without
+normalizing an all-results override. Every survey executes even when empty
+because zero results are useful orientation. A positive `N` explicitly caps
+only the file map's rendered rows, using the map's actual
+direct-entry-plus-directory count; `-1` enables the ordinary markerless page;
+unset / `0` disables previews. `log://` is absent because the current worker's
+log already renders in present mode.
+
+§worker-initialization-entry **Worker initialization is a real `_plurnk` turn.** A worker's first loop begins with one packetless `{ producer="_plurnk", kind="initialization" }` turn submitted through {§turn-ops-admission-path}. It preserves one OPEN exact `turnOps` item and dispatches the same source into ordinary PLAN, orienting READ/FIND, and terminal `SEND0 [102]` rows. Every row is structurally classified `_plurnk` and `init`. The PLAN states `* Discover the tooling available and survey the workspace file root.`; SEND hands off with `Next: Address the prompt.` The first model request occupies the following turn and therefore begins at database/log turn sequence 2; “turn zero” is the initialization phase's model-facing label, not a zero-based database coordinate.
 
 ### §machine-processes The machine and its processes: workspace, worker, fork
 
@@ -340,14 +418,14 @@ terminal history.**
 | Project files ({§machine-processes-one-filesystem})   | Workspace         | Shared live; a fork does not create another checkout.                                                              |
 | Shared worker entries (`worker:///...`)               | Workspace commons | Shared live.                                                                                                       |
 | Membership overlay ({§machine-processes-one-overlay}) | Workspace         | Shared unchanged; divergent membership requires another workspace.                                                 |
-| Log items ({§machine-processes-fork-copies-the-log})  | Worker            | Rows, event identities, curation effects, tags, fold state, and the matching observation cursor are copied as terminal history. |
+| Log items ({§machine-processes-fork-copies-the-log})  | Worker            | Rows, event identities, curation effects, tags, folded body intervals, and the matching observation cursor are copied as terminal history. |
 | §machine-processes-fork-cost **Provider evidence and accounting** | Worker | Turns and their model-facing log history are copied, but `model_calls`, emission-admission rows, and physical provider requests are not: one issued call or request has one owning worker. Parent and fork accounting therefore includes only work issued in that branch, while workspace accounting never double-counts copied history. |
 | Private worker entries (`worker://~/...`)             | Worker            | Deep-copied with ownership remapped; parent and child then diverge.                                                |
 | Active loops, turns, and cancellation                 | Worker            | Never copied as live work; inherited structure is terminal history, then a new loop starts.                        |
 
 §machine-processes-worker-is-its-log **A worker's conversational memory of
 the shared world is its log, with no hidden per-worker snapshot beside it.**
-OPEN/FOLD changes `log_entries.expanded` on that worker's rows ({§open-fold});
+OPEN/FOLD changes canonical folded body intervals on that worker's rows ({§open-fold});
 environment changes arrive as attributed log entries ({§env-delta}). Private
 worker entries are deliberate scratch that the worker reads and writes through
 `worker://~/...`, not an invisible mirror of shared state. The environment door
@@ -356,7 +434,7 @@ therefore carries only shared project-file and shared-entry changes
 
 §machine-processes-model-worker-readable **A worker's log is private to packets, not to the workspace.** Isolation ({§actor-boundary}) governs what an *actor* sees — its own worker, never a sibling's. It does not wall off the client interface: `readLog({ workspaceId, workerId })` may read any ownership-verified worker in that workspace, and `listWorkers` enumerates them. A client-interface module chooses the default worker from its own conversation binding. The read is observation, never packet membership — no actor sees it.
 
-§machine-processes-worker-origin **A worker carries its actor.** Each worker records its `origin` — `model` (a conversation), `client` (a client-interface actor), or `plurnk` (the runtime's self-hosting worker) — set once at creation and inherited by a fork. `listWorkers` returns it, so a client interface identifies actor class without parsing the name, which is set at instantiation and immutable (a worker is permanent history, {§machine-processes-worker-is-its-log}).
+§machine-processes-worker-origin **A worker carries its actor.** Each worker records its `origin` — `model` (a conversation), `client` (a client-interface actor), or `_plurnk` (the runtime's self-hosting worker) — set once at creation and inherited by a fork. `listWorkers` returns it, so a client interface identifies actor class without parsing the name, which is set at instantiation and immutable (a worker is permanent history, {§machine-processes-worker-is-its-log}).
 
 §worker-provider-identity **A worker owns a durable provider identity distinct
 from its database id.** Creation mints a globally unique, opaque 128-bit value;
@@ -380,7 +458,7 @@ or membership overlay requires a new workspace.
 
 ### §worker-scheme The worker:// scheme — the knowledgebase (commons, own space, named spaces, the kernel surface) and worker control (spawn, irc, fork, terminate, cap, collect)
 
-§worker-authority-carving **The authority names the OWNER:** `worker:///notes.md` is in the COMMONS — a shared blackboard; `worker://~/draft.md` is the calling worker's own private space; `worker://<name>/result.md` is a named worker's space; `worker://plurnk/docs/x.md` is the kernel's published surface, world-readable. Storage keys the owner on the entries.owner_id column ({§entry-owner}) — the pathname is always the bare entry path, and a FIND's result paths re-apply the queried authority so the model sees the address it typed. `~` is the sole current-worker sigil and cannot be minted; `commons` and `plurnk` are internal worker names unavailable for minting. Every other mintable authority, including `self`, is a literal worker name ({§worker-name}).
+§worker-authority-carving **The authority names the OWNER:** `worker:///notes.md` is in the COMMONS — a shared blackboard; `worker://~/draft.md` is the calling worker's own private space; `worker://<name>/result.md` is a named worker's space; `worker://plurnk/skills/…` is the kernel's published surface, world-readable ({§skills-materialization}). Storage keys the owner on the entries.owner_id column ({§entry-owner}) — the pathname is always the bare entry path, and a FIND's result paths re-apply the queried authority so the model sees the address it typed. `~` is the sole current-worker sigil and cannot be minted; `commons` and `plurnk` are internal worker names unavailable for minting. Every other mintable authority, including `self`, is a literal worker name ({§worker-name}).
 
 §worker-name-minting **URI ingestion is permissive; worker minting is not.**
 Every model/client worker-creation door applies the contracts-owned
@@ -425,7 +503,7 @@ literal `workers.name` value.
 | `KILL`    | existing literal name, `~`  | Terminate the named worker or caller.   |
 
 - §worker-scheme-spawn **Spawn** — `## WORK0 (worker://<name>)` with a task body creates a new worker sister (empty log) and starts it with that task on its first loop. WORK/FORK are the worker-creation verbs: EDIT is file/entry only, so EDIT on the bare worker entity is a **400** steering to WORK/FORK — the entity is not an entry. A name is **frozen per worker** but **reclaimable across time** ({§machine-processes-worker-origin}): a name held only by a *terminated* sister is free to reuse — a fresh spawn takes a new row and `worker_resolve_by_name` resolves the newest, the corpse keeping its name in permanent history. A name a *live* sister still holds is a conflict — **409 `worker '<name>' is already running`**, legible at the spawn gate, never a raw store-level uniqueness error.
-- §worker-scheme-irc **irc** — `## SEND0 (worker://<name>)` with a message body delivers it to an existing sister, the **voice door** ({§actor-boundary-two-doors}): an active sister folds it into its next turn, an idle one wakes ({§actor-boundary-passive-wake}). `## SEND0 (worker://~)` targets the caller; a literal name with no worker in the workspace is 404.
+- §worker-scheme-irc **irc** — `## SEND0 (worker://<name>)` with a message body delivers it to an existing sister, the **voice door** ({§actor-boundary-two-doors}): an active sister folds it into its next turn, an idle one wakes ({§actor-boundary-passive-wake}). A fresh receiving loop retains that worker's durable model, spawn override, and reasoning policy; the sender and daemon default do not re-select it. `## SEND0 (worker://~)` targets the caller; a literal name with no worker in the workspace is 404.
 - §worker-scheme-fork **Fork** — `## FORK0 (worker://<name>)` with a task body branches the
   current worker into a **named** sister: its log is deep-copied
   ({§machine-processes-fork-copies-the-log}), which continues with `task`; the
@@ -685,7 +763,7 @@ Three current entry points:
 - §provider-surface-capacity `provider.assessRequestCapacity(messages, maxOutputTokens?, signal?)` — provider-owned intersection of request-shaped token evidence and every known physical input limit. It admits, rejects only a proven exact overflow, or defers ambiguity to upstream ({§tokenomics-context-envelope-admission}). `generate` performs this assessment for its exact request and preserves the evidence on success and capacity failure.
 - §provider-surface-prompt-measurement `provider.countPromptTokens(messages, signal)` — the cancellable complete-request measurement primitive used by provider capacity assessment, with `exact`, `upper_bound`, `estimate`, or `unavailable` provenance. Core never substitutes this physical fact for its curation ruler.
 
-§provider-surface-identity Provider capacity and identity are immutable for one instance. `contextWindow`, `maxInputTokens`, and `maxOutputTokens` carry known model limits; `outputBudget` is the total generation envelope, optional `reasoningBudget` is its strict subset, and `inputCapacity` is the stable intersection of known input constraints ({§tokenomics}). Unknown facts remain `null`. `model` identifies persisted turn/provider evidence. Local GBNF boot verification also consumes `constrainsOutput` ({§grammar-enforcement-verified-at-boot}).
+§provider-surface-identity Provider capacity and identity are immutable for one instance. `contextWindow`, `maxInputTokens`, and `maxOutputTokens` carry known model limits; `outputBudget` is the total generation envelope, optional `reasoningBudget` is its strict subset, and `inputCapacity` is the stable intersection of known input constraints ({§tokenomics}). Unknown facts remain `null`. `model` identifies persisted turn/provider evidence. Local GBNF admission also consumes `constrainsOutput` ({§grammar-configuration-admission}).
 
 §meta-passthrough **Metadata passthrough (provider → client).** `generate` may return an open `meta: Record<string, unknown>` bag. The service stores it unenforced per turn (`turns.meta`, `json_valid` only — no schema) and forwards the latest turn's blob in `loop/terminated.usage` ({§notifications}). The service never reads a field within it. Providers own their metadata shapes; monetary values carry an explicit amount and currency rather than an implied unit. Absent → `{}`. The mirror direction (client → provider, the self-identified `client` id) rides `generate({client})` ({§attribution}).
 
@@ -703,9 +781,11 @@ Three current entry points:
 
 A completed provider exchange is an **emission attempt**, not necessarily an engine turn. The provider transports and observes the model's bytes; ANTLR is the admission authority only after provider completion. Admission asks whether the exchange has a trustworthy frame: its first parsed operation is PLAN, its last parsed operation is a terminal SEND, every hard parse error is bounded between those anchors, and no `unparsedTail` exists. Missing anchors, an error outside the frame, or a boundary-destroying tail rejects the entire exchange regardless of `finishReason`; no recovered prefix dispatches. Parser warnings remain admissible. `finish=length` is forensic evidence of likely truncation, not an independent rejection rule. A provider-declared resource interruption never reaches admission, even when its partial bytes form a complete-looking frame ({§provider-interrupted-attempt}).
 
-Core retries a rejected emission against the exact same packet beneath the same engine turn, up to `PLURNK_SERVICE_EMISSION_ATTEMPTS`. Rejected bytes never dispatch or reach the engine strike rail. Before each `generate`, Core opens one durable logical `model_calls` row and its emission-specific `turn_attempts` admission row. A call that ends without response evidence leaves that admission row unclassified (`accepted IS NULL`) and does not consume the emission-attempt ceiling. Beneath the model call, every provider observer invocation opens one cardinal `provider_requests` occurrence immediately before physical I/O and settles it as response or error. Adapter retries and capacity failover append requests in issue order; a response-less failure therefore remains an accounted occurrence rather than disappearing. Normalized response evidence is durable before parser classification and does not duplicate the separately owned accounting. The accepted exchange alone completes `turns.packet`; every physical request remains in turn and loop accounting, while the context gauge reads the latest settled emission request on the latest turn. Digest exposes rejected response evidence as `packetNNN.attemptNNN.rejected.*` and every physical request in its machine-readable ledger.
+§safe-uri-target-groups After source and authored-command admission, Core tolerates one target group on READ, FOLD, or OPEN only when splitting its raw target at top-level comma or whitespace separators produces at least two members and every member independently parses as an explicit `scheme://` URI. Request-metadata blocks are opaque to this split. Each member becomes one ordinary statement with an independent dispatch outcome and log row, in authored member order; scheduling may still move the complete operation class under {§op-mode-phases}. Otherwise the target remains exactly singular, including local filenames containing spaces or commas. The stored `turnOps` and authored command count remain unexpanded, and no other operation admits target groups.
 
-The first exhaustion in a consecutive sequence closes that unadmitted turn as a continue and opens exactly one ordinary recovery turn. Its packet projects the latest rejected response OPEN from a durably FOLDED model item under {§model-entry-log-curation} and carries one transient `invalid_emission` Notice whose complete message is: `Your previous response contained an unrecoverable syntax error. No operations were performed. Try again.` No parser diagnostic, attempt count, or rail state becomes model-facing. The recovery turn has its own honestly stored packet and its configured private same-packet attempts. The packet-local projection never changes the row's curation state, so no later packet repeats the malformed body unless the model explicitly OPENs it. Admission clears the recovery state; exhausting the informed turn terminates instead of opening another.
+Core retries a rejected emission against the exact same packet beneath the same engine turn, up to `PLURNK_SERVICE_EMISSION_ATTEMPTS`. Rejected bytes never dispatch or reach the engine strike rail. Before each `generate`, Core opens one durable logical `model_calls` row and its emission-specific `turn_attempts` admission row. A call that ends without response evidence leaves that admission row unclassified (`accepted IS NULL`) and does not consume the emission-attempt ceiling. Beneath the model call, every provider observer invocation opens one cardinal `provider_requests` occurrence immediately before physical I/O and settles it as response or error. Adapter retries and capacity failover append requests in issue order; a response-less failure therefore remains an accounted occurrence rather than disappearing. Normalized response evidence is durable before parser classification and does not duplicate the separately owned accounting. The accepted exchange alone extends `turns.packet` with response evidence; every physical request remains in turn and loop accounting, while the context gauge reads the latest settled emission request on the latest turn. Digest exposes rejected response evidence as `packetNNN.attemptNNN.rejected.*` and every physical request in its machine-readable ledger.
+
+The first exhaustion in a consecutive sequence closes that unadmitted turn as a continue and opens exactly one ordinary recovery turn. Its packet projects the latest rejected response OPEN from a durably FOLDED emission-attempt item under {§rejected-emission-entry} and carries one transient `invalid_emission` Notice whose complete message is: `Your previous response contained an unrecoverable syntax error. No operations were performed. Try again.` No parser diagnostic, attempt count, or rail state becomes model-facing. The recovery turn has its own honestly stored packet and its configured private same-packet attempts. The packet-local projection never changes the row's curation state, so no later packet repeats the malformed body unless the model explicitly OPENs it. Admission clears the recovery state; exhausting the informed turn terminates instead of opening another.
 
 An admitted frame may contain bounded malformed statements. Parsed operations still dispatch; each malformed statement becomes one durable model-origin `error` row with the parser's exact diagnostic under {§parse-diagnostics} and status 400. These failures are committed before the terminal disposition, participate in the ordinary strike rail, and prevent SEND signal `200` or an already-drained signal `202` from concluding before the model sees them in the next packet. This is operation recovery, not provider resampling.
 The Problem recovery states that only the failed operation needs correction
@@ -759,27 +839,42 @@ it or reinterpret a malformed tag list.
 service-side caching, per-loop selection, context-cap handling, and local GBNF
 verification. Cataloged providers use Models.dev metadata and official AI SDK
 bindings; an operator declaration covers an uncataloged compatible endpoint;
-plugin discovery is the last protocol-extension seam.
+plugin discovery is the last protocol-extension seam. Cache identity includes
+the alias, wire route, and complete provider-knob projection; a registered
+preconstructed handle occupies that same identity and cannot shadow changed
+tuning.
 
-§grammar-enforcement-verified-at-boot **Optional local GBNF is verified at boot.**
+§grammar-configuration-admission **Optional local GBNF is admitted without model generation.**
 The ANTLR grammar always defines and validates the PLURNK language. Separately,
-an operator may configure `PLURNK_PROVIDERS_GBNF_<alias>` for a local
-llama-server. The provider must advertise GBNF transport and satisfy a forcing
-probe whose sampled sentence and pre-projection response match the selected
-rail's template boundary followed by the `PLURNK-RAILS-LIVE` sentinel, or boot
-fails. The setting is resolved
-per alias and is unset by default. Configuring it on a cloud or endpoint-managed
-provider is an error, not a request for best-effort filtering.
-Alias-scoped `PLURNK_PROVIDERS_GBNF_DEBUG` deliberately withholds transport, so
-boot skips the enforcement probe while real requests retain the configured rail
-for local syntax validation and the engine's withheld-rail verdict.
-Runtime injection uses the provider's registered alias, falling back only to
-the process's active alias. Suffixed rail settings with neither identity fail
-instead of guessing. A configured package variant or explicit path that cannot
-be loaded also fails; it never silently becomes unconstrained.
+an operator may configure global `PLURNK_PROVIDERS_GBNF` or
+`PLURNK_PROVIDERS_GBNF_<alias>` for a local
+llama-server. Startup requires the provider to advertise GBNF transport and a
+reasoning-compatible configuration, but daemon lifecycle grants no inference
+or spending authority and therefore generates no verification tokens. The
+setting is resolved globally for an exact route and per alias for a declared
+alias; it is unset by default. Configuring it on a cloud
+or endpoint-managed provider is an error, not a request for best-effort
+filtering. Every user-authorized constrained generation proves transport through
+its exact pre-projection evidence ({§rail-truth-engine-verdict}). Alias-scoped
+`PLURNK_PROVIDERS_GBNF_DEBUG` is the explicit exception: it deliberately
+withholds transport while retaining local grammar validation and the engine's
+withheld-rail verdict. Runtime injection uses the provider's registered alias,
+falling back only to a real process-active alias; an alias-free route uses the
+global setting and ignores unrelated suffixes. A configured package variant or
+explicit path that cannot be loaded also fails; it never silently becomes
+unconstrained.
+
+§grammar-rail-registration **Rail variants are built-in names or import
+specifiers.** A bare variant (no `/`, no `:`) resolves as a built-in rail
+subpath under `@plurnk/plurnk-contracts`. Any other variant form is an import
+specifier — an absolute or relative operator file path, or a package export
+subpath (e.g. `@acme/plurnk-rails/custom.gbnf`) — resolved through the Node
+resolution chain, so a third-party rail package plugs in with no built-in
+registry. An unresolvable or unreadable rail fails the constrained generation
+loudly; it never silently becomes unconstrained.
 
 §gbnf-requires-reasoning Both shipped PLURNK rails require reasoning. The same alias-scoped configuration
-must resolve reasoning to `adaptive` or `on`; `off` with GBNF is rejected before
+must resolve reasoning to `adaptive` or a supported fixed effort; `off` with GBNF is rejected before
 the probe or any model generation. Reasoning-off remains valid when no GBNF rail
 is configured.
 
@@ -787,9 +882,9 @@ is configured.
 For a configured local GBNF, the provider returns the pre-projection sentence as
 `grammarEvidence` under `plurnk-providers` {§gbnf-response-observation}. The engine
 requires that evidence, independently validates `grammarEvidence.input` with the
-artifact's declared response root, and
-stamps `railsAttached: "client"` when transported or `"withheld"` in debug mode
-plus `railsVerdict`; it never validates projected
+artifact's declared response root, and requires `transported: true` unless the
+operator explicitly enabled debug mode. It stamps `railsAttached: "client"`
+when transported or `"withheld"` in debug mode plus `railsVerdict`; it never validates projected
 `assistant.content` as though the required reasoning enclosure were still
 present. A non-accept verdict emits one `grammar_unenforced` notice. A raw
 position at or after `contentStart` is translated to a content offset; a failure
@@ -962,7 +1057,9 @@ Directed SEND (non-null path) routes to scheme's `send`. Status = intent:
 
 - §log-uniform-query **Log speaks the universal query contract** — `## FIND0 (log://…)` works like every scheme's FIND. Candidates are worker rows scoped by the coordinate hierarchy ({§log-coordinate-hierarchy}) and projected exactly as READ shows them. Content dialects use `Matcher.matchCandidates`; `~semantic` and `@graph` use the same persistent derivation artifacts and candidate rankers as entries. Broad results are one-channel catalog groups whose `[0].path` is `log:///loop/turn/seq/OP`; exact matcher results are flat locations ({§find-result-projection}). A FIND signal classifies the FIND result row and never changes this candidate set ({§log-item-tags}). Log remains the core event ledger rather than duplicating rows into `entries`; its core-private storage adapter supplies one complete channel representation to the same READ projector. That adapter is not a plugin seam and grants no protocol scheme an alternate READ path.
 - §find-source-agnostic **The content matcher is source-agnostic** — `Matcher.matchCandidates(body, candidates, mimetypes)` applies a content matcher (regex/jsonpath/xpath/glob) to candidates from ANY source, keyed by the caller's own identity (a pathname for entries, a `loop/turn/seq` coordinate for log). The matcher never cares what table the content came from, so FIND works uniformly across schemes by construction: `EntryFind` and `Log.find` run the one shared primitive rather than re-implementing it per scheme. Log stays its own event stream, but its rows are candidates the shared matcher covers like any entry's content.
-- §matcher-selection-signal **Matching carries navigation evidence** - a matcher is a boolean resource predicate. Internally, each selected resource carries `matches: MatchEvidence[]`, where `MatchEvidence` is `{locator?,region?}`. `locator` preserves a structural address without overloading the resource row's `path`; `region` is a complete four-coordinate `TextRegion` only when the finding maps honestly into the exact text the model can READ. Exact duplicate evidence deduplicates. Relation findings map their indexed source spans through the same readable text coordinate index. FIND alone decides whether that grouped selection projects as resource rows or flat locations ({§find-result-projection}); the engine never fabricates a region or guesses which surgical READ the model wants.
+- §channel-selection-visibility **Channel selection is decision-time information, not a guess** — every multi-channel resource presents its channels with extents wherever FIND presents the resource: broad results list each channel's path, mimetype, tokens, and lines (default channel first), and matcher locations name the channel their line coordinates address. The packet never presents channels as equal and indistinguishable; extents derive from the stored channels by construction. Budget enforcement stays with {§overflow-turn} — this is information, not a second guard.
+
+- §matcher-selection-signal **Matching carries navigation evidence** - a matcher is a boolean resource predicate. Internally, each selected resource carries `matches: MatchEvidence[]`, where `MatchEvidence` is `{channel?,locator?,region?}`; `channel` names the entry channel the finding was located in and is absent for channel-less resources such as log rows, so line coordinates cannot be mis-attributed across channels of the same resource ({§channel-selection-visibility}). `locator` preserves a structural address without overloading the resource row's `path`; `region` is a complete four-coordinate `TextRegion` only when the finding maps honestly into the exact text the model can READ. Exact duplicate evidence deduplicates. Relation findings map their indexed source spans through the same readable text coordinate index. FIND alone decides whether that grouped selection projects as resource rows or flat locations ({§find-result-projection}); the engine never fabricates a region or guesses which surgical READ the model wants.
 
 `## SEND0 [410] (path[#fragment])` also deletes the target entry/channel — an implemented side-effect, NOT taught to the model and with no live/demo surface. The model-facing delete idiom is KILL ({§move}).
 
@@ -981,7 +1078,7 @@ interface PlurnkSchemeContext {
     readonly workerId: number;
     readonly loopId: number;
     readonly turnId: number;
-    readonly writer: "model" | "client" | "plurnk" | "plugin"; // WriterTier
+    readonly writer: "model" | "client" | "_plurnk" | "plugin"; // WriterTier
     readonly signal: AbortSignal | undefined;
     readonly streamEventNotify?: StreamEventNotify;
     readonly wakeWorkerNotify?: WakeWorkerNotify;
@@ -1008,7 +1105,7 @@ Engine → scheme guarantees:
   returns `200`, while only a retained live representation may return `102`
   ({§read-preparation}). No public handler can replace READ.
 - Exact FIND uses the same resolved identity and representation preparation
-  before standard entry selection, then composes the exact default channel's
+  before standard entry selection, then composes the exact selected channel's
   durable producer result with the core-owned query projection. Broad FIND may invoke a custom `find()` for
   genuinely protocol-owned candidate enumeration, or `prepareFind()` followed
   by the standard catalog query. Acquisition never owns matcher, pagination,
@@ -1121,7 +1218,7 @@ model-independent ruler for stored/catalog weights and the model-facing curation
 confined to provider-owned physical capacity assessment
 ({§tokenomics-context-envelope-admission}).
 
-§persistent-search-index **Persistent search index.** `SearchIndex.maintain` is the pre-model engine pass. Each searchable resource supplies an address and the exact readable body its READ exposes. Entries supply their default body; `LogBody` resolves each log row's canonical full body from its durable tx/rx envelope. Acquisition schemes project remote source material before storing that body; search never introduces a second hidden text projection. The readable body, mimetype, resolved text/binary classification, mimetype projection identity, embedder configuration, and applicable search exclusion form a content hash. Complete artifacts own FTS, vectors, symbol definitions, and references; resource rows hold only the attachment hash. Binary, empty, and excluded derivations do not invoke handler projections and therefore use one fixed no-projection identity.
+§persistent-search-index **Persistent search index.** `SearchIndex.maintain` is the pre-model engine pass. Every addressable entry channel supplies the exact readable representation its READ exposes; `LogBody` resolves each log row's canonical full body from its durable tx/rx envelope. Acquisition schemes project remote source material before storing addressable channels; search never introduces a second hidden text projection. The channel content, mimetype, resolved text/binary classification, mimetype projection identity, embedder configuration, and applicable search exclusion form a content hash. Complete artifacts own FTS, vectors, symbol definitions, and references; each `entry_channels` row or log row holds only its own attachment hash. Binary, empty, and excluded derivations do not invoke handler projections and therefore use one fixed no-projection identity.
 
 §search-exclusion **File-search eligibility is Core policy.**
 `PLURNK_SERVICE_SEARCH_EXCLUDE` is a comma-separated table of anchored
@@ -1129,21 +1226,21 @@ body-glob patterns. Patterns containing `/` match the full pathname; every
 other pattern matches the basename. Whitespace around entries is ignored, an
 empty setting excludes nothing, and the first match is the observable reason.
 
-| Search subject     | Exclusion evaluation                                    |
-|--------------------|---------------------------------------------------------|
-| `file` entry       | Apply the configured repository-path patterns once.     |
-| Other-scheme entry | Always eligible; its pathname is a resource identity.   |
-| Log projection     | Always eligible; it has no repository-path membership.  |
+| Search subject       | Exclusion evaluation                                    |
+|----------------------|---------------------------------------------------------|
+| `file` entry         | Apply the configured repository-path patterns once.     |
+| Other-scheme channel | Always eligible; its pathname is a resource identity.   |
+| Log projection       | Always eligible; it has no repository-path membership.  |
 
 A match produces the `excluded` derivation disposition and suppresses graph,
-FTS, and vectors while leaving the stored body and direct READ unchanged. The
+FTS, and vectors while leaving the stored channel and direct READ unchanged. The
 same reason participates in the derivation hash and is surfaced by diagnostics
 and digests. Mimetype detection and projection do not read or report this
 scheme policy.
 
 ```mermaid
 flowchart LR
-    E["entry default body"] --> P["exact READ body"]
+    E["entry channel"] --> P["exact addressed READ"]
     L["log result envelope"] --> P
     P --> H["content-addressed derivation"]
     H --> F["FTS"]
@@ -1156,7 +1253,7 @@ flowchart LR
     G --> Q
 ```
 
-§derivation-exhaustive Identical projections attach the same immutable artifact regardless of their source table. Search primitives therefore consume only `{key, deepHash}` candidates and cannot depend on entry or log storage. Semantic and graph FIND require every selected candidate—and graph's relationship universe—to be attached. An incomplete set returns 503 with `problem.search = {state:"incomplete", indexed, total}`; it never silently searches a partial corpus. Normal execution joins the eager workspace warm before model dispatch, so that response is an interface invariant and diagnostic, not a lazy-search mode.
+§derivation-exhaustive Identical projections attach the same immutable artifact regardless of their source table. Search primitives therefore consume only `{key, deepHash}` candidates and cannot depend on entry or log storage. Semantic and graph FIND require every selected channel candidate—and every channel in graph's relationship universe—to be attached. An incomplete set returns 503 with `problem.search = {state:"incomplete", indexed, total}`; it never silently searches a partial corpus. Normal execution joins the eager workspace warm before model dispatch, so that response is an interface invariant and diagnostic, not a lazy-search mode.
 
 The graph projection stores only addressable symbol names. A structured-data handler may legitimately emit an empty key into its symbols channel, but the `@graph` matcher cannot name an empty symbol; that one definition is omitted from graph storage without suppressing FTS, vectors, or the remaining definitions. Invalid references and other persistence violations still fail the resource derivation explicitly.
 
@@ -1247,8 +1344,9 @@ Per-op semantics. AST shapes come from `@plurnk/plurnk-contracts`'s `PlurnkState
 
 ### §line-anchors Text line anchors
 
-A scheme declaring `textEditScopes: true` with model write authority publishes
-the contracts-owned {§text-line-anchor-syntax}. For canonical model-facing
+A scheme declaring `lineAnchors: true`, or `textEditScopes: true` with model
+write authority, publishes the contracts-owned {§text-line-anchor-syntax}.
+Model-writable `textEditScopes` implies anchors; `lineAnchors` alone makes no EDIT claim. For canonical model-facing
 resource identity `R`, one-based line ordinal `L`, configured non-negative
 neighbor count `C`, and ordered content array `W` containing that line and up to
 `C` complete lines on either side (all excluding separators), core hashes the
@@ -1345,13 +1443,15 @@ copied with log history on fork.
 
 ### §open-fold OPEN / FOLD
 
-AST: `{ op: "OPEN"|"FOLD", target, body: MatcherBody | null, signal: tags | null, lineMarker: null }`.
+AST: `{ op: "OPEN"|"FOLD", target, body: MatcherBody | null, signal: tags | null, lineMarker: TextLineMarker | null }`.
 
-OPEN/FOLD operate on the **log** (`log:///`) - the model's context-curation surface ({§packet}). FOLD collapses a log row to its path; OPEN restores its ordinary packet projection, including any preview bound ({§body-projection}). Both select by target, matcher, and the symmetric ALL-tags filter, then apply the tag changes defined by {§log-item-tags}. The canonical full body remains available through READ of the log URI with `<1,-1>`. Non-destructive: rows and bodies persist. On any valid row, applying its current state again or targeting a bodyless row is a successful visibility no-op; classification changes still land. Malformed targets and nonexistent exact coordinates fail at their addressing boundary. Entries carry no visibility ({§no-visibility}), so OPEN/FOLD against an entry scheme returns 501.
+OPEN/FOLD operate on the **log** (`log:///`) - the model's context-curation surface ({§packet}). Without a scope, FOLD hides and OPEN reveals the whole canonical log body. With a one-line or inclusive two-line scope, each operation changes only that body's intersecting body-relative physical lines. An anchor may be one already published on that immutable body or one returned by READing its `log:///` identity; numeric lines outside a selected body and absent or ambiguous anchors are successful per-body no-ops. Both select rows by target, matcher, and the symmetric ALL-tags filter before independently applying the scope and tag changes to each selected row. Folded intervals are durable, sorted, disjoint, and compositional; `[]` is wholly open and `[[1,-1]]` wholly folded. The canonical body remains complete through log READ/FIND regardless of visibility. Rows and bodies persist, and classification changes still land when visibility is a no-op. Malformed targets, unsupported coordinate arity, and nonexistent exact coordinates fail at their owning boundary. Entries carry no visibility ({§no-visibility}), so OPEN/FOLD against an entry scheme returns 501.
 
 ### §jsonplurnk The Log's wire format
 
-The `## Log` section renders as a fixed three-backtick `jsonplurnk` fence - a JSON array of entry objects, otherwise-valid JSON with **exactly one** deviation: an open, nonempty `body` is a raw multiline string. Its opening JSON quote is followed by a physical newline, every content line begins with a numeric `N:` or anchored `@hash N:` coordinate prefix whose separator is one or more ASCII spaces, and its closing quote appears at column zero before either the object close or a following member. Source quotes, braces, fences, and headings cannot collide with either boundary because source text never occupies column zero after projection; source backticks therefore cannot form a CommonMark closing fence. The fixed opener keeps the packet prefix stable across content changes. The carve-out is localized to `body`, so the strip-parser recognizes `"body":"` followed by a newline, consumes one or more coordinate-prefixed lines, and replaces the raw multiline value with an escaped JSON string while preserving following members to recover strict JSON. The body shape is a strict three-state invariant: `"display":"none","body":""` for no body, `"display":"folded"` with the ordinary projection withheld, and `"display":"open","body":"\n<coordinate>...\n"` with it shown. `path` is the complete model-facing log identity: when a projected operation exists it ends in `/OP`, and no separate `op` field duplicates it. Nonempty `tags` is the row's complete deduplicated, sorted folksonomy; an untagged row omits it. When an OPEN bounded projection differs from the canonical body, it appends `"chunk":"showing <selected> of <complete>"` after `body`; otherwise it omits `chunk`. Complete-line extents use inclusive two-coordinate line regions. A cut inside a line uses four-coordinate, start-inclusive and end-exclusive regions with 1-based Unicode code-point columns. The row's `path` remains the canonical READ target. The block is data only - no prose leads the fence. `tokens` is the model-facing projection of the row's curation weight: the room OPEN adds and FOLD saves. A FIND's nonzero `itemsTokenTotal` weighs the complete matched set; a nonzero `returnedItemsTokenTotal` appears only when the returned page has a different weight. These are curation weights, not dollars. The invariants bind regardless of shape ({§packet}): addressability (`path`/`target`/`#channel`/coordinate-prefixed bodies), weighability (per-item `tokens`), honesty (every 4xx/5xx row and the exact body/display state). {§jsonplurnk} {§packet-jsonplurnk-exception}
+The `## Log` section renders as a fixed three-backtick `jsonplurnk` fence - a JSON array of entry objects, otherwise-valid JSON with **exactly one** deviation: an open, nonempty `body` is a raw multiline string. Its opening JSON quote is followed by a physical newline, every visible content line retains its canonical numeric `N:` or anchored `@hash N:` coordinate, and its closing quote appears at column zero before either the object close or a following member. Source quotes, braces, fences, and headings cannot collide with either boundary because source text never occupies column zero after projection; source backticks therefore cannot form a CommonMark closing fence. The fixed opener keeps the packet prefix stable across content changes. The carve-out is localized to `body`, so the strip-parser recognizes `"body":"` followed by a newline, consumes one or more coordinate-prefixed lines, and replaces the raw multiline value with an escaped JSON string while preserving following members to recover strict JSON. `"display":"none","body":""` means no canonical body, `"display":"folded"` withholds the whole body, and `"display":"open"` appends the visible body. A partially hidden open row also carries `"folded":["<scope>",...]`; coordinate gaps in its body make the omission explicit without renumbering later lines. `path` is the complete model-facing log identity: when a projected operation exists it ends in `/OP`, and no separate `op` field duplicates it. It leads each entry object; the remaining members follow in stable alphabetical order. A present authored operation annotation appears as `annotation`; its absence omits the field. Nonempty `tags` is the row's complete deduplicated, sorted folksonomy; an untagged row omits it. When an automatic bounded projection differs from the visibility-selected body, it appends `"chunk":"showing <selected> of <complete>"` after `body`; otherwise it omits `chunk`. Complete-line extents use inclusive two-coordinate line regions. A cut inside a line uses four-coordinate, start-inclusive and end-exclusive regions with 1-based Unicode code-point columns. The row's `path` remains the canonical READ target. The block is data only - no prose leads the fence. Every row's accounting: {§packet-token-accounting}.
+
+- §packet-token-accounting Every row reports its real weight so the packet self-reconciles against the budget: `tokensMetadata` is its active non-body share (always present — no row reads as free), `tokensBody` is the projected body's weight whenever a canonical body exists, and `tokensActive` is the complete row's weight in the packet right now. A folded or bodyless row has `tokensActive = tokensMetadata`; a wholly or partially open row has `tokensActive = tokensMetadata + tokensBody`. Thus FOLD removes the rendered body's weight while KILL removes `tokensActive`; on a folded row `tokensBody` previews the body share an OPEN would activate. The completed row, including its accounting fields and framing, is measured to a fixed point. A FIND's nonzero `itemsTokenTotal` weighs the complete matched set; a nonzero `returnedItemsTokenTotal` appears only when the returned page has a different weight. These are curation weights, not dollars. The invariants bind regardless of shape ({§packet}): addressability (`path`/`target`/`#channel`/coordinate-prefixed bodies), weighability (per-item `tokens`), honesty (every 4xx/5xx row and the exact body/display state). {§jsonplurnk} {§packet-jsonplurnk-exception}
 
 ### §retrieval-packet-metadata READ/FIND packet metadata
 
@@ -1363,7 +1463,7 @@ The packet projects one actionable owner for each retrieval fact:
 | exact-coordinate READ | none | top-level `region` | none |
 | READ-shaped materialization notice | none | none | generic body `lines` |
 | catalog/path FIND | compact `resource` range | none | none |
-| broad matcher FIND | compact `resource` range | per-resource match-location counts | nonzero complete `matchLocationCount` |
+| broad matcher FIND | compact `resource` range | per-resource match-location counts; a resource with exactly one match also carries that match's `locator`/`region` | nonzero complete `matchLocationCount` |
 | exact matcher FIND | compact `matchLocation` range | each row's locator/region | none |
 
 The compact range is `{ unit, total, requested: [first,last], returned?:
@@ -1379,17 +1479,19 @@ generic body `lines` remains available on READ-shaped materialization notices
 that have no retrieval extent. FIND content weights follow {§jsonplurnk};
 ordinary bounded bodies expose their displayed and complete chunk extents there.
 
-### §model-entry The model's own emission, mirrored back
+### §turn-ops-entry The admitted turn program
+
+§turn-ops-log-curation A source-backed turn preserves its **exact admitted Plurnk program** as an actionless log item in addition to the ordinary result row for every dispatched statement. `op` is null, `attrs.kind="turnOps"` identifies the item, `origin` is the turn producer, no target exists, `tx` is empty, and the source lives in `rx.content`, typed `text/vnd.plurnk`. Its exact address is the undecorated three-part coordinate `log:///<L>/<T>/<S>` because it is the turn program, not another operation. It is line-numbered and OPEN/FOLD/KILL-able like any log body. The worker-initialization `turnOps` is born OPEN because it is the worked orientation example; every other `turnOps`, including model inference and overflow recovery, is born FOLDED and remains available on demand. Log-KILL clears the `writableBy` gate for a model-authored item (Log's handler surface — kill only — keeps every other mutating op at 501). The shared executor writes exactly one after every admitted source-backed turn.
 
-§model-entry-log-curation A model-emission log row is the model's **verbatim emission**, mirrored back so it can inspect and curate its own behavior. It is an actionless artifact: `op` is null, `attrs.kind="model_emission"` identifies the row, no target exists, `tx` is empty, and the emission lives in `rx.content`, typed `text/vnd.plurnk`. Its exact address is the undecorated three-part coordinate `log:///<L>/<T>/<S>` because no operation exists to append. An admitted emission is **always born FOLDED** (budget-neutral), line-numbered like all content, and OPEN/FOLD/KILL-able like any log row. Log-KILL clears the `writableBy` gate for the model (the DB-storage curation lever plurnk.md teaches; Log's handler surface — kill only — keeps every other mutating op at 501). The engine writes one after each admitted model turn. The invalid-emission recovery item under {§emission-admission} mirrors only the latest rejected response, is born FOLDED with `attrs.admission="rejected"`, and is projected OPEN only in the informed recovery packet; every other rejected attempt remains forensic-only.
+§rejected-emission-entry A rejected provider response is not `turnOps`: it never became an admitted turn program. The one bounded invalid-emission recovery item under {§emission-admission} has `attrs.kind="emissionAttempt"`, `origin="model"`, and the exact latest rejected response. It is born durably FOLDED and projected OPEN only in the informed recovery packet; every other rejected attempt remains forensic-only.
 
 - §log-coordinate-hierarchy **Log coordinates are a hierarchical prefix; the trailing slash is optional** — a coordinate is `loop/turn/sequence`, and a PARTIAL coordinate selects its descendants: `log:///1` = loop 1's rows, `log:///1/2` = turn 1/2's rows, `log:///1/2/3` = the one row. A full coordinate is always three parts, so a one- or two-part path is unambiguously a prefix — the trailing slash is an optional alias (`log:///1/2` ≡ `log:///1/2/`), uniform with `## READ0 (worker:///docs/)`. A rendered operation row appends its canonical model-facing `/OP`, not a fourth resource level. Exact consumers tolerate the unsuffixed three-part shorthand; when supplied, the case-insensitive suffix is authoritative and a disagreement resolves 404. Typed entry materialization therefore resolves as `/READ` while retaining its durable `EDIT` event ({§exec-entry-sink}). `log:///1/2/*` still selects the turn's item rows, while `log:///**/READ` deliberately filters the canonical suffix.
 - §log-curation-folder-idiom **Log curation speaks the folder idiom; a zero-match sweep is a no-op success** — OPEN/FOLD/KILL take a concrete coordinate or a path-glob, and a **trailing slash or a partial coordinate means "the contents"** ({§log-coordinate-hierarchy}), like a folder-scoped FIND: `## FOLD0 (log:///1/2)` folds turn 1/2's rows. OPEN and FOLD may instead take only a tag filter ({§log-item-tags}). A **well-formed selection that matches nothing is 204 with `matched: 0`**; a successful sweep's rx carries `matched: N`. A targetless operation without tags or a matcher is 400.
-- §log-curation-set-selection **Set selection, never positional curation** — target/glob, optional body matcher, and optional ALL-tags filter compose by intersection into the affected row set. OPEN and FOLD have no `<L>` marker and never paginate that set; FIND owns result pagination.
+- §log-curation-set-selection **Row selection and body scope are independent** — target/glob, optional body matcher, and optional ALL-tags filter compose by intersection into the affected row set. An optional `<L>` or `<SL,EL>` then intersects each selected canonical body; it never paginates or changes the selected set. Thus `## FOLD0 (log:///**/READ) <17,-1>` may change long READs and no-op on short ones while reporting every selected row in `matched`.
 
-§fold-open-meta-operations **OPEN and FOLD are meta-operations — log-curation directives, not world actions.** They change log visibility and classifications, never the underlying resources. A **successful** OPEN/FOLD **is recorded in the log** but **suppressed from the packet render**: the row exists for forensics — a curation act with NO trace is how a weak model folding its own task frame stayed invisible until a database dig — while the render still costs it nothing, so FOLD stays genuinely free (the original rowless design's concern, met by hide-not-drop). Its exact selected target set, each target's pre-event visibility, and the classifications actually added and removed persist with that event; `matched: N` and the authored selector are not the database's sole effect evidence. The operation row, visibility changes, tag changes, and landed effects commit in one database statement. The emission also survives verbatim in its model-emission mirror. A **failed** OPEN/FOLD (bad target, matcher, or tag signal) renders normally with its status — errors are signals. The idle-turn gate reads the *emitted statements*, so a pure-curation turn is work, never idleness.
+§fold-open-meta-operations **OPEN and FOLD are meta-operations — log-curation directives, not world actions.** They change log visibility and classifications, never the underlying resources. A **successful** OPEN/FOLD **is recorded in the log** but **suppressed from the packet render**: the row exists for forensics — a curation act with NO trace is how a weak model folding its own task frame stayed invisible until a database dig — while the render still costs it nothing, so FOLD stays genuinely free (the original rowless design's concern, met by hide-not-drop). Its exact selected target set, each target's folded intervals before and after, and the classifications actually added and removed persist with that event; `matched: N` and the authored selector are not the database's sole effect evidence. The operation row, visibility changes, tag changes, and landed effects commit in one database statement with each before state as a collision guard. The authored program also survives verbatim in its `turnOps` item. A **failed** OPEN/FOLD (bad target, matcher, or tag signal) renders normally with its status — errors are signals. The idle-turn gate reads the *emitted statements*, so a pure-curation turn is work, never idleness.
 
-§kill-log-receipt-suppressed **A successful KILL of a log item is suppressed from the render too — same principle, different mechanism.** KILL is a real deletion (not a meta-op), but once it has executed against a `log://` target its tombstone is *spent*: the killed row is gone, and a receipt saying "I deleted it" is no forward-actionable context. So a **successful** `KILL` whose target is a **log item** is recorded in the DB (forensics) and suppressed from the packet, while its emission survives in its model-emission mirror. Without suppression, every deleted row would create a replacement receipt, so per-row curation could not shrink the log. The suppression is **scoped to log targets**: a `KILL` of a `worker://` note, an `sh://` stream, or any stored artifact is a **world mutation**, not log housekeeping, and stays visible. A **failed** KILL (bad target, no match ≠ error but a malformed coordinate is) renders like any error.
+§kill-log-receipt-suppressed **A successful KILL of a log item is suppressed from the render too — same principle, different mechanism.** KILL is a real deletion (not a meta-op), but once it has executed against a `log://` target its tombstone is *spent*: the killed row is gone, and a receipt saying "I deleted it" is no forward-actionable context. So a **successful** `KILL` whose target is a **log item** is recorded in the DB (forensics) and suppressed from the packet, while its authored program survives in its `turnOps` item. Without suppression, every deleted row would create a replacement receipt, so per-row curation could not shrink the log. The suppression is **scoped to log targets**: a `KILL` of a `worker://` note, an `sh://` stream, or any stored artifact is a **world mutation**, not log housekeeping, and stays visible. A **failed** KILL (bad target, no match ≠ error but a malformed coordinate is) renders like any error.
 
 ### §log-sensitive-request-evidence Durable request evidence
 
@@ -1404,7 +1506,7 @@ secret detection.
 | Query and authored body             | Preserved exactly; they are authored content and URI identity, not structurally identifiable credential slots.                                                                                                                                  |
 | Parser failure                      | Preserves the structural diagnosis and source position without quoting request-metadata contents ({§path-request-metadata}).                                                                                                                    |
 | Client, fork, packet, and digest    | Consume the stored projection; none owns a second redaction policy.                                                                                                                                                                             |
-| Model-call evidence and model-emission mirror | `model_calls.response` under {§emission-admission} and the folded row under {§model-entry-log-curation} remain exact forensic evidence and are the explicit exception.                                                               |
+| Model-call evidence and source artifacts | `model_calls.response` under {§emission-admission}, `turnOps` under {§turn-ops-log-curation}, and `emissionAttempt` under {§rejected-emission-entry} remain exact forensic evidence and are the explicit exception.                                                               |
 
 ### §copy COPY (engine-orchestrated)
 
@@ -1471,7 +1573,8 @@ AST: `{ op: "FIND", target (scope), body: MatcherBody | null (predicate), signal
   as READ, entry CRUD, and any preceding `prepareFind()`. URI authorities are
   identity-bearing: `https://example.com/page` queries
   `(https, /example.com/page)`, never `(https, /page)`.
-- §find-glob-filter-on-content `body` matcher operates on entry content (glob/regex/jsonpath/xpath), per `plurnk.md` "Pattern Filtering"; the path-glob lives in the (target), not the body.
+- §find-channel-selection The target selects a channel under {§channel-selection}. That channel controls candidate eligibility, every matcher dialect's content or derivation, match-evidence coordinates, and exact producer-result composition. A selected channel absent from an exact entry is 404; a broad scope simply excludes entries lacking it. Successful resource-mode results remain complete default-first channel groups, so sibling channels are navigable catalog metadata rather than additional matches.
+- §find-glob-filter-on-content `body` matcher operates on the addressed entry channel (glob/regex/jsonpath/xpath), per `plurnk.md` "Pattern Filtering"; the path-glob lives in the (target), not the body.
 - §find-semantic-selection Every matcher operates only over the candidate set selected by `(target)`; relation matchers do not bypass that selection. Semantic ranking is exhaustive within that candidate set, then applies the ordinary FIND result scope. Markerless semantic FIND therefore uses the same `<1,16>` default as every other matcher. Integers retain FIND's positional contract: `<N>` selects result N and `<N,M>` selects the inclusive range. A leading decimal first applies a minimum cosine-similarity threshold; following integers select positions within that ranked threshold set. Thus `<0.7,10,20>` means threshold 0.7 followed by results 10 through 20, while `<0.7>` applies the threshold and the ordinary first-16 page.
 - §find-scoped-isolation Workspace + scheme scoped — no cross-workspace/cross-scheme leakage.
 - §find-result-projection **The authored target shape determines the result unit; result cardinality never changes it** ({§find-result-unit}). Returns `FindResult { status, content, mimetype, results, range, matchingPathCount, matchLocationCount, itemsWeightTotal, returnedItemsWeightTotal }`:
@@ -1481,14 +1584,15 @@ AST: `{ op: "FIND", target (scope), body: MatcherBody | null (predicate), signal
   | exact | absent | `resource` | the one catalog channel group |
   | glob or folder | absent | `resource` | catalog channel groups |
   | glob or folder | present | `resource` | matching channel groups with `matchLocationCount` on `[0]` |
-  | exact | present | `matchLocation` | flat `{ locator?, region? }` locations |
+  | exact | present | `matchLocation` | flat `{ channel?, locator?, region? }` locations |
 
   A glob or folder remains resource mode when it resolves to one path. An exact
   target remains location mode when it has many locations. A valid exact match
   with no addressable location is status 200 with `matchingPathCount: 1`,
   `matchLocationCount: 0`, and no fabricated row; a matcher selecting no
   resource is 204. A body-less broad empty catalog survey is status 200; an
-  absent exact resource is 404.
+  absent exact resource is 404. Every entry-channel location names its `channel`
+  ({§channel-selection-visibility}); log rows carry none.
 
   Inside `FindResult`, `matchingPathCount` and `matchLocationCount` describe the
   complete selection before pagination; the packet curates those facts under
@@ -1498,9 +1602,15 @@ AST: `{ op: "FIND", target (scope), body: MatcherBody | null (predicate), signal
   contains one nonempty, flat channel array per resource. Element `[0]` is always
   the default channel and carries the bare resource path; later elements carry
   their complete `path#channel` addresses. Each channel is
-  `{ path, mimetype, weight, lines, parseIssues? }`; `parseIssues` is the
+  `{ path, mimetype, weight, lines, summary?, parseIssues? }`; `parseIssues` is the
   positive-only advisory projection of `{§mimetype-parse-issues}` for the exact
-  body derivation under `{§scheme-catalog-parse-issues}`. Resource-level `stream` and broad-match
+  channel derivation under `{§scheme-catalog-parse-issues}`.
+
+  §scheme-catalog-summary **Catalog summary.** `summary` is the exact channel
+  derivation's `{§mimetype-summary}` clipped to at most 256 Unicode code points
+  including a visible terminal ellipsis; absent metadata is omitted.
+
+  Resource-level `stream` and broad-match
   `matchLocationCount` live only on `[0]`. A single-channel resource is therefore
   a one-element array, with no path-owning wrapper or duplicated channel map.
   A terminal single-star path scope is a one-level map: direct entries retain
@@ -1520,7 +1630,9 @@ AST: `{ op: "FIND", target (scope), body: MatcherBody | null (predicate), signal
   final model-facing representation from `weight` to `tokens`
   ({§json-result-rendering}), so universal packet numbering makes result
   ordinal N addressable as line N, matching `<N>` pagination without a second
-  coordinate system. Pagination is the only FIND materialization bound; no
+  coordinate system. A returned page begins at `range.returned[0]`, and every
+  page left-pads its ordinals to the decimal width of `range.total`; content
+  therefore keeps one stable column across the complete result set. Pagination is the only FIND materialization bound; no
   hidden complete row or location collection is retained behind the public
   projection.
 
@@ -1577,7 +1689,6 @@ the loop continue; repeated offenses terminate through the engine's 500.
   live obligations. If work has completed but is unobserved, it continues
   directly to the next packet because the wake edge has already fired; only a
   genuinely empty set with no successful same-turn FOLD resolves immediately like `[200]`.
-- §send-300-choices **SEND signal `300` is an operator question - a PROPOSAL using the same stop-the-world system as file edits.** Enablement cascades: `PLURNK_QUESTIONS=0` is a servicewide ceiling; otherwise the client affirmatively requests per workspace (`settings.questions: true` at workspace creation), which ALSO injects the required `questions.md` teaching - capability and teaching gate as one ({§teaching-corpus}). An enabled workspace fails doc materialization with the read cause if that source is broken; a disabled workspace does not consume it. Enabled: the `;`-delimited body parses leniently (first segment the question, the rest choices; zero choices = an open question - never malformed), and the ask raises a proposal: dispatch stops the world, `loop/proposal` carries `{question, choices}` in attrs, and the client's accepted proposal body delivers the ANSWER - written into the ask's own model-facing rx (`{"status":200,"body":...}`), read next packet. Reject/timeout resolve through the standard {§proposal} semantics; the turn records a continue either way (never a 300 terminal), and the loop simply proceeds. Loop auto never auto-answers a question - it exists precisely to stop the world for a human, and the workspace opted in. Disabled: refused 409 with a self-decide steer, never a park into the void.
 
 ### §exec EXEC
 
@@ -1628,10 +1739,12 @@ target at its run boundary.
 core-owned temporary file after acceptance. Core reparses the complete authored
 address and resolves one exact `<1,-1>` READ through
 {§universal-read-composition}; internal source consumption never borrows the
-model-facing 16-line preview. The file lives through the executor run and core
-removes it after the subscription's terminal result has settled. A removal
-failure is reported to daemon diagnostics with its complete cause; it cannot
-rewrite the execution result, stream state, or completion wake.
+model-facing 16-line preview. Each spawn creates its file with an exclusive,
+process- and database-coordinate-independent identity. The file lives through
+the executor run and core removes it after the subscription's terminal result
+has settled. A removal failure is reported to daemon diagnostics with its
+complete cause; it cannot rewrite the execution result, stream state, or
+completion wake.
 
 Loop-flag authority follows the selected runtime's declaration:
 
@@ -1715,11 +1828,19 @@ edge. Stream closure remains a wake edge under every poll policy.
 
 §exec-readpure-ungated A `read` runtime (observes external state, e.g. search) or `pure` runtime (no observable effect, e.g. `:memory:` sqlite) is side-effect-free → **auto-run**: no proposal, no human gate, no notification. Core persists the prepared operation before applying it; that write-ahead staging has no resolution waiter and therefore cannot enter proposal discovery ({§proposal-list}). It skips the gate a host command faces, but it does NOT resolve in-band — like every exec it backgrounds and streams, its output reaching the model through the environment-observation injector (a foisted READ of newly publishable stream content each turn, {§exec-stream}), never a same-turn receipt.
 
+§effect-policy-tunable **Effect admission is deployment-tunable.** The default
+map (`host` proposes; `read`/`pure` auto-run) is the contract; the operator may
+override it deployment-wide with `PLURNK_SERVICE_EFFECT_POLICY`, a
+comma-separated `<effect>:<policy>` list (e.g. `read:propose` proposes even
+read effects). Unlisted effects keep the default. An invalid entry — unknown
+effect, unknown policy, or a non-`<effect>:<policy>` shape — fails daemon boot
+loudly rather than degrading admission.
+
 After all non-SEND operations dispatch, the initiating turn applies {§worker-optimistic-settlement} to only the EXEC streams it started, then dispatches its terminal SEND against the refreshed lifecycle state. An older stream receives no renewed opportunity merely because another turn began. This is a settlement barrier before disposition, not sibling-operation serialization: dependent EXECs remain separate observed turns.
 
 §exec-stream **Stream surfacing.** An exec's output is *observed, not fetched*.
 Each turn the environment-observation injector publishes newly publishable content
-from each owned channel as an `origin=plurnk` READ at
+from each owned channel as an `origin=_plurnk` READ at
 `<runtime>:///<coord>#<channel>`, preserving the channel's current mimetype:
 
 | channel mimetype | while active | at terminal state |
@@ -1732,7 +1853,7 @@ The per-channel cursor advances only through content actually published, so an
 active atomic document or trailing partial JSONL record never reaches the model
 as malformed structured data. Ongoing observations are folded and a terminal
 observation is born OPEN; a terminal state with no newly publishable body still
-produces one conclusion row. Every READ then obeys {§body-projection} and
+produces one bodyless conclusion row. Every READ then obeys {§body-projection} and
 therefore renders its selected result complete. A stream that closes before a
 same-turn wait remains pending until this terminal READ crosses the next packet
 boundary. The EXEC row separately records the authored invocation.
@@ -1747,17 +1868,17 @@ stream cannot fall through an internal `exec`-only query. {§stream-control}
 §exec-env-scoped **Scoped environment.** An EXEC subprocess inherits the *project's* environment — its `.env`, the standard shell vars — so the model's commands run as the project expects; but never plurnk's own secrets: the provider API keys and `PLURNK_*` config are stripped before the spawn, so a model-executed command can't `printenv` the engine's keys. The service owns the scoping policy (the denylist); the executor spawns with the env it is handed.
 
 - §exec-hold-until-concluded **The turn-hold exception** — for runtimes in `PLURNK_SERVICE_EXEC_HOLD` (a decision-table env, shipped listing the search family), an in-flight stream **pauses the cycle**: the next packet does not assemble until the stream concludes, so the model never burns a turn asking "are we there yet" about a result the engine controls end-to-end. This exception is limited to seconds-bounded runtimes whose final result the engine controls end-to-end. Bounded by `PLURNK_SERVICE_EXEC_HOLD_MS` and **fail-open**: at the cap the standard cycle resumes untouched (waits, wakes, polls). Zero grammar or teaching surface — the model emits EXEC followed by SEND signal `102` as ever; the wake-shaped world simply arrives one packet sooner. It extends selected runtimes beyond the ordinary {§worker-optimistic-settlement} cap before the next packet assembles. A bare entry holds ALL of a runtime's spawns; a `<runtime>:<effect>` suffix (`github:read`) holds only that effect-class — an MCP server is one runtime whose tools split (a `read` `get_issue` is instant; a `host` `run_migration` is a slow mutation), so an operator opts the known-fast read-class in without parking on the mutation. Conservative stays default: an arbitrary third-party server's latency never parks the engine unless a suffix opts a class in.
-- §exec-entry-sink **The entry() sink** — an executor may *request* entry materialization (execs SPEC §2.6: every sink is a consumer-implemented callback; the executor owns zero substrate). The service implements it in exec dispatch: `entry(path, content: string | null, {tags, mimetype?})` upserts the entry, then journals ONE typed `EDIT` row in the reserved `plurnk` worker's log — the fs-fiction pattern, `source` = the calling worker, `weight` = the canonical resulting span's curation weight, and `attrs.kind="entry_materialized"`. The requested tags classify that journal row under {§log-item-tags}; they never become resource metadata or duplicate into attrs. Durable replay and clients retain that exact creation event. The model packet projects the typed event as a folded system `READ` of the resulting ordinary resource: its relevant truth is readable state now available in the environment, not an agent-authored mutation. **The executor owns no fetcher:** a `content: null` is a *declaration* — the service acquires the page through schemes-http's checked WebFetcher and accepts its model-facing body and available source/evidence channels {§html-materialization}. Generic public HTML follows the same origin-Markdown, configured Tavily, and local-projection routes as exact HTTP acquisition. A failed acquisition, body-production failure, materialization exception, or absent final projection rejects the sink and produces no HTTP entry, but does not invalidate a search runtime's upstream discovery row; materialization exceptions retain their cause in daemon diagnostics. A non-null `content` is the materialize-given-body path (the caller already holds the bytes and states their mimetype) and grants no provider authority. **No page body ever rides a packet**; the announcement is the folded row's path, weight, and log classifications, and the model READs/~queries what it chooses. Parallel `entry()` calls serialize on a per-spawn chain; a rejected call leaves the chain healthy. The spawn tail settles that complete chain before unregistering, so executor idleness and shutdown are barriers over its materialization writes. The narration context (one plurnk-worker turn) is lazy per spawn, not per entry.
+- §exec-entry-sink **The entry() sink** — an executor may *request* entry materialization (execs SPEC §2.6: every sink is a consumer-implemented callback; the executor owns zero substrate). The service implements it in exec dispatch: `entry(path, content: string | null, {tags, mimetype?})` upserts the entry, then records ONE typed `EDIT` row in the reserved `plurnk` worker's log — the fs-fiction pattern, `source` = the calling worker, `weight` = the canonical resulting span's curation weight, and `attrs.kind="entry_materialized"`. The requested tags classify that log row under {§log-item-tags}; they never become resource metadata or duplicate into attrs. Durable replay and clients retain that exact creation event. The model packet projects the typed event as a folded system `READ` of the resulting ordinary resource: its relevant truth is readable state now available in the environment, not an agent-authored mutation. **The executor owns no fetcher:** a `content: null` is a *declaration* — the service acquires the page through schemes-http's checked WebFetcher and accepts its model-facing body and available source/evidence channels {§html-materialization}. Generic public HTML follows the same origin-Markdown, configured materializer, and local-projection routes as exact HTTP acquisition ({§http-materializer-plugins}). A failed acquisition, body-production failure, materialization exception, or absent final projection rejects the sink and produces no HTTP entry, but does not invalidate a search runtime's upstream discovery row; materialization exceptions retain their cause in daemon diagnostics. A non-null `content` is the materialize-given-body path (the caller already holds the bytes and states their mimetype) and grants no provider authority. **No page body ever rides a packet**; the announcement is the folded row's path, weight, and log classifications, and the model READs/~queries what it chooses. Parallel `entry()` calls serialize on a per-spawn chain; a rejected call leaves the chain healthy. The spawn tail settles that complete chain before unregistering, so executor idleness and shutdown are barriers over its materialization writes. The narration context (one plurnk-worker turn) is lazy per spawn, not per entry.
 
 ### §proposal The proposal lifecycle
 
-§proposal-202-pauses A side-effecting op does not execute on dispatch — it **proposes**. The scheme returns **202** (an EXEC `host` runtime {§exec}, an EDIT to a member file {§membership}); the engine writes the log row `state='proposed'`, registers a waiter keyed by `logEntryId`, and **pauses `dispatch`** awaiting a resolution. The pause is internal to dispatch — the turn has already closed, so {§grinder} strike accounting sees the *resolved* status, never the 202. On accept the status becomes 200 and the scheme's effect runs.
+§proposal-202-pauses A side-effecting op does not execute on dispatch — it **proposes**. The scheme returns **202** (an EXEC `host` runtime {§exec}, an EDIT to a member file {§membership}); the engine writes the log row `state='proposed'`, registers a waiter keyed by `logEntryId`, and **pauses `dispatch`** awaiting a resolution. The provider exchange and emitted operation are already durable, while the turn remains open until dispatch settles; {§engine-rails} therefore sees the *resolved* status, never the provisional 202. On accept the status becomes 200 and the scheme's effect runs.
 
 **Resolution arrives through one lifecycle:**
 
 - **Client disposition** ({§methods-proposal-resolve}) — a client interface delivers accept, reject, or cancel; AG-UI uses standard resume entries ({§agui-proposal-resolve}).
 - **Loop disposition** ({§proposal-disposition}) — core applies the exact automatic accept/reject before observational subscribers run; automatic policy is not an event listener or client fallback.
-- §proposal-timeout-cancels **Timeout is OPT-IN; the shipped default is a world that WAITS** - `PLURNK_SERVICE_PROPOSAL_TIMEOUT_MS` empty (shipped) means a pending proposal - a file edit awaiting review or a [300] question - waits indefinitely for its human: absence is not an answer, so the service does not synthesize a cancellation. A finite positive millisecond value establishes the bound; then elapsing synthesizes `cancel` (outcome `timeout`), server-side, needing no client. Every other explicit value fails at the proposal lifecycle owner and terminalizes an already-written proposal rather than silently choosing an indefinite wait.
+- §proposal-timeout-cancels **Timeout is OPT-IN; the shipped default is a world that WAITS** - `PLURNK_SERVICE_PROPOSAL_TIMEOUT_MS` empty (shipped) means a pending proposal - a file edit awaiting review - waits indefinitely for its human: absence is not an answer, so the service does not synthesize a cancellation. A finite positive millisecond value establishes the bound; then elapsing synthesizes `cancel` (outcome `timeout`), server-side, needing no client. Every other explicit value fails at the proposal lifecycle owner and terminalizes an already-written proposal rather than silently choosing an indefinite wait.
 
 **The decision drives a one-way state transition** on `log_entries.state` (resolution is idempotent — `WHERE state='proposed'`, so a second resolution 404s):
 
@@ -1808,17 +1929,14 @@ removes ownerless rows without fabricating cancellation, payload, or replay.
 
 `ProposalDisposition` is either `{ owner: "client" }` or `{ owner: "loop", decision: "accept" | "reject", outcome? }`. The decision table is complete and ordered:
 
-The `[300]` branch is identified by the durable SEND operation signal; `attrs.question` is its required presentation payload, not an independent policy switch ({§send-300-choices}).
+| `auto` | stale target | `noProposals` | Disposition                                               |
+| ------ | ------------ | ------------- | --------------------------------------------------------- |
+| true   | true         | any           | loop reject, outcome `stale_read_clobber`                 |
+| true   | false        | any           | loop accept                                               |
+| false  | any          | true          | loop reject, outcome `no_review_channel`                  |
+| false  | any          | false         | client                                                    |
 
-| `auto` | `[300]` question | stale target | `noProposals` | Disposition                                                        |
-| ------ | ---------------- | ------------ | ------------- | ------------------------------------------------------------------ |
-| true   | yes              | any          | any           | client                                                             |
-| true   | no               | true         | any           | loop reject, outcome `stale_read_clobber`                          |
-| true   | no               | false        | any           | loop accept                                                        |
-| false  | any              | any          | true          | loop reject, outcome `no_review_channel`                           |
-| false  | any              | any          | false         | client                                                             |
-
-Thus `auto` wins the otherwise nonsensical `auto + noProposals` combination, but its operator-question exception still leaves that question client-owned ({§send-300-choices}). Loop-owned settlement occurs before observational notification; observer failures are diagnosed with their cause and cannot change disposition or leave an eligible automatic proposal pending.
+Thus `auto` wins the otherwise nonsensical `auto + noProposals` combination. Loop-owned settlement occurs before observational notification; observer failures are diagnosed with their cause and cannot change disposition or leave an eligible automatic proposal pending.
 
 ---
 
@@ -1837,7 +1955,7 @@ settles it as interruption (`500`) and errors active channels before evaluating
 loops ({§worker-lifecycle-restart-recovery}); it never reports cancellation (`499`) or
 pretends to reconstruct an opaque plugin connection.
 
-§subscriptions-fold-keeps-subscription FOLD/OPEN toggles `log_entries.expanded` ({§open-fold}) — a per-worker render bit, never the subscription registry. FOLDing a streaming entry's log row collapses its body out of the packet but leaves the live stream running: curation is render-only, never cancellation.
+§subscriptions-fold-keeps-subscription FOLD/OPEN changes a log row's folded body intervals ({§open-fold}), never the subscription registry. Curation of a streaming entry's log body leaves the live stream running: visibility is render-only, never cancellation.
 
 ### §chunk-accumulation Chunk accumulation
 
@@ -1974,10 +2092,17 @@ freshness remains the owning family's concern.
 | Family    | Lean framework                     | Service-owned default leaves                                                                                                     |
 |-----------|------------------------------------|----------------------------------------------------------------------------------------------------------------------------------|
 | Schemes   | `@plurnk/plurnk-schemes`           | `@plurnk/plurnk-schemes-http`                                                                                                    |
-| Mimetypes | `@plurnk/plurnk-mimetypes`         | `application-ipynb`, `application-json`, `application-jsonl`, `application-pdf`, and `application-xml` format leaves.             |
+| Mimetypes | `@plurnk/plurnk-mimetypes`         | `application-ipynb`, `application-json`, `application-jsonl`, and `application-xml` format leaves.                                |
 |           |                                    | `text-csv`, `text-diff`, `text-dotenv`, `text-html`, `text-ini`, `text-markdown`, and `text-plain` format leaves.                 |
-|           |                                    | Fixed `embeddings` and `tokenizers` artifacts. All names use the `@plurnk/plurnk-mimetypes-*` prefix.                             |
-| Executors | `@plurnk/plurnk-execs`             | `common`, `git`, `jq`, `search`, `sqlite`, and `wasm` leaves under the `@plurnk/plurnk-execs-*` prefix.                            |
+|           |                                    | Fixed `embeddings` artifact. All names use the `@plurnk/plurnk-mimetypes-*` prefix.                                               |
+| Executors | `@plurnk/plurnk-execs`             | `common`, `git`, `jq`, `sqlite`, and `wasm` leaves under the `@plurnk/plurnk-execs-*` prefix.                            |
+
+The independently published `application-pdf` handler and `tokenizers`
+artifact are opt-in leaves. Installing either beside the service admits it
+through ordinary package discovery without changing the service manifest. The
+default local embedding artifact owns the exact counter for its own model;
+remote embedding deployments install `tokenizers` when their provider does not
+supply an exact counter.
 
 **Providers:** `@plurnk/plurnk-providers` resolves the Models.dev catalog,
 operator declarations, local adapters, and finally installed AI SDK provider
@@ -2022,12 +2147,32 @@ service manifest edit.
 
 ## §operator-config Operator Configuration
 
+### §host-path-layout Host filesystem layout
+
+On XDG-compatible hosts, artifact semantics select the default location. An
+unset or empty base variable uses the XDG default; a relative value is invalid
+and is ignored rather than resolved against the working directory.
+
+| Class | Base | Plurnk member |
+|---|---|---|
+| Configuration | `$XDG_CONFIG_HOME` (default `~/.config`) | `plurnk/.env`, `plurnk/AGENTS.md` |
+| Durable user data | `$XDG_DATA_HOME` (default `~/.local/share`) | `plurnk/plurnk.db` and SQLite sidecars |
+| Persistent operational state | `$XDG_STATE_HOME` (default `~/.local/state`) | Reserved; no directory is created without an owned artifact. |
+| Reproducible cache | `$XDG_CACHE_HOME` (default `~/.cache`) | Reserved; no directory is created without an owned artifact. |
+| Shared global Agent Skills | User home | `.agents/skills/<name>/SKILL.md` |
+
+The service creates only a directory required by the current command. A newly
+created configuration or data directory uses mode `0700`; a newly seeded
+secret-bearing `.env` uses `0600`. Existing user-owned permissions are not
+rewritten. Explicit Plurnk path overrides retain `~/` expansion and their
+ordinary precedence; XDG variables themselves require absolute paths.
+
 §operator-config-precedence Configuration is one environment cascade. Higher-priority sources preserve or replace values supplied by every lower source:
 
 | Priority | Source                             | Ordering                                                  |
 |---------:|------------------------------------|-----------------------------------------------------------|
 |        1 | Assembled package `.env.defaults` | Set-if-unset floor; one owner per key.                     |
-|        2 | `~/.plurnk/.env`                   | User-level ambient configuration.                         |
+|        2 | `$XDG_CONFIG_HOME/plurnk/.env`     | User-level ambient configuration.                         |
 |        3 | `./.env`                           | Working-directory ambient configuration.                  |
 |        4 | `--config=<path>`                  | Singular service-owned explicit file.                     |
 |        5 | `--env-file*`                      | Repeatable explicit files; later selected files win.      |
@@ -2036,17 +2181,27 @@ service manifest edit.
 
 Node's pre-script env-file form and the executable's post-script form share the same later-file-wins ordering. `--env-file-if-exists` skips an absent file without changing the order of selected files.
 
-§operator-config-env-defaults **Every package owns its knobs — `.env.defaults` is the standard.** Each package in the daemon's ecosystem — internal or third-party — ships a `.env.defaults` at its package root declaring its own knobs; the file is the package's configuration reference, traveling in the tarball and changing with the code that reads it. At boot the daemon assembles every installed member's file into one floor (membership = the `@plurnk/*` scope or a `plurnk` package.json field, gated by `PLURNK_PLUGINS_TRUSTED_ONLY` with discover()'s exact semantics), applies it set-if-unset under every operator source, and renders the assembled catalog to `~/.plurnk/.env.defaults`. The catalog is machine-owned, regenerated each boot, and never read back as configuration. A key claimed by two packages fails boot naming both. With the reader-declares discipline, each key has one implementation and one defaults owner.
+§operator-config-env-defaults **Every package owns its knobs — `.env.defaults` is the standard.** Each package in the daemon's ecosystem — internal or third-party — ships a `.env.defaults` at its package root declaring its own knobs; the file is the package's configuration reference, traveling in the tarball and changing with the code that reads it. At boot the daemon assembles every installed member's file into one floor (membership = the `@plurnk/*` scope or a `plurnk` package.json field, gated by `PLURNK_PLUGINS_TRUSTED_ONLY` with discover()'s exact semantics) and applies it set-if-unset under every operator source. `plurnk-service config defaults` renders the same complete, owner-labelled aggregate to stdout on demand, preserving comments and optional declarations without persisting a second copy or exposing effective secret values. A key claimed by two packages fails boot naming both. With the reader-declares discipline, each key has one implementation and one defaults owner.
+
+§operator-config-discovery The conventional `plurnk-service config` command
+family is a view over the environment cascade, never another configuration
+representation. `config` reports the canonical `.env`, actual source order,
+and model-selection state; `config edit` opens that file through `$VISUAL` or
+`$EDITOR`; `config defaults` emits the aggregate above; and `config check`
+validates the provider-free configuration contracts without starting a model
+or provider request. The seeded `.env`, first-run diagnostic, service help, and
+missing-model recovery all signpost `plurnk-service config defaults` as the
+complete installed option catalog.
 
-Model selection: separate alias cascade in `ProviderRegistry` ({§provider-instantiation}). `PLURNK_MODEL_<alias>=<provider>/<model-id>` declares; `PLURNK_MODEL=<alias>` selects. Optional `PLURNK_MODEL_CHILD=<alias>` selects the default child provider; unset means inherit the spawning loop's provider. Aliases and selections live in `.env`, not `.env.defaults` (operator-specific).
+Model selection uses one selector vocabulary in `ProviderRegistry` ({§provider-instantiation}). `PLURNK_MODEL_<alias>=<provider>/<model-id>` optionally declares a friendly route and tuning scope; `PLURNK_MODEL=<selector>` selects either that alias or an exact provider/model route. `PLURNK_MODEL_CHILD=<selector>` uses the same vocabulary for the default child provider; unset means inherit the spawning loop's provider. Operator selections and alias declarations live in `.env`, not `.env.defaults`.
 
 | Var                                                         | Default | Purpose |
 |-------------------------------------------------------------|---------|---------|
-| `PLURNK_SERVICE_DB_PATH`                                    | `~/.plurnk/plurnk.db` | SQLite file path. |
+| `PLURNK_SERVICE_DB_PATH`                                    | `$XDG_DATA_HOME/plurnk/plurnk.db` | SQLite file path; an explicit non-empty value overrides the derived default. |
 | `PLURNK_HOST`                                               | `127.0.0.1` | Bind address for the listener. Local-only by default. |
 | `PLURNK_PORT`                                               | `3044` | TCP port for THE client surface — the AG-UI+ listener (the plurnk-agui plugin module binds it at boot). Production is single-listener. |
 | §operator-config-git-ceiling `PLURNK_SERVICE_GIT_ALLOWED`   | `1` | Hard service ceiling: only `1` admits Git membership, status, branch batching, and `git`/`isogit` executors; every other value denies them before executor registration or packet teaching. |
-| `PLURNK_SERVICE_MAX_TURNS`                                  | `-1` | Operator turn **ceiling** — `-1` = no cap; a positive value clamps `runLoop({maxTurns})`. The effective value is persisted on the durable loop and counts cumulatively across every `202` park/resume. |
+| `PLURNK_SERVICE_MAX_TURNS`                                  | `-1` | Operator inference-turn **ceiling** — `-1` = no cap; a positive value clamps `runLoop({maxTurns})`. The effective value is persisted on the durable loop and counts completed model/inference turns cumulatively across every `202` park/resume; `_plurnk`, client, and plugin turns remain chronology but consume none of this allowance. |
 | `PLURNK_SERVICE_MAX_COMMANDS`                               | `-1` | Per-emission action ceiling; `-1` = no cap (default) — every generated op dispatches. A positive value caps dispatched actions: overflow ops drop with one durable `max-commands-exceeded` error row on the next packet. PLAN and the final disposition always dispatch. Tightened per workspace via `settings.maxCommands` (min wins). |
 | §operator-config-loop-timeout `PLURNK_SERVICE_LOOP_TIMEOUT` | `86400000` | ms wall-clock budget for a single core loop: expiry aborts the loop signal mid-flight (a stuck `generate` included) and the loop terminates `504 loop_timeout` — a legible engine terminal, kin to the exec `<T>` reap's 504 ({§exec-timeout}). |
 | `PLURNK_SERVICE_MAX_STRIKES`                                | `6` | Consecutive admitted-turn strike threshold ({§engine-rails}). |
@@ -2060,7 +2215,6 @@ Model selection: separate alias cascade in `ProviderRegistry` ({§provider-insta
 | `PLURNK_SERVICE_MAX_CYCLE_PERIOD`                           | `4` | Max period length cycle detection examines ({§engine-rails}). |
 | `PLURNK_SERVICE_REQUIEM_MAX_TOKENS`                         | `16384` | Initial forensic witness output allowance ({§digest-requiem}). |
 | `PLURNK_SERVICE_REQUIEM_RETRY_MAX_TOKENS`                   | `32768` | Retry allowance; must be at least the initial requiem allowance ({§digest-requiem}). |
-| `PLURNK_SERVICE_MD_<ALIAS>`                                 | (unset) | Operator reference doc: materializes `<path>` as `worker://plurnk/<ALIAS>.md`, auto-READ into every model worker's turn 0 ({§actor-boundary-doc-injection}). `~` expands to home. |
 | `PLURNK_SERVICE_FILES_ITEMS`                                | `-1` | Turn-0 catalog preview. Folder-capable schemes render a one-level `*` map with `dir/**` rollups; kernel docs remain recursive and explicitly complete. `-1` = markerless first pages; positive `N` explicitly caps only file-map rows; `0` / unset = off ({§actor-boundary-catalog-preview}). |
 | `PLURNK_SERVICE_PROPOSAL_TIMEOUT_MS`                        | (empty — waits indefinitely) | Finite positive milliseconds before cancellation with outcome `timeout`; empty waits, and every other explicit value fails ({§proposal-timeout-cancels}). |
 
@@ -2069,14 +2223,13 @@ Every core knob listed is enforced at its owning read site; `.env.defaults` is t
 **Two override semantics — ceiling vs default.** Which kind a var is determines what "override" means across the cascade:
 
 - **Ceiling** (most-restrictive-wins) — an operator-set hard bound nothing downstream may exceed: not a lower-precedence file, not a per-workspace constraint, not a per-call seam argument. `PLURNK_SERVICE_GIT_ALLOWED` ({§operator-config-git-ceiling}), `PLURNK_SERVICE_MAX_COMMANDS`, `PLURNK_SERVICE_MAX_STRIKES`, and `PLURNK_SERVICE_MAX_TURNS` (`-1` ships it off; a positive value caps the per-call request). The sandbox/cost guarantee: the operator caps it; no client widens it.
-- **Default** (explicit-wins) — a fallback the most-specific setter replaces freely: `PLURNK_MODEL` (a `runLoop({alias})` request overrides it) and the config-time vars (`HOST` / `PORT` / `DB_PATH`).
+- **Default** (explicit-wins) — a fallback the most-specific setter replaces freely: `PLURNK_MODEL` (a `runLoop({selector})` request overrides it) and the config-time vars (`HOST` / `PORT` / `DB_PATH`).
 
 §operator-config-shipped-defaults **The shipped `.env.defaults` is itself under
-test.** It has no active `PLURNK_SERVICE_MD_*` doc alias because policy is a
-section and a doc default double-injects it; no active `PLURNK_MODEL`; no active
-local GBNF constraint; and the policy renders in exactly one packet section.
-Every other tier runs the test cascade, so shipped-default regressions are
-otherwise invisible by construction.
+test.** It has no active `PLURNK_MODEL`; no active local GBNF constraint; and
+the policy renders in exactly one packet section. Every other tier runs the
+test cascade, so shipped-default regressions are otherwise invisible by
+construction.
 
 §operator-config-flag-parity The companion **flag-parity** check binds code and
 template both ways: every `PLURNK_SERVICE_*` the service reads has a
@@ -2124,12 +2277,10 @@ boundary. Operator-arcane knobs stay environment-only.
 | Field                  | Admitted value                                 | Composition / owner                                           |
 | ---------------------- | ---------------------------------------------- | ------------------------------------------------------------- |
 | `settings.filesItems`  | Integer `>= -1`                                | Explicit replacement {§operator-config-workspace-files-items} |
-| `settings.mdDocs`      | Array of `{ alias: [\w.-]+, content: string }` | Alias-keyed union {§operator-config-workspace-md-docs}        |
 | `settings.maxCommands` | Non-negative integer                           | Tightening ceiling {§operator-config-workspace-max-commands}  |
 | `settings.git`         | Boolean                                        | Tightening denial {§operator-config-workspace-git}            |
 | `settings.client`      | Nonempty string                                | Stable self-identification {§client-metadata}                 |
 | `settings.execs`       | Record of policy-key to string                 | Subtractive executor layer {§operator-config-workspace-execs} |
-| `settings.questions`   | Boolean                                        | Affirmative question request {§send-300-choices}              |
 
 The composition families remain distinct so one setting's semantics never
 leak into another.
@@ -2137,8 +2288,6 @@ leak into another.
 *Defaults — explicit-wins (the client replaces/merges freely):*
 
 - §operator-config-workspace-files-items `settings.filesItems` (number) **replaces** `PLURNK_SERVICE_FILES_ITEMS` for the workspace: a one-shot opens clean (`0`, no preview), with ordinary markerless pages (`-1`), or with the file list explicitly capped (`N`, other surveys remain markerless). A single scalar — the client value wins outright.
-- §operator-config-workspace-md-docs `settings.mdDocs` (`[{alias, content}]`) **unions** with the server's `PLURNK_SERVICE_MD_*` docs, keyed by alias — a client adds its own repo docs atop the operator's systemwide policy doc. On alias collision the client wins before I/O (a deliberate shadow), so the unselected operator path is not read; every selected non-empty operator path is required, and absence or another read failure rejects materialization with its cause. The client sends content (it owns the file), not a path.
-
 *Ceilings — most-restrictive-wins (the client may only narrow, never widen):*
 
 - §operator-config-workspace-max-commands `settings.maxCommands` (number)
@@ -2158,9 +2307,8 @@ leak into another.
   effective workspace registry is authoritative and the settings layer only
   intersects it: settings cannot register or re-enable a runtime. A canonical
   key for a currently absent tag is accepted as inert policy and applies if a
-  workspace capability provider later publishes that tag. Dispatch, the
-  model-facing capability sheet, and executor
-  document materialization use the same registered-set intersection and policy
+  workspace capability provider later publishes that tag. Dispatch and
+  model-facing tool-resource materialization use the same registered-set intersection and policy
   predicate, so a workspace-disabled tag is neither executable nor taught.
 
 Feature-flag bools use `process.env.X === "1"` exactly — never `=== "true"`.
@@ -2199,6 +2347,18 @@ recovers durable lifecycle, and starts modules in registration order. Shutdown
 closes started and self-closing modules in reverse order and surfaces aggregated
 close failures.
 
+§module-discovery **Third-party daemon-module composition is manifest
+discovery.** A package declares `plurnk: { kind: "module", module:
+"<export-subpath>" }`; the export is one DaemonModule (an object, or a no-arg
+factory returning one). At boot, core scans installed packages under the
+executor family's discovery and trust rules ({§plugin-discovery}) and
+registers every trusted declaring module before any module setup runs, in
+package-enumeration order. The service's explicit composition — the AG-UI,
+hooks, and MCP modules — carries init options and is wired in service.ts;
+discovery never duplicates those packages. An untrusted declaring package is
+skipped with a boot warning, never executed. A module export that is neither
+an object nor a no-arg factory fails boot loudly.
+
 §module-shutdown-order `Daemon.stop()` returns only after active worker drains,
 streaming producers, derivations, mimetypes, schemes, and every accepted
 conclusion-wake task have settled in dependency order. The supervisor owns each
@@ -2206,6 +2366,12 @@ asynchronous wake task from acceptance through settlement; a task failure
 participates in the shutdown aggregate. The database may be released only after
 the final wake barrier resolves.
 
+§crash-only-stop The settle sequence is deadline-bounded
+(`PLURNK_SERVICE_STOP_TIMEOUT_MS`, default 30000): past the deadline each wait
+is abandoned with a named error instead of hanging the daemon on a child that
+never closes. A wedged child costs a forced shutdown; it must never cost an
+unbounded one.
+
 ```mermaid
 flowchart LR
     stop[Stop accepting work] --> drains[Settle worker drains]
@@ -2251,13 +2417,14 @@ Its function names are transport-neutral library calls, not public wire names.
 | §methods-proposal-resolve Proposals               | `resolveProposal(logEntryId, resolution)` | Validates and delivers one accept, reject, or cancel decision to the engine. An unknown or already-resolved id fails; the client protocol owns how the decision arrived. |
 | §client-interaction-list Client interactions      | `pendingClientInteractions(workspaceId)` | Intersects durable interaction rows with their live operation waiters and returns the contracts-owned projection; a row alone is not a resumable interaction. |
 | §methods-client-interaction-resolve Client interactions | `resolveClientInteraction(interactionId, resolution)` | Validates and delivers one resolved payload or cancellation. Unknown, ownerless, and already-resolved identities fail before affecting an operation. |
-| §methods-loop-run Loops                           | `runLoop({ workspaceId, workerId, prompt, maxTurns?, flags?, openPaths?, alias?, model?, childAlias?, childModel? })` | Validates a model worker and provider policy, persists it with the effective turn ceiling, then returns an immediate status-100 acknowledgement with `loopId` and `action`. The exact terminal result arrives only through `loop/terminated`; parking and resuming do not replace the loop. |
+| §methods-loop-run Loops                           | `runLoop({ workspaceId, workerId, prompt, maxTurns?, flags?, openPaths?, selector?, childSelector? })` | Validates a model worker and provider policy, persists it with the effective turn ceiling, then returns an immediate status-100 acknowledgement with `loopId` and `action`. The exact terminal result arrives only through `loop/terminated`; parking and resuming do not replace the loop. |
 | §methods-loop-cancel Loops                        | `cancelDrain(workerId, reason?)` | Begins durable structured cancellation of the worker tree and reaps its process-local scopes. The boolean reports whether process-local work existed when called; queued or parked durable work is still terminalized when it is `false`. |
-| §methods-op-mirror Client dispatch                | `dispatchClientAction({ workspaceId, workerId, statements })` | Dispatches already-parsed grammar statements as one client action and one journal segment. Every statement is an ordered turn, and every committed `log/entry` is emitted before the action promise resolves; a proposal may keep that promise and segment open until resolution. Core exposes no per-op method family. |
+| §methods-op-mirror Client dispatch                | `dispatchClientAction({ workspaceId, workerId, statements })` | Dispatches already-parsed grammar statements as one client action in one administrative loop. Every statement is an ordered client/operation turn, and every committed `log/entry` is emitted before the action promise resolves; a proposal may keep its turn, loop, and action promise open until resolution. Core exposes no per-op method family. |
 | Client observation                                | `look({ workspaceId, workerId, statement })` | Runs an already-parsed READ through the full resolver without a log row. A non-READ statement is rejected ({§op-look}). |
 | §methods-log-read Reads                           | `readLog({ workspaceId, workerId, ...coordinate })` | Ownership-checks the worker, then reads by ids, recency, or the complete `loopSeq`/`turnSeq`/`sequence` display coordinate. `limit` defaults to 100 and is capped at 1000. |
 | §methods-entry-read Reads                         | `readEntry({ workspaceId, workerId, target, channel?, offset? })` | Resolves the selector from that worker's perspective and returns {§entry-read-result}, either complete or as one channel suffix, without creating action evidence. |
 | Providers                                         | `listProviders()` | Lists configured aliases with provider/model identity, active state, and the effective provider-derived `inputCapacity` when known. |
+| Model catalog                                     | `listModels(query)` | Returns one validated bounded {§model-catalog-wire} page under {§model-catalog}; performs no provider request or selection. |
 | Client capabilities                               | `listClientDisplayCapabilities()` | Composes sorted scheme declarations ({§manifest-client-display}) followed by sorted MIME declarations ({§mimetype-client-display}) into the validated shared wire ({§client-display-capabilities}). The internal `exec` operation handler is excluded; its addressable runtime-tag scheme faces remain included. |
 | §methods-workspace-create Workspace lifecycle     | `createWorkspace({ name?, projectRoot?, settings?, constraints? })` | Validates `settings` through {§operator-config-workspace-settings}, creates the world and its client envelope, materializes current docs and constraints, starts derivation warming, and emits global `workspace/created`. `projectRoot` is established here or the workspace remains headless. |
 | §methods-workspace-attach Workspace lifecycle     | `attachWorkspace({ workspaceId, workerId?, workerName? })` | Validates ownership and returns a client envelope for an existing world. It does not retain caller or transport binding state in core. |
@@ -2306,8 +2473,8 @@ workspace lifecycle calls return exactly the workspace and selected client actor
 carry no conversation-worker or action-loop binding. Core retains no connection,
 thread, or current-workspace mapping. A module may replace its own binding with a
 later create or attach result without requiring a new transport; it resolves the
-conversation worker separately, while each client action allocates its own journal
-segment under {§connection-lifecycle}.
+conversation worker separately, while each client action allocates its own
+administrative loop under {§connection-lifecycle}.
 
 §methods-worker-name-reserved **Client worker-name admission.** Attach,
 fresh-conversation, and fork apply {§worker-name-minting} before lookup or
@@ -2315,24 +2482,118 @@ creation. A client therefore cannot forge or resume an internal worker, insert
 a non-mintable spelling, or make the client registry diverge from model worker
 control.
 
-§methods-loop-run-model **Per-loop model selection.** Optional `model`
-(client-resolved `<provider>/<model>`, wins) or `alias` (a declared
-`PLURNK_MODEL_<alias>`) overrides the boot default for a newly created loop.
-The fully resolved provider identity is persisted on that loop and remains
-immutable through turns, parks, wakes, and restart. Injecting into an existing
-loop with a conflicting selection fails before work is accepted. Provider
-instances are cached; no resume path substitutes a boot default for missing or
-malformed durable selection.
+§worker-settings **The worker carries its own behavioral rules.** The
+workspace is the world — how things are; each worker is an actor inside it,
+carrying the rules its loops obey. Those rules live in one JSON bag
+(`workers.settings`), declared by the client at worker creation and mutable
+between loops through `readWorkerSettings`/`setWorkerSettings`; the bag is
+validated at the client-input boundary against a closed known-key set, and
+unknown keys never persist. A fork begins with the default empty bag — no
+inherited rules, no live link. Readers are permissive: malformed persisted
+JSON yields the default rules, never a read failure. There is no servicewide
+or workspace ceiling on a worker's own rules; each client decides for its own
+workers.
+
+§question-tool **The native request-user-input tool.** Core registers one
+in-process `question` runtime at boot. Its body is the MCP2 2026-07-28
+form-elicitation shape verbatim — `{ message, requestedSchema }` — and its
+`results` channel carries the standard `ElicitResult`
+(`{ action: "accept", content }` or `{ action: "cancel" }`); nothing bespoke
+crosses the wire. The executor maps the body onto the contracts-owned
+`ClientInteractionRequest` (toolName `question`) and awaits the shared
+client-interaction lifecycle — durable pause, reconnect discovery,
+cancellation, and the answer-as-resolution all come from
+{§client-interactions}; there is no loopback MCP and no proposal masquerade.
+Effect `read`: the tool observes the human's answer and is never
+proposal-gated. Admission is per-worker under {§worker-settings}: the tool
+exists for a worker only when that worker's `requestUserInput` rule is set.
+
+§worker-tool-admission **Per-worker tool admission.** A runtime may be
+admitted per worker through the reserved tool tree's visibility rule: the
+find/read faces of the worker scheme drop a tool doc for an asking worker
+whose own rules don't admit it, before matching and rendering, so counts,
+weights, and the catalog text all agree — the tool does not exist for that
+worker's FIND. Dispatch enforces the same boundary with an explicit
+not-available outcome. Admission reads the worker's behavioral rules
+({§worker-settings}) at the operation boundary, never at registration.
+
+§model-catalog **Model discovery is a bounded local projection, not provider
+activity.** Core composes the release-pinned Models.dev snapshot with
+provider-owned `{§model-catalog-readiness}`. The default query includes only
+providers configured enough to attempt; `availability: "all"` includes every
+catalog model with structured missing-configuration causes. Provider and text
+filters apply before deterministic selector ordering and offset/limit paging;
+the default page is 50 and the schema caps it at 100. Discovery never probes,
+authenticates, invokes, or selects a model, and catalog data never enters model
+packets or state snapshots.
+
+§worker-model-selection **Worker-owned model selection.** Every model worker
+owns one durable model, persisted as a nullable `model_routes` foreign key.
+The root conversation worker is seeded once — from an explicit selection, else
+the daemon default — and never re-seeded from a later default change. A
+deliberately modelless daemon leaves the worker unset and rejects model work
+until an explicit selection. Starting a loop snapshots the worker's resolved
+model onto the loop; inject, park, wake, retry, reconnect, and restart
+continue from the loop snapshot and never re-resolve through the alias
+cascade. A WORK/FORK child copies the spawning loop's effective spawn model
+(spawn override ?? model) onto the new worker by value at creation; it retains
+no live link and begins with no override, so a later parent change affects
+only that worker's future loops and descendants. Client operation actors and
+Plurnk-owned bookkeeping workers run no model loops and own no model
+selection. An explicit selection or spawn-override change while the worker
+holds a live or parked loop is a precise `409 worker-loop-active`, never a
+silent retroactive switch of the immutable loop snapshot; select after
+concluding or cancelling the loop.
+
+A client-created branch copies the source worker's durable model, spawn
+override, and reasoning policy by value alongside its history. It retains no
+live policy link to the source worker.
+
+§worker-reasoning-policy **Reasoning is a durable worker policy.** Each selected
+worker model has exactly one member of the shared `{§reasoning-policy-wire}`;
+a modelless worker has none. A declared alias's scoped environment value—or the
+global provider value for an exact route—seeds the policy only when the worker
+first receives its model. Model identity and reasoning
+policy are persisted atomically, while visibility of returned reasoning and
+token ceilings remain separate concerns. An explicit policy change validates
+the exact policy against both the worker model and its optional spawn model and
+is refused while the worker owns a live or parked loop. Client inspection
+returns the supported-policy intersection of those two routes. Inspection or
+mutation materializes the daemon-default model and policy onto an uninitialized
+model worker before answering; a deliberately modelless daemon remains unset.
+
+Starting a loop snapshots the worker's policy beside its model. Restart, retry,
+park, wake, and injection retain that immutable snapshot. WORK, FORK, and BARE
+inherit the spawning loop's policy by value; no descendant consults a later
+environment or parent-worker change. Unsupported policies fail with a precise
+provider-boundary problem rather than being silently weakened or translated.
+
+§methods-loop-run-model **Per-loop model selection.** `runLoop` accepts one
+optional `selector`: either a declared alias or an exact `<provider>/<model>`
+route. An exact route stores no fabricated alias and receives no alias-scoped
+configuration. An explicit selection persists onto the
+addressed worker before the loop snapshots it; an omitted selector is not a
+selection and continues the worker's durable model
+({§worker-model-selection}). The fully resolved provider identity and reasoning
+policy are persisted on the loop and remain immutable through turns, parks,
+wakes, and restart ({§worker-reasoning-policy}).
+Injecting into an existing loop with a conflicting explicit selection fails
+before work is accepted. Provider instances are cached; no resume path
+substitutes a boot default for missing or malformed durable selection.
 
 §methods-loop-run-child-provider **Child-provider selection is one durable
-subcall policy.** Optional `childModel` (client-resolved `<provider>/<model>`, wins) or
-`childAlias` selects the provider for every WORK/FORK descendant and BARE inference; omitted uses
-`PLURNK_MODEL_CHILD`, while explicit `childAlias: null` means inherit. Core
-persists the resolved policy on each loop. A child runs on that provider and
-carries the same policy deeper; inherit uses the spawning loop's provider and
-remains inherit. BARE consumes the selection without spawning a child. Packet admission is unchanged: a smaller WORK is valid when
-its packet fits, and an oversized inherited FORK terminates through the ordinary
-child-loop result without preflight assembly or provider fallback.
+subcall policy.** Optional `childSelector` uses the same alias-or-exact-route
+vocabulary for every WORK/FORK descendant and BARE inference; omitted uses
+`PLURNK_MODEL_CHILD`, while explicit `childSelector: null` means inherit. An
+explicit override persists onto the addressed worker before the loop
+snapshots it; an omitted selector continues the worker's durable override
+({§worker-model-selection}). Core persists the resolved policy on each loop. A
+child runs on the spawning loop's effective spawn model and carries the same
+policy deeper; inherit uses the spawning loop's provider and remains inherit.
+BARE consumes the selection without spawning a child. Packet admission is
+unchanged: a smaller WORK is valid when its packet fits, and an oversized
+inherited FORK terminates through the ordinary child-loop result without
+preflight assembly or provider fallback.
 
 §methods-log-coordinate **Log coordinate.** Every `LogEntry` returned by
 `readLog` or emitted through `log/entry` carries `loop_seq` and `turn_seq`
@@ -2344,6 +2605,13 @@ preserve causal `source` and parse the row's JSON `attrs` into structured data;
 they also project the row's complete sorted `tags` classification. Client
 interfaces do not reconstruct these fields from operation or origin.
 
+§methods-readable-reasoning **Readable provider reasoning remains derived
+provider evidence.** On the model SEND row only, `readLog` and `log/entry`
+project a nonempty admitted `packet.assistant.reasoning` as the optional
+`reasoning` field. The durable packet remains the sole stored representation;
+core does not copy readable reasoning into log attributes or bodies. A turn
+without readable reasoning omits the field.
+
 §op-look **LOOK ownership.** A client-interface module owns the public LOOK
 spelling and grammar parsing. It rewrites a valid LOOK statement to READ and
 hands the AST to core's `look`; core owns the full resolver and the no-log
@@ -2387,10 +2655,10 @@ outward envelope that requires it and owns workspace fan-out.
 
 A module client is an actor ({§machine-processes}). Its dispatched side effects
 write to its own client worker with `origin="client"`; one client action owns
-one journal segment, and its statements become ordered turns inside that
-segment. A proposal may hold the segment across an external interrupt/resume,
-but the segment records durable evidence rather than defining the public client
-lifecycle. Multiple client actors have distinct workers.
+one administrative loop, and its statements become ordered operation turns
+inside that loop. A proposal may hold its turn and loop across an external
+interrupt/resume, but those records preserve durable evidence rather than
+defining the public client lifecycle. Multiple client actors have distinct workers.
 
 `runLoop` targets a separate model worker holding the conversation with
 `origin="model"`. Both workers share workspace state, while a packet renders
@@ -2415,14 +2683,14 @@ implementation status, and superseded alternatives belong in forge issues.
 
 `PacketBuilder.buildRequestPacket` owns the engine's default ordered section
 list. Trusted scheme plugins may transform that first-class list before it is
-rendered or measured; the grinder remains an engine-owned post-build rail.
+rendered or measured; {§overflow-turn} remains an engine-owned post-build rail.
 
 ```mermaid
 flowchart LR
     defaults[Engine section drafts] --> transforms[Trusted scheme transforms<br/>and boundary validation]
     transforms --> render[Render system and user slots]
     render --> measure[Budget substitution and<br/>core-owned measurement]
-    measure --> rail[Engine grinder and dispatch]
+    measure --> rail[Engine budget admission and dispatch]
 ```
 
 #### §packet-cache-monotone Default order and cache locality
@@ -2434,21 +2702,19 @@ Conditional absence never reorders the surviving default sections.
 |     1 | system | `definition`          | Framework definition; leads the most stable prefix. |
 |     2 | system | `system-policy`       | Operator policy; empty content is omitted on the wire. |
 |     3 | system | `project-policy`      | Project policy; empty content is omitted on the wire. |
-|     4 | system | `tools`               | Executable capability sheet for this loop. |
-|     5 | system | `optional-operations` | Present only when optional operations are enabled. |
-|     6 | system | `schemes`             | Active resource catalogue. |
-|     7 | system | `inject`              | Present only when operator notes are configured. |
-|     8 | user   | `log`                 | Append-mostly model-visible history. |
-|     9 | user   | `child-streams`       | Per-turn status; empty content is omitted. |
-|    10 | user   | `child-workers`       | Per-turn status; empty content is omitted. |
-|    11 | user   | `errors`              | Per-turn failure pointers; empty content is omitted. |
-|    12 | user   | `notices`             | Per-turn observations; empty content is omitted. |
-|    13 | user   | `git`                 | Per-turn workspace status; empty content is omitted. |
-|    14 | user   | `budget`              | Model-facing packet pressure; omitted when capacity is unknown. |
-|    15 | user   | `prompt`              | Current prompt-entry pointers. |
+|     4 | system | `schemes`             | Active resource catalogue. |
+|     5 | system | `inject`              | Present only when operator notes are configured. |
+|     6 | user   | `log`                 | Append-mostly model-visible history. |
+|     7 | user   | `child-streams`       | Per-turn status; empty content is omitted. |
+|     8 | user   | `child-workers`       | Per-turn status; empty content is omitted. |
+|     9 | user   | `errors`              | Per-turn failure pointers; empty content is omitted. |
+|    10 | user   | `notices`             | Per-turn observations; empty content is omitted. |
+|    11 | user   | `git`                 | Per-turn workspace status; empty content is omitted. |
+|    12 | user   | `budget`              | `Context Token Budget`; omitted when capacity is unknown. |
+|    13 | user   | `prompt`              | Current prompt-entry pointers. |
 
 The order favors prefix-cache locality where semantics permit: the definition
-and privileged policy lead loop-dependent capabilities, while the append-mostly
+and privileged policy lead the resource directory, while the append-mostly
 log leads the volatile user-status clump. It does **not** claim that every system byte is
 immutable or that the complete packet is globally monotone in volatility:
 capabilities, operator notes, and policies can change. Trust is a separate
@@ -2469,7 +2735,7 @@ sections. It receives no separate engine, database, actor, or request context.
 This is strictly a trusted in-process seam, admitted through the common plugin
 trust gate; an external client action cannot invoke it. Whole-list transformation is
 the fork-avoidance valve for alternate packet shapes ({§ecosystem}), while
-grinding and folding remain closed engine concerns.
+overflow recovery and folding remain closed engine concerns.
 
 ### §tokenomics Tokenomics: four facts, one curation ruler
 
@@ -2484,8 +2750,8 @@ time of measurement.
 | Provider usage and cost | Provider-reported input/output/cache/reasoning tokens and monetary evidence | After every physical request | Durable physical-request forensics under {§provider-usage}; never curation state or a preflight estimate. |
 
 - §tokenomics-weight-stored-at-write **Curation weight, stored at write.** `entry_channels.weight` weighs the complete channel content. `log_entries.weight` weighs the complete canonical `LogBody` content before coordinate and packet presentation; persistence `tx`/`rx` envelopes contribute nothing merely by existing, and proposal settlement recomputes the value when the canonical result changes. Bodyless rows therefore weigh zero. The stored number is a stable content-depth measurement, not a provider-token prediction.
-- §tokenomics-render-weight-budget **Packet curation budget.** The Curation headline measures the *assembled packet* after section transforms and readout substitution. Core measures minimum-width probes, monotonically expands fields that do not fit, then right-aligns final values into those widths; final substitution is length-invariant and displayed weight equals the stored request weight. A `SUM` of stored content weights measures a different artifact and cannot substitute for packet render weight.
-- §tokenomics-context-percent **Curation percent.** The headline carries packet weight as a percentage of its curation budget beside the absolutes. It reads the capacity already resolved by the provider; no extra provider call.
+- §tokenomics-render-weight-budget **Packet curation budget.** `tokensActiveTotal` measures the *complete assembled packet* after section transforms and readout substitution; it is not a sum of log-row `tokensActive` fields. Core measures minimum-width probes, monotonically expands fields that do not fit, then right-aligns final values into those widths; final substitution is length-invariant and the displayed total equals the stored request weight. `tokensActiveMax` is the provider-derived curation calibration. A `SUM` of stored content weights measures a different artifact and cannot substitute for packet render weight.
+- §tokenomics-context-percent **Curation percent.** `tokensActiveTotal` carries packet weight as a percentage of `tokensActiveMax`. It reads the capacity already resolved by the provider; no extra provider call.
 - §tokenomics-window-partition **One capacity derivation; no service-side token budget.** The provider owns model limits and the configured total output envelope. Its resolved `inputCapacity` is the numeric curation-budget calibration as well as the physical denominator exposed to clients. That reuse is policy, not a unit conversion: Core compares stable curation weight with it only to shape context, while provider request-shaped evidence alone admits or rejects I/O. `PLURNK_SERVICE_PROMPT_BUDGET`, `PLURNK_SERVICE_SAFETY`, and the additive reasoning/completion reserve knobs are retired; local and custom deployments tune context window, total output budget, optional reasoning subset, and prompt-projection percentage at their owning layers.
 - §tokenomics-prompt-projection-share **Prompt projection is stable packet policy.**
   `PLURNK_SERVICE_PROMPT_PROJECTION` is a required alias-scoped percentage in
@@ -2496,15 +2762,15 @@ time of measurement.
   one prompt's projection byte-stable as the worker log evolves.
 - §tokenomics-window-unpollable-deliberate **Unknown provider capacity stays unknown.** When the provider cannot derive `inputCapacity`, Core omits denominator-dependent curation telemetry and uses the ordinary bounded prompt projection. The provider still sends requests whose measurement or limits are estimates or unavailable: ambiguity defers to the upstream capacity oracle rather than becoming a local rejection.
 
-§tokenomics-client-gauge **Clients receive curation and physical occupancy as separate pairs.** `loop/terminated.usage` carries latest-turn `curationWeight`/`curationBudget` and latest-emission-call `contextTokens`/`contextCapacity`; each unknown fact is `null`. Both physical facts bind to that same call: a preflight rejection may report capacity while its absent physical request leaves `contextTokens=null`, never borrowed from an earlier call. Clients never divide provider-reported physical tokens by Core curation weight. `providers.list` exposes each instantiated alias's `inputCapacity`. A model switch replaces the latest-turn facts together; aggregate provider accounting remains cardinal monetary evidence, not a gauge input.
+§tokenomics-client-gauge **Clients receive curation and physical occupancy as separate pairs.** `loop/terminated.usage` carries latest packet-bearing model-turn `curationWeight`/`curationBudget` and latest-emission-call `contextTokens`/`contextCapacity`; each unknown fact is `null`. Packetless chronology cannot erase an assembled-request gauge. Both physical facts bind to that same call: a preflight rejection may report capacity while its absent physical request leaves `contextTokens=null`, never borrowed from an earlier call. Clients never divide provider-reported physical tokens by Core curation weight. `providers.list` exposes each instantiated alias's `inputCapacity`. A model switch replaces the latest-turn facts together; aggregate provider accounting remains cardinal monetary evidence, not a gauge input.
 
 - **Derivation is eager and exhaustive.** Workspace creation and searchable-resource changes start one coalesced warm. The first model turn joins that warm; later turns derive intervening changes before dispatch. No model operation observes partial graph or vector coverage. A semantic query ranks every eligible candidate in scope, so lexical overlap never gates vector recall. With no embedder, readable-content FTS is the explicit keyword fallback. Progress notices make the wait visible; latency is never hidden by partial semantics. {§derivation-exhaustive}
 - §membership-binary-sniff **Binary truth beats the label; no entry dominates the corpus.** A tracked member whose HEAD bytes contain NUL enters {§membership-source-projection} as `application/octet-stream` **regardless of what extension-based detection claims**; byte-level evidence outranks a default label. Every eligible text is tiled losslessly to the embedder window and every tile is embedded before its derivation attaches; semantic ranking max-pools the best chunk per candidate.
 - §tokenomics-agnostic-ruler **One model-agnostic curation ruler.** The daemon runs workers on different models in one workspace concurrently, while catalog and log accounting are workspace-wide. `contentWeight = ceil(chars/2)` therefore gives one content one stable number without per-model workspace state or recount passes. It controls curation only; every provider call independently measures the complete request as well as it can.
-- §tokenomics-neutral-telemetry **Curation telemetry is state, with one pressure alarm.** The model-facing Curation section ordinarily has one line: budget, current packet weight and percentage, and free weight. When free weight is negative, exactly one second line directs the model to FOLD or KILL less-relevant log items. Per-entry weights remain on log rows where they describe OPEN cost and FOLD savings. Packet-level composition, rankings, and physical token speculation are absent.
+- §tokenomics-neutral-telemetry **Curation telemetry is state, not response allowance.** The model-facing `Context Token Budget` section contains exactly two fields on separate lines: `tokensActiveTotal: N (P%)` and `tokensActiveMax: M`. It never presents their difference as free response tokens. The protocol definition directly requires FOLD, KILL, or trimming of irrelevant log items to keep the next packet within the maximum. Per-entry weights remain on log rows where they describe OPEN cost and FOLD savings. Packet-level composition, rankings, and physical token speculation are absent.
 - §tokenomics-content-hash-identity **Content identity, not per-tokenizer counts.** Static channel writes stamp `content_hash` (SHA-256) as stable content identity. `weight` is stored beside that content and is never keyed or recomputed by model.
-- §tokenomics-provider-usage **Provider accounting is physical-request evidence, not curation state.** Every issued physical request has one durable pre-I/O `provider_requests` identity and settles once as response or error. Each record preserves conventional {§provider-usage} quantities and required {§provider-cost} evidence; an unreported quantity remains absent, including on response-less failures, and is never replaced by zero. `model_calls` own logical response/failure evidence, `turn_attempts` specialize emission admission, and `provider_requests` are the sole durable accounting representation. Emissions, BARE calls, rejected responses, retries, failovers, and errors therefore remain cardinal and ordered. Turn, loop, worker, workspace, digest, and protocol accounting are derived from those records through the shared {§provider-accounting} projection; only emission calls contribute the latest-packet context gauge. The baseline stores no floating-point money, denormalized totals, or rollup triggers. A documented direct charge becomes `charged`; otherwise the provider may compute an exact-decimal USD `estimated` amount from complete usage and the exact model's Models.dev rates; insufficient evidence becomes `unknown`. Derived `costUsd` is an exact decimal string only when every request is expressible in USD and is `null` otherwise. This is operational request accounting, not invoice reconciliation. Output and reasoning are quantities the model cannot FOLD, so they never alter the model-facing Budget ledger.
-- §tokenomics-negative-pressure **Negative curation pressure is honest and nonterminal.** The readout describes the packet the model actually receives: weight and percent may exceed the curation budget, and free weight equals `budget - weight` without flooring. Crossing the budget records {§grinder-overflow-problem}, then the grinder ({§grinder}) folds only the newest boundary. Remaining curation debt never decides physical admission, creates a strike, or establishes a one-turn quota.
+- §tokenomics-provider-usage **Provider accounting is physical-request evidence, not curation state.** Every issued physical request has one durable pre-I/O `provider_requests` identity and settles once as response or error. Each record preserves conventional {§provider-usage} quantities and required {§provider-cost} evidence; an unreported quantity remains absent, including on response-less failures, and is never replaced by zero. `model_calls` own logical response/failure evidence, `turn_attempts` specialize emission admission, and `provider_requests` are the sole durable accounting representation. Emissions, BARE calls, rejected responses, retries, failovers, and errors therefore remain cardinal and ordered. Turn, loop, worker, workspace, digest, and protocol accounting are derived from those records through the shared {§provider-accounting} projection; only emission calls contribute the latest-packet context gauge. The baseline stores no floating-point money, denormalized totals, or rollup triggers. A documented direct charge becomes `charged`; otherwise the provider may compute an exact-decimal USD `estimated` amount from complete usage and the exact model's Models.dev rates; insufficient evidence becomes `unknown`. Derived `costUsd` sums every USD-expressible request and is `null` only when no request is expressible; a response-less failure or an uncataloged model is skipped, never allowed to erase the expressible evidence. The derived aggregate usage sums every reported quantity the same way. This is operational request accounting, not invoice reconciliation. Output and reasoning are quantities the model cannot FOLD, so they never alter the model-facing Budget ledger.
+- §tokenomics-negative-pressure **Negative curation pressure is honest but never submitted.** The provisional readout may report `tokensActiveTotal` and its percentage above `tokensActiveMax`. Crossing the maximum diverts that would-be model turn into {§overflow-turn}; no over-ceiling packet reaches `provider.generate`. Automatic recovery does not create a strike or consume a model-turn allowance.
 
 ### §membership Workspace identity, membership, disk co-location
 
@@ -2537,7 +2803,7 @@ flowchart LR
 | Internal entries   | Workspace or worker entries are canonical store state. Writing one never implies a project-file write.                                      |
 | Authority          | Service flags set the membership ceiling; workspace constraints narrow it; client or loop auto resolves proposals. `origin` is attribution. |
 
-§web-search-retrieval **Web search and retrieval are one first-class composition.** A search runtime enumerates a configured maximum of candidate URLs and hands each to the engine as a `content: null` `entry()` request ({§exec-entry-sink}): the guarded `WebFetcher` sink fetches candidates in parallel, off the write-serialization chain, and materializes successful bodies as ordinary HTTP entries. SearXNG owns membership and rank; Plurnk does not rerank or classify sources. Every candidate whose `entry()` call rejects, regardless of failure reason, is mechanically omitted from the model-facing result directory; survivors retain upstream order. The compact directory carries `title/url/snippet/publishedDate/materialized`; it locates readable resources and is not a substitute for their contents. Without an entry sink the executor cannot test materialization and omits the verdict.
+§web-search-retrieval **Web discovery is an ordinary MCP concern; retrieval is a first-class composition.** PLURNK owns no search runtime: a search-capable MCP server (e.g. Brave Search) participates through the ordinary MCP contract — admission, read-effect classification, tool documentation, and packet projection are identical to every other MCP tool ({§mcp-tool-presentation}). An executor that wants to materialize discovered pages uses the generic `content: null` `entry()` request ({§exec-entry-sink}): the guarded `WebFetcher` sink fetches candidates in parallel, off the write-serialization chain, and materializes successful bodies as ordinary HTTP entries. Every candidate whose `entry()` call rejects, regardless of failure reason, is mechanically omitted from the model-facing result directory; survivors retain upstream order. Without an entry sink the executor cannot test materialization and omits the verdict.
 
 Search prefetch and direct HTTP READ materialize the same resource contract:
 protocol + canonical authority (including a non-default port) + path + serialized
@@ -2547,13 +2813,10 @@ media type, and projection identity remain explicit auxiliary evidence. A
 normal
 `## READ0 (https://host/path?query)` therefore publishes only the sanitized body
 under that exact URL—never raw HTML, response headers, or a channel-selection
-lesson. FIND and embeddings consume the same stored readable
-projection and never re-fetch each match. Because the search family is in
-`PLURNK_SERVICE_EXEC_HOLD`, the cycle holds until acquisition concludes
-({§exec-hold-until-concluded}), so the next packet contains final
-materialization verdicts and folded ambient rows for every acquired page.
+lesson. FIND and embeddings consume the addressed stored channel representation
+and never re-fetch a match.
 
-§search-gate Coverage protects the composition at distinct seams: HTTP unit tests pin fragmentless-body publication and explicit auxiliary selection; integration tests pin search→materialize→FIND and persistence/publication separation. Model web demos run the live composition end to end — real SearXNG, real pages; stubbed acquisition is confined to unit and integration seams and never appears in a demo. A live positive-control demo requires a materialized HTTPS body and a substantive answer from a real sanitized page. Live discovery demos remain diagnostic and may expose model judgment failures without weakening these assertions. **The search gates** are rail-family accounting — in-memory per-loop state cleaned at the same seam as strikes, restart-drop accepted (a post-restart duplicate re-fetches; the TTL makes it cheap): an IDENTICAL duplicate (same runtime + query in one loop) **strikes and serves** — status 409 (the strike rail counts the turn failure) carrying the prior ranked digest re-read live from the original exec entry, no re-fetch, no provenance prose; the per-turn CAP (`PLURNK_SERVICE_SEARCH_MAX_PER_TURN`) is flood control — 429 with a legible steer, nothing served.
+§web-retrieval-live Coverage protects the composition at distinct seams: HTTP unit tests pin fragmentless-body publication and explicit auxiliary selection; integration tests pin materialize→FIND and persistence/publication separation. A live positive-control demo requires a materialized HTTPS body and a substantive answer from a real sanitized page; live discovery demos remain diagnostic and may expose model judgment failures without weakening these assertions.
 
 **Git is the substrate and the repository is the boundary:**
 
@@ -2564,19 +2827,14 @@ materialization verdicts and folded ambient rows for every acquired page.
   or nested independent repository is not discovered or managed by this
   workspace. When Git is absent there is no filesystem walk; `pick` is then the
   sole source.
-- §git-native-default **Core Git reads use native Git by default.** Membership
-  and status execute the installed Git binary.
+- §git-native-default **Core Git reads use native Git.** Membership and status
+  execute the installed Git binary. An absent or failed binary yields no
+  automatic Git membership or status; core has no alternate implementation or
+  fallback. An independently installed `isogit` executor remains an explicit,
+  model-invoked subset for shellless deployments, not an ambient Git backend.
 - §membership-git-hermetic Native Git runs with ambient `GIT_*` and
   global/system config scrubbed, so repository identity follows `project_root`,
   never the daemon's launch environment.
-- §git-isomorphic-opt-in `PLURNK_SERVICE_GIT_ISO=1` explicitly selects the
-  in-process isomorphic-git backend for a deployment that cannot spawn Git. The
-  alternative is never an automatic fallback: an absent native binary yields
-  no automatic Git membership or status, never an isomorphic retry; an
-  incompatible isomorphic repository surfaces its preserved upstream cause
-  and directs the operator back to the default. The isomorphic untracked scan
-  remains differential-gated against native
-  `ls-files --others --exclude-standard`.
 - §membership-edit-membership-gate **Membership-gated edits.** EDIT is bounded by membership exactly as READ is. An existing **member**'s baseline is its entry snapshot — the body channel the model READ, not a fresh disk read — so the diff is naive against the view the model saw, never empty (the write-side CAS, {§membership-edit-write-cas}, prevents the silent overwrite of out-of-band drift). An existing **non-member** is refused (403) *before* any read or write: the model never reads a file it can't see (no leak into the proposal) and never overwrites one (no wiping a gitignored `.env` it never added). A **new path** stays open — proposal→accept adds it to the manifest. Reaching past membership is `## EXEC0 [sh]`'s job, not the file scheme's.
 - §membership-create-parents **Parent-complete creation.** An accepted File creation—whether authored as EDIT or as a COPY/MOVE destination—recursively creates missing parent directories before writing and registering the new member.
 
@@ -2601,13 +2859,14 @@ identity, and terminal disposition without exposing raw bytes or a base64 lane.
 | Binary with readable projection    | Derived Unicode as `text/markdown`                   | READ uses the projection; source-aware EDIT remains 415.                         |
 | Binary without projection/over cap | Empty marker under the source binary mimetype        | READ and EDIT return 415; private metadata distinguishes unavailable from limit. |
 
-§derivation-dedup-parallel **The index dedups then parallelizes.** The derivation identity hashes the exact READ body, mimetype, reader behavior, embedding configuration, and applicable search exclusion. A resource attaches the immutable artifact only after it is complete; identical entry and log bodies therefore share one FTS row, one symbol graph, and one vector set without copying. Distinct artifacts run with bounded producer concurrency (`PLURNK_SERVICE_DERIVE_CONCURRENCY`). Pending artifacts sort by readable content length before entering that pool, so small resources start first while every outlier still derives fully. Unset uses a host-relative square-root fan-out; a positive integer is an exact operator budget and `-1` claims every core. Token-count and embedding batches retain only a pool-sized promise window; graph persistence writes at most `PLURNK_SERVICE_DERIVE_STORE_BATCH` definitions or references per SQLite statement. Every resource completed by a successful pass attaches a terminal classified artifact, identically at concurrency 1 and N. Multi-item warming reports aggregate milestones and heartbeat notices according to `PLURNK_SERVICE_DERIVE_PROGRESS_STEPS` and `PLURNK_SERVICE_DERIVE_PROGRESS_HEARTBEAT_MS`.
+§derivation-dedup-parallel **The index dedups then parallelizes.** The derivation identity hashes the exact READ channel representation, mimetype, reader behavior, embedding configuration, and applicable search exclusion. A channel or log projection attaches the immutable artifact only after it is complete; identical projections therefore share one FTS row, one symbol graph, and one vector set without copying. Distinct artifacts run with bounded producer concurrency (`PLURNK_SERVICE_DERIVE_CONCURRENCY`). Pending artifacts sort by readable content length before entering that pool, so small resources start first while every outlier still derives fully. Unset uses a host-relative square-root fan-out; a positive integer is an exact operator budget and `-1` claims every core. Token-count and embedding batches retain only a pool-sized promise window; graph persistence writes at most `PLURNK_SERVICE_DERIVE_STORE_BATCH` definitions or references per SQLite statement. Every representation completed by a successful pass attaches a terminal classified artifact, identically at concurrency 1 and N. Multi-item warming reports aggregate milestones and heartbeat notices according to `PLURNK_SERVICE_DERIVE_PROGRESS_STEPS` and `PLURNK_SERVICE_DERIVE_PROGRESS_HEARTBEAT_MS`.
 
-The artifact also retains a positive `{§mimetype-parse-issues}` count when the
-exact parsed body reported one. It remains advisory alongside a normally
-completed semantic disposition; zero and unavailable evidence persist as
-absence. Catalog projection attaches it only to that parsed body channel, never
-to sibling channels whose content the artifact does not describe.
+The artifact also retains a positive `{§mimetype-parse-issues}` count and the
+full normalized `{§mimetype-summary}` when the exact parsed channel reported
+either. Both remain advisory alongside a normally completed semantic
+disposition; zero, empty, and unavailable evidence persist as absence. Catalog
+projection attaches either only to that channel, never to a sibling whose
+content the artifact does not describe.
 
 Every completed artifact records one terminal disposition: `vector`, `lexical`
 (only no embedder or an operator size ceiling), `excluded` (the configured
@@ -2621,11 +2880,11 @@ every non-vector attachment with its disposition and reason. Successful
 optional projection degradations continue indexing and surface their framework
 Notice once per identical observation in a maintenance pass.
 
-§semantic-embed-dedup **Identical content embeds once.** The metaproject's repeated `tokenizer.json` bodies - and any log result exposing the same exact READ body - attach one content-addressed derivation artifact. Graph, FTS, and chunk vectors exist once; addresses join through the artifact hash. One pass-wide semantic plan binds the selected chunk counter to this identity: the embedder's own counter is covered by model-space identity, while a separately resolved fallback counter contributes its `tokenizerId` and exactness. Model, vocabulary, vector-wire encoding ({§mimetype-embedding-wire}), or configuration changes therefore produce a different identity, so incompatible vector spaces, encodings, or chunk boundaries never share.
+§semantic-embed-dedup **Identical content embeds once.** The metaproject's repeated `tokenizer.json` channels - and any log result exposing the same exact readable text - attach one content-addressed derivation artifact. Graph, FTS, and chunk vectors exist once; addresses join through the artifact hash. One pass-wide semantic plan binds the selected chunk counter to this identity: the embedder's own counter is covered by model-space identity, while a separately resolved fallback counter contributes its `tokenizerId` and exactness. Model, vocabulary, vector-wire encoding ({§mimetype-embedding-wire}), or configuration changes therefore produce a different identity, so incompatible vector spaces, encodings, or chunk boundaries never share.
 
 Lossless chunk admission requires either the embedder's own counter or an exact fallback tokenizer. An empirical estimate never proves that content fits the declared token window. When pending readable content would require vectors and only an estimate is available, maintenance surfaces its degradation Notice and fails before embedding or attaching a derivation; no/disabled embedding and the established empty, binary, excluded, and maximum-size dispositions remain non-vector outcomes.
 
-§semantic-max-embed-size **Embedding has an optional size posture.** `PLURNK_SERVICE_MAX_EMBED_SIZE` is an operator-set maximum UTF-8 byte size eligible for vectors; `0` is unlimited and is the shipped default. The measured value is the exact default body READ exposes and the embedder receives. Exhaustive embedding therefore remains the normal posture. When a nonzero ceiling rejects an oversized body, the entry remains directly readable with full graph and lexical indexing; only vectors are absent. The setting is folded into the deep derivation signature, so changing it honestly re-derives affected entries. Client notices report compact aggregate progress; the digest records every non-vector pathname, terminal disposition, and reason for forensic inspection.
+§semantic-max-embed-size **Embedding has an optional size posture.** `PLURNK_SERVICE_MAX_EMBED_SIZE` is an operator-set maximum UTF-8 byte size eligible for vectors; `0` is unlimited and is the shipped default. The measured value is the exact addressed channel representation READ exposes and the embedder receives. Exhaustive embedding therefore remains the normal posture. When a nonzero ceiling rejects an oversized representation, its channel remains directly readable with full graph and lexical indexing; only vectors are absent. The setting is folded into the deep derivation signature, so changing it honestly re-derives affected channels. Client notices report compact aggregate progress; the digest records every non-vector address, terminal disposition, and reason for forensic inspection.
 
 §membership-change-gated-sync **Sync is idempotent and change-gated.** Per turn, membership materializes every member's model-readable snapshot into its entry. Text with an unchanged disk signature is a stat-only no-op. The version token is either the observed `mtime:size` or the explicit `absent` state; an observed deletion removes the stale readable channels, and a later reappearance is therefore a new divergence rather than a first-sight materialization. Binary sources additionally compare the cached per-mimetype projection identity; unchanged bytes are never reacquired, while changed reader behavior rematerializes without fabricating a filesystem-divergence event. Coverage is exhaustive across the project repository while work is proportional to source or projection change. After a pass every member carries the current representation defined by {§membership-source-projection}.
 
@@ -2647,55 +2906,57 @@ beneath each call. Its constraints distinguish pending calls, response
 evidence, and response-less errors while monetary classification remains
 explicit.
 
-### §grinder Budget enforcement: the grinder
+### §overflow-turn Budget enforcement: automated recovery turns
 
-The grinder is the one pre-provider curation path for the model-facing gauge.
-It never decides physical admission. Every request then crosses the provider's
-request-shaped capacity boundary, where proven exact overflow may reject
-pre-I/O and ambiguous evidence defers to upstream:
+Budget recovery is an ordinary state-machine transition, not a private packet
+mutation. Every candidate model request first crosses the model-facing curation
+ceiling and then, only if admitted, the provider's request-shaped physical
+capacity boundary:
 
 ```mermaid
 flowchart TD
-    assemble["Assemble and measure<br/>request packet"] --> policy{"Packet weight ≤<br/>curation budget?"}
-    policy -->|yes| generate["Provider generate"]
-    policy -->|no| problem["Record nonterminal 413<br/>Token Budget Overflow"]
-    problem --> fold["FOLD newest boundary<br/>and its OPEN effects<br/>tag overflow"]
-    fold --> rebuild["Rebuild and remeasure"]
-    rebuild --> generate
-    generate --> capacity{"Provider capacity<br/>failure?"}
+    assemble["Assemble and measure<br/>candidate request"] --> budget{"Weight ≤ curation ceiling?"}
+    budget -->|yes| generate["Provider generate"]
+    budget -->|no| recover["Keep turn packetless<br/>reclassify as `_plurnk` overflow"]
+    recover --> fold["Dispatch PLAN, whole-body FOLD ops,<br/>and SEND through ordinary dispatch"]
+    fold --> verify{"Rebuilt request fits?"}
+    verify -->|yes| next["Next model turn"]
+    verify -->|no| stop["Terminal 413"]
+    next --> assemble
+    generate --> capacity{"Provider capacity failure?"}
     capacity -->|no| response["Classify completed response"]
     capacity -->|yes| prompt{"Withholding automatic<br/>prompt bodies changes request?"}
-    prompt -->|yes| retryPrompt["Persist failure;<br/>rebuild and retry"]
-    retryPrompt --> generate
-    prompt -->|no| boundary{"Newest boundary not yet<br/>rolled back, and rollback<br/>changes request?"}
-    boundary -->|yes| retryBoundary["Persist failure;<br/>roll back, rebuild, retry"]
-    retryBoundary --> generate
-    boundary -->|no| stop["Persist terminal 413"]
+    prompt -->|yes| retry["Persist failure;<br/>rebuild and retry"]
+    retry --> generate
+    prompt -->|no| stop
 ```
 
-§grinder-overflow-only **The grinder fires only on actual overflow.** In
-`Engine.runTurn`, after `PacketBuilder.buildRequestPacket` assembles the request
-and before `provider.generate`, it compares the packet's render-weight
-({§tokenomics}) with the provider-derived curation budget. At or under the budget, the packet
-ships untouched. The grinder never trims
-speculatively or "helpfully."
-
-- §grinder-overflow-problem **Token Budget Overflow is a nonterminal 413 Problem.** Every over-ceiling assembly records exactly one `engine/context/token-budget-overflow` Problem before automatic recovery, with pre-recovery `usage`, `ceiling`, and `deficit` evidence. Its exact `detail` is `Token Budget Overflow: Token Usage exceeded Token Ceiling. Newest log items were automatically FOLDed to fit within token budget. Curate the log and/or perform more conservatively scoped or chunked retrieval operations to recover.` The Problem remains durable and model-visible even when folding restores room and the turn later concludes successfully; it does not strike or replace the turn's terminal disposition.
-- §grinder-layer1-rollback **One rule, every turn: roll back context introduced by the newest boundary.** On overflow the grinder folds, in one set operation, still-open rows born in the immediately prior turn or current pre-model turn plus exact older rows that a successful OPEN in the immediately prior turn transitioned from folded to open. It reads those landed effects from {§fold-open-meta-operations}; it never re-runs the selector, treats an already-open target as newly introduced, or chooses other older history by relevance. Turn 1 has no prior turn, so only its pre-model rows qualify. The same set operation additively applies the `overflow` tag to every row it folds; rows and bodies remain re-OPENable.
-- §grinder-errors-exempt **Errors, the prompt, AND the plan are exempt.** The grinder never folds an `op='error'` row: errors are the model's durable, curatable record of what went wrong. Nor does it fold the actionless **user prompt** row (`prompt:///<loop>/<N>`): the task frame is not ordinary model-authored memory. Nor a **PLAN row**: the checklist is the model's orientation surface when the grinder fires. All three stay OPEN until the model itself FOLDs or KILLs them.
-- §grinder-hard-413 **Only a provider capacity failure can terminalize at 413.** Every `provider.generate` assesses its exact request under {§provider-surface-capacity}. A proven exact preflight overflow issues no physical request; estimate, unavailable evidence, and a non-fitting upper bound defer to upstream, whose context rejection normalizes to the same `capacity_exceeded` failure. Core retries only after changing the request: first by withholding automatic prompt-body projection when that changes the packet, then by rolling back the newest boundary once when the grinder has not already done so and that changes the packet. Each failed logical call, any issued physical request, capacity evidence, and model-visible provider Problem remain durable; these recovery calls do not consume the completed-emission attempt budget. Core never resends identical bytes as capacity recovery and never chooses arbitrary older history. If neither recovery changes the request, or the changed request is still rejected, the request-only turn and exact provider Problem terminalize the loop at **413 Content Too Large**.
-
-- §tokenomics-fetch-fits-free **A retrieval larger than the available packet room arrives folded with a 413 explanation.** The result lands in the next build; if that build exceeds the curation budget, Core records {§grinder-overflow-problem} and folds the newest boundary, which contains the result. Its row and exact body remain durable and re-OPENable, and its `overflow` tag identifies every row selected by the automatic fold. Remaining curation debt follows {§tokenomics-negative-pressure}.
-
-- §loop-terminals **Engine-imposed terminals are HTTP-precise** — the loop-status vocabulary, one meaning each: `200` concluded (the model's SEND signal `200`) · `499` model-abandoned (signal `499`, or a cancel) · `429` maxTurns exhausted · `413` provider input-capacity failure after changed-request recovery · `500` strike threshold or invalid-emission exhaustion (distinct Problem types; `508` when the crossing strike was a detected cycle) · `504` loop timeout / exec-timeout restamp · `202` the bounded wait — a loop blocked on a live obligation (the model's `## SEND0 [202] <T,P>`, {§wait-obligation-matrix}); a wait on nothing resolves to `200` unless a successful same-turn FOLD requires the curated next packet · `100`/`102` queued/running. Never a catch-all, never a new value without changing the owning schema.
-
-§grinder-pressure-surface **What the model sees.** A fold-to-fit packet carries the open {§grinder-overflow-problem} row, its terse `## Errors` pointer, and ordinary folded rows whose complete sorted `tags` include `overflow`. If curation pressure remains negative but the provider accepts the request, the Budget section also reports the negative free-weight value and its one panic line ({§tokenomics-neutral-telemetry}). The curation 413 diagnoses the overflow without striking, terminalizing the turn, or changing the ordinary operation contract.
-
-The model controls its context; the provider owns physical admission, and Core
-performs only bounded changed-request recovery without choosing what older
-history matters. The same boundary applies on turn 1 and turn 101. The grinder
-folds reversibly, never deletes, and never performs speculative or non-overflow
-trimming.
+§overflow-turn-only **Recovery occurs only after measured overflow and before
+provider I/O.** After packet assembly, Core compares render weight
+({§tokenomics}) with the provider-derived curation ceiling. An admitted packet
+ships untouched. An over-ceiling candidate is never stored as a model request
+and never reaches `provider.generate`; its already-created database turn instead
+becomes a packetless `_plurnk` turn. Packetless initialization and recovery turns
+remain ordinary turn chronology but do not consume `maxTurns`, model-call,
+emission-attempt, usage, or cost accounting.
+
+- §overflow-turn-script **Recovery is one ordinary admitted `_plurnk` program.** Its PLAN body is `Automatically FOLD log bodies newly active at token-budget overflow.`, followed by every causal whole-body FOLD and terminal `SEND0 [102]` with body `Next: YOU MUST ONLY FOLD, KILL, or trim ALL superseded, stale, or irrelevant log content in bulk in the next turn.` The final sentence requires the successor's substantive operations to be one dedicated, comprehensive bulk-curation program; mandatory PLAN and SEND framing still applies. Its exact `turnOps` is born FOLDED; successful FOLD rows follow {§fold-open-meta-operations} and therefore remain durable but packet-suppressed. Every recovery row carries `_plurnk` and `overflow`; no model call, synthetic receipt, or parallel explanation exists.
+- §overflow-turn-curation **The preceding turn owns the pressure it introduced.** Core deterministically selects every body already created in the packetless candidate turn, every body created by the immediately preceding completed turn in that worker's chronology, and every older body whose visibility that preceding turn's successful OPEN increased. Every selected body is FOLDed whole (`<1,-1>`) through ordinary dispatch. Already-wholly-folded and bodyless rows require no operation. Core performs no relevance judgment, exempts no operation or resource kind, reconstructs no interval delta, re-runs no authored selector, and chooses no unrelated older history.
+- §overflow-turn-hard-413 **Recovery fails hard when the causal fold cannot fit.** After the ordinary FOLDs land, Core rebuilds and remeasures once. If the plan changes no visibility or the rebuilt request still exceeds the ceiling, the loop terminalizes with an exact `engine/context/token-budget-overflow` 413 Problem; Core neither submits excess bytes nor chooses unrelated older history. Separately, every `provider.generate` assesses physical capacity under {§provider-surface-capacity}. Core may retry a provider capacity rejection only after withholding automatic prompt-body projection when that changes the request. If it cannot produce changed bytes or the changed request is still rejected, the request-only model turn and provider-owned Problem terminalize at **413 Content Too Large**.
+
+- §tokenomics-fetch-fits-free **A retrieval larger than the available packet room remains addressable.** Its complete row lands in the model turn that requested it. If the following candidate packet exceeds the curation ceiling, {§overflow-turn-curation} FOLDs the new body and classifies it `_plurnk` and `overflow`; the exact body remains durable and selectively re-OPENable.
+
+- §loop-terminals **Engine-imposed terminals are HTTP-precise** — the loop-status vocabulary, one meaning each: `200` concluded (the model's SEND signal `200`) · `499` model-abandoned (signal `499`, or a cancel) · `429` maxTurns exhausted · `413` token-ceiling recovery failure or provider input-capacity failure after changed-request recovery · `500` strike threshold or invalid-emission exhaustion (distinct Problem types; `508` when the crossing strike was a detected cycle) · `504` loop timeout / exec-timeout restamp · `202` the bounded wait — a loop blocked on a live obligation (the model's `## SEND0 [202] <T,P>`, {§wait-obligation-matrix}); a wait on nothing resolves to `200` unless a successful same-turn FOLD requires the curated next packet · `100`/`102` queued/running. Never a catch-all, never a new value without changing the owning schema.
+
+§overflow-turn-surface **The packet is the resulting state, not an account of it.**
+The first request after recovery is assembled by the ordinary packet path from
+the actual durable log after the recovery turn. It therefore carries the prior
+causal rows genuinely FOLDED, the recovery PLAN and SEND genuinely OPEN, and
+the recovery `turnOps` genuinely FOLDED. Successful recovery FOLD receipts are
+absent under the universal curation rule. No notice, reconstruction, auto-open,
+or overflow-specific projection simulates what `_plurnk` did; OPENing the exact
+`turnOps` reveals the program that did it. The model retains complete authority
+to reverse or refine that curation through ordinary log operations.
 
 ### §env-delta The environment delta: what changed since the model last looked
 
@@ -2711,7 +2972,7 @@ flowchart LR
     kernel --> events
     typed --> events
     events --> pull["Pre-turn lossless pull<br/>(cursor, captured high-water]"]
-    pull --> log["Observer's self-contained log<br/>origin=plurnk; born FOLDed"]
+    pull --> log["Observer's self-contained log<br/>origin=_plurnk; born FOLDed"]
     log --> packet["Packet lists coordinate;<br/>OPEN recalls exact body"]
 ```
 
@@ -2755,7 +3016,7 @@ cross this door, while an ancestry-authorized explicit READ remains available.
 | Field       | Meaning                                                                                                                                                                                 |
 | ----------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | `worker_id` | The worker whose self-contained log owns the materialized row.                                                                                                                          |
-| `origin`    | The actor tier that wrote the row; a materialized delta is `plurnk`.                                                                                                                    |
+| `origin`    | The actor tier that wrote the row; a materialized delta is `_plurnk`.                                                                                                                   |
 | `source`    | The causal identity. Worker causes use the canonical `worker://<name>` control identity; non-worker causes use a stable subsystem token (currently `file`); self-authored rows omit it. |
 
 §env-delta-no-coalescing **Only filesystem observation nets.** One filesystem
@@ -2904,7 +3165,7 @@ leaves the request-only record, while rejected exchanges remain in
 
 | Turn state                    | `turns.packet`                                  |
 | ----------------------------- | ----------------------------------------------- |
-| No model request assembled    | SQL `NULL`                                      |
+| No model request assembled (including initialization and overflow turns) | SQL `NULL` |
 | Request assembled             | `{ weight, sections }`                         |
 | Response admitted             | `{ weight, sections, assistant, assistantRaw }` |
 
@@ -2921,9 +3182,27 @@ leaves the request-only record, while rejected exchanges remain in
 `StoredPacket` is the one core type and validation path for this algebra. The
 flat schema enforces its root states; typed reads additionally validate every
 section and parsed operation. A hard budget stop remains request-only. Client,
-setup, filesystem-narration, and executor-materialization turns are
-journal-only and therefore store `NULL`. Digest writes an explicit journal-only
-or request-only note instead of fabricating response files.
+setup, filesystem-narration, and executor-materialization turns are ordinary
+operation turns and therefore store `NULL`. Digest projects exact operation
+source independently from this optional model-exchange record; a request-only
+turn receives a note instead of a fabricated response.
+
+§digest-turn-artifact-identity **Digest packet artifacts project durable turns.**
+After selectors are applied, digest retains every turn with exact `turnOps` or
+a stored provider request, orders those turns by durable chronology, and names
+them contiguously from `packet000`. The producer does not affect projection.
+
+| Artifact | Present when | Authority |
+|----------|--------------|-----------|
+| `packetNNN.assistant.md` | The turn has `turnOps` | Exact persisted `turnOps` source |
+| `packetNNN.system.md`, `packetNNN.user.md` | The turn stored a provider request | Stored packet sections projected through `PacketWire` |
+| `packetNNN.assistantRaw.json` | The request has an admitted provider response | Stored opaque provider response |
+| `packetNNN.response.md`, attempt artifacts | The request received no admitted response | Stored request and attempt state |
+
+A source-backed turn without provider participation therefore produces only
+`assistant.md`; a request-only turn produces no fabricated assistant. A
+source-less programmatic turn with no provider request has no forensic payload
+to project and reserves no ordinal.
 
 The external tokenless draft and transformation boundary is owned by
 {§scheme-packet-transform}. Core alone extends each validated draft with its
@@ -2952,13 +3231,13 @@ Retired terms stay retired: the lexicon guard rejects `thinking`, the unqualifie
 
 §encrypted-reasoning-carrier **Encrypted reasoning is opaque client evidence.**
 When a provider returns encrypted reasoning items, core attaches that list to
-the admitted model-emission row's `attrs.reasoning`. `log/entry` and `readLog`
+the admitted model `turnOps` row's `attrs.reasoning`. `log/entry` and `readLog`
 carry it to AG-UI, which may project correlated standard reasoning entities.
 Core never decodes the blobs or renders them into a model packet; readable
 reasoning text remains separate in `assistant.reasoning`. The provider-detail
 identity and derived classification retain their exact provider-normalized
 meaning from {§provider-encrypted-reasoning}; core never reinterprets either as
-a client entity. The mirror row and logical model call remain the lossless
+a client entity. The source row and logical model call remain the lossless
 evidence when a downstream standard cannot represent the complete list.
 
 §body-projection **One full body, one packet projection.** Every durable log row has one canonical full body resolved from its stored tx/rx envelope by `LogBody`. READ and FIND over `log:///`, persistent search derivation, and packet rendering all consume that same meaning. Only packet rendering may project it:
@@ -2972,7 +3251,7 @@ evidence when a downstream standard cannot represent the complete list.
 | every other nonempty body | head bounded independently by `PLURNK_SERVICE_PREVIEW_LINES` and `PLURNK_SERVICE_PREVIEW_CHARS` |
 | bodyless row | `"display":"none","body":""` |
 
-READ and FIND own their range or pagination before packet rendering; the packet never applies a second hidden substring bound to their selected result. PLAN is likewise complete while OPEN: it is the model's explicit persistent reasoning inventory, not ordinary content that the model should have to retrieve from itself. Prompt rows follow their separate adaptive projection contract. Structured mutation contexts already carry the receipt-owned bound in {§edit-result-receipt-truth}, so packet rendering does not preview them again. Model-emission mirrors, SEND/WORK/FORK bodies, EXEC commands, environment-delta EDIT spans, and extension-produced bodies use the ordinary fixed bound. When an OPEN projection differs from its canonical body, `chunk` follows the displayed `body` with the exact selected and complete extents defined by {§jsonplurnk}; complete and FOLDED bodies omit it. `## READ0 (log:///<coordinate>/<OP>)` applies its default or explicit text range to the canonical body; the unsuffixed exact shorthand and authoritative suffix behavior are defined by {§log-coordinate-hierarchy}. `## FIND0 (log:///...)` and search match that same full body. FOLD hides the ordinary projection, and OPEN restores the producer's projection without changing its bound. System/policy sections are not log bodies. Notices are transient non-log observations; they share the ordinary line/character bounds but have no durable body or recovery URI.
+READ and FIND own their range or pagination before packet rendering; the packet never applies a second hidden substring bound to their selected result. PLAN is likewise complete while OPEN: it is the model's explicit persistent reasoning inventory, not ordinary content that the model should have to retrieve from itself. Prompt rows follow their separate adaptive projection contract. Structured mutation contexts already carry the receipt-owned bound in {§edit-result-receipt-truth}, so packet rendering does not preview them again. Actionless source artifacts, SEND/WORK/FORK bodies, EXEC commands, environment-delta EDIT spans, and extension-produced bodies use the ordinary fixed bound. When an OPEN projection differs from its canonical body, `chunk` follows the displayed `body` with the exact selected and complete extents defined by {§jsonplurnk}; complete and FOLDED bodies omit it. `## READ0 (log:///<coordinate>/<OP>)` applies its default or explicit text range to the canonical body; the unsuffixed exact shorthand and authoritative suffix behavior are defined by {§log-coordinate-hierarchy}. `## FIND0 (log:///...)` and search match that same full body. FOLD hides the ordinary projection, and OPEN restores the producer's projection without changing its bound. System/policy sections are not log bodies. Notices are transient non-log observations; they share the ordinary line/character bounds but have no durable body or recovery URI.
 
 §prompt-entry **Prompt as a first-class entry and log row.** Each prompt is stored once at `prompt:///<loop>/<N>` as an owner-keyed text/markdown entry, then published to its turn as one actionless lowercase `prompt` log row. No synthetic EDIT or READ operation is invented. The row is born OPEN and obeys {§body-projection}. The **Active User Prompts** section closes the user-slot status clump as a paths-only list (`* prompt:///<loop>/<N>`), so every frame remains directly READable even after its log row is folded or killed.
 
@@ -2990,8 +3269,8 @@ that loop has no `op='prompt'` row, oldest first. Every still-undelivered frame
 at conclusion is re-ordinalized into one source-keyed recovery loop; that loop's
 first turn publishes the complete ordered set exactly once. Recovery retries
 complete the same queued loop and never mint duplicate work. The automatic
-grinder preserves prompt rows; explicit OPEN/FOLD/KILL follows the ordinary log
-contract.
+overflow turn preserves prompt rows; explicit OPEN/FOLD/KILL follows the ordinary
+log contract.
 
 §packet-catalog **Catalogs are query results, not packet state.** The packet
 stores no materialized manifest. Complete and one-level entry directories,
@@ -3002,7 +3281,7 @@ their row shape, and their ordering are ordinary FIND projections owned by
 
 The model's runtime alert surface has two distinct kinds of information:
 
-- **Turn failures are log items.** A failed action and an engine-rail failure are durable `log_entries` rows whose `rx` is an RFC 9457 operation result. They fold, kill, and budget like every other row. The `errors` section is a derived pointer index over recent `status_rx ≥ 400` rows; it owns no bodies or failure state. Rejected emissions never become accepted turn content; their private response and admission evidence remains in `model_calls` and `turn_attempts`, apart from the bounded recovery mirror under {§invalid-emission-attempts}.
+- **Turn failures are log items.** A failed action and an engine-rail failure are durable `log_entries` rows whose `rx` is an RFC 9457 operation result. They fold, kill, and budget like every other row. The `errors` section is a derived pointer index over recent `status_rx ≥ 400` rows; it owns no bodies or failure state. Rejected emissions never become accepted turn content; their private response and admission evidence remains in `model_calls` and `turn_attempts`, apart from the bounded recovery `emissionAttempt` under {§invalid-emission-attempts}.
 - **Notices are transient observations.** Progress and non-fatal diagnostics such as `turn_awaiting_model`, `embed_progress`, and `grammar_unenforced` may appear once in the packet and broadcast live. They neither substitute for a failure result nor influence scheduling or recovery.
 
 The `log` is durable product truth. The `errors` section points at its failures
@@ -3039,16 +3318,15 @@ retain distinct contracts and lifetimes.
 | failure | row | status |
 |---|---|---|
 | action failure | the failed op's own row; the owning scheme supplies Problem Details | 4xx/5xx |
-| provider input capacity | `op='error'`, origin `plurnk`, source `provider`; exact provider-owned `capacity-exceeded` Problem Details | 413 |
-| max commands exceeded | `op='error'`, origin `plurnk`, source `rail`; `engine/rail/max-commands-exceeded` Problem Details | 429 |
-| idle turn | `op='error'`, origin `plurnk`, source `rail`; `engine/rail/idle-turn` Problem Details | 409 |
+| provider input capacity | `op='error'`, origin `_plurnk`, source `provider`; exact provider-owned `capacity-exceeded` Problem Details | 413 |
+| max commands exceeded | `op='error'`, origin `_plurnk`, source `rail`; `engine/rail/max-commands-exceeded` Problem Details | 429 |
+| idle turn | `op='error'`, origin `_plurnk`, source `rail`; `engine/rail/idle-turn` Problem Details | 409 |
 
 | notice `kind` | Source | Position |
 |---|---|---|
 | `grammar_unenforced` | engine rail verdict, or a forwarded provider transport anomaly such as a discarded-channel escape | content-offset when the observed position maps into content; none for a reasoning-prefix divergence |
 | `parse_advisory` | grammar parser — recoverable near-miss which did not invalidate the parsed statements | content-offset into the model's emission |
 | `embed_progress` | repository materialization/indexing lifecycle ({§mimetype-surface}); structured phase, count, and percent; `level: info` except terminal failure | none |
-| `search_progress` | aggregate search-page acquisition lifecycle; structured phase, counts, and percent; never candidate URLs or per-result notices | none |
 
 §notice-level **Severity on the wire (`level`, required).** Every `Notice` carries `level: "error" | "warn" | "info"`, set by the **producer** at the emit site. The level is client presentation, not operation status: even an `error` notice cannot terminalize work or substitute for a durable Problem. A forwarded `grammar_unenforced` is `warn`; ordinary lifecycle and progress notices are `info`. Clients color straight off `level` without interpreting the open `kind` vocabulary.
 
@@ -3060,7 +3338,7 @@ retain distinct contracts and lifetimes.
 
 | Surface                                | Contract                                                                                                                                            |
 | -------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Import `@plurnk/plurnk-service/digest` | Ships `Digest` and its co-located `digest.sql`; importing performs no I/O or process action. The CLI wrapper alone invokes it.                      |
+| Import `@plurnk/plurnk-service/digest` | Ships `Digest` and its package-owned SqlRite statements; importing performs no I/O or process action. The CLI wrapper alone invokes it.             |
 | `run({ dbPath })`                      | Reads the required database and writes a complete digest to `./test/digest` relative to the caller's working directory.                             |
 | `digestDir`                            | Selects the output directory. `run` removes and recreates it so stale packet artifacts cannot survive; concurrent callers use distinct directories. |
 | `workerId`                             | Narrows workers and every dependent loop, turn, logical model call, emission attempt, physical request, and log row to that one worker.             |
@@ -3073,7 +3351,7 @@ turn.** It cannot execute operations or alter the audited history.
 
 | Aspect    | Contract                                                                                                                                                        |
 |-----------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| Scope     | One interview for each worker with model-bearing turns; journal-only workers are omitted.                                                                       |
+| Scope     | One interview for each worker with model-bearing inference turns; workers without inference evidence are omitted.                                                |
 | Evidence  | The worker's final packet plus every attempt's exact normalized response and admission evidence; opaque raw transport remains in durable forensic artifacts. |
 | Witness   | An explicitly supplied provider or the active configured provider; absence fails hard.                                                                          |
 | Identity  | The worker's durable provider identity ({§worker-provider-identity}) is sent as both `workerId` and `primaryWorkerId`, making the synthetic interview its own root without asserting a live worker topology. |
@@ -3082,49 +3360,122 @@ turn.** It cannot execute operations or alter the audited history.
 
 §turn-lifecycle **Turn-lifecycle liveness.** Provider generation is the long, opaque window in a turn — one or more same-packet emission attempts may occur before the first committed op. A static client screen there is indistinguishable from a hang. The engine brackets the complete attempt window with two `notice/event` notices (`source: "engine:turn"`, `level: "info"`): `turn_awaiting_model` before the first call and `turn_generated` when an emission is accepted or the attempt budget is exhausted. Rejected content never rides the notice channel. Both are suppressed on an aborted loop and broadcast to the workspace like any notice ({§notice-event-notify}).
 
-§notice-content-offset-pointer **Content-offset position.** A non-fatal diagnosis on an accepted emission (for example `grammar_unenforced` or `parse_advisory`) carries `position: { type: "content-offset", line, column }` into the model's own folded mirror row. A bounded hard parse error becomes a durable failed operation whose Problem Details preserve its line, column, source, and parser-owned diagnostic. Hard errors that make the frame untrustworthy remain only with their rejected forensic attempt.
-
-### §tools user.tools — the capability sheet
-
-§tools-capability-sheet The tools capability sheet renders under `## Registered Tools`, after the policy sections. One generated Markdown table is the closed set of valid executor selectors. Its columns state `[executor]`, the `(target)` role and any concrete target witness, the body role, and `Invocation`: a body example, a schema-derived signature, or `bodyless`. The Invocation cell never repeats the `## EXEC0 [executor] (target)` syntax already defined by the headers and columns. A runtime exposing {§executor-tool-registry} contributes exactly one row per enabled exact target instead of its general row; an empty exact registry contributes no row and has no fallback. The compact legend leaves required inputs unmarked, marks optional inputs with `?`, pairs mutually exclusive alternatives with `↔`, marks refused buckets with `—`, and locates optional `<timeout,poll>` on the heading. The preface prefers purpose-built Plurnk operations over EXEC scripts. For a declaration with `target.directory: "cwd"`, the target cell distinguishes a local-directory working context from the plugin-authored non-directory target role. Optional non-EXEC operations render separately under `## Enabled Optional Operations` in a `plurnk` fence, so the catalogue remains truthful. `PacketBuilder.#collectTools` assembles both; a prose notice (e.g. the EXEC-disabled line) stays beside the table, and empty sections are omitted.
+§notice-content-offset-pointer **Content-offset position.** A non-fatal diagnosis on an accepted emission (for example `grammar_unenforced` or `parse_advisory`) carries `position: { type: "content-offset", line, column }` into the model's own folded `turnOps`. A bounded hard parse error becomes a durable failed operation whose Problem Details preserve its line, column, source, and parser-owned diagnostic. Hard errors that make the frame untrustworthy remain only with their rejected forensic attempt.
+
+### §tools Executable tool resources
+
+§tools-resource-discovery **Executable capability discovery uses ordinary
+Plurnk resources.** No generated tool table rides the system packet. Every
+available, workspace-enabled runtime with an admitted invocation materializes one family document at
+`worker://plurnk/skills/plurnk/<runtime>.md`. A general runtime's document contains its
+{§executor-tool-document}; a runtime with an exact
+{§executor-tool-registry} instead materializes one child document per enabled
+target at `worker://plurnk/skills/plurnk/<runtime>/<encoded-target>.md`. Its compact
+family document summarizes the server or runtime and lists every enabled target
+as a directly copyable `## EXEC0` heading with its input signature. Each heading
+uses {§operation-annotation} for the target summary and an exact child-document
+address; it never advertises a generic invocation that dispatch would reject.
+Target filenames use one deterministic percent-encoded path segment; the child
+document retains the exact unencoded target as invocation authority, exposes its
+annotated invocation form through Summary metadata, and carries the richer
+input-side contract. General-runtime summaries similarly expose their compact
+executable witness ({§executor-tool-document}). Tool-result/output schemas remain
+ordinary evidence and never enter these documents.
 
-§tools-loop-affinity **The capability sheet describes the current loop.** The
-sheet filters registered capabilities through the same
-`SchemeRegistry.resolveForLoop(flags)` predicate the dispatcher enforces. When
-registered executors exist but EXEC is inactive, their table is replaced by
-an explicit disabled notice rather than silent absence. The dispatch 403 remains
-the backstop and names the non-retryable loop restriction.
+```mermaid
+flowchart LR
+    Survey["Turn 0 FIND<br/>tools/*.md"] --> Families["family paths + summaries"]
+    Families --> Read["READ selected family"]
+    Read --> Exec["EXEC annotated invocation"]
+    Read --> Detail["READ exact child<br/>only when needed"]
+    Detail --> Exec
+```
 
-**Contributors: the workspace executor snapshot.** Every available executor tag
-contributes its general {§executor-invocation} row or the closed rows and
-documentation from its {§executor-tool-registry} snapshot. Its doc is
-materialized at `worker://plurnk/docs/<tag>.md` and discovered via the turn-0
-`## FIND0 [+init,+docs] (worker://plurnk/docs/**)` foist, not linked inline.
-`PLURNK_SERVICE_DOCS_EXCLUDE` drops a named tag's rows and doc. Installed
-executors are probed once; workspace providers publish only prepared runnable
-selectors, so the table never presumes that another workspace's capability is
-available here.
+§tools-resource-materialization The runtime registry, workspace executor
+policy, tool resources, and dispatch use one effective workspace snapshot. A
+workspace-disabled, unavailable, detached, replaced, or removed runtime has no
+tool resource; an exact registry's empty set publishes no executable family and
+admits no invocation. Reconciliation deletes stale family and child documents
+before upserting the current set. `PLURNK_SERVICE_DOCS_EXCLUDE` does not hide an
+enabled executable; executor enablement is the sole user-configured filter
+shared by discovery and dispatch. A runtime declaration may carry
+`resourcesPath` — the generated-doc root. Absent, its docs live in the internal
+`/skills/plurnk` namespace; present (attached MCP families: `/tools`), the
+family and its child tool docs materialize under that root. Turn 0 surveys the
+families (`## FIND0 [+init,+tools] (worker://plurnk/tools/*.md)`, one row per
+server carrying its summary) and, for each server named in
+`PLURNK_MCP_EXPANDED`, its complete tool tree (`tools/<server>/**`). The child
+summary IS its invocation form so the discovery row teaches the call.
+Attached tools are capabilities like every other runtime; the model never
+learns an origin.
+
+§skills-materialization **The workspace skills surface.** Plurnk discovers one
+ordered union of standard Agent Skills: project
+`<projectRoot>/.agents/skills/<name>/SKILL.md`, user-global
+`~/.agents/skills/<name>/SKILL.md`, then the exact bundled skill
+membership published by `@plurnk/plurnk-meta`. Collisions resolve project over
+global over bundled by directory/name before a shadowed lower-precedence body
+is read. Plurnk never seeds or mutates the shared global root absent an explicit
+user installation action. Every admitted skill requires standard `name` and
+`description` frontmatter with `name` matching its directory; an invalid or
+unreadable discovered skill fails materialization with its path and cause.
+
+Each admitted skill becomes one kernel-owned
+`worker://plurnk/skills/<name>.md` entry at workspace boot and creation.
+`worker://plurnk/skills/index.md` always exists and lists the effective union,
+including the bundled discovery skill, so the turn-0 `+init,+skills` FIND survey always
+shows the surface. The materialized index and each standard skill expose an
+exact H2 `Summary`; a skill's required `description` becomes that summary while
+its instructions body is preserved verbatim. Frontmatter is parsed as YAML;
+admission consumes its standard discovery keys. Reconciliation deletes retired skill entries
+before upserting the current set; turn admission refreshes the surface under the
+workspace gate before packet assembly, so an explicitly installed or removed
+skill is discoverable in the first subsequent model turn while an unchanged set
+dispatches nothing.
+The bundled `find-skills` skill is an attributed, release-pinned adaptation of
+the upstream standard skill and targets the universal Agent Skills location;
+it does not create a Plurnk registry or MCP-like enablement mechanism. Skills
+are user-, project-, or package-installed teaching admitted through the kernel
+surface; they never override instruction authority.
+
+The catalog describes workspace capabilities, not temporary authority. Loop
+mode remains a dispatch concern: an ask-mode EXEC receives the ordinary exact
+403 restriction instead of requiring a second per-loop documentation overlay.
+Optional non-EXEC operations remain a separate `## Enabled Optional Operations`
+section because they are language extensions rather than executable tools.
 
 ### §schemes user.schemes — the resource directory
 
-§schemes-directory A `## Resources` section renders in the system slot **after the policy sections and tools sheet** — a terse directory of the scheme families available this workspace, so the model knows what URI resources and operations exist before it acts. Each scheme that ships a `manifest.example` contributes one or more concise canonical ops (no scheme prefix; each example self-documents) into a `plurnk` fence. Scheme example sets are separated by one blank line. The doc is NOT linked inline — it is materialized at `worker://plurnk/docs/<scheme>.md` and discovered via the turn-0 `## FIND0 [+init,+docs] (worker://plurnk/docs/**)` foist, keeping the raw packet free of doc links. Meta-owned `log` and `worker` depth is required teaching ({§teaching-corpus}); a failed source read rejects materialization with its cause and never falls back. Other core and plugin schemes may supply optional `manifest.documentation`; absence contributes no pull doc. The verbose semantics live in that pull doc (materialized like any entry, READ on demand), not the hot path — terse pushes, depth pulls. A scheme with no example (provisional) is omitted; `PLURNK_SERVICE_DOCS_EXCLUDE` drops a named scheme's examples + doc.
+§schemes-directory A `## Resources` section renders in the system slot **after the policy sections** — a terse directory of the scheme families available this workspace, so the model knows what URI resources and operations exist before it acts. Each scheme that ships a `manifest.example` contributes one or more concise canonical ops (no scheme prefix; each example self-documents) into a `plurnk` fence. Scheme example sets are separated by one blank line. The doc is NOT linked inline — it is materialized as the kernel-generated skill `worker://plurnk/skills/plurnk/<scheme>.md` and discovered via the turn-0 `## FIND0 [+init,+skills] (worker://plurnk/skills/plurnk/*.md)` survey ({§skills-materialization}), keeping the raw packet free of doc links. Meta-owned `worker` depth is required teaching ({§teaching-corpus}); a failed source read rejects materialization with its cause and never falls back. Other core and plugin schemes may supply optional `manifest.documentation`; absence contributes no pull doc. The verbose semantics live in that pull doc (materialized like any entry, READ on demand), not the hot path — terse pushes, depth pulls. A scheme with no example (provisional) is omitted; `PLURNK_SERVICE_DOCS_EXCLUDE` drops a named scheme's examples + doc.
 
 ### §inject system.inject — the operator injection
 
-§packet-inject When `PLURNK_SERVICE_PACKET_INJECT` names a readable markdown file, its content renders as an `## Operator Notes` section in the system slot after policy and capability teaching (definition → policy → project policy → tools → resources → inject). Read per-turn so the operator's edits take effect live; a set-but-unreadable path fails the turn hard (a deliberate setting with a broken path is a misconfig, surfaced not hidden). `~/` expands to home. It's the operator-side complement to the plugin section hook — a pressure valve so reshaping the packet edits operator content, never the core. Unset → no section.
+§packet-inject When `PLURNK_SERVICE_PACKET_INJECT` names a readable markdown file, its content renders as an `## Operator Notes` section in the system slot after policy and capability teaching (definition → policy → project policy → resources → inject). Read per-turn so the operator's edits take effect live; a set-but-unreadable path fails the turn hard (a deliberate setting with a broken path is a misconfig, surfaced not hidden). `~/` expands to home. It's the operator-side complement to the plugin section hook — a pressure valve so reshaping the packet edits operator content, never the core. Unset → no section.
 
 ### §policy system.policy — the client's policy injection
 
-§policy-sections Two sections ride the system slot **after the definition and before loop-dependent capabilities**: `## Policy` from `PLURNK_SERVICE_POLICY` (default `~/.plurnk/AGENTS.md`) and `## Project Policy` from `PLURNK_SERVICE_PROJECT` (default `<projectRoot>/AGENTS.md`, resolved relative to the workspace root). AGENTS.md is **policy** — the client's authoritative rules promoted into the privileged zone — NOT a curatable, foldable, READ-able entry; the model cannot FOLD it away. A default-absent path is silent (the section is omitted); an explicit override (env set) that fails to read fails the turn hard — a deliberate setting with a broken path is a misconfig, surfaced not hidden. Read per-turn so edits take effect live. Reference and scratch docs are NOT policy; `PLURNK_SERVICE_MD_*` materializes them as READ-able entries ({§operator-config}).
+§policy-sections One section rides the system slot **after the definition and before capability teaching**: `## Policy` from `PLURNK_SERVICE_POLICY` (default `$XDG_CONFIG_HOME/plurnk/AGENTS.md`, {§host-path-layout}). Policy is the client's authoritative rules promoted into the privileged zone — NOT a curatable, foldable, READ-able entry; the model cannot FOLD it away. A default-absent path is silent (the section is omitted); an explicit override (env set) that fails to read fails the turn hard — a deliberate setting with a broken path is a misconfig, surfaced not hidden. Read per-turn so edits take effect live. The PROJECT `AGENTS.md` is local guidance, not policy: it rides turn 0 as the foisted `worker://plurnk/agents.md` entry ({§turn0-agents-stunt}); all other reference material is skills under the skills tree ({§skills-materialization}).
 
-On first run, and only when `~/.plurnk` itself is absent, the service seeds
+On first run, and only when `$XDG_CONFIG_HOME/plurnk` itself is absent, the service seeds
 `AGENTS.md` from `@plurnk/plurnk-meta/PLURNK_PERSONALITY.md` ({§teaching-corpus}).
 It reads that required source before creating the service home; a failed read
 surfaces with its cause and leaves no apparently initialized home.
 After that bootstrap the file is user-owned: edits and deletion persist, and a
 later boot never refreshes or recreates it.
 
-§schemes-self-doc-materialization **The scheme self-doc contract.** `@plurnk/plurnk-schemes` owns `example` and `documentation` in `SchemeManifest` ({§manifest-self-doc}); the former is the hot-path operation example set and the latter is the deep pull doc. `SchemeRegistry.teach(workspaceId)` renders the effective directory, `SchemeRegistry.docs(workspaceId)` resolves corpus-or-manifest documentation, and `docEntries(workspaceId)` supplies the current pull-document set when core publishes capabilities for a workspace. Materialization reconciles `worker://plurnk/docs/` exactly under the workspace capability gate: vanished contributions are deleted before current documents are upserted, so an excluded, disabled, detached, or replaced capability cannot leave a stale model-facing contract.
+§legacy-home-transition A legacy `~/.plurnk` is never an ambient fallback. If
+legacy state exists while canonical destinations do not, ordinary startup
+fails with the exact `plurnk-service paths migrate` recovery. That explicit,
+idempotent command refuses destination conflicts and a live database owner,
+moves known user configuration and durable SQLite files to their semantic
+homes, byte-verifies the complete copied set before removing any source,
+discards only recognized generated references, and removes the empty legacy
+directory. A pre-commit failure rolls back canonical files and directories
+created by that attempt. Unknown legacy members or simultaneous
+legacy/canonical state fail without guessing. No dual read or dual write survives
+the transition.
+
+§schemes-self-doc-materialization **The scheme self-doc contract.** `@plurnk/plurnk-schemes` owns `example` and `documentation` in `SchemeManifest` ({§manifest-self-doc}); the former is the hot-path operation example set and the latter is the deep pull doc. Every published pull doc carries an exact H2 `Summary` for ordinary catalog projection. `SchemeRegistry.teach(workspaceId)` renders the effective directory, `SchemeRegistry.docs(workspaceId)` resolves corpus-or-manifest documentation, and `referenceEntries(workspaceId)` supplies the current `/skills/plurnk/` generated-skill set when core publishes workspace capabilities ({§skills-materialization}). One materializer reconciles the reserved scope exactly: vanished contributions are deleted before current documents are upserted, so an excluded scheme or disabled, detached, replaced, or removed runtime cannot leave a stale model-facing contract.
 
 ### §packet-git-status The Git status section — compact repository state
 
@@ -3285,15 +3636,16 @@ projection, and binary handling. Text scope meaning does not vary by mimetype.
 §render-rule-line-navigable-prefix Every textual content body with a source
 `startLine` renders with a coordinate prefix on each physical line, independent
 of mimetype. A successful exact READ whose active scheme declares
-`textEditScopes: true` and model write authority supplies `@hash N:` with one
+`lineAnchors: true`, or `textEditScopes: true` with model write authority, supplies `@hash N:` with one
 or more ASCII spaces before `N` under
-{§line-anchors}; every other body renders `N:`. JSON, XML, and HTML are therefore just as
+{§line-anchors}; generated FIND rows render a result ordinal left-padded to the
+complete result total's width; every other body renders `N:` left-padded to its own largest line number's width, so every body keeps one stable content column. JSON, XML, and HTML are therefore just as
 line-addressable as markdown and source code. The prefix is a packet
 presentation aid, never part of canonical content; matchers and mutations
 consume canonical bytes before rendering. A producer may set `startLine: null`
 only when its content is already source-numbered, such as an effect receipt.
 
-§render-rule-find-renders-result A log row's canonical full body is resolved once by `LogBody`: READ/FIND, model-emission, prompt, and extension result content comes from `rx.content`; EDIT uses its structured receipt or an environment-delta span; COPY/MOVE concatenate the textual receipt contexts in their ordered `effects`; EXEC and the composed PLAN/SEND/WORK/FORK family use their statement body. Whole-channel COPY/MOVE effects are bodyless rather than fabricating a text projection. Packet rendering applies {§body-projection} and the coordinate projection in {§render-rule-line-navigable-prefix}. READ/FIND over `log:///` and search consume the complete canonical body instead. Status and content are orthogonal: a failed terminal stream READ retains its Problem Details and failure status while rendering captured diagnostic output; failure never erases evidence.
+§render-rule-find-renders-result A log row's canonical full body is resolved once by `LogBody`: READ/FIND, actionless source artifacts, prompt, and extension result content comes from `rx.content`; EDIT uses its structured receipt or an environment-delta span; COPY/MOVE concatenate the textual receipt contexts in their ordered `effects`; EXEC and the composed PLAN/SEND/WORK/FORK family use their statement body. Whole-channel COPY/MOVE effects are bodyless rather than fabricating a text projection. Packet rendering applies {§body-projection} and the coordinate projection in {§render-rule-line-navigable-prefix}. READ/FIND over `log:///` and search consume the complete canonical body instead. Status and content are orthogonal: a failed terminal stream READ retains its Problem Details and failure status while rendering captured diagnostic output; failure never erases evidence.
 
 An `EDIT` log row renders its bounded effect receipt (`rx.receipt`) as row
 metadata and join context, not its input statement. Proposal-gated file EDITs
@@ -3343,7 +3695,7 @@ Carried from the contract walk; durable.
   {§copy-move-observation}.
 - **READ rx** prefixes every textual line under {§render-rule}; eligible
   editable resources carry `@hash N:`, and all others carry `N:`.
-- **FIND body matcher** applies to entry content (all dialects), per-candidate via the in-tree `Matcher.matchAgainstContent` ({§matcher-dispatch}; status 200 = content hit → entry selected). The target scope selects candidates; the path-glob is the (target). FIND's signal classifies its own log item ({§log-item-tags}).
+- **FIND body matcher** applies to the addressed entry channel (all dialects), per-candidate via the in-tree `Matcher.matchAgainstContent` ({§matcher-dispatch}; status 200 = content hit → entry selected). The target scope and channel select candidates; the path-glob is the (target). FIND's signal classifies its own log item ({§log-item-tags}).
 - **OPEN/FOLD** operate on the **log** (`log:///`), not entries ({§open-fold}) — FOLD collapses a log row to its path, OPEN restores its body. Aimed at an entry scheme they return 501.
 - **SEND signal `410`** deletes as a side-effect (not the model idiom; {§move}): with `#fragment`, that channel only; without, the whole entry. **SEND signal `499`** resolves the durable open-subscription row and invokes that subscription's exact callable owner through the process-local live registry ({§subscriptions}).
 - **File scheme** detects with `Mimetypes.detect({ path })` and classifies with the same configured service ({§mimetype-classification-consumption}). Handler-declared binary sources materialize through {§membership-source-projection}; projected bodies are READ-able, while source-aware EDIT remains 415.