@plurnk/plurnk-service 1.7.0 → 1.9.0

package/SPEC.md

@@ -26,23 +26,56 @@ flowchart LR
 | **agent**         | PLURNK                | The plurnk runtime. Acts in-workspace as the reserved `plurnk` worker ({§actor-boundary} self-hosting), never a privileged singleton owning its own entries ({§entry-owner}, {§machine-processes}). |
 | **workspace**     | Core                  | Durable user-named shared world. Persists across workers and process restarts. Identity: `workspaces.id` + unique `workspaces.name`. |
 | **worker**        | Core                  | Durable actor and private history over one workspace. Owns its loops and log rows, may carry a `parent_worker_id`, and has one process-local cancellation scope while active. |
-| **loop**          | Core                  | Queued-to-terminal unit of model or client work within a worker. Status ∈ {100 pending · 102 running · 200 done · 202 waiting (blocked on a live obligation, {§send}) · 413 provider input-capacity failure · 429 turn-ceiling · 499 cancelled · 500 failed · 504 wall-clock timeout ({§operator-config-loop-timeout}) · 508 runaway}. Many loops may belong to one worker. |
-| **turn**          | Core                  | One engine scheduling unit (or one client-op scheduling unit). A model turn sends one assembled prompt through one or more emission attempts and admits at most one response. Many turns may belong to one loop. Identity: `(loop_id, sequence)`. |
+| **loop**          | Core                  | Queued-to-terminal unit of model or client work within a worker. Status ∈ {100 pending · 102 running · 200 done · 202 waiting (blocked on a live obligation, {§send}) · 413 input-capacity failure · 429 model-turn ceiling · 499 cancelled · 500 failed · 504 wall-clock timeout ({§operator-config-loop-timeout}) · 508 runaway}. Many loops may belong to one worker. |
+| **turn**          | Core                  | One durable, producer-neutral batch of ordered operations. A turn may be authored by a model, client, plugin, or `_plurnk`; only a model turn assembles a packet and owns an emission call. Many turns may belong to one loop. Identity: `(loop_id, sequence)`. |
 | **model call**    | Core/provider         | One logical `provider.generate` invocation. Emission attempts and BARE inferences share this durable accounting owner; provider retries remain cardinal physical requests beneath it. Identity: `(turn_id, sequence)`. |
-| **op**            | Model/core            | One DSL operation the model emits, parsed into a `PlurnkStatement`. One admitted turn produces zero or more ops. |
+| **op**            | Producer/core         | One DSL operation a producer submits, parsed into a `PlurnkStatement`. One admitted source-backed turn produces an ordered PLAN…SEND program. |
 | **statement**     | Model/core            | A parsed op: the `PlurnkStatement` AST from `@plurnk/plurnk-contracts`. |
-| **action**        | Core                  | One executed op. Execution normally produces a `log_entries` row at `log:///<L>/<T>/<S>/<op>`; an engine rail may instead record an actionless `op='error'` row ({§operation-results}). Actionless artifacts carry no fabricated operation. |
+| **action**        | Core                  | One executed op. Execution normally produces a `log_entries` row at `log:///<L>/<T>/<S>/<op>`; an engine rail may instead record an `op='error'` row ({§operation-results}). A source artifact carries no fabricated operation. |
 | **dispatch**      | Core                  | Routing a statement to its scheme's op handler. |
 | **AG-UI Run**     | AG-UI protocol        | A client request/stream envelope identified by the client's `runId`. A message or resume AG-UI Run binds to one core loop; a management-action AG-UI Run may complete without creating a core loop. |
 | **AG-UI thread**  | AG-UI protocol        | Conversation identity. Within an explicitly selected workspace, `threadId` resolves to one conversation worker. |
 | **`--run`**       | Client compatibility  | A compatibility-sensitive client spelling, not an internal entity. |
 | **session**       | Retired/unqualified   | Not a PLURNK lifecycle noun. Use the actual core noun; a third-party standard may use only its explicitly qualified protocol term. <!-- lexicon-allow: this row defines the retired noun --> |
 
+### §turn-record Producer-neutral turn record
+
+A turn is the durable container for one producer's ordered operations. Packet
+and provider fields are optional evidence belonging only to model inference;
+their absence never makes a client, plugin, or `_plurnk` turn exceptional.
+
+| Field | Contract |
+|---|---|
+| `producer` | Required actor class: `model`, `client`, `plugin`, or `_plurnk`. |
+| `kind` | Required purpose: `inference`, `initialization`, `overflow`, `operation`, or `maintenance`. Model iff inference; initialization, overflow, and maintenance require `_plurnk`. A maintenance turn's successful rows are packet-suppressed — a receipt answers an asker, and maintenance has none ({§actor-boundary-doc-injection}). |
+| `status`, `completed_at` | A new turn is open at status 102 with `completed_at=NULL`. Completion records the exact terminal SEND/operation disposition and timestamp; a completed 102 is therefore distinct from an open 102. |
+| Operations | Ordered by `(turn_id, sequence)` on one exact worker/loop/turn chain. Each row's `origin` is the turn producer or `_plurnk` making a system observation; the observation does not impersonate the producer. |
+| `turnOps` | Every admitted source-backed turn preserves its exact PLAN…SEND program as one undecorated actionless log item under {§turn-ops-entry}. The item supplements rather than replaces the executed operation rows. |
+| Inference evidence | Model calls, `packet`, model, finish reason, and provider metadata belong only to model/inference turns. Turn fields are nullable until recorded and remain NULL for every other kind. |
+
+One lifecycle owner opens, optionally records inference evidence, and completes
+every turn. Initialization, overflow recovery, client dispatch, and model
+inference use that same path. `plugin` is the producer identity for
+plugin-authored operation turns; exposing that path must not introduce a
+parallel record or lifecycle. The sole identity transition is an open,
+evidence-free model/inference candidate becoming `_plurnk`/overflow before
+provider admission. Process-restart recovery completes any turn whose producer
+vanished.
+
+§turn-ops-admission-path **Source acquisition varies; admitted-turn execution does not.**
+A provider response, deterministic `_plurnk` program, or future client/plugin
+program crosses one admission boundary into the same executor. That executor
+parses once, dispatches the admitted statements in order, records their ordinary
+outcomes and the exact `turnOps`, and completes the turn from its SEND ruling.
+Provider attempts, grammar recovery, reasoning, and accounting end before this
+shared seam. A programmatic operation batch that supplied no Plurnk source does
+not fabricate verbatim source.
+
 ### §storage-terms Storage terms
 
 | Term | Meaning |
 |---|---|
-| **entry** | The unit of canonical state. Identity: `(workspace, owner, scheme, pathname)` ({§entry-identity-no-null}). Holds one or more `channels` of content plus private `attributes`. |
+| **entry** | The unit of canonical state. Identity: `(owner, scheme, authority, pathname)`; the owner Worker determines the workspace ({§entry-identity-no-null}). Holds one or more `channels` of content plus private `attributes`. |
 | **channel** | A named content buffer on an entry. Examples: `body`, `stdout`, `stderr`, `headers`, `symbols`. Each channel has `content`, `mimetype`, curation `weight`, and lifecycle `state`. |
 | **scope** | A scheme-manifest declaration ignored by core; registrations are discovered at boot and are not persisted. Entry sharing and privacy are owner-based; #80 owns retiring this residual axis. |
 | **scheme** | An addressed capability family + handler. Built-ins include `worker`, `prompt`, `log`, and bare/file paths; discovered schemes and executor-runtime tags extend that set. Internal `exec` routes the EXEC op but is not an addressable model namespace. Consumption surface {§scheme-surface}; author contract: [plurnk-schemes](../plurnk-schemes/SPEC.md). |
@@ -64,9 +97,9 @@ Independent axes on entries and channels. Confusion across them is a recurring s
 
 | Term | Meaning |
 |---|---|
-| **writer** | The identity authoring a write. One of `model \| client \| plurnk \| plugin`. Carried on `ctx.writer` for schemes; engine enforces `manifest.writableBy`. |
+| **writer** | The identity authoring a write. One of `model \| client \| _plurnk \| plugin`. Carried on `ctx.writer` for schemes; engine enforces `manifest.writableBy`. |
 | **origin** | Synonym for writer in log_entries (`log_entries.origin`). Historical naming; treat as equivalent. |
-| **writable_by** | The set of writers a scheme accepts. Subset of `{model, client, plurnk, plugin}`. Engine rejects writes outside the set with 403; the rejection is logged as the action-entry ({§subscriptions} action-entry-as-outcome). |
+| **writable_by** | The set of writers a scheme accepts. Subset of `{model, client, _plurnk, plugin}`. Engine rejects writes outside the set with 403; the rejection is logged as the action-entry ({§subscriptions} action-entry-as-outcome). |
 
 ### §engine-rails Engine rails
 
@@ -181,8 +214,33 @@ clients render and submit actions but contain no engine logic.
 
 OpenTelemetry may observe PLURNK; it never becomes product state, failure transport, scheduler input, model teaching, or client protocol. Domain and client activity remain on AG-UI. Reusable packages depend on the OTel API only; the daemon constructs only the explicitly configured trace and metric providers. An unconfigured or standards-valid disabled process loads no SDK or exporter implementation and keeps the API's no-op behavior with bounded overhead. OTel Logs have no provider or initialization path.
 
+### §standards-discernment Standards discernment
+
+Seven principles govern which exterior standards Plurnk conforms to (#299):
+
+1. **UVP first.** Never conform away what users chose Plurnk for; the OP grammar, curated log, packet, and worker graph are the product, not a compatibility gap.
+2. **Right-fit.** Hobbyist-first: an enterprise-grade feature is acceptable only when its cost lands on the party that wants it, never on general adoption.
+3. **Traction.** Count running counterparties today; integration horizon must be shorter than the standard's expected half-life. Sockets stay configurable with no default until a candidate earns it.
+4. **POSIX app identity.** Decades-stable host-ecosystem conventions (XDG, NO_COLOR, man, completions, service units) outrank months-stable AI-pipeline fashions.
+5. **Faces, never organs.** A standard adopts as one adapter or projection behind an existing seam; if it cannot, that is the alarm, and it goes to a design gate.
+6. **Deletion is the price of admission.** A standard earns adoption by deleting bespoke surface (the ACP Plan object deleted the Markdown plan microformat); parallel representations, second discovery paths, and compatibility grammars are refused.
+7. **Two arbiters.** Model-facing surfaces change only on measured model evidence; human-facing surfaces follow host-ecosystem convention without ceremony. Standards bodies get a vote on neither.
+
 Configuration uses the standard `OTEL_*` environment: `OTEL_TRACES_EXPORTER` / `OTEL_METRICS_EXPORTER` select `otlp` or `console` per signal (a missing or `none` value keeps that signal off; no SDK default selects an exporter), `OTEL_SERVICE_NAME` names the service (default `plurnk-service`), case-insensitive `true` in `OTEL_SDK_DISABLED` turns the boundary off, and OTLP exporters honor `OTEL_EXPORTER_OTLP_*`. An unknown exporter name fails daemon boot; a typo never silently disables observation. OTel Logs and direct draft semantic-convention use are excluded. HTTP spans carry only an AG-UI-owned bounded route class, never an input pathname or query. Spans otherwise carry high-cardinality identifiers; metric labels stay low-cardinality. Prompts, reasoning, file bodies, arbitrary URLs, secrets, and plugin payloads are never recorded as attributes or metric values by default. Exporter failure cannot change product results or client lifecycle. Daemon, telemetry, and database teardown are independent reverse-ownership phases; every phase runs and aggregate failure preserves every cause.
 
+§observability-genai-conventions **GenAI convention projection.** Provider
+request spans use the OpenTelemetry GenAI semantic conventions: a
+CLIENT-kind `gen_ai.client.request` span carrying `gen_ai.operation.name`
+(`chat`), `gen_ai.system` (the provider alias), and `gen_ai.request.model`;
+on settlement it gains `gen_ai.usage.input_tokens` and
+`gen_ai.usage.output_tokens` from validated accounting plus
+`gen_ai.response.finish_reasons`; failures carry `error.type` as the class
+name only. Plurnk custom attributes (attempt, kind, status, loop/turn ids)
+ride alongside and never replace the convention attributes. The redaction
+boundary is unchanged — no prompts, reasoning, bodies, or URLs. This is the
+sanctioned exception to the blanket draft-convention exclusion; no other
+draft convention is projected.
+
 ### §in-process In-process architecture
 
 Composed daemon internals + admin CLI. Four plug points:
@@ -190,7 +248,7 @@ Composed daemon internals + admin CLI. Four plug points:
 - **Providers** ({§provider}) — LLM transports. Engine sends a turn's messages, receives raw content + usage; engine parses the content into `PlurnkStatement[]`.
 - **Schemes** ({§scheme}) — addressed capabilities. A scheme handler interprets targets under its prefix and owns its storage substrate.
 - **Mimetypes** ({§mimetype}) — content interpretation. Render-time handlers consume channel content; framework owns the dispatch.
-- **Executors** ({§exec} / {§bundled-set}) — EXEC runtime dispatch for subprocess, search, data, and pure-computation runtimes.
+- **Executors** ({§exec} / {§bundled-set}) — EXEC runtime dispatch for subprocess, data, and pure-computation runtimes; web discovery rides the ordinary MCP surface.
 
 Core's internal owners compose without becoming new package or public seams:
 
@@ -199,7 +257,7 @@ Core's internal owners compose without becoming new package or public seams:
 | `Daemon` | Process/module lifecycle, dependency composition, provider policy, notifications, and the external client façade. |
 | `DrainSupervisor` | One worker's queue consumer, drain identity, wake obligations, cancellation scope, poll/park timers, and terminal cleanup. |
 | `Engine` | Loop lifecycle and the public turn, dispatch, derivation, and proposal façades. |
-| `TurnRunner` | One durable model turn from materialization through provider admission, operation scheduling, and settlement. |
+| `TurnRunner` | Model inference plus `_plurnk` initialization/overflow turns from materialization through operation settlement. |
 | `Dispatcher` | Operation admission/routing, scheme execution, proposal waiting, curation, and durable log writes. |
 | `ResourceMutations` | EDIT/COPY/MOVE selection, anchor preconditions, cross-scheme effects, and mutation settlement. |
 
@@ -241,9 +299,10 @@ preserving the originating failure.
 
 ```mermaid
 flowchart LR
-    actor["Worker A"] -->|"shared file or shared entry op"| state["Shared project files<br/>and shared workspace entries"]
-    state -->|"folded attributed delta<br/>environment door"| log["Worker B log"]
-    actor -->|"SEND to worker B<br/>voice door"| log
+    child["Child worker"] -->|"durable activity<br/>environment door"| parent["Direct parent log"]
+    actor["Any worker"] -->|"mutate worker:/// commons"| commons["Workspace commons"]
+    commons -->|"one folded broadcast occurrence"| logs["Every existing worker log"]
+    actor -->|"SEND to named worker<br/>voice door"| log["Addressed worker log"]
     client["User / client"] -->|"loop.inject<br/>voice door"| log
 ```
 
@@ -258,34 +317,68 @@ render-time filter.
 **attribution** — the delta's provenance ({§env-delta}) — and is never read to
 filter a row.
 
+§actor-boundary-attached-functionality **A client operates in the Worker it is
+attached to.** A client connection is attached to one conversation Worker; its
+management commands mutate that Worker's Functionality ({§module-worker-capabilities}),
+and its operations execute in that Worker's environment — executable families,
+runtime schemes, per-Worker tool admission, flag-scoped scheme availability,
+and effect policy resolve through the attached Worker — while the operation
+journals in the client's own worker ({§connection-lifecycle}) and any entry it
+writes binds its principal through that client worker. Every dispatch therefore
+carries two coordinates: `workerId`, the journaling and entry principal, and
+`functionalityWorkerId`, the Worker whose Functionality applies. They are equal
+for model and `_plurnk` dispatches; a client dispatch names its attached
+Worker, which must belong to the same workspace, and Functionality residency is
+acquired for that Worker. Attachment is a connection fact, not topology: it is
+many-to-one, non-owning, and never expressed as parentage.
+
 §actor-boundary-two-doors **Cross-worker arrival is limited to two doors.**
 An explicit READ is not an arrival: the reading worker deliberately addresses a
 file or ancestry-authorized entry through ordinary dispatch ({§worker-read-scope}).
 
-| Door        | Carries                                                                                 | Wake behavior                                                    |
-| ----------- | --------------------------------------------------------------------------------------- | ---------------------------------------------------------------- |
-| Environment | A change to a shared project file or shared worker entry, as a folded attributed delta. | Ambient state never wakes an idle worker ({§env-delta}).         |
-| Voice       | A directed `loop.inject` or `## SEND0 (worker://name)` message.                          | An active worker folds it into its next turn; an idle one wakes. |
-
-§actor-boundary-no-mutex **Wild west by default; explicit branch batches are the exception.** Ordinary workers share workspace state without locks. Coordination is cooperative and softly fenced (the {§membership} `read-only` overlay, a workspace policy, bounds every worker's writable surface uniformly — {§machine-processes}); a conflict *surfaces* as a delta rather than being prevented. A branch-tagged WORK/FORK opts the whole workspace into the bounded, exclusive Git transaction in {§worker-branch-batch}. It is not a general entry mutex or a hidden per-worker filesystem.
+| Door        | Carries                                                                                                                                      | Wake behavior                                                                                 |
+| ----------- | -------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------- |
+| Environment | A direct child's durable activity to its parent, plus a successful mutation of the deliberately global `worker:///` commons to every worker. | Intermediate activity and commons never wake; a child's terminal disposition wakes its parent. |
+| Voice       | A directed `loop.inject` or `## SEND0 (worker://name)` message.                                                                               | An active worker folds it into its next turn; an idle one wakes.                              |
+
+§actor-boundary-lineage-attention **Addressability is workspace-wide; attention
+is lineage-scoped.** Project files, registered resources, and permitted worker
+entries remain addressable throughout the workspace, but ordinary changes do
+not enter unrelated workers' logs. A child's activity reaches only its direct
+parent. That observer row carries the source occurrence identity and never
+republishes, so grandparents observe what their own direct children do without
+receiving an automatic recursive mirror of every descendant.
+
+§actor-boundary-commons-broadcast **`worker:///` is the explicit global
+attention surface.** A successful mutation whose landed effects touch the
+commons emits one occurrence to every worker that existed when it landed.
+Lineage and commons audiences are a union over that one identity: when a child
+mutates the commons, its parent receives one observer row, never a parent copy
+plus a broadcast duplicate. Ordinary project files, private worker entries,
+and remote resources do not acquire ambient attention merely because they are
+workspace-addressable.
+
+§actor-boundary-no-mutex **Wild west by default; explicit branch batches are the exception.** Ordinary workers share workspace state without locks. Coordination is cooperative and softly fenced (the {§membership} `read-only` overlay, a workspace policy, bounds every worker's writable surface uniformly — {§machine-processes}); stale writes reject at their anchor or compare-and-swap boundary rather than being prevented by a lock ({§line-anchors}, {§membership-edit-write-cas}). A branch-tagged WORK/FORK opts the whole workspace into the bounded, exclusive Git transaction in {§worker-branch-batch}. It is not a general entry mutex or a hidden per-worker filesystem.
 
 §actor-boundary-passive-wake **Passive wake follows ownership.** A directed
 voice wakes an idle worker. A parked continuation resumes when an obligation it
-owns — a child or stream — reaches an observable transition ({§worker-loop-lifecycle}).
-An ambient environment delta never wakes; it queues until one of those directed
-events produces a turn ({§env-delta}). The obligation edge is continuation
-control, not a third door through which arbitrary sibling state can enter.
+owns — a child or stream — reaches an observable terminal transition
+({§worker-loop-lifecycle}). Intermediate child activity and commons broadcasts
+never wake; they queue until another cause produces a turn ({§env-delta}). The
+obligation edge is continuation control, not a third door through which
+arbitrary workspace state can enter.
 
 §actor-boundary-self-hosting **Use the actor path when the work has an
 operation; retain irreducible rails in the kernel.** The workspace has one
 reserved `plurnk` worker. It is durable; `DispatchAsPlurnk` opens a fresh
 administrative loop and turn for each ordinary operation batch. Other workers
-never receive its private log. They deliberately READ its published entries;
-ambient shared-state changes still cross only through the environment door.
+cannot read its private log or entries. Generated references are instead
+materialized directly in the addressed worker's private space; only direct
+lineage activity and explicit commons mutations cross the environment door.
 
 | Work                                    | Owning path                                                         | Why                                                                                 |
 | --------------------------------------- | ------------------------------------------------------------------- | ----------------------------------------------------------------------------------- |
-| Operator/client reference documents     | Reserved `plurnk` worker; ordinary EDIT through engine dispatch.    | Creating or replacing an entry is already an operation.                             |
+| Worker reference documents              | Addressed worker; `_plurnk` EDIT through engine dispatch.           | Creating or replacing a private entry is already an operation.                      |
 | Git membership and disk materialization | Kernel `GitMembership` / entry CRUD.                                | Ingesting existing disk state is not a model-authored EDIT.                         |
 | Disk-divergence narration               | Kernel writes an EDIT-shaped `source=file` row to the `plurnk` log. | It reports an environment event honestly; no operation is fabricated as having run. |
 | Search derivation and catalog render    | Kernel.                                                             | They are indexes and read-only projections, not entry operations.                   |
@@ -294,17 +387,50 @@ ambient shared-state changes still cross only through the environment door.
 Git membership includes tracked and untracked-but-not-ignored project files
 ({§membership-auto-add}); it does not stage them or run `git add`.
 
-§actor-boundary-doc-injection **Operator reference documents use the actor
-path.** `PLURNK_SERVICE_MD_<ALIAS>=<path>` ({§operator-config}) materializes
-`<path>` as `worker://plurnk/<ALIAS>.md` through a `DispatchAsPlurnk` EDIT, then
-foists a READ into each model worker's turn 0. The materializing EDIT remains in
-the `plurnk` worker's log; the model sees the shared entry through its own READ.
-Client-provided workspace documents union with the operator set at the same
-entry surface.
-
-§actor-boundary-catalog-preview **Catalog preview.** `PLURNK_SERVICE_FILES_ITEMS` foists turn-0 FINDs into the worker's first turn, so a worker opens with a navigable map instead of blank. An enabled preview executes exactly four orienting surveys in order: project files (`## FIND0 [+init] (*)`), workspace commons (`## FIND0 [+init] (worker:///*)`), the worker's own space (`## FIND0 [+init] (worker://~/*)`), and kernel docs (`## FIND0 [+init,+docs] (worker://plurnk/docs/**) <1,-1>`). Their log classifications make the opening survey one `init` set while retaining `docs` on its documentation row ({§log-item-tags}). A shallow result renders direct entries normally and every deeper first-segment directory as an actionable `dir/**` summary with its recursive `items` and `tokens`. Ordinary surveys use FIND's markerless first-16 page, whose range metadata reports the requested and returned page against the complete result total; only the small curated kernel-doc surface explicitly selects all. The opening exemplar therefore demonstrates both `*` and `**` without normalizing an all-results override. Every survey executes even when empty because zero results are useful orientation. A positive `N` explicitly caps only the file map's rendered rows, using the map's actual direct-entry-plus-directory count; `-1` enables the ordinary markerless page; unset / `0` disables previews. `log://` is absent because the current worker's log already renders in present mode.
-
-§worker-initialization-entry **Worker initialization is not model output.** A worker's first loop begins with one born-OPEN actionless row at `log:///1/1/1`: `origin="plurnk"`, `op` null, and `attrs.kind="initialization"`. Its `text/vnd.plurnk` body dynamically mirrors the turn-zero PLAN, the orienting operations actually dispatched, and terminal `SEND0 [102]`. The PLAN states `* Initialization complete.` and `* Next: address the prompt.`; SEND hands off with `Next, address the prompt.`
+§turn0-agents-stunt **The project AGENTS.md is a turn-0 stunt.** When
+`<projectRoot>/AGENTS.md` exists, LoopDocs materializes it as the current worker's private
+`worker://~/_plurnk/agents.md` entry and the engine foists one READ of it into
+that model worker's first turn — visible, logged, line-addressable. Absent
+file: no entry, no stunt, nothing 404s. The global XDG configuration `AGENTS.md`
+remains system-prompt policy ({§policy-sections}); the stunt carries only
+local repo guidance.
+
+§actor-boundary-doc-injection **Generated documents use the actor path.** The
+project's `AGENTS.md`, skills, and Functionality references are materialized in
+the addressed worker's `_plurnk/` subtree ({§worker-generated-subtree}) through
+ordinary `_plurnk` operation turns. Their exact
+EDIT and SEND programs remain durable in that worker's log; generated state is
+neither a hidden database write nor a kernel-owned mirror.
+
+§actor-boundary-catalog-preview **Catalog preview.** `PLURNK_SERVICE_FILES_ITEMS`
+foists turn-0 discovery into the worker's first turn, so a worker opens with a
+navigable map instead of blank. An enabled preview executes exactly seven baseline
+bodyless FIND surveys in order: enabled Agent Skills (`## FIND0 [+init,+skills]
+(worker://~/_plurnk/skills/*.md) <1,-1>`), Plurnk-generated reference families
+(`## FIND0 [+init,+skills] (worker://~/_plurnk/skills/plurnk/*.md) <1,-1>`), enabled
+tool families (`## FIND0 [+init,+tools] (worker://~/_plurnk/tools/*.md) <1,-1>`),
+enabled outbound agents (`## FIND0 [+init,+agents] (worker://~/_plurnk/agents/*.md)
+<1,-1>`, {§a2a-agents-catalog}), project files (`## FIND0 [+init] (*)`), workspace commons (`## FIND0 [+init]
+(worker:///*)`), and the worker's own space (`## FIND0 [+init] (worker://~/*)`).
+The catalogs select every direct document independently of its authored body;
+ordinary READ supplies its examples and complete instructions on demand. Their
+log classifications make the opening discovery one `init` set while retaining
+`skills`, `tools`, or `agents` on the corresponding rows ({§log-item-tags}). A shallow
+result renders direct entries normally and every deeper first-segment directory
+as an actionable `dir/**` summary with its recursive `items` and `tokens`;
+tool-family rows also carry the concise `{§scheme-catalog-summary}` that drives
+on-demand capability discovery. Ordinary surveys use FIND's markerless first-16
+page, whose range metadata reports the requested and returned page against the
+complete result total; only the small curated skills and tools surfaces
+explicitly select all. The opening survey demonstrates both `*` and `**` without
+normalizing an all-results override. Every survey executes even when empty
+because zero results are useful orientation. A positive `N` explicitly caps
+only the file map's rendered rows, using the map's actual
+direct-entry-plus-directory count; `-1` enables the ordinary markerless page;
+unset / `0` disables previews. `log://` is absent because the current worker's
+log already renders in present mode.
+
+§worker-initialization-entry **Model-worker initialization is a real `_plurnk` turn.** A model worker's first loop begins with one packetless `{ producer="_plurnk", kind="initialization" }` turn submitted through {§turn-ops-admission-path}. It preserves one OPEN exact `turnOps` item and dispatches the same source into ordinary PLAN, orienting READ/FIND, and terminal `SEND0 [102]` rows. Every row is structurally classified `_plurnk` and `init`. The PLAN is the canonical {§plan-value} with one `medium`, `in_progress` entry whose content is `Discover the tooling available and survey the workspace file root.`; SEND hands off with `Next: Address the prompt.` The first model request occupies the following turn and therefore begins at database/log turn sequence 2; “turn zero” is the initialization phase's model-facing label, not a zero-based database coordinate. Client and `_plurnk` administrative workers execute operation turns and do not receive model initialization.
 
 ### §machine-processes The machine and its processes: workspace, worker, fork
 
@@ -340,23 +466,32 @@ terminal history.**
 | Project files ({§machine-processes-one-filesystem})   | Workspace         | Shared live; a fork does not create another checkout.                                                              |
 | Shared worker entries (`worker:///...`)               | Workspace commons | Shared live.                                                                                                       |
 | Membership overlay ({§machine-processes-one-overlay}) | Workspace         | Shared unchanged; divergent membership requires another workspace.                                                 |
-| Log items ({§machine-processes-fork-copies-the-log})  | Worker            | Rows, event identities, curation effects, tags, fold state, and the matching observation cursor are copied as terminal history. |
+| Log items ({§machine-processes-fork-copies-the-log})  | Worker            | Rows, event identities, curation effects, tags, folded body intervals, and the matching observation cursor are copied as terminal history. Parent-audience occurrences still pending at the fork boundary belong to the snapshot; later sibling activity does not. |
 | §machine-processes-fork-cost **Provider evidence and accounting** | Worker | Turns and their model-facing log history are copied, but `model_calls`, emission-admission rows, and physical provider requests are not: one issued call or request has one owning worker. Parent and fork accounting therefore includes only work issued in that branch, while workspace accounting never double-counts copied history. |
-| Private worker entries (`worker://~/...`)             | Worker            | Deep-copied with ownership remapped; parent and child then diverge.                                                |
+| §machine-processes-entry-inheritance **Worker-owned entries** | Worker | The scheme's mandatory `{§manifest-entry-inheritance}` decides: `snapshot` copies only entries whose channels are all quiescent and remaps ownership; `rederive` copies no bytes and lets the child materializer rebuild them from inherited Functionality; `none` carries nothing. Within a `snapshot` scheme the Worker scheme's generated subtree is always rederived ({§worker-generated-subtree}). Parent and child then diverge. |
 | Active loops, turns, and cancellation                 | Worker            | Never copied as live work; inherited structure is terminal history, then a new loop starts.                        |
 
 §machine-processes-worker-is-its-log **A worker's conversational memory of
 the shared world is its log, with no hidden per-worker snapshot beside it.**
-OPEN/FOLD changes `log_entries.expanded` on that worker's rows ({§open-fold});
-environment changes arrive as attributed log entries ({§env-delta}). Private
-worker entries are deliberate scratch that the worker reads and writes through
-`worker://~/...`, not an invisible mirror of shared state. The environment door
-therefore carries only shared project-file and shared-entry changes
-({§env-delta-worker-entry-visibility}).
+OPEN/FOLD changes canonical folded body intervals on that worker's rows ({§open-fold});
+lineage activity and explicit commons broadcasts arrive as attributed log
+entries ({§env-delta}). Worker-owned entries include deliberate scratch and
+other private resources; their manifest declares whether a FORK snapshots,
+rederives, or omits each class. They are not an invisible mirror of shared state. Workspace
+addressability does not imply packet membership or ambient notification
+({§actor-boundary-lineage-attention}).
+
+§machine-processes-fork-pending-activity **A fork is a closed snapshot of the
+parent's view.** It copies rows already materialized in the parent and inherits
+parent-audience occurrences newer than the copied observation cursor through
+the occurrence high-water captured by worker creation. Activity addressed to
+the parent after that boundary is sibling activity, not fork history. Global
+commons broadcasts remain live after the fork because the branch is then an
+existing workspace worker in its own right.
 
 §machine-processes-model-worker-readable **A worker's log is private to packets, not to the workspace.** Isolation ({§actor-boundary}) governs what an *actor* sees — its own worker, never a sibling's. It does not wall off the client interface: `readLog({ workspaceId, workerId })` may read any ownership-verified worker in that workspace, and `listWorkers` enumerates them. A client-interface module chooses the default worker from its own conversation binding. The read is observation, never packet membership — no actor sees it.
 
-§machine-processes-worker-origin **A worker carries its actor.** Each worker records its `origin` — `model` (a conversation), `client` (a client-interface actor), or `plurnk` (the runtime's self-hosting worker) — set once at creation and inherited by a fork. `listWorkers` returns it, so a client interface identifies actor class without parsing the name, which is set at instantiation and immutable (a worker is permanent history, {§machine-processes-worker-is-its-log}).
+§machine-processes-worker-origin **A worker carries its actor.** Each worker records its `origin` — `model` (a conversation), `client` (a client-interface actor), or `_plurnk` (the runtime's self-hosting worker) — set once at creation and inherited by a fork. `listWorkers` returns it, so a client interface identifies actor class without parsing the name, which is set at instantiation and immutable (a worker is permanent history, {§machine-processes-worker-is-its-log}).
 
 §worker-provider-identity **A worker owns a durable provider identity distinct
 from its database id.** Creation mints a globally unique, opaque 128-bit value;
@@ -378,9 +513,9 @@ shared entries, and membership remain live and uncopied.
 histories over one workspace are worker forks. A divergent project filesystem
 or membership overlay requires a new workspace.
 
-### §worker-scheme The worker:// scheme — the knowledgebase (commons, own space, named spaces, the kernel surface) and worker control (spawn, irc, fork, terminate, cap, collect)
+### §worker-scheme The worker:// scheme — the knowledgebase (commons, own space, named spaces) and worker control (spawn, irc, fork, terminate, cap, collect)
 
-§worker-authority-carving **The authority names the OWNER:** `worker:///notes.md` is in the COMMONS — a shared blackboard; `worker://~/draft.md` is the calling worker's own private space; `worker://<name>/result.md` is a named worker's space; `worker://plurnk/docs/x.md` is the kernel's published surface, world-readable. Storage keys the owner on the entries.owner_id column ({§entry-owner}) — the pathname is always the bare entry path, and a FIND's result paths re-apply the queried authority so the model sees the address it typed. `~` is the sole current-worker sigil and cannot be minted; `commons` and `plurnk` are internal worker names unavailable for minting. Every other mintable authority, including `self`, is a literal worker name ({§worker-name}).
+§worker-authority-carving **The authority names the OWNER:** `worker:///notes.md` is in the COMMONS — a shared blackboard; `worker://~/draft.md` is the calling worker's own private space; `worker://<name>/result.md` is a named worker's space. Storage keys the owner on the entries.owner_id column ({§entry-owner}) — the pathname is always the bare entry path, and a FIND's result paths re-apply the queried authority so the model sees the address it typed. `~` is the sole current-worker sigil and cannot be minted; `commons` and `plurnk` are internal worker names unavailable for minting. Every other mintable authority, including `self`, is a literal worker name ({§worker-name}).
 
 §worker-name-minting **URI ingestion is permissive; worker minting is not.**
 Every model/client worker-creation door applies the contracts-owned
@@ -394,9 +529,11 @@ continues to decompose other authorities without treating them as mintable.
 | Any other spelling                             | Refused as `name-invalid` before lookup, insertion, or child startup. |
 | Automatic name                                 | Generated, then admitted through the same predicate.                  |
 
-§worker-read-scope **Named spaces are ancestry-gated reads**: the reader is the owner or an ANCESTOR (the recursive parent_worker_id walk) — oversight flows down the tree, a parent reads `worker://child/result` across generations, a child cannot snoop upward, and an unknown name or unpermitted reader resolves 404 with no existence leak. The kernel surface is the one world-readable named space.
+§worker-read-scope **Named spaces are ancestry-gated reads**: the reader is the owner or an ANCESTOR (the recursive parent_worker_id walk) — oversight flows down the tree, a parent reads `worker://child/result` across generations, a child cannot snoop upward, and an unknown name or unpermitted reader resolves 404 with no existence leak. Reserved runtime workers obey the same rule; there is no world-readable named space.
+
+§worker-write-scoping **Writes are own-space-and-commons only**: a model writes `worker://~/` and `worker:///` — every ancestry-readable named authority is read-only to it (403), while an unreadable name remains 404 under {§worker-read-scope}. `owner_id` is engine-stamped from the dispatch context, never model-set. Nothing worker-authored can land under another principal. The entry-copy seam (COPY/MOVE) is pathname-keyed and addresses the commons; a space's content moves via READ + EDIT. The one exception inside a writable space is the generated subtree below.
 
-§worker-write-scoping **Writes are own-space-and-commons only**: a model writes `worker://~/` and `worker:///` — every named authority is read-only to it (403), and owner_id is engine-stamped from the dispatch context, never model-set. Nothing worker-authored can land under another principal — `worker://plurnk/` included, which is what makes the kernel surface the trust boundary with no guard to forget (only the kernel, dispatching as itself, authors it). The entry-copy seam (COPY/MOVE) is pathname-keyed and addresses the commons; a space's content moves via READ + EDIT.
+§worker-generated-subtree **`_plurnk/` is Plurnk's generated subtree in every worker space.** Every Plurnk-generated per-Worker document lives under `worker://~/_plurnk/`: the project instructions (`_plurnk/agents.md`, with nested AGENTS.md files under `_plurnk/instructions/**` preserving their subtree paths — the standard's closest-file scope, materialized without any foisted READ or teaching), standard Agent Skills and Plurnk-generated references (`_plurnk/skills/**`), executable families (`_plurnk/tools/**`), and future family catalogs. The subtree is readable exactly like the rest of the space ({§worker-read-scope}) and writable only by the `_plurnk` writer tier: a model, client, or plugin EDIT, KILL, SEND 410, or COPY/MOVE destination whose pathname begins `/_plurnk/` is refused 403 `worker-generated-read-only`, in the commons as well as in own and named spaces. Its documents are materialized through ordinary `_plurnk` **maintenance** turns ({§actor-boundary-doc-injection}), so provenance is legible at the address and durable in the log — but a receipt answers an asker, and maintenance turns have none: their successful rows never render in the packet (failures remain visible), while READ over `log:///` recovers them exactly and the turn's self-FOLD keeps client waterfalls tidy. On FORK the subtree is never byte-copied; the child rederives it from its inherited Functionality ({§machine-processes-entry-inheritance}). A runtime's `resourcesPath` is relative to this root ({§tools-resource-materialization}). No world-readable kernel authority exists; there is no `worker://plurnk/`.
 
 §worker-control-addressing **Only an exact authority-only address selects worker
 control.** Control is same-workspace only ({§actor-boundary}). Generic URI
@@ -425,7 +562,7 @@ literal `workers.name` value.
 | `KILL`    | existing literal name, `~`  | Terminate the named worker or caller.   |
 
 - §worker-scheme-spawn **Spawn** — `## WORK0 (worker://<name>)` with a task body creates a new worker sister (empty log) and starts it with that task on its first loop. WORK/FORK are the worker-creation verbs: EDIT is file/entry only, so EDIT on the bare worker entity is a **400** steering to WORK/FORK — the entity is not an entry. A name is **frozen per worker** but **reclaimable across time** ({§machine-processes-worker-origin}): a name held only by a *terminated* sister is free to reuse — a fresh spawn takes a new row and `worker_resolve_by_name` resolves the newest, the corpse keeping its name in permanent history. A name a *live* sister still holds is a conflict — **409 `worker '<name>' is already running`**, legible at the spawn gate, never a raw store-level uniqueness error.
-- §worker-scheme-irc **irc** — `## SEND0 (worker://<name>)` with a message body delivers it to an existing sister, the **voice door** ({§actor-boundary-two-doors}): an active sister folds it into its next turn, an idle one wakes ({§actor-boundary-passive-wake}). `## SEND0 (worker://~)` targets the caller; a literal name with no worker in the workspace is 404.
+- §worker-scheme-irc **irc** — `## SEND0 (worker://<name>)` with a message body delivers it to an existing sister, the **voice door** ({§actor-boundary-two-doors}): an active sister folds it into its next turn, an idle one wakes ({§actor-boundary-passive-wake}). A fresh receiving loop retains that worker's durable model, spawn override, and reasoning policy; the sender and daemon default do not re-select it. `## SEND0 (worker://~)` targets the caller; a literal name with no worker in the workspace is 404.
 - §worker-scheme-fork **Fork** — `## FORK0 (worker://<name>)` with a task body branches the
   current worker into a **named** sister: its log is deep-copied
   ({§machine-processes-fork-copies-the-log}), which continues with `task`; the
@@ -505,13 +642,14 @@ The remaining worker surfaces are:
 - §worker-scheme-terminate **Terminate** — `## KILL0 (worker://<name>)` aborts a named worker and `## KILL0 (worker://~)` aborts the caller: every unresolved loop in that worker's subtree closes 499 and every subscription in the subtree tears down; a literal name with no worker is 404. Cancellation is structured: descendants cannot detach implicitly. The override to the fire-and-forget default is not a parent-power — whoever holds the address may end it; a worker left alone simply ends at its own SEND signal `200`.
 - §worker-scheme-cap **Cap** — `PLURNK_SERVICE_WORKSPACE_WORKERS_MAX_ACTIVE` ceilings the *concurrent* active workers per workspace (a worker with a non-terminal loop); a spawn or fork past it fails hard (508 — no queue, no retry), irc exempt; `-1` disables it. The fork-bomb brake, sized for workspaces that live for months.
 - §worker-scheme-collect **Collect** — a worker's loop reaching a terminal status
-  surfaces to its sisters as an ambient delta ({§env-delta}): a `SEND` from
+  surfaces to its direct parent as an ambient delta ({§env-delta}): a `SEND` from
   `worker://<name>` carrying the loop's exact terminal operation result. A
   **2xx deliverable is born OPEN** (its body
   materialized into the parent's packet, not hidden behind a fold): a child's
   success must reach the parent open and awakening, never a bodyless row. An
   non-2xx result surfaces folded; a failure retains its exact status and Problem. Every death-path is stamped uniformly,
-  so no termination is silent; collection is the shared world moving, never a
+  so no child termination is silent to its owner; collection is lineage
+  supervision, never a
   verb. The **pull** side mirrors the push: a path-absent
   `## READ0 (worker://<name>)` collects that same result on demand for a
   concluded worker; a worker **still running** has not delivered, so the READ
@@ -524,11 +662,11 @@ The remaining worker surfaces are:
   turn the packet's status clump surfaces the live things this worker currently
   holds — open streams (`## Child Streams`) and unconcluded child workers
   (`## Active Child Workers`) — as terse `* <status> <path>` pointers (the same
-  shape as the errors section), just above it. A worker is otherwise marked
-  only at spawn and at conclusion; in between it goes silent, so a model loses
-  track of what it holds and premature-terminates. This is orienting state,
-  never advice: the model sees its live subtree (`* 102 worker://worker-x`,
-  `* active sh:///1/2/3`) and reasons for itself — READ/OPEN/KILL via the path.
+  shape as the errors section), just above it. Folded child activity is durable
+  history; this clump is the current inventory that keeps an active obligation
+  visible even when no new activity arrived. It is orienting state, never
+  advice: the model sees its live subtree (`* 102 worker://worker-x`, `* active
+  sh:///1/2/3`) and reasons for itself — READ/OPEN/KILL via the path.
   Empty sections are omitted, like errors.
 
 ### §worker-loop-lifecycle Worker and loop lifecycle: drain, reap, and passive wake
@@ -551,6 +689,12 @@ stateDiagram-v2
 
 §worker-lifecycle-state-machine The lifecycle store admits only the guarded transitions shown above: `100 → 102`, `102 → 202`, `202 → 100`, and any unresolved state (`100`, `102`, `202`) to a terminal status. Terminal state is immutable. `DrainSupervisor` owns claim, wake, and cancellation; the dispatcher owns model-requested park/conclusion; the daemon owns boot-recovery orchestration; and the engine owns policy terminals. A racing transition that loses observes the durable winner; it does not overwrite it or report the requested state as fact.
 
+§worker-lifecycle-live **Worker liveness is existential, not latest-state.** A
+Worker is live while ANY of its loops is unresolved (`100`, `102`, or `202`). A
+newer terminal loop cannot mask older queued, running, or parked work. Name
+collision, workspace worker caps, child obligations, orientation, and recovery
+all use that one definition.
+
 §stream-catalog-lifecycle Streams are independently durable subscriptions owned by a worker. Payload and
 lifecycle are orthogonal: zero bytes is a valid payload for both success and
 failure, while the closed subscription and its status are the terminal fact.
@@ -663,7 +807,7 @@ boundary.
 - §worker-lifecycle-total-reap **Cancellation is recursive and reaps every held stream.** `loop.cancel`, worker `KILL`, shutdown, and a worker's SEND signal `499` terminalize every unresolved loop in the cancelled worker subtree and iterate each worker's durable open-subscription rows, invoking each exact callable owner from the process-local live registry. The durable rows answer *what is held*; the live registry answers *how this process tears it down*; the abort signal is a fast-path optimization. There is no implicit detachment. Before shutdown awaits drains, it cancels every process-local proposal waiter through {§proposal-cancel-aborts} with outcome `daemon_stopping`, so a stopped-world dispatch cannot hold teardown open. A stream that is running, mid-spawn (its row written before it is killable), or spawned after the cancel is reaped alike. The teardown abort is bounded: the executor sends a polite signal then SIGKILL after a consumer-set grace (`PLURNK_SERVICE_EXEC_KILL_GRACE_MS`). A model `## KILL0 [code]` on one live stream instead delivers exactly that signal once (bare KILL uses the executor's SIGHUP default; `## KILL0 [9]` uses SIGKILL).
 - §worker-lifecycle-exec-epoch-bound **A stream's kill binds to the scope it captured at spawn.** A stream captures the worker's cancellation scope as it registers and wires its kill to it, re-checking `aborted` AFTER wiring — no check-then-listen gap can drop an abort that lands mid-registration. Because the scope is replaced only once aborted, a captured-then-replaced scope is necessarily already aborted, so replacement never strands a live stream.
 - §worker-lifecycle-no-resurrection **A cancelled worker is not resurrected by its own torn-down work.** A stream conclusion delivered to a cancelled, idle worker starts no fresh drain: an aborted (499) conclusion is skipped, and a straggler that concluded cleanly surfaces its deliverable as an environment delta ({§env-delta}), never a revived loop. The cancel was deliberate; only an explicit `runLoop` request resumes the worker.
-- §worker-lifecycle-wake-liveness **A stream conclusion always reaches its worker.** When a backgrounded stream concludes, `DrainSupervisor` routes it through the same inject seam as any loop source ({§actor-boundary-passive-wake}): an active worker folds the conclusion into its next turn; a worker **blocked on a 202 wait** for that stream ({§wait-obligation-matrix}) **awakens that loop in place** — the blocked loop *is* the continuation, so there is no fresh loop and no summary-as-prompt fiction. The result is never lost: a blocked loop sleeps rather than ending, and the stream's status-transition is the arrival ({§actor-boundary-passive-wake}) that wakes it; on resume it reads the concluded stream's own state, not a synthetic prompt.
+- §worker-lifecycle-wake-liveness **A stream conclusion always reaches its worker.** The stream first persists its terminal state. A worker **blocked on a 202 wait** for that stream ({§wait-obligation-matrix}) then **awakens that loop in place** — the blocked loop *is* the continuation, so there is no fresh loop and no summary-as-prompt fiction. An already-active worker needs no injected prompt or second wake because its next packet reads the durable terminal state. A concluded worker receives no synthetic loop from ambient stream closure. The result remains available in the stream's own state under every case.
 - §worker-lifecycle-child-wake **A child worker concluding wakes a parent blocked on it — the topology join.** `worker://` spawn/fork records `parent_worker_id` ({§lifecycle-terms}). When a worker's drain exits having **concluded** — no `202`-blocked loop, no open stream — `DrainSupervisor.#onDrainExit` resumes its parent **in place** through the shared `#wakeParkedWorker`, the same 202→100 resume a stream conclusion uses. So a parent that spawns work and blocks with SEND signal `202` is woken the moment its child finishes; on resume it reads the child's deliverable from the {§worker-scheme-collect} delta in its own log — a control edge, **never an injected prompt**. The wake recurses upward via the parent's own drain-exit. A child still running — or itself blocked at 202 — is not *concluded*, so it does not wake the parent (it's still a live thing the subtree holds). This is the structured-concurrency join: streams and child workers are the same kind of "live thing a worker holds," driving premature-terminate ({§send-premature-terminate}), the wake edge, and the collect delta identically. A worker conclusion is a **bounded, un-loseable** wake: if the conclusion fires while the parent is mid-turn (before its block commits), `#wakeParkedWorker` finds it not-yet-slept and records an **owed wake**, which the drain honors when the parent blocks — so a wait awaiting workers **always returns**, never dead-blocks on a conclude-before-block race. (Only a live exec stream, unbounded absent a timeout, may legitimately hold a wait open.)
 - §worker-optimistic-settlement **Asynchronous settlement receives one bounded worker-local opportunity before model dispatch.** An initiating turn lets only the streams it started settle before its terminal SEND; separately, a stream or direct-child conclusion persists and publishes immediately but holds the parked worker's single `202→100` requeue while another stream or direct child remains live. Both use `PLURNK_SERVICE_OPTIMISTIC_WAIT_MS`, shipped at five seconds; zero disables the opportunity. The wake hold ends as soon as no sibling obligation remains, never extends its original deadline, and coalesces every conclusion that lands within it into one requeue. With no sibling obligation the wake is immediate; at the deadline, surviving work follows the ordinary monitored lifecycle. A conclusion that lands after provider dispatch begins retains its next wake, while poll, park-deadline, prompt, and operator wakes never open this hold. Only packet/provider dispatch waits: terminal state, client events, cancellation, and child execution do not. One redaction-safe span records elapsed time, quiescence versus deadline, and conclusion count without entering the packet.
 - §worker-lifecycle-idle-is-concluded **An idle worker concludes; it does not park.** A loop is idle only when it has neither live obligations nor completed results awaiting their first packet. A live child or stream blocks a SEND signal `202` join; a completed stream, child result, or same-turn retrieval continues directly to the next packet where it is observed. Only after those sets are drained does signal `202` resolve like signal `200`. There is no held-open idle loop and no `loop/quiesced` soft signal. A concluded worker is durable working history and an addressed arrival reawakens it as a new loop.
@@ -685,7 +829,7 @@ Three current entry points:
 - §provider-surface-capacity `provider.assessRequestCapacity(messages, maxOutputTokens?, signal?)` — provider-owned intersection of request-shaped token evidence and every known physical input limit. It admits, rejects only a proven exact overflow, or defers ambiguity to upstream ({§tokenomics-context-envelope-admission}). `generate` performs this assessment for its exact request and preserves the evidence on success and capacity failure.
 - §provider-surface-prompt-measurement `provider.countPromptTokens(messages, signal)` — the cancellable complete-request measurement primitive used by provider capacity assessment, with `exact`, `upper_bound`, `estimate`, or `unavailable` provenance. Core never substitutes this physical fact for its curation ruler.
 
-§provider-surface-identity Provider capacity and identity are immutable for one instance. `contextWindow`, `maxInputTokens`, and `maxOutputTokens` carry known model limits; `outputBudget` is the total generation envelope, optional `reasoningBudget` is its strict subset, and `inputCapacity` is the stable intersection of known input constraints ({§tokenomics}). Unknown facts remain `null`. `model` identifies persisted turn/provider evidence. Local GBNF boot verification also consumes `constrainsOutput` ({§grammar-enforcement-verified-at-boot}).
+§provider-surface-identity Provider capacity and identity are immutable for one instance. `contextWindow`, `maxInputTokens`, and `maxOutputTokens` carry known model limits; `outputBudget` is the total generation envelope, optional `reasoningBudget` is its strict subset, and `inputCapacity` is the stable intersection of known input constraints ({§tokenomics}). Unknown facts remain `null`. `model` identifies persisted turn/provider evidence. Local GBNF admission also consumes `constrainsOutput` ({§grammar-configuration-admission}).
 
 §meta-passthrough **Metadata passthrough (provider → client).** `generate` may return an open `meta: Record<string, unknown>` bag. The service stores it unenforced per turn (`turns.meta`, `json_valid` only — no schema) and forwards the latest turn's blob in `loop/terminated.usage` ({§notifications}). The service never reads a field within it. Providers own their metadata shapes; monetary values carry an explicit amount and currency rather than an implied unit. Absent → `{}`. The mirror direction (client → provider, the self-identified `client` id) rides `generate({client})` ({§attribution}).
 
@@ -703,9 +847,11 @@ Three current entry points:
 
 A completed provider exchange is an **emission attempt**, not necessarily an engine turn. The provider transports and observes the model's bytes; ANTLR is the admission authority only after provider completion. Admission asks whether the exchange has a trustworthy frame: its first parsed operation is PLAN, its last parsed operation is a terminal SEND, every hard parse error is bounded between those anchors, and no `unparsedTail` exists. Missing anchors, an error outside the frame, or a boundary-destroying tail rejects the entire exchange regardless of `finishReason`; no recovered prefix dispatches. Parser warnings remain admissible. `finish=length` is forensic evidence of likely truncation, not an independent rejection rule. A provider-declared resource interruption never reaches admission, even when its partial bytes form a complete-looking frame ({§provider-interrupted-attempt}).
 
-Core retries a rejected emission against the exact same packet beneath the same engine turn, up to `PLURNK_SERVICE_EMISSION_ATTEMPTS`. Rejected bytes never dispatch or reach the engine strike rail. Before each `generate`, Core opens one durable logical `model_calls` row and its emission-specific `turn_attempts` admission row. A call that ends without response evidence leaves that admission row unclassified (`accepted IS NULL`) and does not consume the emission-attempt ceiling. Beneath the model call, every provider observer invocation opens one cardinal `provider_requests` occurrence immediately before physical I/O and settles it as response or error. Adapter retries and capacity failover append requests in issue order; a response-less failure therefore remains an accounted occurrence rather than disappearing. Normalized response evidence is durable before parser classification and does not duplicate the separately owned accounting. The accepted exchange alone completes `turns.packet`; every physical request remains in turn and loop accounting, while the context gauge reads the latest settled emission request on the latest turn. Digest exposes rejected response evidence as `packetNNN.attemptNNN.rejected.*` and every physical request in its machine-readable ledger.
+§safe-uri-target-groups After source and authored-command admission, Core tolerates one target group on READ, FOLD, or OPEN only when splitting its raw target at top-level comma or whitespace separators produces at least two members and every member independently parses as an explicit `scheme://` URI. Request-metadata blocks are opaque to this split. Each member becomes one ordinary statement with an independent dispatch outcome and log row, in authored member order; scheduling may still move the complete operation class under {§op-mode-phases}. Otherwise the target remains exactly singular, including local filenames containing spaces or commas. The stored `turnOps` and authored command count remain unexpanded, and no other operation admits target groups.
 
-The first exhaustion in a consecutive sequence closes that unadmitted turn as a continue and opens exactly one ordinary recovery turn. Its packet projects the latest rejected response OPEN from a durably FOLDED model item under {§model-entry-log-curation} and carries one transient `invalid_emission` Notice whose complete message is: `Your previous response contained an unrecoverable syntax error. No operations were performed. Try again.` No parser diagnostic, attempt count, or rail state becomes model-facing. The recovery turn has its own honestly stored packet and its configured private same-packet attempts. The packet-local projection never changes the row's curation state, so no later packet repeats the malformed body unless the model explicitly OPENs it. Admission clears the recovery state; exhausting the informed turn terminates instead of opening another.
+Core retries a rejected emission against the exact same packet beneath the same engine turn, up to `PLURNK_SERVICE_EMISSION_ATTEMPTS`. Rejected bytes never dispatch or reach the engine strike rail. Before each `generate`, Core opens one durable logical `model_calls` row and its emission-specific `turn_attempts` admission row. A call that ends without response evidence leaves that admission row unclassified (`accepted IS NULL`) and does not consume the emission-attempt ceiling. Beneath the model call, every provider observer invocation opens one cardinal `provider_requests` occurrence immediately before physical I/O and settles it as response or error. Adapter retries and capacity failover append requests in issue order; a response-less failure therefore remains an accounted occurrence rather than disappearing. Normalized response evidence is durable before parser classification and does not duplicate the separately owned accounting. The accepted exchange alone extends `turns.packet` with response evidence; every physical request remains in turn and loop accounting, while the context gauge reads the latest settled emission request on the latest turn. Digest exposes rejected response evidence as `packetNNN.attemptNNN.rejected.*` and every physical request in its machine-readable ledger.
+
+The first exhaustion in a consecutive sequence closes that unadmitted turn as a continue and opens exactly one ordinary recovery turn. Its packet projects the latest rejected response OPEN from a durably FOLDED emission-attempt item under {§rejected-emission-entry} and carries one transient `invalid_emission` Notice whose complete message is: `Your previous response contained an unrecoverable syntax error. No operations were performed. Try again.` No parser diagnostic, attempt count, or rail state becomes model-facing. The recovery turn has its own honestly stored packet and its configured private same-packet attempts. The packet-local projection never changes the row's curation state, so no later packet repeats the malformed body unless the model explicitly OPENs it. Admission clears the recovery state; exhausting the informed turn terminates instead of opening another.
 
 An admitted frame may contain bounded malformed statements. Parsed operations still dispatch; each malformed statement becomes one durable model-origin `error` row with the parser's exact diagnostic under {§parse-diagnostics} and status 400. These failures are committed before the terminal disposition, participate in the ordinary strike rail, and prevent SEND signal `200` or an already-drained signal `202` from concluding before the model sees them in the next packet. This is operation recovery, not provider resampling.
 The Problem recovery states that only the failed operation needs correction
@@ -759,27 +905,42 @@ it or reinterpret a malformed tag list.
 service-side caching, per-loop selection, context-cap handling, and local GBNF
 verification. Cataloged providers use Models.dev metadata and official AI SDK
 bindings; an operator declaration covers an uncataloged compatible endpoint;
-plugin discovery is the last protocol-extension seam.
+plugin discovery is the last protocol-extension seam. Cache identity includes
+the alias, wire route, and complete provider-knob projection; a registered
+preconstructed handle occupies that same identity and cannot shadow changed
+tuning.
 
-§grammar-enforcement-verified-at-boot **Optional local GBNF is verified at boot.**
+§grammar-configuration-admission **Optional local GBNF is admitted without model generation.**
 The ANTLR grammar always defines and validates the PLURNK language. Separately,
-an operator may configure `PLURNK_PROVIDERS_GBNF_<alias>` for a local
-llama-server. The provider must advertise GBNF transport and satisfy a forcing
-probe whose sampled sentence and pre-projection response match the selected
-rail's template boundary followed by the `PLURNK-RAILS-LIVE` sentinel, or boot
-fails. The setting is resolved
-per alias and is unset by default. Configuring it on a cloud or endpoint-managed
-provider is an error, not a request for best-effort filtering.
-Alias-scoped `PLURNK_PROVIDERS_GBNF_DEBUG` deliberately withholds transport, so
-boot skips the enforcement probe while real requests retain the configured rail
-for local syntax validation and the engine's withheld-rail verdict.
-Runtime injection uses the provider's registered alias, falling back only to
-the process's active alias. Suffixed rail settings with neither identity fail
-instead of guessing. A configured package variant or explicit path that cannot
-be loaded also fails; it never silently becomes unconstrained.
+an operator may configure global `PLURNK_PROVIDERS_GBNF` or
+`PLURNK_PROVIDERS_GBNF_<alias>` for a local
+llama-server. Startup requires the provider to advertise GBNF transport and a
+reasoning-compatible configuration, but daemon lifecycle grants no inference
+or spending authority and therefore generates no verification tokens. The
+setting is resolved globally for an exact route and per alias for a declared
+alias; it is unset by default. Configuring it on a cloud
+or endpoint-managed provider is an error, not a request for best-effort
+filtering. Every user-authorized constrained generation proves transport through
+its exact pre-projection evidence ({§rail-truth-engine-verdict}). Alias-scoped
+`PLURNK_PROVIDERS_GBNF_DEBUG` is the explicit exception: it deliberately
+withholds transport while retaining local grammar validation and the engine's
+withheld-rail verdict. Runtime injection uses the provider's registered alias,
+falling back only to a real process-active alias; an alias-free route uses the
+global setting and ignores unrelated suffixes. A configured package variant or
+explicit path that cannot be loaded also fails; it never silently becomes
+unconstrained.
+
+§grammar-rail-registration **Rail variants are built-in names or import
+specifiers.** A bare variant (no `/`, no `:`) resolves as a built-in rail
+subpath under `@plurnk/plurnk-contracts`. Any other variant form is an import
+specifier — an absolute or relative operator file path, or a package export
+subpath (e.g. `@acme/plurnk-rails/custom.gbnf`) — resolved through the Node
+resolution chain, so a third-party rail package plugs in with no built-in
+registry. An unresolvable or unreadable rail fails the constrained generation
+loudly; it never silently becomes unconstrained.
 
 §gbnf-requires-reasoning Both shipped PLURNK rails require reasoning. The same alias-scoped configuration
-must resolve reasoning to `adaptive` or `on`; `off` with GBNF is rejected before
+must resolve reasoning to `adaptive` or a supported fixed effort; `off` with GBNF is rejected before
 the probe or any model generation. Reasoning-off remains valid when no GBNF rail
 is configured.
 
@@ -787,9 +948,9 @@ is configured.
 For a configured local GBNF, the provider returns the pre-projection sentence as
 `grammarEvidence` under `plurnk-providers` {§gbnf-response-observation}. The engine
 requires that evidence, independently validates `grammarEvidence.input` with the
-artifact's declared response root, and
-stamps `railsAttached: "client"` when transported or `"withheld"` in debug mode
-plus `railsVerdict`; it never validates projected
+artifact's declared response root, and requires `transported: true` unless the
+operator explicitly enabled debug mode. It stamps `railsAttached: "client"`
+when transported or `"withheld"` in debug mode plus `railsVerdict`; it never validates projected
 `assistant.content` as though the required reasoning enclosure were still
 present. A non-accept verdict emits one `grammar_unenforced` notice. A raw
 position at or after `contentStart` is translated to a content offset; a failure
@@ -819,21 +980,25 @@ Author-facing contract: [`@plurnk/plurnk-schemes`](../plurnk-schemes/SPEC.md). B
 
 When an op carries a target, RFC 3986 supplies the component model and WHATWG
 URL supplies canonical decomposition; an entry key is
-`(workspace, owner, scheme, pathname)` ({§entry-identity-no-null}). Handler
-routing and resource identity are separate:
-
-- §scheme-address-namespace-fold A **registered non-network, non-worker scheme** mechanically folds its authority into the canonical storage pathname (`Dispatcher.#extractTarget` → `foldAuthorityIntoPath`). For an entry namespace, the authority is therefore a leading path segment rather than a separate identity component.
-- The **`worker` scheme is the registered exception**: its authority selects an owner ({§worker-authority-carving}) and remains distinct through dispatch; the handler strips it only after resolving the entry owner.
+`(owner, scheme, authority, pathname)`; the owner Worker determines the
+workspace ({§entry-identity-no-null}).
+The registered manifest's {§manifest-authority} disposition determines the one
+meaning of an authored URI authority before any entry capability is exposed:
+
+- §scheme-address-namespace-fold A **namespace scheme** mechanically folds its authored authority into the canonical storage pathname and persists the empty entry authority. For an entry tree, the authored authority is therefore a leading path segment rather than a separate resource coordinate.
+- An **owner scheme** consumes its authored authority while resolving `entries.owner_id` and persists the empty entry authority. `worker` uses this disposition ({§worker-authority-carving}).
+- A **resource scheme** preserves its canonical authority as the durable entry-authority coordinate. Every capability and exact query is bound to that authority; it cannot collide with or observe the same pathname at another authority.
 - §scheme-address-network A **network resource** uses the shared schemes-layer
   normalization contract {§network-address}:
   `https://example.com:8443/page?b=2&a=1` →
-  `(https, /example.com:8443/page?b=2&a=1)`. The exact protocol, canonical
+  `(https, example.com:8443, /page?b=2&a=1)`. The exact protocol, canonical
   host, non-default port, path, and serialized query are identity; query order,
   duplicates, and an explicit empty `?` survive. A fragment is a Plurnk channel
   selector, not network identity or transport. URL userinfo is rejected and
-  request metadata never enters identity. `https` may route through `http`,
+  request metadata never enters identity. Plain `http` routes through `https`,
   just as `ws` routes through `wss`; those implementation aliases never alias
-  resources. `SchemeCtx.entries` binds every cap to the addressed protocol.
+  resources, and the secure face is the one taught — `http` stays supported
+  for the endpoint that requires it, never advertised as a peer. `SchemeCtx.entries` binds every cap to the addressed protocol.
   Absolute network URLs are single resources even when their path ends `/` —
   folder/glob expansion belongs to entry namespaces, never an HTTP origin.
 - The **`file` class is the workspace filesystem** — a mount namespace with its own resolution and naming law, specified below.
@@ -841,37 +1006,83 @@ routing and resource identity are separate:
 §client-entry-address A client entry read carries the observing `workerId` and
 passes its selector through the registered data scheme's
 {§entry-address-resolution} before querying storage. The scheme returns its
-canonical pathname and semantic owner; core alone resolves that owner to
-`entries.owner_id` and queries the complete `(workspace, owner, scheme,
-pathname)` identity. Worker and capability-stream authorities reuse their
+canonical authority, pathname, and semantic owner; core alone resolves that
+owner to `entries.owner_id` and queries the complete `(owner, scheme,
+authority, pathname)` identity. Worker and capability-stream authorities reuse their
 ancestry checks, so unknown or unauthorized owners return the same 404 and
 cannot select an arbitrary colliding row. The result is the contracts-owned
 {§entry-read-result}; persistence columns never cross the seam.
 
+§scheme-entry-matrix URI authority, entry principal, access, and fork
+inheritance are independent decisions. The built-in surfaces declare them
+explicitly:
+
+| Surface | URI authority | Entry principal | Cross-Worker read | FORK entry disposition |
+|---|---|---|---|---|
+| Project file | Filesystem name | `commons` | Workspace-shared | Shared live; no copy |
+| `worker:///...` | Empty selects commons | `resolved` commons | Workspace-shared | Shared live; no copy |
+| `worker://~/...` | `~` selects caller | `resolved` Worker | Self; parent may use the child's literal name | Quiescent snapshot; `_plurnk/**` rederived |
+| `worker://<name>/...` | Literal Worker selector | `resolved` Worker | Owner or ancestor | Scheme disposition only when the selected owner is the fork source; otherwise no copy |
+| `prompt:///...` | Loop-relative coordinate | Calling Worker | Self-only | Quiescent snapshot |
+| Provisional `skill:///...` | Entry namespace | Calling Worker | Self-only | Quiescent snapshot |
+| `http(s)://...` | Remote resource identity | Calling Worker | Self-only | Quiescent snapshot; an active stream is omitted |
+| `wss://...` | Remote resource identity | Calling Worker | Self-only | None |
+| Executor/MCP output | Optional named actor selector | `resolved` Worker | Owner or ancestor | None |
+| `a2a://...` outbound resource | Remote-agent identity | Calling Worker | Self-only | None |
+
+A resolved-owner scheme authorizes the actor selector before returning its
+principal; a numeric Worker id is never extension input. `worker` ownership has
+no cross-actor form. Thus identical HTTP, WSS, A2A, prompt, Skill, or unqualified
+executor addresses in independent root Workers are distinct resources without
+render-time filtering.
+
 §fs-namespace **The workspace is a mount namespace; `project_root` is the model's `/`.** Chroot semantics: host paths do not exist inside the jail, and no engine surface folds a host-absolute spelling onto a member. The root is **fixed immutably at workspace creation** (headless is forever); the namespace's mount table changes only through the declared membership overlay ({§membership}), never by re-rooting. At `project_root = /` the jail is the whole filesystem and every rule below degenerates to identity — the design's proof case, and the common benchmark topology.
 
 §fs-namei **Resolution is namei over the mount table.** The model's CWD is permanently `/`, so `src/x.md` and `/src/x.md` are the same name — the slash rule is a corollary, never a legislated equivalence. Resolution is lexical: `.` and `..` resolve before anything touches storage (`..` is legal *during* traversal); the final name lands in the root subtree (a bare key), on a declared outside-root mount (a `../`-prefixed key — the git-style overlay), or names nothing (404 carrying the resolved form). Containment is the resolution semantics — there is no separate traversal check to forget.
 
 §fs-canonical-name **One canonical name, storage ≡ wire: the git pathspec.** Member keys follow gitformat-index(5) verbatim (reference edition: git 2.47.3): relative to the workspace `project_root`, without leading slash, `/`-separated, no trailing slash or NUL. Directories are never entries and the root needs no name. When `project_root` is below the containing repository's top level, Git members above it naturally use the same `../`-prefixed CWD-relative names that `git ls-files` emits without `--full-name`; these are not outside-repository mounts. The database stores that root-relative key directly because workspace identity is rooted at the access point. Every model spelling canonicalizes before storage or comparison.
 
-§fs-visibility-grantors **Visibility has three grantors; plurnk is never one of them.** A file is visible to the model only when admitted by (1) the client's explicit `pick` grant, (2) the containing repository's inclusion semantics (ls-files ∪ untracked-not-ignored − ignored), or (3) the AGENTS.md knob ({§policy-sections} — auto-pulled as POLICY, deliberately not a member; a git-tracked AGENTS.md may separately be an ordinary member via grantor 2). Model creation is a WRITE permission, never a visibility source — the created file's visibility rides git's rules, so a gitignored creation would be invisible even to its creator (which is why the write gate refuses it — the blind-write closure in {§fs-write-surface}). **Counterintuitive on purpose**: a file physically inside the root that no grantor admits DOES NOT EXIST for the model. Every visible byte traces to the client's constraint table or the operator's Git rules, never to a Plurnk guess.
-
-§fs-write-surface **The write surface — mount semantics, grantor-keyed.** The project root is the model's one read-write mount; writability elsewhere tracks the grantor: *write permission = inside the root, or client-granted outside it — Git grants read-write only within the project.*
-
-| Location               | Path state          | Admission                 | Result |
-|------------------------|---------------------|---------------------------|--------|
-| Project root           | Absent              | Git or client after write | Exclusive CREATE (`open(O_CREAT\|O_EXCL)` semantics), only when the result will remain visible. |
-| Project root           | Existing member     | Any grantor               | Proposal-gated EDIT. |
-| Project root           | Existing non-member | None                      | Refuse; reveal occupancy only, never content. |
-| Declared outside mount | Existing member     | Client                    | Read-write, proposal-gated; the explicit pick acts as a per-file rw bind mount. |
-| Declared outside mount | Existing member     | Git                       | Read-only. |
-| Declared outside mount | Absent              | Any                       | Refuse; only the project root mints files. |
-
-The **blind-write closure** refuses a root create that Git would ignore and no
-client pick covers, because Plurnk never writes bytes its own sandbox cannot
-subsequently see. A non-Git root grants nothing by itself. Refusing an occupied
-non-member follows the POSIX exclusive-create precedent: namespace occupancy is
-not secret, but content remains dark.
+§fs-visibility-grantors **File visibility has two represented grantors; Plurnk never invents a private third one.** A file member is admitted by the active Git substrate or by an ordinary `pick` constraint. A `pick` is either explicit client policy or the exact, inspectable record of an accepted creation ({§fs-create-generated-pick}); both resolve to `constraint` membership. AGENTS.md remains auto-pulled as POLICY ({§policy-sections}), deliberately not a file member. A physically existing path that neither Git nor `pick` admits does not exist for the model and cannot be overwritten.
+
+§fs-write-surface **The write surface — one admission and incorporation path.** Existing writes remain membership-gated. An absent path additionally crosses the effective creation scope and the complete constraint/Git policy before a proposal is issued. EDIT, COPY destinations, and MOVE destinations use this same path regardless of whether the producer is a model, client, plugin, or `_plurnk`.
+
+| Case | Required admission | Accepted result |
+|------|--------------------|-----------------|
+| §fs-create-disabled Absent path, effective scope `none` | None | Refuse without touching disk. |
+| §fs-create-root Absent path inside `project_root` | Effective scope `root` or `namespace`; no matching `hide` or `view` | Exclusive CREATE (`open(O_CREAT\|O_EXCL)` semantics), then incorporation below. |
+| §fs-create-namespace Absent canonical `../` path | Effective scope `namespace`; no matching `hide` or `view` | Exclusive CREATE, then an exact `pick` so the outside member is read-write. |
+| §fs-create-ignored Absent path ignored by active Git | Matching **explicit** `pick` | Exclusive CREATE through that pick; an automatic/generated pick never overrides Git ignore. |
+| §fs-create-git Absent in-root path admitted by active Git | Not ignored | Exclusive CREATE followed by successful `git add -- <path>`; a staging failure falls back to an exact generated pick. |
+| §fs-create-pick Absent admitted path without Git incorporation | Existing explicit pick or automatic incorporation permitted | Exclusive CREATE followed by an exact generated pick when no explicit pick already covers it. |
+| §fs-write-member Existing in-root member | Git or pick membership; no matching `view` | Proposal-gated EDIT. |
+| §fs-write-outside Existing canonical `../` member | Pick membership; no matching `view` | Proposal-gated EDIT. Git-only outside members are read-only. |
+| §fs-write-nonmember Existing non-member | None | Refuse; reveal occupancy only, never content. |
+
+§fs-create-incorporation **Creation incorporation is durable workspace state, not a transient entry exception.** `workspace_constraints.source` distinguishes an operator/client-authored `explicit` constraint from a runtime-authored `create` constraint. An explicit row interprets `glob` as a pattern; a generated row interprets the same field as one literal canonical path, so legal filename metacharacters never become wildcard syntax. Generated constraints appear through the ordinary `workspace.constraints` client surface. An explicit pick covering the same path always wins and is never demoted.
+
+| Event | Generated-pick lifecycle |
+|-------|--------------------------|
+| §fs-create-generated-pick Successful creation not incorporated by Git or an existing explicit pick | Insert exact `{ effect: "pick", glob: canonicalPath, source: "create" }`. |
+| §fs-create-copy COPY to a new path | Incorporate the destination independently; the source is unchanged. |
+| §fs-create-move MOVE to a new path | Incorporate the destination, then remove the source's generated exact pick after deleting the source. |
+| §fs-create-kill KILL or accepted whole-resource deletion | Remove the deleted path's generated exact pick. |
+| §fs-create-explicit-promotion Explicit `pick` added at the same exact path | Promote/retain the row as `source: "explicit"`; later automatic cleanup cannot remove it. |
+| §fs-create-masked A later `hide` or active Git-ignore rule excludes a generated-pick member | Preserve the generated pick as dormant policy; removing the exclusion restores membership when the file still exists. A later `view` leaves it visible but read-only. |
+| §fs-create-ambient-delete Reconciliation confirms a generated-pick path disappeared outside Plurnk | Remove the generated exact pick; explicit picks remain operator policy. |
+
+The file-creation invariants are deliberately redundant with the matrices only
+where the invariant closes an architectural failure mode:
+
+- §file-create-no-orphans A successful create always ends in Git membership or a real pick; no accepted file is orphaned from the workspace that created it.
+- §file-create-no-clobber Creation is exclusive and an existing non-member remains unreadable and non-overwritable.
+- §file-create-exclusions-win `hide` and `view` outrank all automatic creation; active Git ignore is overridden only by an explicit pick.
+- §file-create-scope The effective creation scope is the minimum of the service ceiling and workspace setting; no call site or producer may widen it.
+- §file-create-producer-neutral The file contract depends on the operation and target, never the producer identity.
+- §file-create-single-owner File membership owns prospective admission, incorporation choice, and generated-pick lifecycle; file operations consume that decision rather than re-deriving Git and constraint policy.
+- §file-create-transaction Success requires both exclusive disk creation and durable incorporation. Approval re-resolves physical containment and policy, so a proposal-time parent cannot be swapped for an outside-pointing symlink. Incorporation failure removes the created entry and file; incomplete rollback is an explicit partial-failure Problem.
+
+Refusing an occupied non-member follows the POSIX exclusive-create precedent:
+namespace occupancy is not secret, but content remains dark.
 
 §fs-answer-in-canon **The engine answers in canon.** Every engine-authored address — log-row pathname columns, rx spans and error facts, FIND results, the catalog, the foists — renders the one canonical form: exactly what `git ls-files --full-name` prints, byte-for-byte on the git-membership subset. A miss names the RESOLVED form, never an echo of the model's spelling. The single verbatim survivor is the model's own emission text — history is never rewritten. There is no shadow universe of model-preferred addressing.
 
@@ -888,7 +1099,7 @@ Every fact names the canonical key, never the host root or an echo of the
 model's spelling. These classes let a caller distinguish a wrong address, an
 invalid range, read-only authority, and occupied hidden state without guessing.
 
-§fs-world-state **The world-state harness — coverage that closes the class.** Op-outcome tests check what an op returned; the harness checks the resulting world. `WorldState.check(db)` asserts, pure-db and read-only: identity uniqueness in practice (no tuple holds two rows), the canonical fixpoint on every file-class key, channel orphan-freedom, the closed admission set (a file row's grantor is git or a client act — or the create-accepted transient NULL the next reconcile stamps), and sig-coherence. It runs as a lifecycle-test epilogue and at every soak turn boundary, where the delta half applies: an idle turn grows the entries table by ZERO. A violation names its law and its row.
+§fs-world-state **The world-state harness — coverage that closes the class.** Op-outcome tests check what an op returned; the harness checks the resulting world. `WorldState.check(db)` asserts, pure-db and read-only: identity uniqueness in practice (no tuple holds two rows), the canonical fixpoint on every file-class key, channel orphan-freedom, the closed admission set (every file row's origin is Git or constraint), and sig-coherence. Generated-pick incorporation and lifecycle require filesystem/Git evidence and are covered by the composed creation matrix rather than a false pure-database proxy. The harness runs as a lifecycle-test epilogue and at every soak turn boundary, where the delta half applies: an idle turn grows the entries table by ZERO. A violation names its law and its row.
 
 ### §scheme-manifest Manifest
 
@@ -962,7 +1173,9 @@ Directed SEND (non-null path) routes to scheme's `send`. Status = intent:
 
 - §log-uniform-query **Log speaks the universal query contract** — `## FIND0 (log://…)` works like every scheme's FIND. Candidates are worker rows scoped by the coordinate hierarchy ({§log-coordinate-hierarchy}) and projected exactly as READ shows them. Content dialects use `Matcher.matchCandidates`; `~semantic` and `@graph` use the same persistent derivation artifacts and candidate rankers as entries. Broad results are one-channel catalog groups whose `[0].path` is `log:///loop/turn/seq/OP`; exact matcher results are flat locations ({§find-result-projection}). A FIND signal classifies the FIND result row and never changes this candidate set ({§log-item-tags}). Log remains the core event ledger rather than duplicating rows into `entries`; its core-private storage adapter supplies one complete channel representation to the same READ projector. That adapter is not a plugin seam and grants no protocol scheme an alternate READ path.
 - §find-source-agnostic **The content matcher is source-agnostic** — `Matcher.matchCandidates(body, candidates, mimetypes)` applies a content matcher (regex/jsonpath/xpath/glob) to candidates from ANY source, keyed by the caller's own identity (a pathname for entries, a `loop/turn/seq` coordinate for log). The matcher never cares what table the content came from, so FIND works uniformly across schemes by construction: `EntryFind` and `Log.find` run the one shared primitive rather than re-implementing it per scheme. Log stays its own event stream, but its rows are candidates the shared matcher covers like any entry's content.
-- §matcher-selection-signal **Matching carries navigation evidence** - a matcher is a boolean resource predicate. Internally, each selected resource carries `matches: MatchEvidence[]`, where `MatchEvidence` is `{locator?,region?}`. `locator` preserves a structural address without overloading the resource row's `path`; `region` is a complete four-coordinate `TextRegion` only when the finding maps honestly into the exact text the model can READ. Exact duplicate evidence deduplicates. Relation findings map their indexed source spans through the same readable text coordinate index. FIND alone decides whether that grouped selection projects as resource rows or flat locations ({§find-result-projection}); the engine never fabricates a region or guesses which surgical READ the model wants.
+- §channel-selection-visibility **Channel selection is decision-time information, not a guess** — every multi-channel resource presents its channels with extents wherever FIND presents the resource: broad results list each channel's path, mimetype, tokens, and lines (default channel first), and matcher locations name the channel their line coordinates address. The packet never presents channels as equal and indistinguishable; extents derive from the stored channels by construction. Budget enforcement stays with {§overflow-turn} — this is information, not a second guard.
+
+- §matcher-selection-signal **Matching carries navigation evidence** - a matcher is a boolean resource predicate. Internally, each selected resource carries `matches: MatchEvidence[]`, where `MatchEvidence` is `{channel?,locator?,region?}`; `channel` names the entry channel the finding was located in and is absent for channel-less resources such as log rows, so line coordinates cannot be mis-attributed across channels of the same resource ({§channel-selection-visibility}). `locator` preserves a structural address without overloading the resource row's `path`; `region` is a complete four-coordinate `TextRegion` only when the finding maps honestly into the exact text the model can READ. Exact duplicate evidence deduplicates. Relation findings map their indexed source spans through the same readable text coordinate index. FIND alone decides whether that grouped selection projects as resource rows or flat locations ({§find-result-projection}); the engine never fabricates a region or guesses which surgical READ the model wants.
 
 `## SEND0 [410] (path[#fragment])` also deletes the target entry/channel — an implemented side-effect, NOT taught to the model and with no live/demo surface. The model-facing delete idiom is KILL ({§move}).
 
@@ -981,7 +1194,7 @@ interface PlurnkSchemeContext {
     readonly workerId: number;
     readonly loopId: number;
     readonly turnId: number;
-    readonly writer: "model" | "client" | "plurnk" | "plugin"; // WriterTier
+    readonly writer: "model" | "client" | "_plurnk" | "plugin"; // WriterTier
     readonly signal: AbortSignal | undefined;
     readonly streamEventNotify?: StreamEventNotify;
     readonly wakeWorkerNotify?: WakeWorkerNotify;
@@ -1001,14 +1214,14 @@ Engine → scheme guarantees:
 - `ctx` is fresh per call. No mutation across calls.
 - §universal-read-composition **Exact READ has one composition.** Core resolves
   canonical identity and owner once, gives a data scheme its optional
-  `prepareRepresentation({ target, pathname })` opportunity, reads the complete
+  `prepareRepresentation({ target, authority, pathname })` opportunity, reads the complete
   canonical channels, selects the authored channel, applies binary and
   text-coordinate rules, and finally composes that channel's durable producer
   result. Preparation receives neither fragment nor `lineMarker`; finite work
   returns `200`, while only a retained live representation may return `102`
   ({§read-preparation}). No public handler can replace READ.
 - Exact FIND uses the same resolved identity and representation preparation
-  before standard entry selection, then composes the exact default channel's
+  before standard entry selection, then composes the exact selected channel's
   durable producer result with the core-owned query projection. Broad FIND may invoke a custom `find()` for
   genuinely protocol-owned candidate enumeration, or `prepareFind()` followed
   by the standard catalog query. Acquisition never owns matcher, pagination,
@@ -1121,7 +1334,7 @@ model-independent ruler for stored/catalog weights and the model-facing curation
 confined to provider-owned physical capacity assessment
 ({§tokenomics-context-envelope-admission}).
 
-§persistent-search-index **Persistent search index.** `SearchIndex.maintain` is the pre-model engine pass. Each searchable resource supplies an address and the exact readable body its READ exposes. Entries supply their default body; `LogBody` resolves each log row's canonical full body from its durable tx/rx envelope. Acquisition schemes project remote source material before storing that body; search never introduces a second hidden text projection. The readable body, mimetype, resolved text/binary classification, mimetype projection identity, embedder configuration, and applicable search exclusion form a content hash. Complete artifacts own FTS, vectors, symbol definitions, and references; resource rows hold only the attachment hash. Binary, empty, and excluded derivations do not invoke handler projections and therefore use one fixed no-projection identity.
+§persistent-search-index **Persistent search index.** `SearchIndex.maintain` is the pre-model engine pass. Every addressable entry channel supplies the exact readable representation its READ exposes; `LogBody` resolves each log row's canonical full body from its durable tx/rx envelope. Acquisition schemes project remote source material before storing addressable channels; search never introduces a second hidden text projection. The channel content, mimetype, resolved text/binary classification, mimetype projection identity, embedder configuration, and applicable search exclusion form a content hash. Complete artifacts own FTS, vectors, symbol definitions, and references; each `entry_channels` row or log row holds only its own attachment hash. Binary, empty, and excluded derivations do not invoke handler projections and therefore use one fixed no-projection identity.
 
 §search-exclusion **File-search eligibility is Core policy.**
 `PLURNK_SERVICE_SEARCH_EXCLUDE` is a comma-separated table of anchored
@@ -1129,21 +1342,21 @@ body-glob patterns. Patterns containing `/` match the full pathname; every
 other pattern matches the basename. Whitespace around entries is ignored, an
 empty setting excludes nothing, and the first match is the observable reason.
 
-| Search subject     | Exclusion evaluation                                    |
-|--------------------|---------------------------------------------------------|
-| `file` entry       | Apply the configured repository-path patterns once.     |
-| Other-scheme entry | Always eligible; its pathname is a resource identity.   |
-| Log projection     | Always eligible; it has no repository-path membership.  |
+| Search subject       | Exclusion evaluation                                    |
+|----------------------|---------------------------------------------------------|
+| `file` entry         | Apply the configured repository-path patterns once.     |
+| Other-scheme channel | Always eligible; its pathname is a resource identity.   |
+| Log projection       | Always eligible; it has no repository-path membership.  |
 
 A match produces the `excluded` derivation disposition and suppresses graph,
-FTS, and vectors while leaving the stored body and direct READ unchanged. The
+FTS, and vectors while leaving the stored channel and direct READ unchanged. The
 same reason participates in the derivation hash and is surfaced by diagnostics
 and digests. Mimetype detection and projection do not read or report this
 scheme policy.
 
 ```mermaid
 flowchart LR
-    E["entry default body"] --> P["exact READ body"]
+    E["entry channel"] --> P["exact addressed READ"]
     L["log result envelope"] --> P
     P --> H["content-addressed derivation"]
     H --> F["FTS"]
@@ -1156,7 +1369,7 @@ flowchart LR
     G --> Q
 ```
 
-§derivation-exhaustive Identical projections attach the same immutable artifact regardless of their source table. Search primitives therefore consume only `{key, deepHash}` candidates and cannot depend on entry or log storage. Semantic and graph FIND require every selected candidate—and graph's relationship universe—to be attached. An incomplete set returns 503 with `problem.search = {state:"incomplete", indexed, total}`; it never silently searches a partial corpus. Normal execution joins the eager workspace warm before model dispatch, so that response is an interface invariant and diagnostic, not a lazy-search mode.
+§derivation-exhaustive Identical projections attach the same immutable artifact regardless of their source table. Search primitives therefore consume only `{key, deepHash}` candidates and cannot depend on entry or log storage. Semantic and graph FIND require every selected channel candidate—and every channel in graph's relationship universe—to be attached. An incomplete set returns 503 with `problem.search = {state:"incomplete", indexed, total}`; it never silently searches a partial corpus. Explicit membership changes may warm eagerly; every model turn joins exhaustive derivation before dispatch. Passive workspace creation and attachment do not launch it. The incomplete response is therefore an interface invariant and diagnostic, not a lazy-search mode.
 
 The graph projection stores only addressable symbol names. A structured-data handler may legitimately emit an empty key into its symbols channel, but the `@graph` matcher cannot name an empty symbol; that one definition is omitted from graph storage without suppressing FTS, vectors, or the remaining definitions. Invalid references and other persistence violations still fail the resource derivation explicitly.
 
@@ -1247,8 +1460,9 @@ Per-op semantics. AST shapes come from `@plurnk/plurnk-contracts`'s `PlurnkState
 
 ### §line-anchors Text line anchors
 
-A scheme declaring `textEditScopes: true` with model write authority publishes
-the contracts-owned {§text-line-anchor-syntax}. For canonical model-facing
+A scheme declaring `lineAnchors: true`, or `textEditScopes: true` with model
+write authority, publishes the contracts-owned {§text-line-anchor-syntax}.
+Model-writable `textEditScopes` implies anchors; `lineAnchors` alone makes no EDIT claim. For canonical model-facing
 resource identity `R`, one-based line ordinal `L`, configured non-negative
 neighbor count `C`, and ordered content array `W` containing that line and up to
 `C` complete lines on either side (all excluding separators), core hashes the
@@ -1345,13 +1559,15 @@ copied with log history on fork.
 
 ### §open-fold OPEN / FOLD
 
-AST: `{ op: "OPEN"|"FOLD", target, body: MatcherBody | null, signal: tags | null, lineMarker: null }`.
+AST: `{ op: "OPEN"|"FOLD", target, body: MatcherBody | null, signal: tags | null, lineMarker: TextLineMarker | null }`.
 
-OPEN/FOLD operate on the **log** (`log:///`) - the model's context-curation surface ({§packet}). FOLD collapses a log row to its path; OPEN restores its ordinary packet projection, including any preview bound ({§body-projection}). Both select by target, matcher, and the symmetric ALL-tags filter, then apply the tag changes defined by {§log-item-tags}. The canonical full body remains available through READ of the log URI with `<1,-1>`. Non-destructive: rows and bodies persist. On any valid row, applying its current state again or targeting a bodyless row is a successful visibility no-op; classification changes still land. Malformed targets and nonexistent exact coordinates fail at their addressing boundary. Entries carry no visibility ({§no-visibility}), so OPEN/FOLD against an entry scheme returns 501.
+OPEN/FOLD operate on the **log** (`log:///`) - the model's context-curation surface ({§packet}). Without a scope, FOLD hides and OPEN reveals the whole canonical log body. With a one-line or inclusive two-line scope, each operation changes only that body's intersecting body-relative physical lines. An anchor may be one already published on that immutable body or one returned by READing its `log:///` identity; numeric lines outside a selected body and absent or ambiguous anchors are successful per-body no-ops. Both select rows by target, matcher, and the symmetric ALL-tags filter before independently applying the scope and tag changes to each selected row. Folded intervals are durable, sorted, disjoint, and compositional; `[]` is wholly open and `[[1,-1]]` wholly folded. The canonical body remains complete through log READ/FIND regardless of visibility. Rows and bodies persist, and classification changes still land when visibility is a no-op. Malformed targets, unsupported coordinate arity, and nonexistent exact coordinates fail at their owning boundary. Entries carry no visibility ({§no-visibility}), so OPEN/FOLD against an entry scheme returns 501.
 
 ### §jsonplurnk The Log's wire format
 
-The `## Log` section renders as a fixed three-backtick `jsonplurnk` fence - a JSON array of entry objects, otherwise-valid JSON with **exactly one** deviation: an open, nonempty `body` is a raw multiline string. Its opening JSON quote is followed by a physical newline, every content line begins with a numeric `N:` or anchored `@hash N:` coordinate prefix whose separator is one or more ASCII spaces, and its closing quote appears at column zero before either the object close or a following member. Source quotes, braces, fences, and headings cannot collide with either boundary because source text never occupies column zero after projection; source backticks therefore cannot form a CommonMark closing fence. The fixed opener keeps the packet prefix stable across content changes. The carve-out is localized to `body`, so the strip-parser recognizes `"body":"` followed by a newline, consumes one or more coordinate-prefixed lines, and replaces the raw multiline value with an escaped JSON string while preserving following members to recover strict JSON. The body shape is a strict three-state invariant: `"display":"none","body":""` for no body, `"display":"folded"` with the ordinary projection withheld, and `"display":"open","body":"\n<coordinate>...\n"` with it shown. `path` is the complete model-facing log identity: when a projected operation exists it ends in `/OP`, and no separate `op` field duplicates it. Nonempty `tags` is the row's complete deduplicated, sorted folksonomy; an untagged row omits it. When an OPEN bounded projection differs from the canonical body, it appends `"chunk":"showing <selected> of <complete>"` after `body`; otherwise it omits `chunk`. Complete-line extents use inclusive two-coordinate line regions. A cut inside a line uses four-coordinate, start-inclusive and end-exclusive regions with 1-based Unicode code-point columns. The row's `path` remains the canonical READ target. The block is data only - no prose leads the fence. `tokens` is the model-facing projection of the row's curation weight: the room OPEN adds and FOLD saves. A FIND's nonzero `itemsTokenTotal` weighs the complete matched set; a nonzero `returnedItemsTokenTotal` appears only when the returned page has a different weight. These are curation weights, not dollars. The invariants bind regardless of shape ({§packet}): addressability (`path`/`target`/`#channel`/coordinate-prefixed bodies), weighability (per-item `tokens`), honesty (every 4xx/5xx row and the exact body/display state). {§jsonplurnk} {§packet-jsonplurnk-exception}
+The `## Log` section renders as a fixed three-backtick `jsonplurnk` fence - a JSON array of entry objects, otherwise-valid JSON with **exactly one** deviation: an open, nonempty `body` is a raw multiline string. Its opening JSON quote is followed by a physical newline, every visible content line retains its canonical numeric `N:` or anchored `@hash N:` coordinate, and its closing quote appears at column zero before either the object close or a following member. Source quotes, braces, fences, and headings cannot collide with either boundary because source text never occupies column zero after projection; source backticks therefore cannot form a CommonMark closing fence. The fixed opener keeps the packet prefix stable across content changes. The carve-out is localized to `body`, so the strip-parser recognizes `"body":"` followed by a newline, consumes one or more coordinate-prefixed lines, and replaces the raw multiline value with an escaped JSON string while preserving following members to recover strict JSON. The three body states are self-describing through field presence alone: a `body` field means open, `tokensBody` without `body` means folded (the value prices the OPEN), and neither means no canonical body; no `display` label exists. Two defaults are likewise field absence: `origin` is omitted for the worker's own model authorship (exactly as `source` absence means the owning worker), and `status` is omitted for a routine 200 on a non-SEND row — SEND always carries its submit code and every non-200 stays explicit. A partially hidden open row also carries `"folded":["<scope>",...]`; coordinate gaps in its body make the omission explicit without renumbering later lines. `path` is the complete model-facing log identity: when a projected operation exists it ends in `/OP`, and no separate `op` field duplicates it. It leads each entry object; the remaining members follow in stable alphabetical order. A present authored operation annotation appears as `annotation`; its absence omits the field. Nonempty `tags` is the row's complete deduplicated, sorted folksonomy; an untagged row omits it. When an automatic bounded projection differs from the visibility-selected body, it appends `"chunk":"showing <selected> of <complete>"` after `body`; otherwise it omits `chunk`. Complete-line extents use inclusive two-coordinate line regions. A cut inside a line uses four-coordinate, start-inclusive and end-exclusive regions with 1-based Unicode code-point columns. The row's `path` remains the canonical READ target. The block is data only - no prose leads the fence. Every row's accounting: {§packet-token-accounting}.
+
+- §packet-token-accounting Every row reports its real weight so the packet self-reconciles against the budget: `tokensBody` is the projected body's nonzero weight whenever a canonical body would render (never `0` — a priceless OPEN is field absence), and `tokensActive` is the complete row's weight in the packet right now. The metadata share is derivable (`tokensActive − tokensBody` when open; `tokensActive` otherwise) and is never serialized — it feeds no curation decision. Thus FOLD removes the rendered body's weight while KILL removes `tokensActive`; on a folded row `tokensBody` previews the body share an OPEN would activate. The completed row, including its accounting field and framing, is measured to a fixed point. A FIND's nonzero `itemsTokenTotal` weighs the complete matched set; a nonzero `returnedItemsTokenTotal` appears only when the returned page has a different weight. These are curation weights, not dollars. The invariants bind regardless of shape ({§packet}): addressability (`path`/`target`/`#channel`/coordinate-prefixed bodies), weighability (per-item `tokens`), honesty (every 4xx/5xx row and the exact body state). {§jsonplurnk} {§packet-jsonplurnk-exception}
 
 ### §retrieval-packet-metadata READ/FIND packet metadata
 
@@ -1363,7 +1579,7 @@ The packet projects one actionable owner for each retrieval fact:
 | exact-coordinate READ | none | top-level `region` | none |
 | READ-shaped materialization notice | none | none | generic body `lines` |
 | catalog/path FIND | compact `resource` range | none | none |
-| broad matcher FIND | compact `resource` range | per-resource match-location counts | nonzero complete `matchLocationCount` |
+| broad matcher FIND | compact `resource` range | per-resource match-location counts; a resource with exactly one match also carries that match's `locator`/`region` | nonzero complete `matchLocationCount` |
 | exact matcher FIND | compact `matchLocation` range | each row's locator/region | none |
 
 The compact range is `{ unit, total, requested: [first,last], returned?:
@@ -1379,17 +1595,19 @@ generic body `lines` remains available on READ-shaped materialization notices
 that have no retrieval extent. FIND content weights follow {§jsonplurnk};
 ordinary bounded bodies expose their displayed and complete chunk extents there.
 
-### §model-entry The model's own emission, mirrored back
+### §turn-ops-entry The admitted turn program
+
+§turn-ops-log-curation A source-backed turn preserves its **exact admitted Plurnk program** as an actionless log item in addition to the ordinary result row for every dispatched statement. `op` is null, `attrs.kind="turnOps"` identifies the item, `origin` is the turn producer, no target exists, `tx` is empty, and the source lives in `rx.content`, typed `text/vnd.plurnk`. Its exact address is the undecorated three-part coordinate `log:///<L>/<T>/<S>` because it is the turn program, not another operation. It is line-numbered and OPEN/FOLD/KILL-able like any log body. The worker-initialization `turnOps` is born OPEN because it is the worked orientation example; every other `turnOps`, including model inference and overflow recovery, is born FOLDED and remains available on demand. Log-KILL clears the `writableBy` gate for a model-authored item (Log's handler surface — kill only — keeps every other mutating op at 501). The shared executor writes exactly one after every admitted source-backed turn.
 
-§model-entry-log-curation A model-emission log row is the model's **verbatim emission**, mirrored back so it can inspect and curate its own behavior. It is an actionless artifact: `op` is null, `attrs.kind="model_emission"` identifies the row, no target exists, `tx` is empty, and the emission lives in `rx.content`, typed `text/vnd.plurnk`. Its exact address is the undecorated three-part coordinate `log:///<L>/<T>/<S>` because no operation exists to append. An admitted emission is **always born FOLDED** (budget-neutral), line-numbered like all content, and OPEN/FOLD/KILL-able like any log row. Log-KILL clears the `writableBy` gate for the model (the DB-storage curation lever plurnk.md teaches; Log's handler surface — kill only — keeps every other mutating op at 501). The engine writes one after each admitted model turn. The invalid-emission recovery item under {§emission-admission} mirrors only the latest rejected response, is born FOLDED with `attrs.admission="rejected"`, and is projected OPEN only in the informed recovery packet; every other rejected attempt remains forensic-only.
+§rejected-emission-entry A rejected provider response is not `turnOps`: it never became an admitted turn program. The one bounded invalid-emission recovery item under {§emission-admission} has `attrs.kind="emissionAttempt"`, `origin="model"`, and the exact latest rejected response. It is born durably FOLDED and projected OPEN only in the informed recovery packet; every other rejected attempt remains forensic-only.
 
 - §log-coordinate-hierarchy **Log coordinates are a hierarchical prefix; the trailing slash is optional** — a coordinate is `loop/turn/sequence`, and a PARTIAL coordinate selects its descendants: `log:///1` = loop 1's rows, `log:///1/2` = turn 1/2's rows, `log:///1/2/3` = the one row. A full coordinate is always three parts, so a one- or two-part path is unambiguously a prefix — the trailing slash is an optional alias (`log:///1/2` ≡ `log:///1/2/`), uniform with `## READ0 (worker:///docs/)`. A rendered operation row appends its canonical model-facing `/OP`, not a fourth resource level. Exact consumers tolerate the unsuffixed three-part shorthand; when supplied, the case-insensitive suffix is authoritative and a disagreement resolves 404. Typed entry materialization therefore resolves as `/READ` while retaining its durable `EDIT` event ({§exec-entry-sink}). `log:///1/2/*` still selects the turn's item rows, while `log:///**/READ` deliberately filters the canonical suffix.
 - §log-curation-folder-idiom **Log curation speaks the folder idiom; a zero-match sweep is a no-op success** — OPEN/FOLD/KILL take a concrete coordinate or a path-glob, and a **trailing slash or a partial coordinate means "the contents"** ({§log-coordinate-hierarchy}), like a folder-scoped FIND: `## FOLD0 (log:///1/2)` folds turn 1/2's rows. OPEN and FOLD may instead take only a tag filter ({§log-item-tags}). A **well-formed selection that matches nothing is 204 with `matched: 0`**; a successful sweep's rx carries `matched: N`. A targetless operation without tags or a matcher is 400.
-- §log-curation-set-selection **Set selection, never positional curation** — target/glob, optional body matcher, and optional ALL-tags filter compose by intersection into the affected row set. OPEN and FOLD have no `<L>` marker and never paginate that set; FIND owns result pagination.
+- §log-curation-set-selection **Row selection and body scope are independent** — target/glob, optional body matcher, and optional ALL-tags filter compose by intersection into the affected row set. An optional `<L>` or `<SL,EL>` then intersects each selected canonical body; it never paginates or changes the selected set. Thus `## FOLD0 (log:///**/READ) <17,-1>` may change long READs and no-op on short ones while reporting every selected row in `matched`.
 
-§fold-open-meta-operations **OPEN and FOLD are meta-operations — log-curation directives, not world actions.** They change log visibility and classifications, never the underlying resources. A **successful** OPEN/FOLD **is recorded in the log** but **suppressed from the packet render**: the row exists for forensics — a curation act with NO trace is how a weak model folding its own task frame stayed invisible until a database dig — while the render still costs it nothing, so FOLD stays genuinely free (the original rowless design's concern, met by hide-not-drop). Its exact selected target set, each target's pre-event visibility, and the classifications actually added and removed persist with that event; `matched: N` and the authored selector are not the database's sole effect evidence. The operation row, visibility changes, tag changes, and landed effects commit in one database statement. The emission also survives verbatim in its model-emission mirror. A **failed** OPEN/FOLD (bad target, matcher, or tag signal) renders normally with its status — errors are signals. The idle-turn gate reads the *emitted statements*, so a pure-curation turn is work, never idleness.
+§fold-open-meta-operations **OPEN and FOLD are meta-operations — log-curation directives, not world actions.** They change log visibility and classifications, never the underlying resources. A **successful** OPEN/FOLD **is recorded in the log** but **suppressed from the packet render**: the row exists for forensics — a curation act with NO trace is how a weak model folding its own task frame stayed invisible until a database dig — while the render still costs it nothing, so FOLD stays genuinely free (the original rowless design's concern, met by hide-not-drop). Its exact selected target set, each target's folded intervals before and after, and the classifications actually added and removed persist with that event; `matched: N` and the authored selector are not the database's sole effect evidence. The operation row, visibility changes, tag changes, and landed effects commit in one database statement with each before state as a collision guard. The authored program also survives verbatim in its `turnOps` item. A **failed** OPEN/FOLD (bad target, matcher, or tag signal) renders normally with its status — errors are signals. The idle-turn gate reads the *emitted statements*, so a pure-curation turn is work, never idleness.
 
-§kill-log-receipt-suppressed **A successful KILL of a log item is suppressed from the render too — same principle, different mechanism.** KILL is a real deletion (not a meta-op), but once it has executed against a `log://` target its tombstone is *spent*: the killed row is gone, and a receipt saying "I deleted it" is no forward-actionable context. So a **successful** `KILL` whose target is a **log item** is recorded in the DB (forensics) and suppressed from the packet, while its emission survives in its model-emission mirror. Without suppression, every deleted row would create a replacement receipt, so per-row curation could not shrink the log. The suppression is **scoped to log targets**: a `KILL` of a `worker://` note, an `sh://` stream, or any stored artifact is a **world mutation**, not log housekeeping, and stays visible. A **failed** KILL (bad target, no match ≠ error but a malformed coordinate is) renders like any error.
+§kill-log-receipt-suppressed **A successful KILL of a log item is suppressed from the render too — same principle, different mechanism.** KILL is a real deletion (not a meta-op), but once it has executed against a `log://` target its tombstone is *spent*: the killed row is gone, and a receipt saying "I deleted it" is no forward-actionable context. So a **successful** `KILL` whose target is a **log item** is recorded in the DB (forensics) and suppressed from the packet, while its authored program survives in its `turnOps` item. Without suppression, every deleted row would create a replacement receipt, so per-row curation could not shrink the log. The suppression is **scoped to log targets**: a `KILL` of a `worker://` note, an `sh://` stream, or any stored artifact is a **world mutation**, not log housekeeping, and stays visible. A **failed** KILL (bad target, no match ≠ error but a malformed coordinate is) renders like any error.
 
 ### §log-sensitive-request-evidence Durable request evidence
 
@@ -1404,7 +1622,7 @@ secret detection.
 | Query and authored body             | Preserved exactly; they are authored content and URI identity, not structurally identifiable credential slots.                                                                                                                                  |
 | Parser failure                      | Preserves the structural diagnosis and source position without quoting request-metadata contents ({§path-request-metadata}).                                                                                                                    |
 | Client, fork, packet, and digest    | Consume the stored projection; none owns a second redaction policy.                                                                                                                                                                             |
-| Model-call evidence and model-emission mirror | `model_calls.response` under {§emission-admission} and the folded row under {§model-entry-log-curation} remain exact forensic evidence and are the explicit exception.                                                               |
+| Model-call evidence and source artifacts | `model_calls.response` under {§emission-admission}, `turnOps` under {§turn-ops-log-curation}, and `emissionAttempt` under {§rejected-emission-entry} remain exact forensic evidence and are the explicit exception.                                                               |
 
 ### §copy COPY (engine-orchestrated)
 
@@ -1467,11 +1685,12 @@ Log history preserved — `log_entries` stores path tuple as text, not FK to `en
 AST: `{ op: "FIND", target (scope), body: MatcherBody | null (predicate), signal: tags | null, lineMarker? }`.
 
 - §find-scope-prefix-filter Filters entries within scope. A **bare** path is the exact entry; an explicit **shell glob**, classified once by {§path-glob}, expands to a scope. Path globs use segment semantics: `*` and `?` never cross `/`; `**` does. Terminal `*` and `**` are structural catalog selectors and include dot-prefixed entries, so a complete map does not hide `.env.defaults` or `.github`; richer patterns retain native shell behavior. SQLite prefix queries may reduce the candidate set but never decide the match. A trailing slash is a recursive FIND scope only for a scheme whose manifest declares `folderScopes: true`; otherwise it is ordinary resource syntax. This is an explicit plugin contract, never inferred from URL punctuation.
-- An exact target resolves to the same canonical `(scheme, pathname)` identity
+- An exact target resolves to the same canonical `(scheme, authority, pathname)` identity
   as READ, entry CRUD, and any preceding `prepareFind()`. URI authorities are
   identity-bearing: `https://example.com/page` queries
-  `(https, /example.com/page)`, never `(https, /page)`.
-- §find-glob-filter-on-content `body` matcher operates on entry content (glob/regex/jsonpath/xpath), per `plurnk.md` "Pattern Filtering"; the path-glob lives in the (target), not the body.
+  `(https, example.com, /page)`, never an empty-authority row at `/page`.
+- §find-channel-selection The target selects a channel under {§channel-selection}. That channel controls candidate eligibility, every matcher dialect's content or derivation, match-evidence coordinates, and exact producer-result composition. A selected channel absent from an exact entry is 404; a broad scope simply excludes entries lacking it. Successful resource-mode results remain complete default-first channel groups, so sibling channels are navigable catalog metadata rather than additional matches.
+- §find-glob-filter-on-content `body` matcher operates on the addressed entry channel (glob/regex/jsonpath/xpath), per `plurnk.md` "Pattern Filtering"; the path-glob lives in the (target), not the body.
 - §find-semantic-selection Every matcher operates only over the candidate set selected by `(target)`; relation matchers do not bypass that selection. Semantic ranking is exhaustive within that candidate set, then applies the ordinary FIND result scope. Markerless semantic FIND therefore uses the same `<1,16>` default as every other matcher. Integers retain FIND's positional contract: `<N>` selects result N and `<N,M>` selects the inclusive range. A leading decimal first applies a minimum cosine-similarity threshold; following integers select positions within that ranked threshold set. Thus `<0.7,10,20>` means threshold 0.7 followed by results 10 through 20, while `<0.7>` applies the threshold and the ordinary first-16 page.
 - §find-scoped-isolation Workspace + scheme scoped — no cross-workspace/cross-scheme leakage.
 - §find-result-projection **The authored target shape determines the result unit; result cardinality never changes it** ({§find-result-unit}). Returns `FindResult { status, content, mimetype, results, range, matchingPathCount, matchLocationCount, itemsWeightTotal, returnedItemsWeightTotal }`:
@@ -1481,14 +1700,15 @@ AST: `{ op: "FIND", target (scope), body: MatcherBody | null (predicate), signal
   | exact | absent | `resource` | the one catalog channel group |
   | glob or folder | absent | `resource` | catalog channel groups |
   | glob or folder | present | `resource` | matching channel groups with `matchLocationCount` on `[0]` |
-  | exact | present | `matchLocation` | flat `{ locator?, region? }` locations |
+  | exact | present | `matchLocation` | flat `{ channel?, locator?, region? }` locations |
 
   A glob or folder remains resource mode when it resolves to one path. An exact
   target remains location mode when it has many locations. A valid exact match
   with no addressable location is status 200 with `matchingPathCount: 1`,
   `matchLocationCount: 0`, and no fabricated row; a matcher selecting no
   resource is 204. A body-less broad empty catalog survey is status 200; an
-  absent exact resource is 404.
+  absent exact resource is 404. Every entry-channel location names its `channel`
+  ({§channel-selection-visibility}); log rows carry none.
 
   Inside `FindResult`, `matchingPathCount` and `matchLocationCount` describe the
   complete selection before pagination; the packet curates those facts under
@@ -1498,9 +1718,15 @@ AST: `{ op: "FIND", target (scope), body: MatcherBody | null (predicate), signal
   contains one nonempty, flat channel array per resource. Element `[0]` is always
   the default channel and carries the bare resource path; later elements carry
   their complete `path#channel` addresses. Each channel is
-  `{ path, mimetype, weight, lines, parseIssues? }`; `parseIssues` is the
+  `{ path, mimetype, weight, lines, summary?, parseIssues? }`; `parseIssues` is the
   positive-only advisory projection of `{§mimetype-parse-issues}` for the exact
-  body derivation under `{§scheme-catalog-parse-issues}`. Resource-level `stream` and broad-match
+  channel derivation under `{§scheme-catalog-parse-issues}`.
+
+  §scheme-catalog-summary **Catalog summary.** `summary` is the exact channel
+  derivation's `{§mimetype-summary}` clipped to at most 256 Unicode code points
+  including a visible terminal ellipsis; absent metadata is omitted.
+
+  Resource-level `stream` and broad-match
   `matchLocationCount` live only on `[0]`. A single-channel resource is therefore
   a one-element array, with no path-owning wrapper or duplicated channel map.
   A terminal single-star path scope is a one-level map: direct entries retain
@@ -1520,7 +1746,9 @@ AST: `{ op: "FIND", target (scope), body: MatcherBody | null (predicate), signal
   final model-facing representation from `weight` to `tokens`
   ({§json-result-rendering}), so universal packet numbering makes result
   ordinal N addressable as line N, matching `<N>` pagination without a second
-  coordinate system. Pagination is the only FIND materialization bound; no
+  coordinate system. A returned page begins at `range.returned[0]`, and every
+  page left-pads its ordinals to the decimal width of `range.total`; content
+  therefore keeps one stable column across the complete result set. Pagination is the only FIND materialization bound; no
   hidden complete row or location collection is retained behind the public
   projection.
 
@@ -1562,7 +1790,7 @@ the loop continue; repeated offenses terminate through the engine's 500.
 
 - §send-idle-turn **Idle turn** — a continuing turn (102) whose ops are only PLAN/SEND — no work op. The model continued with nothing to do. The steer, verbatim: *"If your work is done, conclude with `## SEND0 [200]`. If you're waiting on a child or stream you spawned, use `## SEND0 [202]` to block on it — a 202 with nothing to wait on simply concludes."* A successful same-turn FOLD is the exception: its `202` continues without a strike so the curated packet can support the next reasoning turn.
 - §send-premature-terminate **Premature terminate — the pending set.**
-  Completion is gated by one rule: *nothing pending may be silently
+  A model's completion claim is gated by one rule: *nothing pending may be silently
   discarded*. Pending work has two states: **live obligations** (open
   streams/spawns and live child workers) and **completed-but-unobserved
   results** (same-turn READ/FIND/OPEN results, failed operations, terminal
@@ -1572,12 +1800,16 @@ the loop continue; repeated offenses terminate through the engine's 500.
   and the loop continues; every refusal strikes uniformly, including a
   retrieval-only refusal. The pending kind changes the corrective message, not
   rail accounting. `[499]` deliberately abandons regardless.
+- §send-administrative-terminal **An administrative terminal closes its own
+  transaction.** A client, plugin, or `_plurnk` operation program runs in its
+  own administrative loop. Its SEND signal `200` concludes exactly that loop;
+  it neither claims nor consumes the Worker's model-visible pending set. Model
+  completion rails therefore apply only to a model-authored disposition.
 - §send-undelivered-child-term **Completion is not delivery.** A result becomes
   observed only after crossing a packet boundary. SEND signal `202` parks only on
   live obligations. If work has completed but is unobserved, it continues
   directly to the next packet because the wake edge has already fired; only a
   genuinely empty set with no successful same-turn FOLD resolves immediately like `[200]`.
-- §send-300-choices **SEND signal `300` is an operator question - a PROPOSAL using the same stop-the-world system as file edits.** Enablement cascades: `PLURNK_QUESTIONS=0` is a servicewide ceiling; otherwise the client affirmatively requests per workspace (`settings.questions: true` at workspace creation), which ALSO injects the required `questions.md` teaching - capability and teaching gate as one ({§teaching-corpus}). An enabled workspace fails doc materialization with the read cause if that source is broken; a disabled workspace does not consume it. Enabled: the `;`-delimited body parses leniently (first segment the question, the rest choices; zero choices = an open question - never malformed), and the ask raises a proposal: dispatch stops the world, `loop/proposal` carries `{question, choices}` in attrs, and the client's accepted proposal body delivers the ANSWER - written into the ask's own model-facing rx (`{"status":200,"body":...}`), read next packet. Reject/timeout resolve through the standard {§proposal} semantics; the turn records a continue either way (never a 300 terminal), and the loop simply proceeds. Loop auto never auto-answers a question - it exists precisely to stop the world for a human, and the workspace opted in. Disabled: refused 409 with a self-decide steer, never a park into the void.
 
 ### §exec EXEC
 
@@ -1628,10 +1860,12 @@ target at its run boundary.
 core-owned temporary file after acceptance. Core reparses the complete authored
 address and resolves one exact `<1,-1>` READ through
 {§universal-read-composition}; internal source consumption never borrows the
-model-facing 16-line preview. The file lives through the executor run and core
-removes it after the subscription's terminal result has settled. A removal
-failure is reported to daemon diagnostics with its complete cause; it cannot
-rewrite the execution result, stream state, or completion wake.
+model-facing 16-line preview. Each spawn creates its file with an exclusive,
+process- and database-coordinate-independent identity. The file lives through
+the executor run and core removes it after the subscription's terminal result
+has settled. A removal failure is reported to daemon diagnostics with its
+complete cause; it cannot rewrite the execution result, stream state, or
+completion wake.
 
 Loop-flag authority follows the selected runtime's declaration:
 
@@ -1653,18 +1887,18 @@ effect-qualified hold policy. The post-acceptance materialization path never
 triggers reclassification.
 
 §exec-registry-resolves The runtime slot (`signal`) selects an executor from
-the current workspace snapshot. Installed siblings form the immutable base:
+the current worker snapshot. Installed siblings form the immutable base:
 they are discovered and probed at startup, and availability is cached.
-Workspace capability providers may atomically overlay additional names under
-{§module-workspace-capabilities}; a name has one owner within a workspace, while
-independent workspaces may use the same name. An absent or empty tag selects
+Worker Functionality providers may atomically overlay additional names under
+{§module-worker-capabilities}; a name has one owner within a worker, while
+independent workers may use the same name. An absent or empty tag selects
 `sh`; a non-empty tag selects exactly that registered executable tool. Unknown
 tags are refused 501 with direction to use only the advertised catalogue or
 put a complete command in bare `EXEC`; they are never reinterpreted as shell
 command words. An unavailable runtime is also 501 and carries the probe
 `detail`.
 
-For a family runtime, `ExecutorRegistry.toolRegistry(tag, workspaceId)`
+For a family runtime, `ExecutorRegistry.toolRegistry(tag, workerId)`
 validates the one executor-owned snapshot used by packet presentation,
 dispatch admission, and pull-document materialization. Core performs no
 protocol discovery while building a packet and has no alternate tool
@@ -1707,7 +1941,17 @@ edge. Stream closure remains a wake edge under every poll policy.
 
 §exec-host-proposes **Effect-gating.** Each executor declares an `effect` (`pure` | `read` | `host`); the service maps it to policy (`EffectPolicy`). A `host` runtime (subprocess; file-backed sqlite) mutates the host → **propose** (lifecycle {§proposal}): the worker waits for a human gate, then spawns and writes stdout/stderr to channels of a `<runtime>:///<loop>/<turn>/<seq>` entry (the runtime tag is the URI scheme, {§exec}; the coordinate matches the op's log-row coordinate, e.g. `sh:///1/1/2`), returning `102 Processing` immediately. Channel state transitions (`active` → `closed`/`errored`) drive what the model sees at subsequent turn boundaries ({§channel-state}).
 
-§entry-owner **Every entry is owned by a worker.** `entries.owner_id` is a real worker row, part of the identity key — the workspace's reserved `commons` worker for shared content, the spawning worker for capability streams. Never NULL (NULLs are distinct under UNIQUE — a nullable owner would let the shared-content identity fragment into duplicate rows), never rendered into a URI or packet: the model addresses owners by NAME in the authority slot. `plurnk` (the kernel) and `commons` are the two reserved rows; no spawn or client may take their names (nor `~`, the current-worker sigil).
+§entry-owner **Every entry has one structurally bound principal.**
+`entries.owner_id` is a real Worker row and part of the identity key: the
+workspace's reserved `commons` Worker for deliberately shared content, the
+effective Worker for private resources, or the exact authorized Worker selected
+by a resolved-owner scheme. It is never nullable or supplied by a plugin call.
+Core binds it once through {§entry-address-resolution} before exposing any
+entry, channel, notification, subscription, mutation, proposal, client-read, or
+cancellation capability. URI authority remains a separate coordinate; a scheme
+may use a semantic Worker name there, but the private numeric id never appears
+in a URI or packet. `plurnk` and `commons` are reserved Workers, and `~` is the
+current-Worker sigil; none can be minted by a spawn or client.
 
 §stream-owner-scoped **Capability streams are owner-scoped.** Concurrent workers' stream coordinates are loop-relative and IDENTICAL (every worker's first loop is sequence 1), so the entry identity keys on the owner and identical coordinates across workers are distinct rows. The address's authority names the owner: **empty = the calling worker** — your own streams need no qualifier, so a fan-out sibling's output can never surface under your READ — and a **named authority** reaches that worker's streams gated by ancestry (the reader is the owner or an ancestor; oversight flows down the tree, unknown-or-unpermitted resolves 404 with no existence leak). KILL stays self-only — a parent controls a child through the worker lifecycle, never by reaching into its streams. The storage pathname stays the bare loop coordinate; the owner rides the column, so nothing model-facing carries a worker id.
 
@@ -1715,11 +1959,19 @@ edge. Stream closure remains a wake edge under every poll policy.
 
 §exec-readpure-ungated A `read` runtime (observes external state, e.g. search) or `pure` runtime (no observable effect, e.g. `:memory:` sqlite) is side-effect-free → **auto-run**: no proposal, no human gate, no notification. Core persists the prepared operation before applying it; that write-ahead staging has no resolution waiter and therefore cannot enter proposal discovery ({§proposal-list}). It skips the gate a host command faces, but it does NOT resolve in-band — like every exec it backgrounds and streams, its output reaching the model through the environment-observation injector (a foisted READ of newly publishable stream content each turn, {§exec-stream}), never a same-turn receipt.
 
+§effect-policy-tunable **Effect admission is deployment-tunable.** The default
+map (`host` proposes; `read`/`pure` auto-run) is the contract; the operator may
+override it deployment-wide with `PLURNK_SERVICE_EFFECT_POLICY`, a
+comma-separated `<effect>:<policy>` list (e.g. `read:propose` proposes even
+read effects). Unlisted effects keep the default. An invalid entry — unknown
+effect, unknown policy, or a non-`<effect>:<policy>` shape — fails daemon boot
+loudly rather than degrading admission.
+
 After all non-SEND operations dispatch, the initiating turn applies {§worker-optimistic-settlement} to only the EXEC streams it started, then dispatches its terminal SEND against the refreshed lifecycle state. An older stream receives no renewed opportunity merely because another turn began. This is a settlement barrier before disposition, not sibling-operation serialization: dependent EXECs remain separate observed turns.
 
 §exec-stream **Stream surfacing.** An exec's output is *observed, not fetched*.
 Each turn the environment-observation injector publishes newly publishable content
-from each owned channel as an `origin=plurnk` READ at
+from each owned channel as an `origin=_plurnk` READ at
 `<runtime>:///<coord>#<channel>`, preserving the channel's current mimetype:
 
 | channel mimetype | while active | at terminal state |
@@ -1728,14 +1980,18 @@ from each owned channel as an `origin=plurnk` READ at
 | `application/jsonl` or `application/x-ndjson` | complete newline-terminated records | every remaining record |
 | every other mimetype | nothing | the complete atomic document |
 
-The per-channel cursor advances only through content actually published, so an
-active atomic document or trailing partial JSONL record never reaches the model
-as malformed structured data. Ongoing observations are folded and a terminal
-observation is born OPEN; a terminal state with no newly publishable body still
-produces one conclusion row. Every READ then obeys {§body-projection} and
-therefore renders its selected result complete. A stream that closes before a
-same-turn wait remains pending until this terminal READ crosses the next packet
-boundary. The EXEC row separately records the authored invocation.
+The durable per-subscription, per-channel cursor advances only through content
+actually published, so an active atomic document or trailing partial JSONL
+record never reaches the model as malformed structured data. Its transition and
+the generated READ commit atomically. Ongoing observations are folded and a
+terminal observation is born OPEN; a terminal state with no newly publishable
+body still produces one bodyless conclusion row. OPEN, FOLD, or KILL may curate
+that log row without rewinding the cursor or publishing the terminal result
+again; the exact terminal result and channel content remain READable at the
+stream address. Every READ then obeys {§body-projection} and therefore renders
+its selected result complete. A stream that closes before a same-turn wait
+remains pending until every selected channel's terminal READ crosses the next
+packet boundary. The EXEC row separately records the authored invocation.
 
 `## KILL0 (<runtime>:///<loop>/<turn>/<seq>)` cancels an active subprocess via
 the subscription registry's stored controller. A terminal stream is immutable:
@@ -1747,17 +2003,17 @@ stream cannot fall through an internal `exec`-only query. {§stream-control}
 §exec-env-scoped **Scoped environment.** An EXEC subprocess inherits the *project's* environment — its `.env`, the standard shell vars — so the model's commands run as the project expects; but never plurnk's own secrets: the provider API keys and `PLURNK_*` config are stripped before the spawn, so a model-executed command can't `printenv` the engine's keys. The service owns the scoping policy (the denylist); the executor spawns with the env it is handed.
 
 - §exec-hold-until-concluded **The turn-hold exception** — for runtimes in `PLURNK_SERVICE_EXEC_HOLD` (a decision-table env, shipped listing the search family), an in-flight stream **pauses the cycle**: the next packet does not assemble until the stream concludes, so the model never burns a turn asking "are we there yet" about a result the engine controls end-to-end. This exception is limited to seconds-bounded runtimes whose final result the engine controls end-to-end. Bounded by `PLURNK_SERVICE_EXEC_HOLD_MS` and **fail-open**: at the cap the standard cycle resumes untouched (waits, wakes, polls). Zero grammar or teaching surface — the model emits EXEC followed by SEND signal `102` as ever; the wake-shaped world simply arrives one packet sooner. It extends selected runtimes beyond the ordinary {§worker-optimistic-settlement} cap before the next packet assembles. A bare entry holds ALL of a runtime's spawns; a `<runtime>:<effect>` suffix (`github:read`) holds only that effect-class — an MCP server is one runtime whose tools split (a `read` `get_issue` is instant; a `host` `run_migration` is a slow mutation), so an operator opts the known-fast read-class in without parking on the mutation. Conservative stays default: an arbitrary third-party server's latency never parks the engine unless a suffix opts a class in.
-- §exec-entry-sink **The entry() sink** — an executor may *request* entry materialization (execs SPEC §2.6: every sink is a consumer-implemented callback; the executor owns zero substrate). The service implements it in exec dispatch: `entry(path, content: string | null, {tags, mimetype?})` upserts the entry, then journals ONE typed `EDIT` row in the reserved `plurnk` worker's log — the fs-fiction pattern, `source` = the calling worker, `weight` = the canonical resulting span's curation weight, and `attrs.kind="entry_materialized"`. The requested tags classify that journal row under {§log-item-tags}; they never become resource metadata or duplicate into attrs. Durable replay and clients retain that exact creation event. The model packet projects the typed event as a folded system `READ` of the resulting ordinary resource: its relevant truth is readable state now available in the environment, not an agent-authored mutation. **The executor owns no fetcher:** a `content: null` is a *declaration* — the service acquires the page through schemes-http's checked WebFetcher and accepts its model-facing body and available source/evidence channels {§html-materialization}. Generic public HTML follows the same origin-Markdown, configured Tavily, and local-projection routes as exact HTTP acquisition. A failed acquisition, body-production failure, materialization exception, or absent final projection rejects the sink and produces no HTTP entry, but does not invalidate a search runtime's upstream discovery row; materialization exceptions retain their cause in daemon diagnostics. A non-null `content` is the materialize-given-body path (the caller already holds the bytes and states their mimetype) and grants no provider authority. **No page body ever rides a packet**; the announcement is the folded row's path, weight, and log classifications, and the model READs/~queries what it chooses. Parallel `entry()` calls serialize on a per-spawn chain; a rejected call leaves the chain healthy. The spawn tail settles that complete chain before unregistering, so executor idleness and shutdown are barriers over its materialization writes. The narration context (one plurnk-worker turn) is lazy per spawn, not per entry.
+- §exec-entry-sink **The entry() sink** — an executor may *request* entry materialization (execs SPEC §2.6: every sink is a consumer-implemented callback; the executor owns zero substrate). The service implements it in exec dispatch: `entry(path, content: string | null, {tags, mimetype?})` upserts the entry, then records ONE typed `EDIT` row in the reserved `plurnk` worker's log — the fs-fiction pattern, `source` = the calling worker, `weight` = the canonical resulting span's curation weight, and `attrs.kind="entry_materialized"`. The requested tags classify that log row under {§log-item-tags}; they never become resource metadata or duplicate into attrs. Durable replay and clients retain that exact creation event. The model packet projects the typed event as a folded system `READ` of the resulting ordinary resource: its relevant truth is readable state now available in the environment, not an agent-authored mutation. **The executor owns no fetcher:** a `content: null` is a *declaration* — the service acquires the page through schemes-http's checked WebFetcher and accepts its model-facing body and available source/evidence channels {§html-materialization}. Generic public HTML follows the same origin-Markdown, configured materializer, and local-projection routes as exact HTTP acquisition ({§http-materializer-plugins}). A failed acquisition, body-production failure, materialization exception, or absent final projection rejects the sink and produces no HTTP entry, but does not invalidate a search runtime's upstream discovery row; materialization exceptions retain their cause in daemon diagnostics. A non-null `content` is the materialize-given-body path (the caller already holds the bytes and states their mimetype) and grants no provider authority. **No page body ever rides a packet**; the announcement is the folded row's path, weight, and log classifications, and the model READs/~queries what it chooses. Parallel `entry()` calls serialize on a per-spawn chain; a rejected call leaves the chain healthy. The spawn tail settles that complete chain before unregistering, so executor idleness and shutdown are barriers over its materialization writes. The narration context (one plurnk-worker turn) is lazy per spawn, not per entry.
 
 ### §proposal The proposal lifecycle
 
-§proposal-202-pauses A side-effecting op does not execute on dispatch — it **proposes**. The scheme returns **202** (an EXEC `host` runtime {§exec}, an EDIT to a member file {§membership}); the engine writes the log row `state='proposed'`, registers a waiter keyed by `logEntryId`, and **pauses `dispatch`** awaiting a resolution. The pause is internal to dispatch — the turn has already closed, so {§grinder} strike accounting sees the *resolved* status, never the 202. On accept the status becomes 200 and the scheme's effect runs.
+§proposal-202-pauses A side-effecting op does not execute on dispatch — it **proposes**. The scheme returns **202** (an EXEC `host` runtime {§exec}, an EDIT to a member file {§membership}); the engine writes the log row `state='proposed'`, registers a waiter keyed by `logEntryId`, and **pauses `dispatch`** awaiting a resolution. The provider exchange and emitted operation are already durable, while the turn remains open until dispatch settles; {§engine-rails} therefore sees the *resolved* status, never the provisional 202. On accept the status becomes 200 and the scheme's effect runs.
 
 **Resolution arrives through one lifecycle:**
 
 - **Client disposition** ({§methods-proposal-resolve}) — a client interface delivers accept, reject, or cancel; AG-UI uses standard resume entries ({§agui-proposal-resolve}).
 - **Loop disposition** ({§proposal-disposition}) — core applies the exact automatic accept/reject before observational subscribers run; automatic policy is not an event listener or client fallback.
-- §proposal-timeout-cancels **Timeout is OPT-IN; the shipped default is a world that WAITS** - `PLURNK_SERVICE_PROPOSAL_TIMEOUT_MS` empty (shipped) means a pending proposal - a file edit awaiting review or a [300] question - waits indefinitely for its human: absence is not an answer, so the service does not synthesize a cancellation. A finite positive millisecond value establishes the bound; then elapsing synthesizes `cancel` (outcome `timeout`), server-side, needing no client. Every other explicit value fails at the proposal lifecycle owner and terminalizes an already-written proposal rather than silently choosing an indefinite wait.
+- §proposal-timeout-cancels **Timeout is OPT-IN; the shipped default is a world that WAITS** - `PLURNK_SERVICE_PROPOSAL_TIMEOUT_MS` empty (shipped) means a pending proposal - a file edit awaiting review - waits indefinitely for its human: absence is not an answer, so the service does not synthesize a cancellation. A finite positive millisecond value establishes the bound; then elapsing synthesizes `cancel` (outcome `timeout`), server-side, needing no client. Every other explicit value fails at the proposal lifecycle owner and terminalizes an already-written proposal rather than silently choosing an indefinite wait.
 
 **The decision drives a one-way state transition** on `log_entries.state` (resolution is idempotent — `WHERE state='proposed'`, so a second resolution 404s):
 
@@ -1778,11 +2034,10 @@ Core derives the contracts-owned `ProposalProjection` from the durable proposed
 | Projection field      | Durable authority                                                                                                  |
 | --------------------- | ------------------------------------------------------------------------------------------------------------------ |
 | identity              | proposed log row `id`, `worker_id`, `loop_id`, `turn_id`, and validated `op`                                       |
-| `target`              | canonical `attrs.proposalTarget` for staged COPY/MOVE, otherwise the log row target                                |
+| `target`              | canonical `{ scheme, authority, pathname }` from `attrs.proposalTarget` for staged COPY/MOVE, otherwise the log row target |
 | `body`                | proposed operation result `rx.body`; absent means the empty review body                                            |
 | `attrs`               | proposed log row `attrs` object                                                                                    |
 | `flags`               | validated persisted loop flags expanded over contracts-owned defaults                                              |
-| `staleClobberRisk`    | target-matched ambient file divergence in the proposal's worker and turn                                           |
 | `disposition`         | {§proposal-disposition}; the same value drives automatic settlement and client presentation                        |
 
 Workspace scope remains the event envelope / seam argument ({§notifications-envelope-carries-workspaceid}); it is not forged into `ProposalProjection`. Malformed durable JSON, target metadata, result envelopes, loop policy, or final projection fails at core with its cause; after insertion, core terminalizes that row as a 500 `policy_failed` before propagating the internal failure, so no waiter or durable stopped world is orphaned.
@@ -1808,17 +2063,13 @@ removes ownerless rows without fabricating cancellation, payload, or replay.
 
 `ProposalDisposition` is either `{ owner: "client" }` or `{ owner: "loop", decision: "accept" | "reject", outcome? }`. The decision table is complete and ordered:
 
-The `[300]` branch is identified by the durable SEND operation signal; `attrs.question` is its required presentation payload, not an independent policy switch ({§send-300-choices}).
-
-| `auto` | `[300]` question | stale target | `noProposals` | Disposition                                                        |
-| ------ | ---------------- | ------------ | ------------- | ------------------------------------------------------------------ |
-| true   | yes              | any          | any           | client                                                             |
-| true   | no               | true         | any           | loop reject, outcome `stale_read_clobber`                          |
-| true   | no               | false        | any           | loop accept                                                        |
-| false  | any              | any          | true          | loop reject, outcome `no_review_channel`                           |
-| false  | any              | any          | false         | client                                                             |
+| `auto` | `noProposals` | Disposition                              |
+| ------ | ------------- | ---------------------------------------- |
+| true   | any           | loop accept                              |
+| false  | true          | loop reject, outcome `no_review_channel` |
+| false  | false         | client                                   |
 
-Thus `auto` wins the otherwise nonsensical `auto + noProposals` combination, but its operator-question exception still leaves that question client-owned ({§send-300-choices}). Loop-owned settlement occurs before observational notification; observer failures are diagnosed with their cause and cannot change disposition or leave an eligible automatic proposal pending.
+Thus `auto` wins the otherwise nonsensical `auto + noProposals` combination. Loop-owned settlement occurs before observational notification; observer failures are diagnosed with their cause and cannot change disposition or leave an eligible automatic proposal pending.
 
 ---
 
@@ -1830,14 +2081,14 @@ Thus `auto` wins the otherwise nonsensical `auto + noProposals` combination, but
 
 §subscriptions-subscription-registry-routes-cancellation READ on a streaming scheme is a subscription, not a one-shot. The scheme establishes its protocol-specific acquisition boundary, returns `102 Processing`, and stays alive through the `StreamSubscription` returned by `subscriptions.open()`. The service commits that initial operation result normally; later chunk and terminal work cannot rewrite it. Durable terminal truth lives on the subscription and its channels. The service records durable subscription identity and metadata in SQLite and retains the callable `SubscriptionHandle` only in its process-local live registry. SEND signal `499`, worker cancellation, turn-scoped reap, and shutdown all route through that one live registry; no handler-specific cancellation hook or database access is part of the plugin contract.
 
-The durable row is lifecycle evidence and the lookup key, not a serialized callback. `subscriptions.open()` establishes both halves before yielding a composed `StreamSubscription`: an `AbortSignal` whose fused `notifyChunk` and terminal `close` methods are safe to retain without the operation's general `SchemeCtx`. `close(result, summary?)` validates and persists the exact universal operation result, settles channel state, closes the durable row, wakes the worker when appropriate, and unregisters the live handle. `close_status` is a constrained relational projection of `close_result.status`, never an independent result. A durable open row without a live handle is an explicit lifecycle failure, never a fabricated cancellation success. Channel state ({§channel-state}) + log entries ({§no-chunk-rows}) carry lifecycle.
+The durable row is lifecycle evidence and the lookup key, not a serialized callback. `subscriptions.open()` establishes both halves before yielding a composed `StreamSubscription`: an `AbortSignal` whose fused `notifyChunk` and terminal `close` methods are safe to retain without the operation's general `SchemeCtx`. `close(result, summary?, channelResults?)` validates one universal terminal producer result plus exact named channel overrides. One SQLite transition closes the subscription and installs each channel's terminal `producerResult`; its lifecycle state derives from that result. The transition then wakes the worker when appropriate and unregisters the live handle. `close_status` is a constrained relational projection of `close_result.status`, never an independent result, while `channel_results` preserves historical overrides after a later subscription replaces the channel's current evidence. A durable open row without a live handle is an explicit lifecycle failure, never a fabricated cancellation success. Channel state ({§channel-state}) + log entries ({§no-chunk-rows}) carry lifecycle.
 
 At process restart every still-open row is necessarily missing its callable owner. Boot
 settles it as interruption (`500`) and errors active channels before evaluating parked
 loops ({§worker-lifecycle-restart-recovery}); it never reports cancellation (`499`) or
 pretends to reconstruct an opaque plugin connection.
 
-§subscriptions-fold-keeps-subscription FOLD/OPEN toggles `log_entries.expanded` ({§open-fold}) — a per-worker render bit, never the subscription registry. FOLDing a streaming entry's log row collapses its body out of the packet but leaves the live stream running: curation is render-only, never cancellation.
+§subscriptions-fold-keeps-subscription FOLD/OPEN changes a log row's folded body intervals ({§open-fold}), never the subscription registry. Curation of a streaming entry's log body leaves the live stream running: visibility is render-only, never cancellation.
 
 ### §chunk-accumulation Chunk accumulation
 
@@ -1891,7 +2142,7 @@ No generator. SQLite-optimal: STRICT (3.37+), `INTEGER PRIMARY KEY` aliasing, ex
 
 - **Schema-alignment test**: loads `@plurnk/plurnk-contracts/schema/*.json`, parses DDL via `node:sqlite` introspection, asserts every required schema field has a corresponding `NOT NULL` column. Contract drift fails CI.
 - DDL = storage truth; JSON Schemas = wire truth. Tested-aligned, allowed to differ where ergonomics demand.
-- §entry-identity-no-null **Identity components are never NULL.** The entries identity tuple — (workspace, owner, scheme, pathname) — admits no NULL component because SQLite treats NULLs as distinct under a UNIQUE index, allowing duplicate logical identities. File members persist under the reserved **`file`** scheme (`storedScheme: "file"`; they still render as bare paths); `entries.scheme` is `NOT NULL`; a manifest declaring `storedScheme: null` is refused at registration.
+- §entry-identity-no-null **Identity components are never NULL.** The entries identity tuple — `(owner, scheme, authority, pathname)` — admits no NULL component because SQLite treats NULLs as distinct under a UNIQUE index, allowing duplicate logical identities. `owner_id` references one Worker, which is the sole workspace coordinate; `entries` stores no redundant `workspace_id` that could contradict it. `authority` defaults to the canonical empty string for namespace and owner schemes; resource schemes persist their canonical authority there. File members persist under the reserved **`file`** scheme (`storedScheme: "file"`; they still render as bare paths); `entries.scheme` and `entries.authority` are `NOT NULL`; a manifest declaring `storedScheme: null` is refused at registration.
 
 ### §sql-ts-boundary SQL/TS responsibility boundary
 
@@ -1974,10 +2225,17 @@ freshness remains the owning family's concern.
 | Family    | Lean framework                     | Service-owned default leaves                                                                                                     |
 |-----------|------------------------------------|----------------------------------------------------------------------------------------------------------------------------------|
 | Schemes   | `@plurnk/plurnk-schemes`           | `@plurnk/plurnk-schemes-http`                                                                                                    |
-| Mimetypes | `@plurnk/plurnk-mimetypes`         | `application-ipynb`, `application-json`, `application-jsonl`, `application-pdf`, and `application-xml` format leaves.             |
+| Mimetypes | `@plurnk/plurnk-mimetypes`         | `application-ipynb`, `application-json`, `application-jsonl`, and `application-xml` format leaves.                                |
 |           |                                    | `text-csv`, `text-diff`, `text-dotenv`, `text-html`, `text-ini`, `text-markdown`, and `text-plain` format leaves.                 |
-|           |                                    | Fixed `embeddings` and `tokenizers` artifacts. All names use the `@plurnk/plurnk-mimetypes-*` prefix.                             |
-| Executors | `@plurnk/plurnk-execs`             | `common`, `git`, `jq`, `search`, `sqlite`, and `wasm` leaves under the `@plurnk/plurnk-execs-*` prefix.                            |
+|           |                                    | Fixed `embeddings` artifact. All names use the `@plurnk/plurnk-mimetypes-*` prefix.                                               |
+| Executors | `@plurnk/plurnk-execs`             | `common`, `git`, `jq`, `sqlite`, and `wasm` leaves under the `@plurnk/plurnk-execs-*` prefix.                            |
+
+The independently published `application-pdf` handler and `tokenizers`
+artifact are opt-in leaves. Installing either beside the service admits it
+through ordinary package discovery without changing the service manifest. The
+default local embedding artifact owns the exact counter for its own model;
+remote embedding deployments install `tokenizers` when their provider does not
+supply an exact counter.
 
 **Providers:** `@plurnk/plurnk-providers` resolves the Models.dev catalog,
 operator declarations, local adapters, and finally installed AI SDK provider
@@ -2022,12 +2280,32 @@ service manifest edit.
 
 ## §operator-config Operator Configuration
 
+### §host-path-layout Host filesystem layout
+
+On XDG-compatible hosts, artifact semantics select the default location. An
+unset or empty base variable uses the XDG default; a relative value is invalid
+and is ignored rather than resolved against the working directory.
+
+| Class | Base | Plurnk member |
+|---|---|---|
+| Configuration | `$XDG_CONFIG_HOME` (default `~/.config`) | `plurnk/.env`, `plurnk/AGENTS.md` |
+| Durable user data | `$XDG_DATA_HOME` (default `~/.local/share`) | `plurnk/plurnk.db` and SQLite sidecars |
+| Persistent operational state | `$XDG_STATE_HOME` (default `~/.local/state`) | Reserved; no directory is created without an owned artifact. |
+| Reproducible cache | `$XDG_CACHE_HOME` (default `~/.cache`) | Reserved; no directory is created without an owned artifact. |
+| Shared global Agent Skills | User home | `.agents/skills/<name>/SKILL.md` |
+
+The service creates only a directory required by the current command. A newly
+created configuration or data directory uses mode `0700`; a newly seeded
+secret-bearing `.env` uses `0600`. Existing user-owned permissions are not
+rewritten. Explicit Plurnk path overrides retain `~/` expansion and their
+ordinary precedence; XDG variables themselves require absolute paths.
+
 §operator-config-precedence Configuration is one environment cascade. Higher-priority sources preserve or replace values supplied by every lower source:
 
 | Priority | Source                             | Ordering                                                  |
 |---------:|------------------------------------|-----------------------------------------------------------|
 |        1 | Assembled package `.env.defaults` | Set-if-unset floor; one owner per key.                     |
-|        2 | `~/.plurnk/.env`                   | User-level ambient configuration.                         |
+|        2 | `$XDG_CONFIG_HOME/plurnk/.env`     | User-level ambient configuration.                         |
 |        3 | `./.env`                           | Working-directory ambient configuration.                  |
 |        4 | `--config=<path>`                  | Singular service-owned explicit file.                     |
 |        5 | `--env-file*`                      | Repeatable explicit files; later selected files win.      |
@@ -2036,17 +2314,28 @@ service manifest edit.
 
 Node's pre-script env-file form and the executable's post-script form share the same later-file-wins ordering. `--env-file-if-exists` skips an absent file without changing the order of selected files.
 
-§operator-config-env-defaults **Every package owns its knobs — `.env.defaults` is the standard.** Each package in the daemon's ecosystem — internal or third-party — ships a `.env.defaults` at its package root declaring its own knobs; the file is the package's configuration reference, traveling in the tarball and changing with the code that reads it. At boot the daemon assembles every installed member's file into one floor (membership = the `@plurnk/*` scope or a `plurnk` package.json field, gated by `PLURNK_PLUGINS_TRUSTED_ONLY` with discover()'s exact semantics), applies it set-if-unset under every operator source, and renders the assembled catalog to `~/.plurnk/.env.defaults`. The catalog is machine-owned, regenerated each boot, and never read back as configuration. A key claimed by two packages fails boot naming both. With the reader-declares discipline, each key has one implementation and one defaults owner.
+§operator-config-env-defaults **Every package owns its knobs — `.env.defaults` is the standard.** Each package in the daemon's ecosystem — internal or third-party — ships a `.env.defaults` at its package root declaring its own knobs; the file is the package's configuration reference, traveling in the tarball and changing with the code that reads it. At boot the daemon assembles every installed member's file into one floor (membership = the `@plurnk/*` scope or a `plurnk` package.json field, gated by `PLURNK_PLUGINS_TRUSTED_ONLY` with discover()'s exact semantics) and applies it set-if-unset under every operator source. `plurnk-service config defaults` renders the same complete, owner-labelled aggregate to stdout on demand, preserving comments and optional declarations without persisting a second copy or exposing effective secret values. A key claimed by two packages fails boot naming both. With the reader-declares discipline, each key has one implementation and one defaults owner.
+
+§operator-config-discovery The conventional `plurnk-service config` command
+family is a view over the environment cascade, never another configuration
+representation. `config` reports the canonical `.env`, actual source order,
+and model-selection state; `config edit` opens that file through `$VISUAL` or
+`$EDITOR`; `config defaults` emits the aggregate above; and `config check`
+validates the provider-free configuration contracts without starting a model
+or provider request. The seeded `.env`, first-run diagnostic, service help, and
+missing-model recovery all signpost `plurnk-service config defaults` as the
+complete installed option catalog.
 
-Model selection: separate alias cascade in `ProviderRegistry` ({§provider-instantiation}). `PLURNK_MODEL_<alias>=<provider>/<model-id>` declares; `PLURNK_MODEL=<alias>` selects. Optional `PLURNK_MODEL_CHILD=<alias>` selects the default child provider; unset means inherit the spawning loop's provider. Aliases and selections live in `.env`, not `.env.defaults` (operator-specific).
+Model selection uses one selector vocabulary in `ProviderRegistry` ({§provider-instantiation}). `PLURNK_MODEL_<alias>=<provider>/<model-id>` optionally declares a friendly route and tuning scope; `PLURNK_MODEL=<selector>` selects either that alias or an exact provider/model route. `PLURNK_MODEL_CHILD=<selector>` uses the same vocabulary for the default child provider; unset means inherit the spawning loop's provider. Operator selections and alias declarations live in `.env`, not `.env.defaults`.
 
 | Var                                                         | Default | Purpose |
 |-------------------------------------------------------------|---------|---------|
-| `PLURNK_SERVICE_DB_PATH`                                    | `~/.plurnk/plurnk.db` | SQLite file path. |
+| `PLURNK_SERVICE_DB_PATH`                                    | `$XDG_DATA_HOME/plurnk/plurnk.db` | SQLite file path; an explicit non-empty value overrides the derived default. |
 | `PLURNK_HOST`                                               | `127.0.0.1` | Bind address for the listener. Local-only by default. |
 | `PLURNK_PORT`                                               | `3044` | TCP port for THE client surface — the AG-UI+ listener (the plurnk-agui plugin module binds it at boot). Production is single-listener. |
 | §operator-config-git-ceiling `PLURNK_SERVICE_GIT_ALLOWED`   | `1` | Hard service ceiling: only `1` admits Git membership, status, branch batching, and `git`/`isogit` executors; every other value denies them before executor registration or packet teaching. |
-| `PLURNK_SERVICE_MAX_TURNS`                                  | `-1` | Operator turn **ceiling** — `-1` = no cap; a positive value clamps `runLoop({maxTurns})`. The effective value is persisted on the durable loop and counts cumulatively across every `202` park/resume. |
+| §operator-config-file-create-scope `PLURNK_SERVICE_FILE_CREATE_SCOPE` | `root` | Hard file-creation ceiling: `none < root < namespace`. `none` denies new filesystem files, `root` admits only paths inside `project_root`, and `namespace` also admits canonical outside-root paths. Existing-member writes are unaffected. |
+| `PLURNK_SERVICE_MAX_TURNS`                                  | `-1` | Operator inference-turn **ceiling** — `-1` = no cap; a positive value clamps `runLoop({maxTurns})`. The effective value is persisted on the durable loop and counts completed model/inference turns cumulatively across every `202` park/resume; `_plurnk`, client, and plugin turns remain chronology but consume none of this allowance. |
 | `PLURNK_SERVICE_MAX_COMMANDS`                               | `-1` | Per-emission action ceiling; `-1` = no cap (default) — every generated op dispatches. A positive value caps dispatched actions: overflow ops drop with one durable `max-commands-exceeded` error row on the next packet. PLAN and the final disposition always dispatch. Tightened per workspace via `settings.maxCommands` (min wins). |
 | §operator-config-loop-timeout `PLURNK_SERVICE_LOOP_TIMEOUT` | `86400000` | ms wall-clock budget for a single core loop: expiry aborts the loop signal mid-flight (a stuck `generate` included) and the loop terminates `504 loop_timeout` — a legible engine terminal, kin to the exec `<T>` reap's 504 ({§exec-timeout}). |
 | `PLURNK_SERVICE_MAX_STRIKES`                                | `6` | Consecutive admitted-turn strike threshold ({§engine-rails}). |
@@ -2060,23 +2349,23 @@ Model selection: separate alias cascade in `ProviderRegistry` ({§provider-insta
 | `PLURNK_SERVICE_MAX_CYCLE_PERIOD`                           | `4` | Max period length cycle detection examines ({§engine-rails}). |
 | `PLURNK_SERVICE_REQUIEM_MAX_TOKENS`                         | `16384` | Initial forensic witness output allowance ({§digest-requiem}). |
 | `PLURNK_SERVICE_REQUIEM_RETRY_MAX_TOKENS`                   | `32768` | Retry allowance; must be at least the initial requiem allowance ({§digest-requiem}). |
-| `PLURNK_SERVICE_MD_<ALIAS>`                                 | (unset) | Operator reference doc: materializes `<path>` as `worker://plurnk/<ALIAS>.md`, auto-READ into every model worker's turn 0 ({§actor-boundary-doc-injection}). `~` expands to home. |
 | `PLURNK_SERVICE_FILES_ITEMS`                                | `-1` | Turn-0 catalog preview. Folder-capable schemes render a one-level `*` map with `dir/**` rollups; kernel docs remain recursive and explicitly complete. `-1` = markerless first pages; positive `N` explicitly caps only file-map rows; `0` / unset = off ({§actor-boundary-catalog-preview}). |
 | `PLURNK_SERVICE_PROPOSAL_TIMEOUT_MS`                        | (empty — waits indefinitely) | Finite positive milliseconds before cancellation with outcome `timeout`; empty waits, and every other explicit value fails ({§proposal-timeout-cancels}). |
+| §operator-config-worker-warm `PLURNK_SERVICE_WORKER_WARM_MS` | `900000` | Milliseconds a lease-free worker Functionality snapshot remains warm; `0` cools without grace and `-1` disables time-based cooling ({§module-worker-residency}). |
+| `PLURNK_SERVICE_WORKER_WARM_MAX`                            | `2` | Maximum lease-free worker Functionality snapshots retained process-wide; `0` retains none and `-1` disables the idle-LRU bound ({§module-worker-residency}). |
 
 Every core knob listed is enforced at its owning read site; `.env.defaults` is the authoritative default ({§operator-config-env-defaults}). Provider, scheme, executor, mimetype, and client-interface knobs are documented by their owning packages and appear in the assembled catalog.
 
 **Two override semantics — ceiling vs default.** Which kind a var is determines what "override" means across the cascade:
 
-- **Ceiling** (most-restrictive-wins) — an operator-set hard bound nothing downstream may exceed: not a lower-precedence file, not a per-workspace constraint, not a per-call seam argument. `PLURNK_SERVICE_GIT_ALLOWED` ({§operator-config-git-ceiling}), `PLURNK_SERVICE_MAX_COMMANDS`, `PLURNK_SERVICE_MAX_STRIKES`, and `PLURNK_SERVICE_MAX_TURNS` (`-1` ships it off; a positive value caps the per-call request). The sandbox/cost guarantee: the operator caps it; no client widens it.
-- **Default** (explicit-wins) — a fallback the most-specific setter replaces freely: `PLURNK_MODEL` (a `runLoop({alias})` request overrides it) and the config-time vars (`HOST` / `PORT` / `DB_PATH`).
+- **Ceiling** (most-restrictive-wins) — an operator-set hard bound nothing downstream may exceed: not a lower-precedence file, not a per-workspace constraint, not a per-call seam argument. `PLURNK_SERVICE_GIT_ALLOWED` ({§operator-config-git-ceiling}), `PLURNK_SERVICE_FILE_CREATE_SCOPE` ({§operator-config-file-create-scope}), `PLURNK_SERVICE_MAX_COMMANDS`, `PLURNK_SERVICE_MAX_STRIKES`, and `PLURNK_SERVICE_MAX_TURNS` (`-1` ships it off; a positive value caps the per-call request). The sandbox/cost guarantee: the operator caps it; no client widens it.
+- **Default** (explicit-wins) — a fallback the most-specific setter replaces freely: `PLURNK_MODEL` (a `runLoop({selector})` request overrides it) and the config-time vars (`HOST` / `PORT` / `DB_PATH`).
 
 §operator-config-shipped-defaults **The shipped `.env.defaults` is itself under
-test.** It has no active `PLURNK_SERVICE_MD_*` doc alias because policy is a
-section and a doc default double-injects it; no active `PLURNK_MODEL`; no active
-local GBNF constraint; and the policy renders in exactly one packet section.
-Every other tier runs the test cascade, so shipped-default regressions are
-otherwise invisible by construction.
+test.** It has no active `PLURNK_MODEL`; no active local GBNF constraint; and
+the policy renders in exactly one packet section. Every other tier runs the
+test cascade, so shipped-default regressions are otherwise invisible by
+construction.
 
 §operator-config-flag-parity The companion **flag-parity** check binds code and
 template both ways: every `PLURNK_SERVICE_*` the service reads has a
@@ -2124,12 +2413,11 @@ boundary. Operator-arcane knobs stay environment-only.
 | Field                  | Admitted value                                 | Composition / owner                                           |
 | ---------------------- | ---------------------------------------------- | ------------------------------------------------------------- |
 | `settings.filesItems`  | Integer `>= -1`                                | Explicit replacement {§operator-config-workspace-files-items} |
-| `settings.mdDocs`      | Array of `{ alias: [\w.-]+, content: string }` | Alias-keyed union {§operator-config-workspace-md-docs}        |
 | `settings.maxCommands` | Non-negative integer                           | Tightening ceiling {§operator-config-workspace-max-commands}  |
 | `settings.git`         | Boolean                                        | Tightening denial {§operator-config-workspace-git}            |
+| `settings.fileCreateScope` | `none`, `root`, or `namespace`             | Tightening ceiling {§operator-config-workspace-file-create-scope} |
 | `settings.client`      | Nonempty string                                | Stable self-identification {§client-metadata}                 |
 | `settings.execs`       | Record of policy-key to string                 | Subtractive executor layer {§operator-config-workspace-execs} |
-| `settings.questions`   | Boolean                                        | Affirmative question request {§send-300-choices}              |
 
 The composition families remain distinct so one setting's semantics never
 leak into another.
@@ -2137,8 +2425,6 @@ leak into another.
 *Defaults — explicit-wins (the client replaces/merges freely):*
 
 - §operator-config-workspace-files-items `settings.filesItems` (number) **replaces** `PLURNK_SERVICE_FILES_ITEMS` for the workspace: a one-shot opens clean (`0`, no preview), with ordinary markerless pages (`-1`), or with the file list explicitly capped (`N`, other surveys remain markerless). A single scalar — the client value wins outright.
-- §operator-config-workspace-md-docs `settings.mdDocs` (`[{alias, content}]`) **unions** with the server's `PLURNK_SERVICE_MD_*` docs, keyed by alias — a client adds its own repo docs atop the operator's systemwide policy doc. On alias collision the client wins before I/O (a deliberate shadow), so the unselected operator path is not read; every selected non-empty operator path is required, and absence or another read failure rejects materialization with its cause. The client sends content (it owns the file), not a path.
-
 *Ceilings — most-restrictive-wins (the client may only narrow, never widen):*
 
 - §operator-config-workspace-max-commands `settings.maxCommands` (number)
@@ -2146,10 +2432,11 @@ leak into another.
   workspace: a client tightens the runaway-op guard and never raises it past
   the operator's.
 - §operator-config-workspace-max-commands-floor The cap bounds *actions* only.
-  PLAN (intended goals) and the final disposition `SEND` (`102`, `200`, `202`,
+  PLAN (complete current Plan) and the final disposition `SEND` (`102`, `200`, `202`,
   `300`, or `499`) are never counted and always dispatch, so `0` is a valid
   floor — the tightest — admitting a plan and disposition with zero actions.
 - §operator-config-workspace-git `settings.git` (`false`) **denies** git for the workspace (`PLURNK_SERVICE_GIT_ALLOWED` AND workspace) — the client opts its workspace out of git membership and working-tree status; it can never re-enable git past the operator's service-wide lockout.
+- §operator-config-workspace-file-create-scope `settings.fileCreateScope` narrows `PLURNK_SERVICE_FILE_CREATE_SCOPE` by the ordered lattice `none < root < namespace`; a workspace may disable creation or confine a namespace-enabled service to its root, but never widen the operator's ceiling. Unknown service values fail configuration validation and unknown workspace values fail `workspace.create`.
 - §operator-config-workspace-execs `settings.execs` is a workspace-stable
   snapshot of one `Record<string, string>` policy layer using
   {§executor-policy}. Keys are matched case-insensitively and must be
@@ -2158,9 +2445,8 @@ leak into another.
   effective workspace registry is authoritative and the settings layer only
   intersects it: settings cannot register or re-enable a runtime. A canonical
   key for a currently absent tag is accepted as inert policy and applies if a
-  workspace capability provider later publishes that tag. Dispatch, the
-  model-facing capability sheet, and executor
-  document materialization use the same registered-set intersection and policy
+  worker Functionality provider later publishes that tag. Dispatch and
+  model-facing tool-resource materialization use the same registered-set intersection and policy
   predicate, so a workspace-disabled tag is neither executable nor taught.
 
 Feature-flag bools use `process.env.X === "1"` exactly — never `=== "true"`.
@@ -2173,7 +2459,8 @@ External plugins declare their own env vars in their own `.env.defaults`, assemb
 
 ## §rpc Module seam
 
-Core owns a typed in-process module seam. It owns no external listener, public
+Core implements the contracts-owned {§application-port} and owns the typed
+module setup seam. It owns no external listener, public
 action-name catalog, or generic string-dispatched method registry. A
 client-interface module such as `plurnk-agui` owns its public protocol, action
 names, request validation, discovery result, and event projection.
@@ -2183,33 +2470,74 @@ names, request validation, discovery result, and event projection.
 ```mermaid
 flowchart LR
     register["Daemon.registerModule"] --> setup["module.setup(ModuleSetupSeam)"]
-    setup --> capabilities["Register static capabilities,<br/>workspace providers, and actions"]
-    capabilities --> ready["Schemes ready; docs published;<br/>durable lifecycle recovered"]
-    ready --> start["module.start(CoreSeam)"]
+    setup --> capabilities["Register static capabilities,<br/>workspace activators, and actions"]
+    capabilities --> ready["Process-wide schemes ready"]
+    ready --> recovery["Reconcile durable lifecycle"]
+    recovery --> start["module.start(ApplicationPort)"]
     start --> interface["Module-owned listener<br/>and client protocol"]
-    interface --> calls["Typed CoreSeam calls"]
+    recovery -->|durable workspace work| demand["First workspace demand"]
+    interface -->|client workspace work| demand
+    demand --> lease["Acquire capability residency"]
+    lease --> activate["Activate if cold;<br/>publish workspace docs"]
+    activate --> calls["Typed ApplicationPort calls"]
+    calls --> release["Release demand lease"]
+    release --> warm["Bounded warm grace / idle LRU"]
+    warm -->|new demand| lease
+    warm -->|idle bound| cool["Deactivate providers;<br/>withdraw runtime projections"]
+    interface -->|worldless call| calls
     calls --> core["Core state and orchestration"]
     core --> events["subscribeToEvents<br/>(workspaceId, event, payload)"]
     events --> interface
 ```
 
 Every registered module's `setup` runs in registration order before any
-module's `start`. Core then readies schemes, publishes installed capabilities,
-recovers durable lifecycle, and starts modules in registration order. Shutdown
-closes started and self-closing modules in reverse order and surfaces aggregated
-close failures.
-
-§module-shutdown-order `Daemon.stop()` returns only after active worker drains,
-streaming producers, derivations, mimetypes, schemes, and every accepted
-conclusion-wake task have settled in dependency order. The supervisor owns each
-asynchronous wake task from acceptance through settlement; a task failure
-participates in the shutdown aggregate. The database may be released only after
-the final wake barrier resolves.
+module's `start`. Core then readies process-wide schemes, reconciles durable
+lifecycle, and starts modules in registration order. Persisted workspaces with
+no durable work stay passive until first demand; activation publishes their
+complete capabilities and documentation before the demanding operation
+proceeds. `setup` is the readiness boundary for every capability registered
+with Core: recovery may demand a workspace provider before `start`. `start`
+opens module-owned exterior ingress only after recovery, so no registered
+capability may depend on it. Shutdown begins started and self-closing module
+closure in reverse order and surfaces aggregated close failures.
+
+§module-discovery **Third-party daemon-module composition is manifest
+discovery.** A package declares `plurnk: { kind: "module", module:
+"<export-subpath>" }`; the export is one DaemonModule (an object, or a no-arg
+factory returning one). At boot, core scans installed packages under the
+executor family's discovery and trust rules ({§plugin-discovery}) and
+registers every trusted declaring module before any module setup runs, in
+package-name order. The service's explicit composition — the AG-UI,
+hooks, and MCP modules — carries init options and is wired in service.ts;
+discovery never duplicates those packages. An untrusted declaring package is
+skipped with a boot warning, never executed. A module export that is neither
+an object nor a no-arg factory, a factory returning a non-object, or an object
+with a non-function lifecycle member fails boot loudly.
+
+§module-shutdown-order `Daemon.stop()` first rejects new capability demand and
+aborts proposals, branches, derivations, and worker scopes. It simultaneously
+begins every module closer in reverse registration order, allowing exterior
+listeners to stop accepting work while active requests observe those
+cancellations. It then settles branches, drains, module closers, streaming
+producers, derivations, mimetypes, and schemes before its final conclusion-wake
+barrier. The supervisor owns each asynchronous wake task from acceptance
+through settlement; a task failure participates in the shutdown aggregate. The
+database may be released only after the final wake barrier resolves.
+
+§crash-only-stop The settle sequence is deadline-bounded
+(`PLURNK_SERVICE_STOP_TIMEOUT_MS`, default 30000): past the deadline each wait
+is abandoned with a named error instead of hanging the daemon on a child that
+never closes. A wedged child costs a forced shutdown; it must never cost an
+unbounded one.
 
 ```mermaid
 flowchart LR
-    stop[Stop accepting work] --> drains[Settle worker drains]
-    drains --> producers[Settle streaming producers]
+    stop[Begin stop] --> abort[Abort core producers]
+    stop --> moduleClose[Begin reverse module closure]
+    abort --> drains[Settle worker drains]
+    drains --> joined[Settle module closures]
+    moduleClose --> joined
+    joined --> producers[Settle streaming producers]
     producers --> resources[Dispose derivations,<br/>mimetypes, and schemes]
     resources --> wakes[Settle conclusion wakes]
     wakes --> database[Release database]
@@ -2219,30 +2547,166 @@ flowchart LR
 |---|---|
 | `registerRuntimes([{ decl, executor, availability, scheme? }, ...])` | Validates the complete canonical tag set under {§executor-runtime-declaration}, then publishes every process-wide executor and optional claimed scheme facet atomically. |
 | `registerScheme(name, handler)` | Adds one process-wide addressable scheme handler; scheme readiness and model-facing capability publication remain core-owned. |
-| §module-action-registration `registerModuleAction({ name, scope, handler })` | Adds one non-empty, extension-unique action. `scope` is exactly `worldless` or `workspace`; the handler receives validated params and a separate matching context. A workspace context contains the trusted bound `workspaceId`, never a client parameter. A client-interface module decides whether and how the name becomes public and owns collisions with its built-ins. |
-| §module-workspace-provider `registerWorkspaceCapabilityProvider(namespaceOwner, provider)` | Registers one extension-unique provider whose `hydrate(workspaceId)` reconstructs its effective snapshot. Core invokes every provider for existing workspaces before capability publication and for a new workspace before that workspace is returned or advertised. |
-| §module-workspace-state `readWorkspaceModuleState(workspaceId, namespaceOwner)` | Reads the provider's one nullable JSON state value. Core owns workspace isolation and storage; the provider owns and validates its schema. Secret values are forbidden when a durable symbolic reference can identify their authoritative source. |
-| §module-workspace-capabilities `replaceWorkspaceCapabilities({ workspaceId, namespaceOwner, state, runtimes })` | Replaces one provider's complete durable state and runtime/scheme snapshot at a quiescent workspace boundary. Core validates base/peer namespace claims before mutation, blocks new turns, commits the snapshot, and reconciles pull docs as one operation. Failure restores the prior state and presentation. The empty runtime set removes that provider's workspace namespace. |
-
-§module-workspace-quiescence **A capability snapshot changes only between
-workspace operations.** A replacement attempt while a turn or another
+| §module-action-registration `registerModuleAction({ name, scope, inputSchema, outputSchema, handler })` | Adds one non-empty, extension-unique action with resolvable JSON Schemas. `scope` is exactly `worldless`, `workspace`, or `worker`; the handler receives schema-validated params and a separate matching context. Scoped contexts contain trusted bound identifiers, never client parameters. A client-interface module decides whether and how the name becomes public, validates successful output, and owns collisions with its built-ins. |
+| §module-worker-provider `registerWorkerCapabilityProvider(namespaceOwner, provider)` | Registers one extension-unique Functionality provider. `activate({ workspaceId, workerId, retain })` reconstructs that worker's effective snapshot; idempotent `deactivate({ workspaceId, workerId })` releases its process-local resources. Core coalesces activation and cooling, publishes complete private documentation before use, and supplies `retain()` so provider work that outlives its caller holds an idempotently releasable residency lease. Dormant workers perform no provider work at boot. |
+| §module-worker-state `readWorkerModuleState(workerId, namespaceOwner)` | Reads the provider's one nullable JSON state value for one worker. Core owns worker isolation and storage; the provider owns and validates its schema. Secret values are forbidden when a durable symbolic reference can identify their authoritative source. |
+| §module-functionality-adapter `registerFunctionalityAdapter(adapter)` | Registers one family of managed Functionality beneath the shared coordinator ({§functionality-coordinator}). The adapter owns protocol truth; the coordinator owns lifecycle, durable state, publication, and both projections. |
+| §module-worker-capabilities `replaceWorkerCapabilities({ workspaceId, workerId, namespaceOwner, state, runtimes })` | Replaces one provider's complete durable state and runtime/scheme snapshot for one worker at a quiescent workspace-operation boundary. Core validates worker membership and base/peer namespace claims before mutation, commits the snapshot, and reconciles that worker's private pull docs as one operation. Failure restores the prior state and presentation. The empty runtime set removes that provider from the worker's Functionality. |
+
+§module-worker-quiescence **A worker's Functionality snapshot changes only
+between workspace operations.** A replacement attempt while a turn or another
 capability mutation owns the workspace fails 409 instead of waiting behind an
 unbounded proposal. Candidate discovery may occur before the gate, but the
 provider must re-check its old connection for active user work after acquiring
 the gate. Infrastructure-owned watches may be cancelled during replacement;
 an active request, input exchange, or Task keeps the old snapshot authoritative
-and makes replacement fail 409.
-
-The version-1 baseline table `workspace_module_state` stores one JSON value per
-`(workspace_id, namespace_owner)`. It is not an alternate registry: executable
-and resource presentation always comes from the in-memory snapshot reconstructed
-by the registered provider. Deleting a workspace cascades its module state.
-
-### §methods CoreSeam function set
-
-`CoreSeam` is a curated `Pick<Daemon, ...>` and therefore changes with the
-implementation at compile time rather than through a parallel method catalog.
-Its function names are transport-neutral library calls, not public wire names.
+and makes replacement fail 409. The workspace-wide gate is an atomicity
+boundary, not ownership: only the addressed worker's snapshot changes. A Worker's
+own accepted Functionality mutation is the one replacement that waits instead of
+failing: it queues fairly behind the turn that raised it and publishes at that
+turn's boundary ({§functionality-model-mutation}). Two publications take no
+gate of their own because their demand already holds whatever applies: a
+Worker's activation (demanded from a client action, an operation, or a child's
+turn inside its parent's held lineage) and a family's turn-admission refresh
+({§skills-hotload}), which republishes inside the turn it is admitting. The
+three modes are explicit at the host boundary — `try` (409 while held),
+`wait` (queue behind the holder), `none` (publish within the demand) — and
+nothing else may choose `none`.
+
+§module-worker-inheritance **Functionality inherits by value.** Creating a
+child copies every parent `worker_module_state` row into the child in the same
+database transaction. Parent and child thereafter mutate independently;
+activation reconstructs each worker's own snapshot and generated references.
+Workers that merely share a workspace never share enabled Functionality.
+
+§module-worker-residency **Persistence is not residency.** Model execution,
+capability-aware client reads and operations, worker module actions, and
+provider work retained through the setup context hold that worker's Functionality
+resident. Daemon boot, workspace or worker creation, attachment, listing,
+renaming, an idle client, and durable queued or parked state do not. After the
+final lease releases, core keeps the complete snapshot warm for
+`PLURNK_SERVICE_WORKER_WARM_MS` (default `900000`) while an idle LRU keeps at
+most `PLURNK_SERVICE_WORKER_WARM_MAX` (default `2`) lease-free workers.
+`0` disables the respective grace or idle allowance; `-1` disables that bound.
+Only lease-free workers cool. New demand cancels pending cooling or waits for
+in-progress cooling before one coalesced reactivation.
+
+Cooling runs at a quiescent workspace-operation boundary. It deactivates every
+provider for that worker, withdraws its ephemeral executor and scheme snapshots,
+and evicts its passive process caches; durable workspace, worker, history,
+module-state, and reference-entry rows remain unchanged. Client connection
+presence and naming never participate in this lifecycle. Shutdown cancels warm
+timers and closes all still-resident provider resources through their module
+owner.
+
+The version-1 baseline table `worker_module_state` stores one JSON value per
+`(worker_id, namespace_owner)`. It is not an alternate registry: executable and
+resource presentation always comes from the in-memory snapshot reconstructed by
+the registered provider. Deleting a worker cascades its state; child creation
+applies {§module-worker-inheritance}.
+
+### §functionality Worker Functionality: one lifecycle above every family
+
+§functionality-coordinator **Core owns one coordinator above every family
+adapter.** Agent Skills, MCP servers, and outbound A2A agents are families of
+managed Functionality. Each family registers one adapter
+({§functionality-adapter}); the coordinator owns the common lifecycle —
+`list | discover | add | enable | disable | remove` — its durable per-Worker
+state ({§functionality-state}), serialization per Worker and family, atomic
+publication ({§functionality-publication}), and both projections: worker-scoped
+client actions `worker.<family>.<verb>` and one generated executor family per
+Worker ({§functionality-model-projection}). An explicit client action and an
+accepted model proposal converge on the same coordinator method; no family
+invents a third management grammar, configuration path, proposal policy, or
+hotload mechanism.
+
+| Verb | Common contract |
+|---|---|
+| `list` | Project every definition with its origin, desired enabledness, and current state — `disabled`, `active`, `unavailable` with its exact Problem, or `authorization-required` — without exposing credentials. |
+| `discover` | Inspect a query or source and return inert candidates with provenance. Discovery never installs, persists, enables, executes, or widens authority. |
+| `add` | Admit one exact definition through the adapter, persist it as a worker-origin definition, prepare it, and enable it atomically. A worker definition may shadow a same-alias service definition; a second worker definition for one alias is a 409 collision. |
+| `enable` | Prepare and publish one available definition; re-enabling an unavailable one retries its preparation. |
+| `disable` | Withdraw the effective capability while keeping the definition available and client-visible. |
+| `remove` | Disable and forget the Worker's own definition; a same-alias service definition becomes visible again, disabled. Service definitions are disable-only. |
+
+§functionality-adapter **An adapter owns protocol truth and nothing else.** It
+declares its family (the action segment and EXEC tag), its one namespace owner,
+the exact definition schema one `add` accepts, its service-contributed
+definitions with their default enabledness, inert discovery, admission of an
+authored definition, two-phase preparation of the enabled set, and teardown.
+Preparation returns the family's runtimes, its generated documents, one outcome
+per enabled alias, and a snapshot with `commit`/`abort`; the coordinator
+never tears down a previous snapshot behind the adapter — it commits after a
+successful publication, aborts after a failed one, and tears down only on
+deactivation. Protocol continuations (an OAuth completion, an input-required
+answer) remain adapter-registered actions beneath the common grammar. An
+adapter may declare `forget`: before the coordinator forgets a Worker-origin
+definition on `remove` it lets the adapter release what that definition
+installed or provisioned ({§skills-remove}); a failed release rejects the
+removal and changes nothing.
+
+§functionality-state **One durable value per Worker and family.** The
+coordinator stores `{ version: 1, definitions: { [alias]: { origin, enabled,
+definition? } } }` in `worker_module_state` under the adapter's namespace
+owner. A `service` alias persists only its enabledness; a `worker` alias
+persists its exact definition. Enabledness is durable desired state; active,
+unavailable, and authorization-required are the current preparation outcome.
+Inheritance by value is the table's own birth snapshot
+({§module-worker-inheritance}); service, user, project, and client configuration
+contribute available definitions and defaults but are never the live effective
+authority.
+
+§functionality-publication **One replacement publishes a family.** The
+coordinator prepares the enabled set, then replaces the family's state and
+runtimes — the family's manager runtime first, the adapter's capabilities after
+it — in one {§module-worker-capabilities} call, so admission, generated
+documentation, resources, effects, Turn 0, client status, and teardown derive
+from one committed snapshot. A failed replacement aborts the preparation and
+keeps the previous snapshot authoritative. Mutations serialize per Worker and
+family; shutdown — and any caller that must observe a boundary publication
+before acting, through `settleFunctionality` — settles every queued
+publication before closing the database.
+
+§functionality-documents **A family's generated documents travel with its
+snapshot.** Preparation may return documents addressed relative to the
+Worker's generated subtree ({§worker-generated-subtree}); the coordinator
+contributes them to the Worker's reference entries so they reconcile with the
+same `_plurnk` materialization as every other generated document. The model
+surface is silent until active (operator ruling, #333): a disabled or
+enabled-but-unavailable definition publishes no document and no Turn 0 row —
+the hot path carries only working capability, never "a thing you cannot do."
+An unavailable definition's exact Problem stays reachable on demand: the
+family's `list` verb returns it and invoking the alias is rejected with it.
+
+§functionality-model-projection **The model face is a generated executor
+family per Worker.** Every activated Worker publishes, for each registered
+family, one executor tagged with the family name whose registered targets are
+exactly the six verbs; its documents render through
+{§tools-resource-materialization} like every family, so the model learns the
+manager from `_plurnk/skills/plurnk/<family>.md` and never from hand-written
+teaching. `list` and `discover` are `read` effects and run ungated; `add`,
+`enable`, `disable`, and `remove` are `host` effects and propose through
+the ordinary Exec proposal lifecycle. A verb's JSON outcome streams into the
+family's output entry. `ExecArgs` carries no Worker identity, which is why
+the manager is published per Worker rather than once.
+
+§functionality-model-mutation **An accepted mutation publishes at its turn
+boundary.** The verb runs inside the turn that raised it, which holds the
+workspace; the coordinator persists desired state and prepares immediately —
+so the result reports `active`, `unavailable`, or `authorization-required`
+— and a failed preparation publishes an enabled-but-unavailable outcome rather
+than rejecting. Publication queues behind that turn in the family's serialized
+lane and settles before the Worker's next operation or packet. An explicit
+client action instead publishes now, rejects a failed preparation, and fails
+409 while the workspace is held ({§module-worker-quiescence}). Rejecting a
+proposal prepares, persists, and publishes nothing.
+
+### §methods ApplicationPort function set
+
+`ApplicationPort` is the contracts-owned interface implemented by `Daemon` and
+consumed by every exterior adapter ({§application-port}). Its function names are
+transport-neutral library calls, not public wire names; this table specifies
+Core's behavior behind them.
 
 | Area                                              | Function | Core contract |
 |---------------------------------------------------|----------|---------------|
@@ -2251,15 +2715,16 @@ Its function names are transport-neutral library calls, not public wire names.
 | §methods-proposal-resolve Proposals               | `resolveProposal(logEntryId, resolution)` | Validates and delivers one accept, reject, or cancel decision to the engine. An unknown or already-resolved id fails; the client protocol owns how the decision arrived. |
 | §client-interaction-list Client interactions      | `pendingClientInteractions(workspaceId)` | Intersects durable interaction rows with their live operation waiters and returns the contracts-owned projection; a row alone is not a resumable interaction. |
 | §methods-client-interaction-resolve Client interactions | `resolveClientInteraction(interactionId, resolution)` | Validates and delivers one resolved payload or cancellation. Unknown, ownerless, and already-resolved identities fail before affecting an operation. |
-| §methods-loop-run Loops                           | `runLoop({ workspaceId, workerId, prompt, maxTurns?, flags?, openPaths?, alias?, model?, childAlias?, childModel? })` | Validates a model worker and provider policy, persists it with the effective turn ceiling, then returns an immediate status-100 acknowledgement with `loopId` and `action`. The exact terminal result arrives only through `loop/terminated`; parking and resuming do not replace the loop. |
-| §methods-loop-cancel Loops                        | `cancelDrain(workerId, reason?)` | Begins durable structured cancellation of the worker tree and reaps its process-local scopes. The boolean reports whether process-local work existed when called; queued or parked durable work is still terminalized when it is `false`. |
-| §methods-op-mirror Client dispatch                | `dispatchClientAction({ workspaceId, workerId, statements })` | Dispatches already-parsed grammar statements as one client action and one journal segment. Every statement is an ordered turn, and every committed `log/entry` is emitted before the action promise resolves; a proposal may keep that promise and segment open until resolution. Core exposes no per-op method family. |
-| Client observation                                | `look({ workspaceId, workerId, statement })` | Runs an already-parsed READ through the full resolver without a log row. A non-READ statement is rejected ({§op-look}). |
+| §methods-loop-run Loops                           | `runLoop({ workspaceId, workerId, prompt, source?, maxTurns?, flags?, openPaths?, selector?, childSelector? })` | Validates a model worker and provider policy, persists it with the effective turn ceiling, then returns an immediate status-100 acknowledgement with `loopId` and `action`. A trusted adapter may identify the prompt's causal actor with one canonical `source`; ordinary clients cannot author it through their protocol surface. The exact terminal result arrives only through `loop/terminated`; parking and resuming do not replace the loop. |
+| §methods-loop-cancel Loops                        | `cancelDrain(workerId, reason?)`; `cancelWorker({ workspaceId, workerId, reason? })` | `cancelDrain` begins durable structured cancellation and reports whether process-local work existed when called; queued or parked durable work is still terminalized when it is `false`. The ownership-bounded `cancelWorker` awaits that same tree cancellation and stream reap, so an exterior protocol can project the settled durable result without polling or fabricating state. |
+| §methods-op-mirror Client dispatch                | `dispatchClientAction({ workspaceId, workerId, functionalityWorkerId, statements })` | Dispatches already-parsed grammar statements as one client action in one administrative loop in the client worker, executing in the attached Worker's Functionality ({§actor-boundary-attached-functionality}). Every statement is an ordered client/operation turn, and every committed `log/entry` is emitted before the action promise resolves; a proposal may keep its turn, loop, and action promise open until resolution. Core exposes no per-op method family. |
+| Client observation                                | `look({ workspaceId, workerId, functionalityWorkerId, statement })` | Runs an already-parsed READ through the full resolver in the attached Worker's Functionality without a log row. A non-READ statement is rejected ({§op-look}). |
 | §methods-log-read Reads                           | `readLog({ workspaceId, workerId, ...coordinate })` | Ownership-checks the worker, then reads by ids, recency, or the complete `loopSeq`/`turnSeq`/`sequence` display coordinate. `limit` defaults to 100 and is capped at 1000. |
 | §methods-entry-read Reads                         | `readEntry({ workspaceId, workerId, target, channel?, offset? })` | Resolves the selector from that worker's perspective and returns {§entry-read-result}, either complete or as one channel suffix, without creating action evidence. |
 | Providers                                         | `listProviders()` | Lists configured aliases with provider/model identity, active state, and the effective provider-derived `inputCapacity` when known. |
+| Model catalog                                     | `listModels(query)` | Returns one validated bounded {§model-catalog-wire} page under {§model-catalog}; performs no provider request or selection. |
 | Client capabilities                               | `listClientDisplayCapabilities()` | Composes sorted scheme declarations ({§manifest-client-display}) followed by sorted MIME declarations ({§mimetype-client-display}) into the validated shared wire ({§client-display-capabilities}). The internal `exec` operation handler is excluded; its addressable runtime-tag scheme faces remain included. |
-| §methods-workspace-create Workspace lifecycle     | `createWorkspace({ name?, projectRoot?, settings?, constraints? })` | Validates `settings` through {§operator-config-workspace-settings}, creates the world and its client envelope, materializes current docs and constraints, starts derivation warming, and emits global `workspace/created`. `projectRoot` is established here or the workspace remains headless. |
+| §methods-workspace-create Workspace lifecycle     | `createWorkspace({ name?, projectRoot?, settings?, constraints? })` | Validates `settings` through {§operator-config-workspace-settings}, creates the world and its client envelope, applies constraints, and emits global `workspace/created`. Creation and attachment are passive: neither starts derivation nor activates worker Functionality. `projectRoot` is established here or the workspace remains headless. |
 | §methods-workspace-attach Workspace lifecycle     | `attachWorkspace({ workspaceId, workerId?, workerName? })` | Validates ownership and returns a client envelope for an existing world. It does not retain caller or transport binding state in core. |
 | §methods-model-worker Workspace lifecycle         | `ensureModelWorker(workspaceId)` | Returns the workspace's stable default model worker, creating it on first use. A durable default-conversation role identifies it independently of worker name and root creation order. Repeated and concurrent calls return the same root; fresh conversations and forks do not replace it. |
 | §methods-conversation-worker Workspace lifecycle  | `createConversationWorker({ workspaceId, name? })` | Creates a distinct model-origin root worker with empty private history: a fresh conversation over the same world, not a fork or the stable default. |
@@ -2267,8 +2732,11 @@ Its function names are transport-neutral library calls, not public wire names.
 | §methods-workspace-rename Workspace metadata      | `renameWorkspace(workspaceId, name)` | Changes only the world's unique mutable name; workers, log, and membership remain intact. |
 | Workspace metadata                                | `constrain(...)`, `unconstrain(...)`, `listConstraints(...)`, `listMembers(...)` | Owns the membership overlay and returns its resolved effects; clients do not reimplement constraint semantics. |
 | §methods-workspace-prompts Workspace metadata     | `listPrompts(workspaceId, limit?)` | Returns nonempty loop-seed prompts from the workspace's model-origin root conversations, newest-first. The positive limit defaults to 100; spawned and forked child prompts are excluded. |
-| Workspace metadata                                | `listWorkspaces()`, `listWorkers(...)`, `workspaceDerivationStatus(...)` | Reads current workspace topology and derivation progress. |
-| Extension actions | `listModuleActions()`, `invokeModuleAction(name, params, context)` | Lists setup-registered `{ name, scope }` descriptors in sorted order. Invocation requires a context matching the registered scope; missing names, forged scope, and missing workspace identity fail before the owner runs. Handler values remain opaque to core. |
+| Workspace metadata                                | `listWorkspaces()`, `workspaceDerivationStatus(...)` | Reads current workspace identity and derivation progress. |
+| §methods-worker-read Worker topology              | `readWorker({ workspaceId, identity })` | Ownership-bounds an exact id-or-name lookup and returns one durable Worker projection or `null` under {§application-worker-observation}. Supplying both identities or neither is invalid. |
+| §methods-worker-list Worker topology              | `listWorkers(workspaceId, query?)` | Returns the workspace's durable Worker projections under {§application-worker-observation}. The origin filter is exact; an explicitly present `parentWorkerId` filters roots (`null`) or one immediate parent (id), while omission returns every lineage position. |
+| §methods-worker-loops Loop lifecycle              | `listWorkerLoops({ workspaceId, workerId })` | Ownership-checks the Worker and returns its Loops in sequence order under {§application-loop-observation}, including the validated exact terminal result when one exists. It performs no scheduling or event replay. |
+| Extension actions | `listModuleActions()`, `invokeModuleAction(name, params, context)` | Lists setup-registered `{ name, scope, inputSchema, outputSchema }` descriptors in sorted order. Invocation requires a context matching the registered scope; missing names, forged scope, and missing workspace identity fail before the owner runs. Handler values remain opaque to core. |
 
 §methods-loop-run-fold-consistency **A folded prompt cannot silently reconfigure
 its loop.** When `runLoop` targets an active or 202-parked loop, core appends the
@@ -2306,8 +2774,8 @@ workspace lifecycle calls return exactly the workspace and selected client actor
 carry no conversation-worker or action-loop binding. Core retains no connection,
 thread, or current-workspace mapping. A module may replace its own binding with a
 later create or attach result without requiring a new transport; it resolves the
-conversation worker separately, while each client action allocates its own journal
-segment under {§connection-lifecycle}.
+conversation worker separately, while each client action allocates its own
+administrative loop under {§connection-lifecycle}.
 
 §methods-worker-name-reserved **Client worker-name admission.** Attach,
 fresh-conversation, and fork apply {§worker-name-minting} before lookup or
@@ -2315,24 +2783,118 @@ creation. A client therefore cannot forge or resume an internal worker, insert
 a non-mintable spelling, or make the client registry diverge from model worker
 control.
 
-§methods-loop-run-model **Per-loop model selection.** Optional `model`
-(client-resolved `<provider>/<model>`, wins) or `alias` (a declared
-`PLURNK_MODEL_<alias>`) overrides the boot default for a newly created loop.
-The fully resolved provider identity is persisted on that loop and remains
-immutable through turns, parks, wakes, and restart. Injecting into an existing
-loop with a conflicting selection fails before work is accepted. Provider
-instances are cached; no resume path substitutes a boot default for missing or
-malformed durable selection.
+§worker-settings **The worker carries its own behavioral rules.** The
+workspace is the world — how things are; each worker is an actor inside it,
+carrying the rules its loops obey. Those rules live in one JSON bag
+(`workers.settings`), declared by the client at worker creation and mutable
+between loops through `readWorkerSettings`/`setWorkerSettings`; the bag is
+validated at the client-input boundary against a closed known-key set, and
+unknown keys never persist. A fork begins with the default empty bag — no
+inherited rules, no live link. Readers are permissive: malformed persisted
+JSON yields the default rules, never a read failure. There is no servicewide
+or workspace ceiling on a worker's own rules; each client decides for its own
+workers.
+
+§question-tool **The native request-user-input tool.** Core registers one
+in-process `question` runtime at boot. Its body is the MCP2 2026-07-28
+form-elicitation shape verbatim — `{ message, requestedSchema }` — and its
+`results` channel carries the standard `ElicitResult`
+(`{ action: "accept", content }` or `{ action: "cancel" }`); nothing bespoke
+crosses the wire. The executor maps the body onto the contracts-owned
+`ClientInteractionRequest` (toolName `question`) and awaits the shared
+client-interaction lifecycle — durable pause, reconnect discovery,
+cancellation, and the answer-as-resolution all come from
+{§client-interactions}; there is no loopback MCP and no proposal masquerade.
+Effect `read`: the tool observes the human's answer and is never
+proposal-gated. Admission is per-worker under {§worker-settings}: the tool
+exists for a worker only when that worker's `requestUserInput` rule is set.
+
+§worker-tool-admission **Per-worker tool admission.** A runtime may be
+admitted per worker through the reserved tool tree's visibility rule: the
+find/read faces of the worker scheme drop a tool doc for an asking worker
+whose own rules don't admit it, before matching and rendering, so counts,
+weights, and the catalog text all agree — the tool does not exist for that
+worker's FIND. Dispatch enforces the same boundary with an explicit
+not-available outcome. Admission reads the worker's behavioral rules
+({§worker-settings}) at the operation boundary, never at registration.
+
+§model-catalog **Model discovery is a bounded local projection, not provider
+activity.** Core composes the release-pinned Models.dev snapshot with
+provider-owned `{§model-catalog-readiness}`. The default query includes only
+providers configured enough to attempt; `availability: "all"` includes every
+catalog model with structured missing-configuration causes. Provider and text
+filters apply before deterministic selector ordering and offset/limit paging;
+the default page is 50 and the schema caps it at 100. Discovery never probes,
+authenticates, invokes, or selects a model, and catalog data never enters model
+packets or state snapshots.
+
+§worker-model-selection **Worker-owned model selection.** Every model worker
+owns one durable model, persisted as a nullable `model_routes` foreign key.
+The root conversation worker is seeded once — from an explicit selection, else
+the daemon default — and never re-seeded from a later default change. A
+deliberately modelless daemon leaves the worker unset and rejects model work
+until an explicit selection. Starting a loop snapshots the worker's resolved
+model onto the loop; inject, park, wake, retry, reconnect, and restart
+continue from the loop snapshot and never re-resolve through the alias
+cascade. A WORK/FORK child copies the spawning loop's effective spawn model
+(spawn override ?? model) onto the new worker by value at creation; it retains
+no live link and begins with no override, so a later parent change affects
+only that worker's future loops and descendants. Client operation actors and
+Plurnk-owned bookkeeping workers run no model loops and own no model
+selection. An explicit selection or spawn-override change while the worker
+holds a live or parked loop is a precise `409 worker-loop-active`, never a
+silent retroactive switch of the immutable loop snapshot; select after
+concluding or cancelling the loop.
+
+A client-created branch copies the source worker's durable model, spawn
+override, and reasoning policy by value alongside its history. It retains no
+live policy link to the source worker.
+
+§worker-reasoning-policy **Reasoning is a durable worker policy.** Each selected
+worker model has exactly one member of the shared `{§reasoning-policy-wire}`;
+a modelless worker has none. A declared alias's scoped environment value—or the
+global provider value for an exact route—seeds the policy only when the worker
+first receives its model. Model identity and reasoning
+policy are persisted atomically, while visibility of returned reasoning and
+token ceilings remain separate concerns. An explicit policy change validates
+the exact policy against both the worker model and its optional spawn model and
+is refused while the worker owns a live or parked loop. Client inspection
+returns the supported-policy intersection of those two routes. Inspection or
+mutation materializes the daemon-default model and policy onto an uninitialized
+model worker before answering; a deliberately modelless daemon remains unset.
+
+Starting a loop snapshots the worker's policy beside its model. Restart, retry,
+park, wake, and injection retain that immutable snapshot. WORK, FORK, and BARE
+inherit the spawning loop's policy by value; no descendant consults a later
+environment or parent-worker change. Unsupported policies fail with a precise
+provider-boundary problem rather than being silently weakened or translated.
+
+§methods-loop-run-model **Per-loop model selection.** `runLoop` accepts one
+optional `selector`: either a declared alias or an exact `<provider>/<model>`
+route. An exact route stores no fabricated alias and receives no alias-scoped
+configuration. An explicit selection persists onto the
+addressed worker before the loop snapshots it; an omitted selector is not a
+selection and continues the worker's durable model
+({§worker-model-selection}). The fully resolved provider identity and reasoning
+policy are persisted on the loop and remain immutable through turns, parks,
+wakes, and restart ({§worker-reasoning-policy}).
+Injecting into an existing loop with a conflicting explicit selection fails
+before work is accepted. Provider instances are cached; no resume path
+substitutes a boot default for missing or malformed durable selection.
 
 §methods-loop-run-child-provider **Child-provider selection is one durable
-subcall policy.** Optional `childModel` (client-resolved `<provider>/<model>`, wins) or
-`childAlias` selects the provider for every WORK/FORK descendant and BARE inference; omitted uses
-`PLURNK_MODEL_CHILD`, while explicit `childAlias: null` means inherit. Core
-persists the resolved policy on each loop. A child runs on that provider and
-carries the same policy deeper; inherit uses the spawning loop's provider and
-remains inherit. BARE consumes the selection without spawning a child. Packet admission is unchanged: a smaller WORK is valid when
-its packet fits, and an oversized inherited FORK terminates through the ordinary
-child-loop result without preflight assembly or provider fallback.
+subcall policy.** Optional `childSelector` uses the same alias-or-exact-route
+vocabulary for every WORK/FORK descendant and BARE inference; omitted uses
+`PLURNK_MODEL_CHILD`, while explicit `childSelector: null` means inherit. An
+explicit override persists onto the addressed worker before the loop
+snapshots it; an omitted selector continues the worker's durable override
+({§worker-model-selection}). Core persists the resolved policy on each loop. A
+child runs on the spawning loop's effective spawn model and carries the same
+policy deeper; inherit uses the spawning loop's provider and remains inherit.
+BARE consumes the selection without spawning a child. Packet admission is
+unchanged: a smaller WORK is valid when its packet fits, and an oversized
+inherited FORK terminates through the ordinary child-loop result without
+preflight assembly or provider fallback.
 
 §methods-log-coordinate **Log coordinate.** Every `LogEntry` returned by
 `readLog` or emitted through `log/entry` carries `loop_seq` and `turn_seq`
@@ -2344,6 +2906,13 @@ preserve causal `source` and parse the row's JSON `attrs` into structured data;
 they also project the row's complete sorted `tags` classification. Client
 interfaces do not reconstruct these fields from operation or origin.
 
+§methods-readable-reasoning **Readable provider reasoning remains derived
+provider evidence.** On the model SEND row only, `readLog` and `log/entry`
+project a nonempty admitted `packet.assistant.reasoning` as the optional
+`reasoning` field. The durable packet remains the sole stored representation;
+core does not copy readable reasoning into log attributes or bodies. A turn
+without readable reasoning omits the field.
+
 §op-look **LOOK ownership.** A client-interface module owns the public LOOK
 spelling and grammar parsing. It rewrites a valid LOOK statement to READ and
 hands the AST to core's `look`; core owns the full resolver and the no-log
@@ -2365,6 +2934,7 @@ active lifecycle behind. LOOK text anchors resolve through the same
 | §notifications-stream-event-on-channel-change `stream/event` | `{ entryId, workerId, target, channel, state, contentLength, mimetype?, loop_seq?, turn_seq?, sequence? }` | Channel content grows or channel state transitions. `workerId` is the entry owner and read perspective; `target` is its canonical URI. The optional coordinate is copied from schemes whose addresses carry one. Core-managed channel writes include the current stored `mimetype`, which may change per call ({§channel-mimetype}); the generic plugin notification capability does not require it. It carries metadata, not content; consumers read bytes from the stated worker perspective. |
 | §notifications-stream-concluded `stream/concluded`           | `{ entryId, workerId, target, subscriptionId, scheme, result, summary, wakeAction, wakeLoopId?, loop_seq?, turn_seq?, sequence? }` | A subscription closes. `workerId` identifies the entry owner; `target` is its canonical URI. The optional coordinate is copied from schemes whose addresses carry one, so clients never parse it back out of `target`. Exact result truth is preserved; `wakeAction` records whether core resumed a parked loop, folded into an active loop, skipped an aborted/cancelled worker, or found no loop. |
 | §notifications-notice-event `notice/event`                   | `{ loopId, notice: Notice }` | A transient observation or progress notice occurs. It cannot alter durable history, scheduling, recovery, or model-visible failure truth. |
+| §notifications-reasoning-event `reasoning/event`             | `{ workerId, loopId, turnId, modelCallId, phase, delta? }` | A main emission call exposes readable reasoning. A nonempty stream is balanced start/content/end; only content carries a nonempty exact delta. It is transient presentation evidence, never a log row, Notice, packet field, or BARE/child channel. The settled provider response remains the durable authority. |
 
 §notifications-stream-event-failure-isolation The plugin-facing
 `NotifyCaps.streamEvent()` remains a synchronous advisory call while core
@@ -2386,11 +2956,13 @@ outward envelope that requires it and owns workspace fan-out.
 ### §connection-lifecycle Client action evidence
 
 A module client is an actor ({§machine-processes}). Its dispatched side effects
-write to its own client worker with `origin="client"`; one client action owns
-one journal segment, and its statements become ordered turns inside that
-segment. A proposal may hold the segment across an external interrupt/resume,
-but the segment records durable evidence rather than defining the public client
-lifecycle. Multiple client actors have distinct workers.
+write to its own client worker with `origin="client"` and execute in the
+Functionality of the Worker the client is attached to
+({§actor-boundary-attached-functionality}); one client action owns
+one administrative loop, and its statements become ordered operation turns
+inside that loop. A proposal may hold its turn and loop across an external
+interrupt/resume, but those records preserve durable evidence rather than
+defining the public client lifecycle. Multiple client actors have distinct workers.
 
 `runLoop` targets a separate model worker holding the conversation with
 `origin="model"`. Both workers share workspace state, while a packet renders
@@ -2415,14 +2987,14 @@ implementation status, and superseded alternatives belong in forge issues.
 
 `PacketBuilder.buildRequestPacket` owns the engine's default ordered section
 list. Trusted scheme plugins may transform that first-class list before it is
-rendered or measured; the grinder remains an engine-owned post-build rail.
+rendered or measured; {§overflow-turn} remains an engine-owned post-build rail.
 
 ```mermaid
 flowchart LR
     defaults[Engine section drafts] --> transforms[Trusted scheme transforms<br/>and boundary validation]
     transforms --> render[Render system and user slots]
     render --> measure[Budget substitution and<br/>core-owned measurement]
-    measure --> rail[Engine grinder and dispatch]
+    measure --> rail[Engine budget admission and dispatch]
 ```
 
 #### §packet-cache-monotone Default order and cache locality
@@ -2434,21 +3006,19 @@ Conditional absence never reorders the surviving default sections.
 |     1 | system | `definition`          | Framework definition; leads the most stable prefix. |
 |     2 | system | `system-policy`       | Operator policy; empty content is omitted on the wire. |
 |     3 | system | `project-policy`      | Project policy; empty content is omitted on the wire. |
-|     4 | system | `tools`               | Executable capability sheet for this loop. |
-|     5 | system | `optional-operations` | Present only when optional operations are enabled. |
-|     6 | system | `schemes`             | Active resource catalogue. |
-|     7 | system | `inject`              | Present only when operator notes are configured. |
-|     8 | user   | `log`                 | Append-mostly model-visible history. |
-|     9 | user   | `child-streams`       | Per-turn status; empty content is omitted. |
-|    10 | user   | `child-workers`       | Per-turn status; empty content is omitted. |
-|    11 | user   | `errors`              | Per-turn failure pointers; empty content is omitted. |
-|    12 | user   | `notices`             | Per-turn observations; empty content is omitted. |
-|    13 | user   | `git`                 | Per-turn workspace status; empty content is omitted. |
-|    14 | user   | `budget`              | Model-facing packet pressure; omitted when capacity is unknown. |
-|    15 | user   | `prompt`              | Current prompt-entry pointers. |
+|     4 | system | `schemes`             | Active resource catalogue. |
+|     5 | system | `inject`              | Present only when operator notes are configured. |
+|     6 | user   | `log`                 | Append-mostly model-visible history. |
+|     7 | user   | `child-streams`       | Per-turn status; empty content is omitted. |
+|     8 | user   | `child-workers`       | Per-turn status; empty content is omitted. |
+|     9 | user   | `errors`              | Per-turn failure pointers; empty content is omitted. |
+|    10 | user   | `notices`             | Per-turn observations; empty content is omitted. |
+|    11 | user   | `git`                 | Per-turn workspace status; empty content is omitted. |
+|    12 | user   | `budget`              | `Context Token Budget`; omitted when capacity is unknown. |
+|    13 | user   | `prompt`              | Current prompt-entry pointers. |
 
 The order favors prefix-cache locality where semantics permit: the definition
-and privileged policy lead loop-dependent capabilities, while the append-mostly
+and privileged policy lead the resource directory, while the append-mostly
 log leads the volatile user-status clump. It does **not** claim that every system byte is
 immutable or that the complete packet is globally monotone in volatility:
 capabilities, operator notes, and policies can change. Trust is a separate
@@ -2469,7 +3039,7 @@ sections. It receives no separate engine, database, actor, or request context.
 This is strictly a trusted in-process seam, admitted through the common plugin
 trust gate; an external client action cannot invoke it. Whole-list transformation is
 the fork-avoidance valve for alternate packet shapes ({§ecosystem}), while
-grinding and folding remain closed engine concerns.
+overflow recovery and folding remain closed engine concerns.
 
 ### §tokenomics Tokenomics: four facts, one curation ruler
 
@@ -2484,8 +3054,8 @@ time of measurement.
 | Provider usage and cost | Provider-reported input/output/cache/reasoning tokens and monetary evidence | After every physical request | Durable physical-request forensics under {§provider-usage}; never curation state or a preflight estimate. |
 
 - §tokenomics-weight-stored-at-write **Curation weight, stored at write.** `entry_channels.weight` weighs the complete channel content. `log_entries.weight` weighs the complete canonical `LogBody` content before coordinate and packet presentation; persistence `tx`/`rx` envelopes contribute nothing merely by existing, and proposal settlement recomputes the value when the canonical result changes. Bodyless rows therefore weigh zero. The stored number is a stable content-depth measurement, not a provider-token prediction.
-- §tokenomics-render-weight-budget **Packet curation budget.** The Curation headline measures the *assembled packet* after section transforms and readout substitution. Core measures minimum-width probes, monotonically expands fields that do not fit, then right-aligns final values into those widths; final substitution is length-invariant and displayed weight equals the stored request weight. A `SUM` of stored content weights measures a different artifact and cannot substitute for packet render weight.
-- §tokenomics-context-percent **Curation percent.** The headline carries packet weight as a percentage of its curation budget beside the absolutes. It reads the capacity already resolved by the provider; no extra provider call.
+- §tokenomics-render-weight-budget **Packet curation budget.** `tokensActiveTotal` measures the *complete assembled packet* after section transforms and readout substitution; it is not a sum of log-row `tokensActive` fields. Core measures minimum-width probes, monotonically expands fields that do not fit, then right-aligns final values into those widths; final substitution is length-invariant and the displayed total equals the stored request weight. `tokensActiveMax` is the provider-derived curation calibration. A `SUM` of stored content weights measures a different artifact and cannot substitute for packet render weight.
+- §tokenomics-context-percent **Curation percent.** `tokensActiveTotal` carries packet weight as a percentage of `tokensActiveMax`. It reads the capacity already resolved by the provider; no extra provider call.
 - §tokenomics-window-partition **One capacity derivation; no service-side token budget.** The provider owns model limits and the configured total output envelope. Its resolved `inputCapacity` is the numeric curation-budget calibration as well as the physical denominator exposed to clients. That reuse is policy, not a unit conversion: Core compares stable curation weight with it only to shape context, while provider request-shaped evidence alone admits or rejects I/O. `PLURNK_SERVICE_PROMPT_BUDGET`, `PLURNK_SERVICE_SAFETY`, and the additive reasoning/completion reserve knobs are retired; local and custom deployments tune context window, total output budget, optional reasoning subset, and prompt-projection percentage at their owning layers.
 - §tokenomics-prompt-projection-share **Prompt projection is stable packet policy.**
   `PLURNK_SERVICE_PROMPT_PROJECTION` is a required alias-scoped percentage in
@@ -2496,15 +3066,15 @@ time of measurement.
   one prompt's projection byte-stable as the worker log evolves.
 - §tokenomics-window-unpollable-deliberate **Unknown provider capacity stays unknown.** When the provider cannot derive `inputCapacity`, Core omits denominator-dependent curation telemetry and uses the ordinary bounded prompt projection. The provider still sends requests whose measurement or limits are estimates or unavailable: ambiguity defers to the upstream capacity oracle rather than becoming a local rejection.
 
-§tokenomics-client-gauge **Clients receive curation and physical occupancy as separate pairs.** `loop/terminated.usage` carries latest-turn `curationWeight`/`curationBudget` and latest-emission-call `contextTokens`/`contextCapacity`; each unknown fact is `null`. Both physical facts bind to that same call: a preflight rejection may report capacity while its absent physical request leaves `contextTokens=null`, never borrowed from an earlier call. Clients never divide provider-reported physical tokens by Core curation weight. `providers.list` exposes each instantiated alias's `inputCapacity`. A model switch replaces the latest-turn facts together; aggregate provider accounting remains cardinal monetary evidence, not a gauge input.
+§tokenomics-client-gauge **Clients receive curation and physical occupancy as separate pairs.** `loop/terminated.usage` carries latest packet-bearing model-turn `curationWeight`/`curationBudget` and latest-emission-call `contextTokens`/`contextCapacity`; each unknown fact is `null`. Packetless chronology cannot erase an assembled-request gauge. Both physical facts bind to that same call: a preflight rejection may report capacity while its absent physical request leaves `contextTokens=null`, never borrowed from an earlier call. Clients never divide provider-reported physical tokens by Core curation weight. `providers.list` exposes each instantiated alias's `inputCapacity`. A model switch replaces the latest-turn facts together; aggregate provider accounting remains cardinal monetary evidence, not a gauge input.
 
-- **Derivation is eager and exhaustive.** Workspace creation and searchable-resource changes start one coalesced warm. The first model turn joins that warm; later turns derive intervening changes before dispatch. No model operation observes partial graph or vector coverage. A semantic query ranks every eligible candidate in scope, so lexical overlap never gates vector recall. With no embedder, readable-content FTS is the explicit keyword fallback. Progress notices make the wait visible; latency is never hidden by partial semantics. {§derivation-exhaustive}
+- **Derivation is exhaustive and demand-led.** Explicit searchable-resource changes may start one coalesced warm. Passive creation and attachment do not. The first model turn starts or joins that warm; later turns derive intervening changes before dispatch. No model operation observes partial graph or vector coverage. A semantic query ranks every eligible candidate in scope, so lexical overlap never gates vector recall. With no embedder, readable-content FTS is the explicit keyword fallback. Progress notices make the wait visible; latency is never hidden by partial semantics. {§derivation-exhaustive}
 - §membership-binary-sniff **Binary truth beats the label; no entry dominates the corpus.** A tracked member whose HEAD bytes contain NUL enters {§membership-source-projection} as `application/octet-stream` **regardless of what extension-based detection claims**; byte-level evidence outranks a default label. Every eligible text is tiled losslessly to the embedder window and every tile is embedded before its derivation attaches; semantic ranking max-pools the best chunk per candidate.
 - §tokenomics-agnostic-ruler **One model-agnostic curation ruler.** The daemon runs workers on different models in one workspace concurrently, while catalog and log accounting are workspace-wide. `contentWeight = ceil(chars/2)` therefore gives one content one stable number without per-model workspace state or recount passes. It controls curation only; every provider call independently measures the complete request as well as it can.
-- §tokenomics-neutral-telemetry **Curation telemetry is state, with one pressure alarm.** The model-facing Curation section ordinarily has one line: budget, current packet weight and percentage, and free weight. When free weight is negative, exactly one second line directs the model to FOLD or KILL less-relevant log items. Per-entry weights remain on log rows where they describe OPEN cost and FOLD savings. Packet-level composition, rankings, and physical token speculation are absent.
+- §tokenomics-neutral-telemetry **Curation telemetry is state, not response allowance.** The model-facing `Context Token Budget` section contains exactly two fields on separate lines: `tokensActiveTotal: N (P%)` and `tokensActiveMax: M`. It never presents their difference as free response tokens. The protocol definition directly requires FOLD, KILL, or trimming of irrelevant log items to keep the next packet within the maximum. Per-entry weights remain on log rows where they describe OPEN cost and FOLD savings. Packet-level composition, rankings, and physical token speculation are absent.
 - §tokenomics-content-hash-identity **Content identity, not per-tokenizer counts.** Static channel writes stamp `content_hash` (SHA-256) as stable content identity. `weight` is stored beside that content and is never keyed or recomputed by model.
-- §tokenomics-provider-usage **Provider accounting is physical-request evidence, not curation state.** Every issued physical request has one durable pre-I/O `provider_requests` identity and settles once as response or error. Each record preserves conventional {§provider-usage} quantities and required {§provider-cost} evidence; an unreported quantity remains absent, including on response-less failures, and is never replaced by zero. `model_calls` own logical response/failure evidence, `turn_attempts` specialize emission admission, and `provider_requests` are the sole durable accounting representation. Emissions, BARE calls, rejected responses, retries, failovers, and errors therefore remain cardinal and ordered. Turn, loop, worker, workspace, digest, and protocol accounting are derived from those records through the shared {§provider-accounting} projection; only emission calls contribute the latest-packet context gauge. The baseline stores no floating-point money, denormalized totals, or rollup triggers. A documented direct charge becomes `charged`; otherwise the provider may compute an exact-decimal USD `estimated` amount from complete usage and the exact model's Models.dev rates; insufficient evidence becomes `unknown`. Derived `costUsd` is an exact decimal string only when every request is expressible in USD and is `null` otherwise. This is operational request accounting, not invoice reconciliation. Output and reasoning are quantities the model cannot FOLD, so they never alter the model-facing Budget ledger.
-- §tokenomics-negative-pressure **Negative curation pressure is honest and nonterminal.** The readout describes the packet the model actually receives: weight and percent may exceed the curation budget, and free weight equals `budget - weight` without flooring. Crossing the budget records {§grinder-overflow-problem}, then the grinder ({§grinder}) folds only the newest boundary. Remaining curation debt never decides physical admission, creates a strike, or establishes a one-turn quota.
+- §tokenomics-provider-usage **Provider accounting is physical-request evidence, not curation state.** Every issued physical request has one durable pre-I/O `provider_requests` identity and settles once as response or error. Each record preserves conventional {§provider-usage} quantities and required {§provider-cost} evidence; an unreported quantity remains absent, including on response-less failures, and is never replaced by zero. `model_calls` own logical response/failure evidence, `turn_attempts` specialize emission admission, and `provider_requests` are the sole durable accounting representation. Emissions, BARE calls, rejected responses, retries, failovers, and errors therefore remain cardinal and ordered. Turn, loop, worker, workspace, digest, and protocol accounting are derived from those records through the shared {§provider-accounting} projection; only emission calls contribute the latest-packet context gauge. The baseline stores no floating-point money, denormalized totals, or rollup triggers. A documented direct charge becomes `charged`; otherwise the provider may compute an exact-decimal USD `estimated` amount from complete usage and the exact model's Models.dev rates; insufficient evidence becomes `unknown`. Derived `costUsd` sums every USD-expressible request and is `null` only when no request is expressible; a response-less failure or an uncataloged model is skipped, never allowed to erase the expressible evidence. The derived aggregate usage sums every reported quantity the same way. This is operational request accounting, not invoice reconciliation. Output and reasoning are quantities the model cannot FOLD, so they never alter the model-facing Budget ledger.
+- §tokenomics-negative-pressure **Negative curation pressure is honest but never submitted.** The provisional readout may report `tokensActiveTotal` and its percentage above `tokensActiveMax`. Crossing the maximum diverts that would-be model turn into {§overflow-turn}; no over-ceiling packet reaches `provider.generate`. Automatic recovery does not create a strike or consume a model-turn allowance.
 
 ### §membership Workspace identity, membership, disk co-location
 
@@ -2537,7 +3107,7 @@ flowchart LR
 | Internal entries   | Workspace or worker entries are canonical store state. Writing one never implies a project-file write.                                      |
 | Authority          | Service flags set the membership ceiling; workspace constraints narrow it; client or loop auto resolves proposals. `origin` is attribution. |
 
-§web-search-retrieval **Web search and retrieval are one first-class composition.** A search runtime enumerates a configured maximum of candidate URLs and hands each to the engine as a `content: null` `entry()` request ({§exec-entry-sink}): the guarded `WebFetcher` sink fetches candidates in parallel, off the write-serialization chain, and materializes successful bodies as ordinary HTTP entries. SearXNG owns membership and rank; Plurnk does not rerank or classify sources. Every candidate whose `entry()` call rejects, regardless of failure reason, is mechanically omitted from the model-facing result directory; survivors retain upstream order. The compact directory carries `title/url/snippet/publishedDate/materialized`; it locates readable resources and is not a substitute for their contents. Without an entry sink the executor cannot test materialization and omits the verdict.
+§web-search-retrieval **Web discovery is an ordinary MCP concern; retrieval is a first-class composition.** PLURNK owns no search runtime: a search-capable MCP server (e.g. Brave Search) participates through the ordinary MCP contract — admission, read-effect classification, tool documentation, and packet projection are identical to every other MCP tool ({§mcp-tool-presentation}). An executor that wants to materialize discovered pages uses the generic `content: null` `entry()` request ({§exec-entry-sink}): the guarded `WebFetcher` sink fetches candidates in parallel, off the write-serialization chain, and materializes successful bodies as ordinary HTTP entries. Every candidate whose `entry()` call rejects, regardless of failure reason, is mechanically omitted from the model-facing result directory; survivors retain upstream order. Without an entry sink the executor cannot test materialization and omits the verdict.
 
 Search prefetch and direct HTTP READ materialize the same resource contract:
 protocol + canonical authority (including a non-default port) + path + serialized
@@ -2547,13 +3117,10 @@ media type, and projection identity remain explicit auxiliary evidence. A
 normal
 `## READ0 (https://host/path?query)` therefore publishes only the sanitized body
 under that exact URL—never raw HTML, response headers, or a channel-selection
-lesson. FIND and embeddings consume the same stored readable
-projection and never re-fetch each match. Because the search family is in
-`PLURNK_SERVICE_EXEC_HOLD`, the cycle holds until acquisition concludes
-({§exec-hold-until-concluded}), so the next packet contains final
-materialization verdicts and folded ambient rows for every acquired page.
+lesson. FIND and embeddings consume the addressed stored channel representation
+and never re-fetch a match.
 
-§search-gate Coverage protects the composition at distinct seams: HTTP unit tests pin fragmentless-body publication and explicit auxiliary selection; integration tests pin search→materialize→FIND and persistence/publication separation. Model web demos run the live composition end to end — real SearXNG, real pages; stubbed acquisition is confined to unit and integration seams and never appears in a demo. A live positive-control demo requires a materialized HTTPS body and a substantive answer from a real sanitized page. Live discovery demos remain diagnostic and may expose model judgment failures without weakening these assertions. **The search gates** are rail-family accounting — in-memory per-loop state cleaned at the same seam as strikes, restart-drop accepted (a post-restart duplicate re-fetches; the TTL makes it cheap): an IDENTICAL duplicate (same runtime + query in one loop) **strikes and serves** — status 409 (the strike rail counts the turn failure) carrying the prior ranked digest re-read live from the original exec entry, no re-fetch, no provenance prose; the per-turn CAP (`PLURNK_SERVICE_SEARCH_MAX_PER_TURN`) is flood control — 429 with a legible steer, nothing served.
+§web-retrieval-live Coverage protects the composition at distinct seams: HTTP unit tests pin fragmentless-body publication and explicit auxiliary selection; integration tests pin materialize→FIND and persistence/publication separation. A live positive-control demo requires a materialized HTTPS body and a substantive answer from a real sanitized page; live discovery demos remain diagnostic and may expose model judgment failures without weakening these assertions.
 
 **Git is the substrate and the repository is the boundary:**
 
@@ -2564,27 +3131,22 @@ materialization verdicts and folded ambient rows for every acquired page.
   or nested independent repository is not discovered or managed by this
   workspace. When Git is absent there is no filesystem walk; `pick` is then the
   sole source.
-- §git-native-default **Core Git reads use native Git by default.** Membership
-  and status execute the installed Git binary.
+- §git-native-default **Core Git reads use native Git.** Membership and status
+  execute the installed Git binary. An absent or failed binary yields no
+  automatic Git membership or status; core has no alternate implementation or
+  fallback. An independently installed `isogit` executor remains an explicit,
+  model-invoked subset for shellless deployments, not an ambient Git backend.
 - §membership-git-hermetic Native Git runs with ambient `GIT_*` and
   global/system config scrubbed, so repository identity follows `project_root`,
   never the daemon's launch environment.
-- §git-isomorphic-opt-in `PLURNK_SERVICE_GIT_ISO=1` explicitly selects the
-  in-process isomorphic-git backend for a deployment that cannot spawn Git. The
-  alternative is never an automatic fallback: an absent native binary yields
-  no automatic Git membership or status, never an isomorphic retry; an
-  incompatible isomorphic repository surfaces its preserved upstream cause
-  and directs the operator back to the default. The isomorphic untracked scan
-  remains differential-gated against native
-  `ls-files --others --exclude-standard`.
-- §membership-edit-membership-gate **Membership-gated edits.** EDIT is bounded by membership exactly as READ is. An existing **member**'s baseline is its entry snapshot — the body channel the model READ, not a fresh disk read — so the diff is naive against the view the model saw, never empty (the write-side CAS, {§membership-edit-write-cas}, prevents the silent overwrite of out-of-band drift). An existing **non-member** is refused (403) *before* any read or write: the model never reads a file it can't see (no leak into the proposal) and never overwrites one (no wiping a gitignored `.env` it never added). A **new path** stays open — proposal→accept adds it to the manifest. Reaching past membership is `## EXEC0 [sh]`'s job, not the file scheme's.
+- §membership-edit-membership-gate **Membership-gated edits.** EDIT is bounded by membership exactly as READ is. An existing **member**'s baseline is its entry snapshot — the body channel the model READ, not a fresh disk read — so the diff is naive against the view the model saw, never empty (the write-side CAS, {§membership-edit-write-cas}, prevents the silent overwrite of out-of-band drift). An existing **non-member** is refused (403) *before* any read or write: the model never reads a file it can't see (no leak into the proposal) and never overwrites one (no wiping a gitignored `.env` it never added). A **new path** crosses the creation matrix in {§fs-write-surface}; proposal acceptance cannot bypass its scope, exclusion, or incorporation rules. Reaching past membership is `## EXEC0 [sh]`'s job, not the file scheme's.
 - §membership-create-parents **Parent-complete creation.** An accepted File creation—whether authored as EDIT or as a COPY/MOVE destination—recursively creates missing parent directories before writing and registering the new member.
 
 **The overlay — `pick | view | hide`, removed by `drop`.** A `workspace_constraints` table is the client's supersede over Git. Resolved membership is `(project repository files ∪ pick) − hide`, with `view` enforced at the edit gate.
 
-- §membership-auto-add **Auto-add** — the project repository's membership is its tracked `ls-files` plus untracked-but-not-ignored files (`git ls-files --others --exclude-standard`), with `git` origin. A model-created file is a member the moment it exists—no `git add`—while `.gitignore` still filters it.
-- §membership-overlay-pick **`pick`** — admit an untracked file git misses: a targeted client-dictated `node:fs` glob scan over untracked matches (files only), 'constraint' origin, reconciled like git members. Enumerated, so the manifest stays exhaustive. git-absent, `pick` is the *sole* membership source.
-- §membership-overlay-hide **`hide`** — exclude a tracked file: resolution drops matches (`node:path.matchesGlob`) and reconciles so the entry set *equals* the member set. The lever to exclude a committed-but-sensitive tracked file; `entries.membership_origin` keeps reconciliation off model-created members.
+- §membership-auto-add **Auto-add** — the project repository's ambient membership is its tracked `ls-files` plus untracked-but-not-ignored files (`git ls-files --others --exclude-standard`), with `git` origin. An accepted creation selected for Git incorporation is explicitly staged; failure falls back to an exact generated pick, never an orphan ({§file-create-no-orphans}).
+- §membership-overlay-pick **`pick`** — admit a file Git misses through a targeted constraint scan (files only), with `constraint` origin. `source: "explicit"` records operator/client policy; `source: "create"` is the exact durable record of an accepted creation. Only explicit picks override active Git ignore. In a Git-absent root, picks are the sole file-membership source.
+- §membership-overlay-hide **`hide`** — exclude a tracked or picked file: resolution drops matches (`node:path.matchesGlob`) and reconciles so the entry set *equals* the member set. The lever to exclude a committed-but-sensitive tracked file; exclusions mask generated creation picks without deleting their provenance ({§fs-create-masked}).
 - §membership-overlay-view **`view`** — keep a member readable but refuse `File.edit`, 403'd at the membership check before any diff. (Admitting an untracked file as `view` rides on `pick`'s scan.)
 - §membership-resolved-effects **Resolved effect is a read, not a re-derivation.** `workspace.members` surfaces each candidate's resolved effect — `(ls-files ∪ pick) − hide` tagged `member` / `view`, plus the `hide`-excluded `hidden` set — so a client signs file visibility (member / read-only / ignored) without reimplementing the overlay glob-matching. The daemon owns git + the globs; the per-file effect is its to resolve, the client's to render.
 
@@ -2601,13 +3163,14 @@ identity, and terminal disposition without exposing raw bytes or a base64 lane.
 | Binary with readable projection    | Derived Unicode as `text/markdown`                   | READ uses the projection; source-aware EDIT remains 415.                         |
 | Binary without projection/over cap | Empty marker under the source binary mimetype        | READ and EDIT return 415; private metadata distinguishes unavailable from limit. |
 
-§derivation-dedup-parallel **The index dedups then parallelizes.** The derivation identity hashes the exact READ body, mimetype, reader behavior, embedding configuration, and applicable search exclusion. A resource attaches the immutable artifact only after it is complete; identical entry and log bodies therefore share one FTS row, one symbol graph, and one vector set without copying. Distinct artifacts run with bounded producer concurrency (`PLURNK_SERVICE_DERIVE_CONCURRENCY`). Pending artifacts sort by readable content length before entering that pool, so small resources start first while every outlier still derives fully. Unset uses a host-relative square-root fan-out; a positive integer is an exact operator budget and `-1` claims every core. Token-count and embedding batches retain only a pool-sized promise window; graph persistence writes at most `PLURNK_SERVICE_DERIVE_STORE_BATCH` definitions or references per SQLite statement. Every resource completed by a successful pass attaches a terminal classified artifact, identically at concurrency 1 and N. Multi-item warming reports aggregate milestones and heartbeat notices according to `PLURNK_SERVICE_DERIVE_PROGRESS_STEPS` and `PLURNK_SERVICE_DERIVE_PROGRESS_HEARTBEAT_MS`.
+§derivation-dedup-parallel **The index dedups then parallelizes.** The derivation identity hashes the exact READ channel representation, mimetype, reader behavior, embedding configuration, and applicable search exclusion. A channel or log projection attaches the immutable artifact only after it is complete; identical projections therefore share one FTS row, one symbol graph, and one vector set without copying. Distinct artifacts run with bounded producer concurrency (`PLURNK_SERVICE_DERIVE_CONCURRENCY`). Pending artifacts sort by readable content length before entering that pool, so small resources start first while every outlier still derives fully. Unset uses a host-relative square-root fan-out; a positive integer is an exact operator budget and `-1` claims every core. Token-count and embedding batches retain only a pool-sized promise window; graph persistence writes at most `PLURNK_SERVICE_DERIVE_STORE_BATCH` definitions or references per SQLite statement. Every representation completed by a successful pass attaches a terminal classified artifact, identically at concurrency 1 and N. Multi-item warming reports aggregate milestones and heartbeat notices according to `PLURNK_SERVICE_DERIVE_PROGRESS_STEPS` and `PLURNK_SERVICE_DERIVE_PROGRESS_HEARTBEAT_MS`.
 
-The artifact also retains a positive `{§mimetype-parse-issues}` count when the
-exact parsed body reported one. It remains advisory alongside a normally
-completed semantic disposition; zero and unavailable evidence persist as
-absence. Catalog projection attaches it only to that parsed body channel, never
-to sibling channels whose content the artifact does not describe.
+The artifact also retains a positive `{§mimetype-parse-issues}` count and the
+full normalized `{§mimetype-summary}` when the exact parsed channel reported
+either. Both remain advisory alongside a normally completed semantic
+disposition; zero, empty, and unavailable evidence persist as absence. Catalog
+projection attaches either only to that channel, never to a sibling whose
+content the artifact does not describe.
 
 Every completed artifact records one terminal disposition: `vector`, `lexical`
 (only no embedder or an operator size ceiling), `excluded` (the configured
@@ -2621,21 +3184,21 @@ every non-vector attachment with its disposition and reason. Successful
 optional projection degradations continue indexing and surface their framework
 Notice once per identical observation in a maintenance pass.
 
-§semantic-embed-dedup **Identical content embeds once.** The metaproject's repeated `tokenizer.json` bodies - and any log result exposing the same exact READ body - attach one content-addressed derivation artifact. Graph, FTS, and chunk vectors exist once; addresses join through the artifact hash. One pass-wide semantic plan binds the selected chunk counter to this identity: the embedder's own counter is covered by model-space identity, while a separately resolved fallback counter contributes its `tokenizerId` and exactness. Model, vocabulary, vector-wire encoding ({§mimetype-embedding-wire}), or configuration changes therefore produce a different identity, so incompatible vector spaces, encodings, or chunk boundaries never share.
+§semantic-embed-dedup **Identical content embeds once.** The metaproject's repeated `tokenizer.json` channels - and any log result exposing the same exact readable text - attach one content-addressed derivation artifact. Graph, FTS, and chunk vectors exist once; addresses join through the artifact hash. One pass-wide semantic plan binds the selected chunk counter to this identity: the embedder's own counter is covered by model-space identity, while a separately resolved fallback counter contributes its `tokenizerId` and exactness. Model, vocabulary, vector-wire encoding ({§mimetype-embedding-wire}), or configuration changes therefore produce a different identity, so incompatible vector spaces, encodings, or chunk boundaries never share.
 
 Lossless chunk admission requires either the embedder's own counter or an exact fallback tokenizer. An empirical estimate never proves that content fits the declared token window. When pending readable content would require vectors and only an estimate is available, maintenance surfaces its degradation Notice and fails before embedding or attaching a derivation; no/disabled embedding and the established empty, binary, excluded, and maximum-size dispositions remain non-vector outcomes.
 
-§semantic-max-embed-size **Embedding has an optional size posture.** `PLURNK_SERVICE_MAX_EMBED_SIZE` is an operator-set maximum UTF-8 byte size eligible for vectors; `0` is unlimited and is the shipped default. The measured value is the exact default body READ exposes and the embedder receives. Exhaustive embedding therefore remains the normal posture. When a nonzero ceiling rejects an oversized body, the entry remains directly readable with full graph and lexical indexing; only vectors are absent. The setting is folded into the deep derivation signature, so changing it honestly re-derives affected entries. Client notices report compact aggregate progress; the digest records every non-vector pathname, terminal disposition, and reason for forensic inspection.
+§semantic-max-embed-size **Embedding has an optional size posture.** `PLURNK_SERVICE_MAX_EMBED_SIZE` is an operator-set maximum UTF-8 byte size eligible for vectors; `0` is unlimited and is the shipped default. The measured value is the exact addressed channel representation READ exposes and the embedder receives. Exhaustive embedding therefore remains the normal posture. When a nonzero ceiling rejects an oversized representation, its channel remains directly readable with full graph and lexical indexing; only vectors are absent. The setting is folded into the deep derivation signature, so changing it honestly re-derives affected channels. Client notices report compact aggregate progress; the digest records every non-vector address, terminal disposition, and reason for forensic inspection.
 
 §membership-change-gated-sync **Sync is idempotent and change-gated.** Per turn, membership materializes every member's model-readable snapshot into its entry. Text with an unchanged disk signature is a stat-only no-op. The version token is either the observed `mtime:size` or the explicit `absent` state; an observed deletion removes the stale readable channels, and a later reappearance is therefore a new divergence rather than a first-sight materialization. Binary sources additionally compare the cached per-mimetype projection identity; unchanged bytes are never reacquired, while changed reader behavior rematerializes without fabricating a filesystem-divergence event. Coverage is exhaustive across the project repository while work is proportional to source or projection change. After a pass every member carries the current representation defined by {§membership-source-projection}.
 
-§membership-emi-divergence-signal **EMI divergence signal.** The detector that gates the work *is* the one that fires this — one mechanism, not a second full read. When the change-detect finds a member moved out-of-band, the delta detector ({§env-delta}) surfaces it as a system `EDIT` log row naming the file, `source="file"` — the model sees what changed without diffing the manifest against memory. The model's own edits are write-through (the entry equals disk after a File write), so the scan never mis-attributes them as external divergence.
+§membership-emi-divergence-signal **EMI divergence evidence.** The detector that gates the work *is* the one that records this — one mechanism, not a second full read. When change detection finds a member moved out-of-band, the runtime actor records an `EDIT`-shaped row naming the file with `source="file"`; it does not broadcast that workspace change into unrelated workers' logs ({§env-delta-filesystem-narration}). The model's own edits are write-through (the entry equals disk after a File write), so the scan never mis-attributes them as external divergence. The current file remains ordinarily addressable. A stale anchored edit rejects under {§line-anchors}; a disk race after proposal rejects under {§membership-edit-write-cas}.
 
-§membership-edit-write-cas **The write-back is a compare-and-swap — never a clobber, never a clever merge.** EDIT is *naive against the editable text snapshot*: it diffs the model's change onto the entry's body channel — the exact Unicode the model READ — and the proposal carries the `synced_sig` that snapshot was taken at. Binary sources are refused before this path ({§membership-source-projection}). At accept, `applyResolution` re-stats disk and lands the proposed content only if that signature still matches. If disk moved out-of-band in the propose→accept window — a sibling worker, the user's editor, a build step — the write is **refused** with the same neutral `edit-collision` as {§edit-collision}, and **nothing is written**. The engine neither blind-writes over the ambient change (a *clobber*) nor silently re-diffs the model's edit against a state it never saw (getting *clever*) — both would bury a stale-view contract violation under a fallback. The collision surfaces instead: a ≥400 apply downgrades to a reject ({§proposal}), so the model sees that EDIT **did not occur** (400; the `edit_collision` outcome is forensics-only), the next reconcile narrates the real disk content as a `source=file` divergence ({§membership-emi-divergence-signal}), and the model re-reads and re-proposes against the fresh snapshot.
+§membership-edit-write-cas **The write-back is a compare-and-swap — never a clobber, never a clever merge.** EDIT is *naive against the editable text snapshot*: it diffs the model's change onto the entry's body channel — the exact Unicode the model READ — and the proposal carries the `synced_sig` that snapshot was taken at. Binary sources are refused before this path ({§membership-source-projection}). At accept, `applyResolution` re-stats disk and lands the proposed content only if that signature still matches. If disk moved out-of-band in the propose→accept window — a sibling worker, the user's editor, a build step — the write is **refused** with the same neutral `edit-collision` as {§edit-collision}, and **nothing is written**. The engine neither blind-writes over the ambient change (a *clobber*) nor silently re-diffs the model's edit against a state it never saw (getting *clever*) — both would bury a stale-view contract violation under a fallback. The collision surfaces instead: a ≥400 apply downgrades to a reject ({§proposal}), so the model sees that EDIT **did not occur** (400; the `edit_collision` outcome is forensics-only). Reconciliation aligns the current file projection and records the `source=file` evidence in the runtime log ({§membership-emi-divergence-signal}); the model re-reads and re-proposes against the fresh snapshot.
 
 The version travels *with the proposal*, never re-read from the entry at accept: a sibling worker in the same workspace may reconcile while this proposal sits paused, advancing the entry's `synced_sig` to the drifted disk — comparing against the *current* entry sig would wave that clobber through, so the comparison is always against the sig the proposal was computed at. A proposal that assumed an **absent** path (a create) conflicts only if a file has since appeared; a member with **no recorded snapshot** (an un-materialized entry, null `synced_sig`) has no baseline to guard and writes through — the two are told apart by the proposal's `existed` flag, not by a null sig alone. On a clean landing the entry refreshes to the written content and `synced_sig` is **restamped** to it, so the next reconcile recognizes the model's own write (not an external divergence) and a second same-turn edit bases on the landed bytes, not a stale sig. This is the write-side twin of the read-side change-gate ({§membership-change-gated-sync}): one `synced_sig`, gating both the re-read and the write.
 
-The CAS is the **hard backstop**, at the moment of writing, on every accept path. It composes with — and is distinct from — the loop-auto `staleClobberRisk` guard ({§proposal-ownership-auto-stale-clobber}): that guard refuses to resolve an edit whose target already diverged earlier this turn (the read→propose window, auto path only); the CAS refuses to write against a snapshot disk has left (the propose→write window, every path). Together they bracket the full read→write span.
+The CAS is the **hard backstop**, at the moment of writing, on every accept path. It composes with the model-facing {§line-anchors}: an anchor rejects a target whose relevant neighborhood changed before dispatch, while the CAS refuses to write against a snapshot disk left after proposal. An unanchored edit deliberately claims no pre-dispatch stale-view guarantee.
 
 §membership-git-flags **Permission flags.** Service-wide Git admission comes from {§operator-config-git-ceiling}. `PLURNK_SERVICE_GIT_AUTO=1` (default) includes the repository containing `project_root`; `=0` disables automatic Git membership, leaving `pick` as the only membership source. `ALLOWED` gates `AUTO`.
 
@@ -2647,130 +3210,131 @@ beneath each call. Its constraints distinguish pending calls, response
 evidence, and response-less errors while monetary classification remains
 explicit.
 
-### §grinder Budget enforcement: the grinder
+### §overflow-turn Budget enforcement: automated recovery turns
 
-The grinder is the one pre-provider curation path for the model-facing gauge.
-It never decides physical admission. Every request then crosses the provider's
-request-shaped capacity boundary, where proven exact overflow may reject
-pre-I/O and ambiguous evidence defers to upstream:
+Budget recovery is an ordinary state-machine transition, not a private packet
+mutation. Every candidate model request first crosses the model-facing curation
+ceiling and then, only if admitted, the provider's request-shaped physical
+capacity boundary:
 
 ```mermaid
 flowchart TD
-    assemble["Assemble and measure<br/>request packet"] --> policy{"Packet weight ≤<br/>curation budget?"}
-    policy -->|yes| generate["Provider generate"]
-    policy -->|no| problem["Record nonterminal 413<br/>Token Budget Overflow"]
-    problem --> fold["FOLD newest boundary<br/>and its OPEN effects<br/>tag overflow"]
-    fold --> rebuild["Rebuild and remeasure"]
-    rebuild --> generate
-    generate --> capacity{"Provider capacity<br/>failure?"}
+    assemble["Assemble and measure<br/>candidate request"] --> budget{"Weight ≤ curation ceiling?"}
+    budget -->|yes| generate["Provider generate"]
+    budget -->|no| recover["Keep turn packetless<br/>reclassify as `_plurnk` overflow"]
+    recover --> fold["Dispatch PLAN, whole-body FOLD ops,<br/>and SEND through ordinary dispatch"]
+    fold --> verify{"Rebuilt request fits?"}
+    verify -->|yes| next["Next model turn"]
+    verify -->|no| stop["Terminal 413"]
+    next --> assemble
+    generate --> capacity{"Provider capacity failure?"}
     capacity -->|no| response["Classify completed response"]
     capacity -->|yes| prompt{"Withholding automatic<br/>prompt bodies changes request?"}
-    prompt -->|yes| retryPrompt["Persist failure;<br/>rebuild and retry"]
-    retryPrompt --> generate
-    prompt -->|no| boundary{"Newest boundary not yet<br/>rolled back, and rollback<br/>changes request?"}
-    boundary -->|yes| retryBoundary["Persist failure;<br/>roll back, rebuild, retry"]
-    retryBoundary --> generate
-    boundary -->|no| stop["Persist terminal 413"]
+    prompt -->|yes| retry["Persist failure;<br/>rebuild and retry"]
+    retry --> generate
+    prompt -->|no| stop
 ```
 
-§grinder-overflow-only **The grinder fires only on actual overflow.** In
-`Engine.runTurn`, after `PacketBuilder.buildRequestPacket` assembles the request
-and before `provider.generate`, it compares the packet's render-weight
-({§tokenomics}) with the provider-derived curation budget. At or under the budget, the packet
-ships untouched. The grinder never trims
-speculatively or "helpfully."
-
-- §grinder-overflow-problem **Token Budget Overflow is a nonterminal 413 Problem.** Every over-ceiling assembly records exactly one `engine/context/token-budget-overflow` Problem before automatic recovery, with pre-recovery `usage`, `ceiling`, and `deficit` evidence. Its exact `detail` is `Token Budget Overflow: Token Usage exceeded Token Ceiling. Newest log items were automatically FOLDed to fit within token budget. Curate the log and/or perform more conservatively scoped or chunked retrieval operations to recover.` The Problem remains durable and model-visible even when folding restores room and the turn later concludes successfully; it does not strike or replace the turn's terminal disposition.
-- §grinder-layer1-rollback **One rule, every turn: roll back context introduced by the newest boundary.** On overflow the grinder folds, in one set operation, still-open rows born in the immediately prior turn or current pre-model turn plus exact older rows that a successful OPEN in the immediately prior turn transitioned from folded to open. It reads those landed effects from {§fold-open-meta-operations}; it never re-runs the selector, treats an already-open target as newly introduced, or chooses other older history by relevance. Turn 1 has no prior turn, so only its pre-model rows qualify. The same set operation additively applies the `overflow` tag to every row it folds; rows and bodies remain re-OPENable.
-- §grinder-errors-exempt **Errors, the prompt, AND the plan are exempt.** The grinder never folds an `op='error'` row: errors are the model's durable, curatable record of what went wrong. Nor does it fold the actionless **user prompt** row (`prompt:///<loop>/<N>`): the task frame is not ordinary model-authored memory. Nor a **PLAN row**: the checklist is the model's orientation surface when the grinder fires. All three stay OPEN until the model itself FOLDs or KILLs them.
-- §grinder-hard-413 **Only a provider capacity failure can terminalize at 413.** Every `provider.generate` assesses its exact request under {§provider-surface-capacity}. A proven exact preflight overflow issues no physical request; estimate, unavailable evidence, and a non-fitting upper bound defer to upstream, whose context rejection normalizes to the same `capacity_exceeded` failure. Core retries only after changing the request: first by withholding automatic prompt-body projection when that changes the packet, then by rolling back the newest boundary once when the grinder has not already done so and that changes the packet. Each failed logical call, any issued physical request, capacity evidence, and model-visible provider Problem remain durable; these recovery calls do not consume the completed-emission attempt budget. Core never resends identical bytes as capacity recovery and never chooses arbitrary older history. If neither recovery changes the request, or the changed request is still rejected, the request-only turn and exact provider Problem terminalize the loop at **413 Content Too Large**.
-
-- §tokenomics-fetch-fits-free **A retrieval larger than the available packet room arrives folded with a 413 explanation.** The result lands in the next build; if that build exceeds the curation budget, Core records {§grinder-overflow-problem} and folds the newest boundary, which contains the result. Its row and exact body remain durable and re-OPENable, and its `overflow` tag identifies every row selected by the automatic fold. Remaining curation debt follows {§tokenomics-negative-pressure}.
-
-- §loop-terminals **Engine-imposed terminals are HTTP-precise** — the loop-status vocabulary, one meaning each: `200` concluded (the model's SEND signal `200`) · `499` model-abandoned (signal `499`, or a cancel) · `429` maxTurns exhausted · `413` provider input-capacity failure after changed-request recovery · `500` strike threshold or invalid-emission exhaustion (distinct Problem types; `508` when the crossing strike was a detected cycle) · `504` loop timeout / exec-timeout restamp · `202` the bounded wait — a loop blocked on a live obligation (the model's `## SEND0 [202] <T,P>`, {§wait-obligation-matrix}); a wait on nothing resolves to `200` unless a successful same-turn FOLD requires the curated next packet · `100`/`102` queued/running. Never a catch-all, never a new value without changing the owning schema.
-
-§grinder-pressure-surface **What the model sees.** A fold-to-fit packet carries the open {§grinder-overflow-problem} row, its terse `## Errors` pointer, and ordinary folded rows whose complete sorted `tags` include `overflow`. If curation pressure remains negative but the provider accepts the request, the Budget section also reports the negative free-weight value and its one panic line ({§tokenomics-neutral-telemetry}). The curation 413 diagnoses the overflow without striking, terminalizing the turn, or changing the ordinary operation contract.
-
-The model controls its context; the provider owns physical admission, and Core
-performs only bounded changed-request recovery without choosing what older
-history matters. The same boundary applies on turn 1 and turn 101. The grinder
-folds reversibly, never deletes, and never performs speculative or non-overflow
-trimming.
+§overflow-turn-only **Recovery occurs only after measured overflow and before
+provider I/O.** After packet assembly, Core compares render weight
+({§tokenomics}) with the provider-derived curation ceiling. An admitted packet
+ships untouched. An over-ceiling candidate is never stored as a model request
+and never reaches `provider.generate`; its already-created database turn instead
+becomes a packetless `_plurnk` turn. Packetless initialization and recovery turns
+remain ordinary turn chronology but do not consume `maxTurns`, model-call,
+emission-attempt, usage, or cost accounting.
+
+- §overflow-turn-script **Recovery is one ordinary admitted `_plurnk` program.** Its canonical {§plan-value} has one `medium`, `in_progress` entry whose content is `Automatically FOLD log bodies newly active at token-budget overflow.`, followed by every causal whole-body FOLD and terminal `SEND0 [102]` with body `Next: YOU MUST ONLY FOLD, KILL, or trim ALL superseded, stale, or irrelevant log content in bulk in the next turn.` The final sentence requires the successor's substantive operations to be one dedicated, comprehensive bulk-curation program; mandatory PLAN and SEND framing still applies. Its exact `turnOps` is born FOLDED; successful FOLD rows follow {§fold-open-meta-operations} and therefore remain durable but packet-suppressed. Every recovery row carries `_plurnk` and `overflow`; no model call, synthetic receipt, or parallel explanation exists.
+- §overflow-turn-curation **The preceding turn owns the pressure it introduced.** Core deterministically selects every body already created in the packetless candidate turn, every body created by the immediately preceding completed turn in that worker's chronology, and every older body whose visibility that preceding turn's successful OPEN increased. Every selected body is FOLDed whole (`<1,-1>`) through ordinary dispatch. Already-wholly-folded and bodyless rows require no operation. Core performs no relevance judgment, exempts no operation or resource kind, reconstructs no interval delta, re-runs no authored selector, and chooses no unrelated older history.
+- §overflow-turn-hard-413 **Recovery fails hard when the causal fold cannot fit.** After the ordinary FOLDs land, Core rebuilds and remeasures once. If the plan changes no visibility or the rebuilt request still exceeds the ceiling, the loop terminalizes with an exact `engine/context/token-budget-overflow` 413 Problem; Core neither submits excess bytes nor chooses unrelated older history. Separately, every `provider.generate` assesses physical capacity under {§provider-surface-capacity}. Core may retry a provider capacity rejection only after withholding automatic prompt-body projection when that changes the request. If it cannot produce changed bytes or the changed request is still rejected, the request-only model turn and provider-owned Problem terminalize at **413 Content Too Large**.
+
+- §tokenomics-fetch-fits-free **A retrieval larger than the available packet room remains addressable.** Its complete row lands in the model turn that requested it. If the following candidate packet exceeds the curation ceiling, {§overflow-turn-curation} FOLDs the new body and classifies it `_plurnk` and `overflow`; the exact body remains durable and selectively re-OPENable.
+
+- §loop-terminals **Engine-imposed terminals are HTTP-precise** — the loop-status vocabulary, one meaning each: `200` concluded (the model's SEND signal `200`) · `499` model-abandoned (signal `499`, or a cancel) · `429` maxTurns exhausted · `413` token-ceiling recovery failure or provider input-capacity failure after changed-request recovery · `500` strike threshold or invalid-emission exhaustion (distinct Problem types; `508` when the crossing strike was a detected cycle) · `504` loop timeout / exec-timeout restamp · `202` the bounded wait — a loop blocked on a live obligation (the model's `## SEND0 [202] <T,P>`, {§wait-obligation-matrix}); a wait on nothing resolves to `200` unless a successful same-turn FOLD requires the curated next packet · `100`/`102` queued/running. Never a catch-all, never a new value without changing the owning schema.
+
+§overflow-turn-surface **The packet is the resulting state, not an account of it.**
+The first request after recovery is assembled by the ordinary packet path from
+the actual durable log after the recovery turn. It therefore carries the prior
+causal rows genuinely FOLDED, the recovery PLAN and SEND genuinely OPEN, and
+the recovery `turnOps` genuinely FOLDED. Successful recovery FOLD receipts are
+absent under the universal curation rule. No notice, reconstruction, auto-open,
+or overflow-specific projection simulates what `_plurnk` did; OPENing the exact
+`turnOps` reveals the program that did it. The model retains complete authority
+to reverse or refine that curation through ordinary log operations.
 
 ### §env-delta The environment delta: what changed since the model last looked
 
 Catalog FIND results ({§packet-catalog}) state what existed when observed. The
-environment delta supplies the events that made a worker's prior view stale
-without copying the shared world into worker-private state.
+environment delta supplies structurally addressed activity without copying the
+workspace into every worker's private state.
 
 ```mermaid
 flowchart LR
-    sibling["Sibling resolves EDIT<br/>on shared entry"] --> events["Durable shared-event record"]
-    disk["Project file diverges<br/>from materialized snapshot"] --> kernel["Reserved plurnk worker<br/>records source=file EDIT"]
-    sink["Executor entry() sink<br/>materializes readable entry"] --> typed["Reserved plurnk worker<br/>records typed EDIT event"]
-    kernel --> events
-    typed --> events
-    events --> pull["Pre-turn lossless pull<br/>(cursor, captured high-water]"]
-    pull --> log["Observer's self-contained log<br/>origin=plurnk; born FOLDed"]
+    child["Child commits activity"] --> event["One durable occurrence"]
+    commons["Any worker mutates worker:///"] --> event
+    event --> parent["Direct-parent audience"]
+    event -->|"commons only"| global["Workspace audience"]
+    parent --> pull["Pre-turn lossless pull<br/>(cursor, captured high-water]"]
+    global --> pull
+    pull --> log["Observer's self-contained log<br/>origin=_plurnk"]
     log --> packet["Packet lists coordinate;<br/>OPEN recalls exact body"]
 ```
 
 §env-delta-log-pull **Pull the event record, never a world snapshot.** At
-pre-turn, a worker materializes every other actor's event on shared state after
-its last completed observation boundary into its own log. The set is
-exhaustive, unranked, and exactly once; the engine makes no relevance decision.
-Each copied event retains its effect, cause, typed attributes, and initial
-log classifications ({§log-item-tags}). Every
-producer appends to one workspace-scoped occurrence journal with a monotonic
-identity. A pull captures one closed `(worker cursor, high-water]` interval,
-materializes each identity idempotently, then advances the cursor only after the
-whole interval is durable. An event racing the capture is therefore in this
-interval or a later one, never neither or both. Source-log curation cannot erase
-the occurrence record.
-
-The cursor is observation progress, not a private copy of entry contents. A
-fresh worker baselines the current high-water immediately after opening its
-first turn: older state arrives through the ordinary current-world projections,
-while events racing that first packet remain deliverable. A fork copies the
-parent's captured cursor with its log; copied event identities cannot republish,
-and occurrences the parent had not observed remain pending independently for
-both workers.
-
-§env-delta-worker-entry-visibility **Worker-entry visibility follows the
-authority contract.** Commons mutations (`worker:///...`) and mutations to the
-published kernel surface (`worker://plurnk/...`) are shared-state events and
-retain that authority in the observer row. Current-worker scratch
-(`worker://~/...`) and every ordinary named worker space are private: they never
-cross this door, while an ancestry-authorized explicit READ remains available.
-
-| Producer                                                 | Durable event                                                                                                               | Observer projection                                                                                                                                    |
-| -------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| §env-delta-sibling-edit Sibling commons mutation         | The sibling's successful resolved `EDIT` row and its receipt.                                                               | One folded `EDIT` retaining the exact effect and typed attributes.                                                                                     |
-| §env-delta-kernel-entry-edit Kernel-published mutation   | The reserved `plurnk` worker's successful resolved `EDIT` row on `worker://plurnk/...`.                                     | One folded `EDIT` retaining the published authority, exact effect, and typed attributes.                                                               |
-| §env-delta-filesystem-narration Project-file divergence  | The reserved `plurnk` worker records one `source=file` EDIT-shaped event during pre-turn membership reconciliation.         | One folded `EDIT` naming the file and carrying the net changed span plus the exact two-coordinate Git porcelain status in `git` metadata when Git reports that path. No model operation is fabricated as having run. |
-| §env-delta-entry-materialization Executor `entry()` sink | The reserved `plurnk` worker records a typed `EDIT` event with `kind="entry_materialized"` and the calling worker as cause. | One folded system `READ` projection advertising newly readable state; the durable event remains an EDIT for replay and forensics ({§exec-entry-sink}). |
+pre-turn, a worker materializes only occurrences whose structural audience
+includes that worker. The set is exhaustive, unranked, and exactly once; the
+engine makes no relevance decision. Each copied event retains the operation,
+result, typed attributes, and initial log classifications ({§log-item-tags}).
+Every producer appends to one workspace-scoped occurrence journal with a
+monotonic identity. A pull captures one closed `(worker cursor, high-water]`
+interval, materializes each addressed identity idempotently, then advances the
+cursor only after the whole interval is durable. An event racing the capture is
+therefore in this interval or a later one, never neither or both. Source-log
+curation cannot erase the occurrence record.
+
+The cursor is observation progress, not a private copy of resource contents. A
+fresh worker captures the current high-water when its worker row is created, so
+pre-existing broadcast history stays out while later occurrences remain
+deliverable even before its first packet. A fork instead copies the parent's
+cursor and captures its own fork high-water atomically with worker creation
+({§machine-processes-fork-pending-activity}). Observer rows retain the source
+identity and never publish another occurrence.
+
+§env-delta-worker-entry-visibility **The commons is global; every other
+resource follows lineage.** A successful state-changing `EDIT`, `COPY`, `MOVE`,
+entry-path `KILL`, or entry-path `SEND` signal `410` whose landed effects touch `worker:///...` acquires the workspace
+audience and retains the commons address in its observer row. Mutations to
+`worker://~/...`, named worker spaces, project files, and remote resources do
+not broadcast. When authored by a child, their
+ordinary operation evidence still reaches that child's direct parent.
+
+| Producer / event                                      | Durable occurrence                                                                                     | Observer projection                                                                                                                |
+| ----------------------------------------------------- | ------------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------- |
+| §env-delta-child-activity Direct-child activity       | Every final op-bearing child log row except runtime-private `_plurnk/operation` maintenance: prompt, PLAN, operation result, or actionless error. | Direct parent only; one exact attributed row born folded. Provider reasoning, calls, rejected emissions, turnOps, and harness maintenance do not cross. |
+| §env-delta-child-termination Direct-child termination | The child's exact terminal loop result when the loop contains at least one non-maintenance turn.       | Direct parent only; a 2xx deliverable is born open and every failure is folded ({§worker-scheme-collect}).                         |
+| §env-delta-commons-mutation Commons mutation          | One successful resolved operation whose landed effects touch `worker:///...`.                         | Every existing worker; one folded row per observer, deduplicated with any lineage audience.                                       |
+| §env-delta-filesystem-narration Project-file divergence | Runtime-owned reconciliation evidence remains in the runtime actor's own log.                        | No ambient observer row. Current content remains addressable and stale hash edits reject at their owned boundary.                 |
+| §env-delta-entry-materialization Executor `entry()` sink | The runtime records typed materialization evidence under its owning actor.                           | No ambient observer row unless the resulting operation itself is direct-child activity or a commons mutation ({§exec-entry-sink}). |
 
 §env-delta-attribution **Ownership, authorship, and cause are independent.**
 
 | Field       | Meaning                                                                                                                                                                                 |
 | ----------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | `worker_id` | The worker whose self-contained log owns the materialized row.                                                                                                                          |
-| `origin`    | The actor tier that wrote the row; a materialized delta is `plurnk`.                                                                                                                    |
-| `source`    | The causal identity. Worker causes use the canonical `worker://<name>` control identity; non-worker causes use a stable subsystem token (currently `file`); self-authored rows omit it. |
+| `origin`    | The actor tier that wrote the row; a materialized delta is `_plurnk`.                                                                                                                   |
+| `source`    | The immediate causal identity in this log. A lineage or commons observation uses the canonical `worker://<producer>` control identity; self-authored rows omit it. |
 
-§env-delta-no-coalescing **Only filesystem observation nets.** One filesystem
-event is `editedSpan(entry-as-of-last-align, disk-now)`, inherently netting any
-number of out-of-band writes before reconciliation. Sibling edits are discrete
-events already in the log and remain discrete. Coalescing them would destroy
-the record and conflate state comparison with event replay.
+§env-delta-no-coalescing **Activity is never coalesced.** Each admitted child
+operation and each commons mutation has one occurrence identity. Combining
+them would destroy causal order and conflate event replay with a state
+comparison.
 
 §env-delta-passive **Observation never forces a turn.** Deltas materialize only
-while a packet is already assembling, so an ambient change cannot wake an idle
-worker. Urgent directed communication uses the voice door
-({§actor-boundary-two-doors}). Sibling loop conclusions and owned stream
-progress reuse durable ambient log delivery under {§worker-scheme-collect} and
-{§exec-stream}; their lifecycle-specific open/fold and wake rules remain owned
-there.
+while a packet is already assembling. Intermediate child activity and commons
+broadcasts therefore cannot wake an idle worker. Urgent directed communication
+uses the voice door ({§actor-boundary-two-doors}); direct-child terminal
+disposition alone carries the structured-concurrency wake owned by
+{§worker-scheme-collect}. Stream progress remains owned by {§exec-stream}.
 
 ### §edit-result-render Mutation log rows render truthful effects
 
@@ -2889,8 +3453,6 @@ only after authority crosses the client boundary.
 
 §proposal-ownership-notification **The notification carries disposition, not policy inputs.** `loop/proposal` carries the core-owned `ProposalDisposition` ({§notifications}, {§proposal-disposition}). A connected client presents only `owner="client"`; it never reimplements precedence from flags, operation, or attrs.
 
-§proposal-ownership-auto-stale-clobber **Auto is not blind — it refuses a stale clobber.** When an EDIT's target diverged on disk this turn, accepting it would overwrite an ambient change. The projection carries `staleClobberRisk=true`, and core's loop disposition rejects it; the model can re-READ and retry. This brackets the read→propose window for loop auto, while the compare-and-swap ({§membership-edit-write-cas}) brackets propose→write for every accept path.
-
 ---
 
 ## §packet Packet shape
@@ -2904,7 +3466,7 @@ leaves the request-only record, while rejected exchanges remain in
 
 | Turn state                    | `turns.packet`                                  |
 | ----------------------------- | ----------------------------------------------- |
-| No model request assembled    | SQL `NULL`                                      |
+| No model request assembled (including initialization and overflow turns) | SQL `NULL` |
 | Request assembled             | `{ weight, sections }`                         |
 | Response admitted             | `{ weight, sections, assistant, assistantRaw }` |
 
@@ -2921,9 +3483,27 @@ leaves the request-only record, while rejected exchanges remain in
 `StoredPacket` is the one core type and validation path for this algebra. The
 flat schema enforces its root states; typed reads additionally validate every
 section and parsed operation. A hard budget stop remains request-only. Client,
-setup, filesystem-narration, and executor-materialization turns are
-journal-only and therefore store `NULL`. Digest writes an explicit journal-only
-or request-only note instead of fabricating response files.
+setup, filesystem-narration, and executor-materialization turns are ordinary
+operation turns and therefore store `NULL`. Digest projects exact operation
+source independently from this optional model-exchange record; a request-only
+turn receives a note instead of a fabricated response.
+
+§digest-turn-artifact-identity **Digest packet artifacts project durable turns.**
+After selectors are applied, digest retains every turn with exact `turnOps` or
+a stored provider request, orders those turns by durable chronology, and names
+them contiguously from `packet000`. The producer does not affect projection.
+
+| Artifact | Present when | Authority |
+|----------|--------------|-----------|
+| `packetNNN.assistant.md` | The turn has `turnOps` | Exact persisted `turnOps` source |
+| `packetNNN.system.md`, `packetNNN.user.md` | The turn stored a provider request | Stored packet sections projected through `PacketWire` |
+| `packetNNN.assistantRaw.json` | The request has an admitted provider response | Stored opaque provider response |
+| `packetNNN.response.md`, attempt artifacts | The request received no admitted response | Stored request and attempt state |
+
+A source-backed turn without provider participation therefore produces only
+`assistant.md`; a request-only turn produces no fabricated assistant. A
+source-less programmatic turn with no provider request has no forensic payload
+to project and reserves no ordinal.
 
 The external tokenless draft and transformation boundary is owned by
 {§scheme-packet-transform}. Core alone extends each validated draft with its
@@ -2952,13 +3532,13 @@ Retired terms stay retired: the lexicon guard rejects `thinking`, the unqualifie
 
 §encrypted-reasoning-carrier **Encrypted reasoning is opaque client evidence.**
 When a provider returns encrypted reasoning items, core attaches that list to
-the admitted model-emission row's `attrs.reasoning`. `log/entry` and `readLog`
+the admitted model `turnOps` row's `attrs.reasoning`. `log/entry` and `readLog`
 carry it to AG-UI, which may project correlated standard reasoning entities.
 Core never decodes the blobs or renders them into a model packet; readable
 reasoning text remains separate in `assistant.reasoning`. The provider-detail
 identity and derived classification retain their exact provider-normalized
 meaning from {§provider-encrypted-reasoning}; core never reinterprets either as
-a client entity. The mirror row and logical model call remain the lossless
+a client entity. The source row and logical model call remain the lossless
 evidence when a downstream standard cannot represent the complete list.
 
 §body-projection **One full body, one packet projection.** Every durable log row has one canonical full body resolved from its stored tx/rx envelope by `LogBody`. READ and FIND over `log:///`, persistent search derivation, and packet rendering all consume that same meaning. Only packet rendering may project it:
@@ -2966,16 +3546,18 @@ evidence when a downstream standard cannot represent the complete list.
 | row producer | ordinary OPEN projection |
 |---|---|
 | any `READ` or `FIND` | complete selected operation result |
-| any `PLAN` | complete authored working memory |
+| any `PLAN` | complete canonical Plurnk Plan JSON {§plan-value} |
 | actionless lowercase `prompt` | budgeted head under {§prompt-projection} |
 | structured `EDIT` receipt or textual `COPY`/`MOVE` effects | complete receipt-owned join context |
 | every other nonempty body | head bounded independently by `PLURNK_SERVICE_PREVIEW_LINES` and `PLURNK_SERVICE_PREVIEW_CHARS` |
 | bodyless row | `"display":"none","body":""` |
 
-READ and FIND own their range or pagination before packet rendering; the packet never applies a second hidden substring bound to their selected result. PLAN is likewise complete while OPEN: it is the model's explicit persistent reasoning inventory, not ordinary content that the model should have to retrieve from itself. Prompt rows follow their separate adaptive projection contract. Structured mutation contexts already carry the receipt-owned bound in {§edit-result-receipt-truth}, so packet rendering does not preview them again. Model-emission mirrors, SEND/WORK/FORK bodies, EXEC commands, environment-delta EDIT spans, and extension-produced bodies use the ordinary fixed bound. When an OPEN projection differs from its canonical body, `chunk` follows the displayed `body` with the exact selected and complete extents defined by {§jsonplurnk}; complete and FOLDED bodies omit it. `## READ0 (log:///<coordinate>/<OP>)` applies its default or explicit text range to the canonical body; the unsuffixed exact shorthand and authoritative suffix behavior are defined by {§log-coordinate-hierarchy}. `## FIND0 (log:///...)` and search match that same full body. FOLD hides the ordinary projection, and OPEN restores the producer's projection without changing its bound. System/policy sections are not log bodies. Notices are transient non-log observations; they share the ordinary line/character bounds but have no durable body or recovery URI.
+READ and FIND own their range or pagination before packet rendering; the packet never applies a second hidden substring bound to their selected result. PLAN is likewise complete while OPEN: it is the model's explicit persistent reasoning inventory, serialized once as compact JSON rather than clipped or reparsed from source text. Prompt rows follow their separate adaptive projection contract. Structured mutation contexts already carry the receipt-owned bound in {§edit-result-receipt-truth}, so packet rendering does not preview them again. Actionless source artifacts, SEND/WORK/FORK bodies, EXEC commands, environment-delta EDIT spans, and extension-produced bodies use the ordinary fixed bound. When an OPEN projection differs from its canonical body, `chunk` follows the displayed `body` with the exact selected and complete extents defined by {§jsonplurnk}; complete and FOLDED bodies omit it. `## READ0 (log:///<coordinate>/<OP>)` applies its default or explicit text range to the canonical body; the unsuffixed exact shorthand and authoritative suffix behavior are defined by {§log-coordinate-hierarchy}. `## FIND0 (log:///...)` and search match that same full body. FOLD hides the ordinary projection, and OPEN restores the producer's projection without changing its bound. System/policy sections are not log bodies. Notices are transient non-log observations; they share the ordinary line/character bounds but have no durable body or recovery URI.
 
 §prompt-entry **Prompt as a first-class entry and log row.** Each prompt is stored once at `prompt:///<loop>/<N>` as an owner-keyed text/markdown entry, then published to its turn as one actionless lowercase `prompt` log row. No synthetic EDIT or READ operation is invented. The row is born OPEN and obeys {§body-projection}. The **Active User Prompts** section closes the user-slot status clump as a paths-only list (`* prompt:///<loop>/<N>`), so every frame remains directly READable even after its log row is folded or killed.
 
+§prompt-causal-source **Prompt authorship and delivery are distinct facts.** The harness publishes every prompt row with `origin="_plurnk"`; the row's existing `source` carries the canonical address of a different causal actor. Native WORK, FORK, and directed worker SEND derive `worker://<sender>` from the authenticated sender worker ID. A trusted exterior adapter may supply its own canonical actor address through {§methods-loop-run}. An absent source means the owning worker itself. Attribution persists with the prompt frame through active delivery, parking, orphan recovery, restart, and later log projection; model syntax cannot author it.
+
 §prompt-projection **Prompt storage is unbounded by model context; automatic materialization is not.** Core persists every accepted prompt completely before packet assembly. The selected provider's derived `inputCapacity` and the alias-resolved percentage from `PLURNK_SERVICE_PROMPT_PROJECTION` derive one aggregate curation-weight allowance for OPEN prompt bodies. Complete prompt bodies render when their aggregate weight fits. Otherwise all OPEN prompt rows share the allowance: full bodies consume only their required share, unused shares are redistributed, and partial bodies render the largest leading complete-line region that fits their share or an exact character-bound prefix when the first physical line alone is larger. The sum of their rendered body weights never exceeds the allowance. Every partial body carries its exact `chunk` after `body`; the canonical `prompt:///` entry and `log:///` body remain complete and READ/FIND-addressable. When provider input capacity is unknown the percentage is underivable, so prompt rows retain the ordinary bounded projection rather than inventing capacity. This policy never rejects, summarizes, or discards a prompt because it exceeds a context window.
 
 §prompt-self-only The frame is self-only and owner-keyed:
@@ -2990,8 +3572,8 @@ that loop has no `op='prompt'` row, oldest first. Every still-undelivered frame
 at conclusion is re-ordinalized into one source-keyed recovery loop; that loop's
 first turn publishes the complete ordered set exactly once. Recovery retries
 complete the same queued loop and never mint duplicate work. The automatic
-grinder preserves prompt rows; explicit OPEN/FOLD/KILL follows the ordinary log
-contract.
+overflow turn preserves prompt rows; explicit OPEN/FOLD/KILL follows the ordinary
+log contract.
 
 §packet-catalog **Catalogs are query results, not packet state.** The packet
 stores no materialized manifest. Complete and one-level entry directories,
@@ -3002,7 +3584,7 @@ their row shape, and their ordering are ordinary FIND projections owned by
 
 The model's runtime alert surface has two distinct kinds of information:
 
-- **Turn failures are log items.** A failed action and an engine-rail failure are durable `log_entries` rows whose `rx` is an RFC 9457 operation result. They fold, kill, and budget like every other row. The `errors` section is a derived pointer index over recent `status_rx ≥ 400` rows; it owns no bodies or failure state. Rejected emissions never become accepted turn content; their private response and admission evidence remains in `model_calls` and `turn_attempts`, apart from the bounded recovery mirror under {§invalid-emission-attempts}.
+- **Turn failures are log items.** A failed action and an engine-rail failure are durable `log_entries` rows whose `rx` is an RFC 9457 operation result. They fold, kill, and budget like every other row. The `errors` section is a derived pointer index over recent `status_rx ≥ 400` rows; it owns no bodies or failure state. Rejected emissions never become accepted turn content; their private response and admission evidence remains in `model_calls` and `turn_attempts`, apart from the bounded recovery `emissionAttempt` under {§invalid-emission-attempts}.
 - **Notices are transient observations.** Progress and non-fatal diagnostics such as `turn_awaiting_model`, `embed_progress`, and `grammar_unenforced` may appear once in the packet and broadcast live. They neither substitute for a failure result nor influence scheduling or recovery.
 
 The `log` is durable product truth. The `errors` section points at its failures
@@ -3039,16 +3621,15 @@ retain distinct contracts and lifetimes.
 | failure | row | status |
 |---|---|---|
 | action failure | the failed op's own row; the owning scheme supplies Problem Details | 4xx/5xx |
-| provider input capacity | `op='error'`, origin `plurnk`, source `provider`; exact provider-owned `capacity-exceeded` Problem Details | 413 |
-| max commands exceeded | `op='error'`, origin `plurnk`, source `rail`; `engine/rail/max-commands-exceeded` Problem Details | 429 |
-| idle turn | `op='error'`, origin `plurnk`, source `rail`; `engine/rail/idle-turn` Problem Details | 409 |
+| provider input capacity | `op='error'`, origin `_plurnk`, source `provider`; exact provider-owned `capacity-exceeded` Problem Details | 413 |
+| max commands exceeded | `op='error'`, origin `_plurnk`, source `rail`; `engine/rail/max-commands-exceeded` Problem Details | 429 |
+| idle turn | `op='error'`, origin `_plurnk`, source `rail`; `engine/rail/idle-turn` Problem Details | 409 |
 
 | notice `kind` | Source | Position |
 |---|---|---|
 | `grammar_unenforced` | engine rail verdict, or a forwarded provider transport anomaly such as a discarded-channel escape | content-offset when the observed position maps into content; none for a reasoning-prefix divergence |
 | `parse_advisory` | grammar parser — recoverable near-miss which did not invalidate the parsed statements | content-offset into the model's emission |
 | `embed_progress` | repository materialization/indexing lifecycle ({§mimetype-surface}); structured phase, count, and percent; `level: info` except terminal failure | none |
-| `search_progress` | aggregate search-page acquisition lifecycle; structured phase, counts, and percent; never candidate URLs or per-result notices | none |
 
 §notice-level **Severity on the wire (`level`, required).** Every `Notice` carries `level: "error" | "warn" | "info"`, set by the **producer** at the emit site. The level is client presentation, not operation status: even an `error` notice cannot terminalize work or substitute for a durable Problem. A forwarded `grammar_unenforced` is `warn`; ordinary lifecycle and progress notices are `info`. Clients color straight off `level` without interpreting the open `kind` vocabulary.
 
@@ -3060,20 +3641,20 @@ retain distinct contracts and lifetimes.
 
 | Surface                                | Contract                                                                                                                                            |
 | -------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Import `@plurnk/plurnk-service/digest` | Ships `Digest` and its co-located `digest.sql`; importing performs no I/O or process action. The CLI wrapper alone invokes it.                      |
+| Import `@plurnk/plurnk-service/digest` | Ships `Digest` and its package-owned SqlRite statements; importing performs no I/O or process action. The CLI wrapper alone invokes it.             |
 | `run({ dbPath })`                      | Reads the required database and writes a complete digest to `./test/digest` relative to the caller's working directory.                             |
 | `digestDir`                            | Selects the output directory. `run` removes and recreates it so stale packet artifacts cannot survive; concurrent callers use distinct directories. |
 | `workerId`                             | Narrows workers and every dependent loop, turn, logical model call, emission attempt, physical request, and log row to that one worker.             |
 | `workspaceId`                          | Narrows workers and dependent evidence to one workspace; when both selectors are present they intersect.                                            |
 
-§digest-forensic-fidelity **Forensic fidelity and cardinality.** The digest's machine-readable JSON preserves every log row, including causal `source` and structured `attrs`, every exact OPEN/FOLD target effect from {§fold-open-meta-operations}, the exact Problem on every failed row, each loop's exact terminal result, and every ordered physical provider request. Accounting on broader rows is the shared exact derivation from that ledger, never a second stored fact. The human Markdown waterfall shows a present causal source and may preview only the Problem detail because it remains a triage projection, not the machine record. Targets reconstruct the model-visible address, including hostname, port, serialized query, and fragment; an authority-bearing URL must never degrade from `https://host/path` to `https:///path`, and folded network-entry storage paths render back to their authority form. Its human Markdown waterfall groups identical per-turn op outcomes and typed `entry_materialized` narrations, reporting the exact count and sequence span (`xN (seq A-B)`). Grouping keys include source and the complete target, so distinct causes, authorities, or channels never collapse. Thus amplification is conspicuous without making the diagnostic artifact itself pathological; packet files remain byte-identical records of what the model saw.
+§digest-forensic-fidelity **Forensic fidelity and cardinality.** The digest's machine-readable JSON preserves every log row, including causal `source` and structured `attrs`, every exact OPEN/FOLD target effect from {§fold-open-meta-operations}, the exact Problem on every failed row, each loop's exact terminal result, and every ordered physical provider request. Accounting on broader rows is the shared exact derivation from that ledger, never a second stored fact. The human Markdown waterfall shows a present causal source and may preview only the Problem detail because it remains a triage projection, not the machine record. Targets reconstruct the model-visible address, including hostname, port, serialized query, and fragment; an authority-bearing URL must never degrade from `https://host/path` to `https:///path`, and durable resource coordinates render back to their authority form. Its human Markdown waterfall groups identical per-turn op outcomes and typed `entry_materialized` narrations, reporting the exact count and sequence span (`xN (seq A-B)`). Grouping keys include source and the complete target, so distinct causes, authorities, or channels never collapse. Thus amplification is conspicuous without making the diagnostic artifact itself pathological; packet files remain byte-identical records of what the model saw.
 
 §digest-requiem **A requiem is an out-of-band forensic interview, not a worker
 turn.** It cannot execute operations or alter the audited history.
 
 | Aspect    | Contract                                                                                                                                                        |
 |-----------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| Scope     | One interview for each worker with model-bearing turns; journal-only workers are omitted.                                                                       |
+| Scope     | One interview for each worker with model-bearing inference turns; workers without inference evidence are omitted.                                                |
 | Evidence  | The worker's final packet plus every attempt's exact normalized response and admission evidence; opaque raw transport remains in durable forensic artifacts. |
 | Witness   | An explicitly supplied provider or the active configured provider; absence fails hard.                                                                          |
 | Identity  | The worker's durable provider identity ({§worker-provider-identity}) is sent as both `workerId` and `primaryWorkerId`, making the synthetic interview its own root without asserting a live worker topology. |
@@ -3082,49 +3663,158 @@ turn.** It cannot execute operations or alter the audited history.
 
 §turn-lifecycle **Turn-lifecycle liveness.** Provider generation is the long, opaque window in a turn — one or more same-packet emission attempts may occur before the first committed op. A static client screen there is indistinguishable from a hang. The engine brackets the complete attempt window with two `notice/event` notices (`source: "engine:turn"`, `level: "info"`): `turn_awaiting_model` before the first call and `turn_generated` when an emission is accepted or the attempt budget is exhausted. Rejected content never rides the notice channel. Both are suppressed on an aborted loop and broadcast to the workspace like any notice ({§notice-event-notify}).
 
-§notice-content-offset-pointer **Content-offset position.** A non-fatal diagnosis on an accepted emission (for example `grammar_unenforced` or `parse_advisory`) carries `position: { type: "content-offset", line, column }` into the model's own folded mirror row. A bounded hard parse error becomes a durable failed operation whose Problem Details preserve its line, column, source, and parser-owned diagnostic. Hard errors that make the frame untrustworthy remain only with their rejected forensic attempt.
+§notice-content-offset-pointer **Content-offset position.** A non-fatal diagnosis on an accepted emission (for example `grammar_unenforced` or `parse_advisory`) carries `position: { type: "content-offset", line, column }` into the model's own folded `turnOps`. A bounded hard parse error becomes a durable failed operation whose Problem Details preserve its line, column, source, and parser-owned diagnostic. Hard errors that make the frame untrustworthy remain only with their rejected forensic attempt.
+
+### §tools Executable tool resources
+
+§tools-resource-discovery **Executable capability discovery uses ordinary
+Plurnk resources.** No generated tool table rides the system packet. Every
+runtime enabled for the current worker with an admitted invocation materializes exactly one
+family document at `worker://~/_plurnk/skills/plurnk/<runtime>.md`. A general runtime's
+document contains its {§executor-tool-document}; a runtime with an exact
+{§executor-tool-registry} materializes the same single document — per-target
+child documents do not exist, shown or stored. The family document summarizes
+the server or runtime, lists every enabled target as a directly copyable
+`## EXEC0` heading with its input signature ({§operation-annotation} carries the
+target one-liner; no invocation dispatch would reject is ever advertised), and
+carries each detailed target's richer input-side contract as a
+`## <target>` section of the same document, that target's own headings demoted
+one level beneath it. A detail-less target's invocation line is its whole
+teaching. Tool-result/output schemas remain ordinary evidence and never enter
+this document.
 
-### §tools user.tools — the capability sheet
-
-§tools-capability-sheet The tools capability sheet renders under `## Registered Tools`, after the policy sections. One generated Markdown table is the closed set of valid executor selectors. Its columns state `[executor]`, the `(target)` role and any concrete target witness, the body role, and `Invocation`: a body example, a schema-derived signature, or `bodyless`. The Invocation cell never repeats the `## EXEC0 [executor] (target)` syntax already defined by the headers and columns. A runtime exposing {§executor-tool-registry} contributes exactly one row per enabled exact target instead of its general row; an empty exact registry contributes no row and has no fallback. The compact legend leaves required inputs unmarked, marks optional inputs with `?`, pairs mutually exclusive alternatives with `↔`, marks refused buckets with `—`, and locates optional `<timeout,poll>` on the heading. The preface prefers purpose-built Plurnk operations over EXEC scripts. For a declaration with `target.directory: "cwd"`, the target cell distinguishes a local-directory working context from the plugin-authored non-directory target role. Optional non-EXEC operations render separately under `## Enabled Optional Operations` in a `plurnk` fence, so the catalogue remains truthful. `PacketBuilder.#collectTools` assembles both; a prose notice (e.g. the EXEC-disabled line) stays beside the table, and empty sections are omitted.
-
-§tools-loop-affinity **The capability sheet describes the current loop.** The
-sheet filters registered capabilities through the same
-`SchemeRegistry.resolveForLoop(flags)` predicate the dispatcher enforces. When
-registered executors exist but EXEC is inactive, their table is replaced by
-an explicit disabled notice rather than silent absence. The dispatch 403 remains
-the backstop and names the non-retryable loop restriction.
+```mermaid
+flowchart LR
+    Survey["Turn 0 FIND<br/>tools/*.md"] --> Families["family paths + summaries"]
+    Families --> Read["READ selected family<br/>only when needed"]
+    Read --> Exec["EXEC annotated invocation"]
+```
 
-**Contributors: the workspace executor snapshot.** Every available executor tag
-contributes its general {§executor-invocation} row or the closed rows and
-documentation from its {§executor-tool-registry} snapshot. Its doc is
-materialized at `worker://plurnk/docs/<tag>.md` and discovered via the turn-0
-`## FIND0 [+init,+docs] (worker://plurnk/docs/**)` foist, not linked inline.
-`PLURNK_SERVICE_DOCS_EXCLUDE` drops a named tag's rows and doc. Installed
-executors are probed once; workspace providers publish only prepared runnable
-selectors, so the table never presumes that another workspace's capability is
-available here.
+§tools-resource-materialization The runtime registry, worker executor policy,
+tool resources, and dispatch use one effective worker snapshot. A
+worker-disabled, unavailable, detached, replaced, or removed runtime has no
+tool resource; an exact registry's empty set publishes no executable family and
+admits no invocation. Reconciliation deletes stale documents
+before upserting the current set. `PLURNK_SERVICE_DOCS_EXCLUDE` does not hide an
+enabled executable; executor enablement is the sole user-configured filter
+shared by discovery and dispatch. A runtime declaration may carry
+`resourcesPath` — its generated-doc root relative to the worker's generated
+subtree ({§worker-generated-subtree}). Absent, its docs live in the internal
+`_plurnk/skills/plurnk` namespace; present (attached MCP families: `/tools`),
+the family document materializes at `_plurnk` + that root in the
+worker's private entry space. Turn 0 surveys the families (`## FIND0 [+init,+tools]
+(worker://~/_plurnk/tools/*.md)`, one row per
+server carrying its summary) and, for each server named in
+`PLURNK_MCP_EXPANDED`, adds one complete family-document READ
+(`_plurnk/tools/<server>.md <1,-1>`) so turn 0 names every tool it exposes.
+Attached tools are capabilities like every other runtime; the model never
+learns an origin.
+
+§skills-functionality **Agent Skills are one Worker Functionality family.**
+Core registers the `skills` family with the coordinator ({§functionality-coordinator});
+its adapter owns protocol truth for standard Agent Skills and nothing else. A
+definition is `SkillDefinition` — the standard skill `name`, the universal
+root `scope` (`project` = `<projectRoot>/.agents/skills`, `global` =
+`~/.agents/skills`), and for a Worker-installed skill the standard installer
+`source` that provides it. Plurnk bundles no skills of its own and never
+seeds or mutates a universal root absent an explicit `add`/`remove`.
+
+*Available definitions.* The filesystem is the only truth about installation:
+every `<root>/<name>/SKILL.md` directory under the project then the global
+root is one service-origin definition, enabled by default, project shadowing
+global by name; when the standard installer's `skills-lock.json` records a
+source it rides the definition. A Worker's durable state owns enablement
+({§functionality-state}); a disabled skill stays client-visible and leaves no
+model-facing trace.
+
+*Discovery is inert.* `discover {query}` searches the ecosystem registry
+(`PLURNK_SERVICE_SKILLS_REGISTRY_URL`, default `https://skills.sh`; empty disables it
+with 501 `registry-not-configured`) and returns one candidate per hit with
+`registry` provenance and the exact `owner/repo` source. `discover {source}`
+lists the skills one standard package reference contains with `source`
+provenance. Neither installs, persists, or enables. Client `configuration`
+contributes nothing and is refused with 400.
+
+*Admission.* `add {alias, definition}` requires `alias = name`, a `source`,
+and a project root when `scope` is `project`; the Worker's own definition may
+shadow a service skill of the same name.
+
+*Preparation.* For each enabled alias the adapter locates the directory at the
+definition's scope; a Worker definition whose directory is absent is installed
+through the standard CLI (`PLURNK_SERVICE_SKILLS_CLI`, default `npx --yes skills`:
+`add <source> --agent universal --skill <name> --yes [--global]`, run with
+`HOME` set to the service's user home so the installer's `~` is the global
+root) and the installed `SKILL.md` — never the installer's output — is the
+evidence.
+Each admitted skill requires standard `name` and `description` frontmatter
+with `name` matching its directory. A missing, uninstallable, or invalid skill
+is `unavailable` with its exact Problem (`skill-missing`, `install-failed`,
+`skill-invalid`) under the coordinator's failure policy
+({§functionality-model-mutation}); one bad skill never fails the family.
+
+*Documents.* The family publishes `worker://~/_plurnk/skills/index.md` —
+which always exists and lists the active skills by name and description — and
+one `worker://~/_plurnk/skills/<name>.md` per active skill, with an exact H2
+`Summary` carrying the standard `description` and the instruction body
+preserved verbatim ({§functionality-documents}). They are discovered by the
+turn-0 `+init,+skills` FIND survey; disabled and unavailable skills are
+absent from model teaching.
+
+§skills-remove **`remove` uninstalls what the Worker installed.** Before the
+coordinator forgets a Worker-origin skill definition the adapter removes that
+skill from the definition's scope through the standard CLI (`remove <name>
+--yes [--global]`), verified by the directory's absence; a failed removal
+rejects the mutation. A same-named skill at a lower-precedence root is then
+revealed as a service definition, disabled ({§functionality-coordinator}).
+Service definitions are disable-only.
+
+§skills-hotload **Out-of-band installers are admitted at the next turn.** The
+family keeps one signature of the installed roots per resident Worker; turn
+admission recomputes it under the workspace gate before packet assembly and
+republishes the family through the coordinator when it changed, so a skill
+installed or removed by any other tool is discoverable in the first subsequent
+model turn while an unchanged set dispatches nothing. The model manages skills
+only through the generated `EXEC [skills]` family
+({§functionality-model-projection}); it is never taught a package manager.
+
+The catalog describes this worker's Functionality, not temporary authority. Loop
+mode remains a dispatch concern: an ask-mode EXEC receives the ordinary exact
+403 restriction instead of requiring a second per-loop documentation overlay.
+Optional non-EXEC operations remain a separate `## Enabled Optional Operations`
+section because they are language extensions rather than executable tools.
 
 ### §schemes user.schemes — the resource directory
 
-§schemes-directory A `## Resources` section renders in the system slot **after the policy sections and tools sheet** — a terse directory of the scheme families available this workspace, so the model knows what URI resources and operations exist before it acts. Each scheme that ships a `manifest.example` contributes one or more concise canonical ops (no scheme prefix; each example self-documents) into a `plurnk` fence. Scheme example sets are separated by one blank line. The doc is NOT linked inline — it is materialized at `worker://plurnk/docs/<scheme>.md` and discovered via the turn-0 `## FIND0 [+init,+docs] (worker://plurnk/docs/**)` foist, keeping the raw packet free of doc links. Meta-owned `log` and `worker` depth is required teaching ({§teaching-corpus}); a failed source read rejects materialization with its cause and never falls back. Other core and plugin schemes may supply optional `manifest.documentation`; absence contributes no pull doc. The verbose semantics live in that pull doc (materialized like any entry, READ on demand), not the hot path — terse pushes, depth pulls. A scheme with no example (provisional) is omitted; `PLURNK_SERVICE_DOCS_EXCLUDE` drops a named scheme's examples + doc.
+§schemes-directory A `## Resources` section renders in the system slot **after the policy sections** — a terse directory of the scheme families available to this worker, so the model knows what URI resources and operations exist before it acts. Each scheme that ships a `manifest.example` contributes one or more concise canonical ops (no scheme prefix; each example self-documents) into a `plurnk` fence. Scheme example sets are separated by one blank line. The doc is NOT linked inline — it is materialized as the worker-private skill `worker://~/_plurnk/skills/plurnk/<scheme>.md` and discovered via the turn-0 `## FIND0 [+init,+skills] (worker://~/_plurnk/skills/plurnk/*.md)` survey ({§skills-functionality}), keeping the raw packet free of doc links. Meta-owned `worker` depth is required teaching ({§teaching-corpus}); a failed source read rejects materialization with its cause and never falls back. Other core and plugin schemes may supply optional `manifest.documentation`; absence contributes no pull doc. The verbose semantics live in that pull doc (materialized like any entry, READ on demand), not the hot path — terse pushes, depth pulls. A scheme with no example (provisional) is omitted; `PLURNK_SERVICE_DOCS_EXCLUDE` drops a named scheme's examples + doc.
 
 ### §inject system.inject — the operator injection
 
-§packet-inject When `PLURNK_SERVICE_PACKET_INJECT` names a readable markdown file, its content renders as an `## Operator Notes` section in the system slot after policy and capability teaching (definition → policy → project policy → tools → resources → inject). Read per-turn so the operator's edits take effect live; a set-but-unreadable path fails the turn hard (a deliberate setting with a broken path is a misconfig, surfaced not hidden). `~/` expands to home. It's the operator-side complement to the plugin section hook — a pressure valve so reshaping the packet edits operator content, never the core. Unset → no section.
+§packet-inject When `PLURNK_SERVICE_PACKET_INJECT` names a readable markdown file, its content renders as an `## Operator Notes` section in the system slot after policy and capability teaching (definition → policy → project policy → resources → inject). Read per-turn so the operator's edits take effect live; a set-but-unreadable path fails the turn hard (a deliberate setting with a broken path is a misconfig, surfaced not hidden). `~/` expands to home. It's the operator-side complement to the plugin section hook — a pressure valve so reshaping the packet edits operator content, never the core. Unset → no section.
 
 ### §policy system.policy — the client's policy injection
 
-§policy-sections Two sections ride the system slot **after the definition and before loop-dependent capabilities**: `## Policy` from `PLURNK_SERVICE_POLICY` (default `~/.plurnk/AGENTS.md`) and `## Project Policy` from `PLURNK_SERVICE_PROJECT` (default `<projectRoot>/AGENTS.md`, resolved relative to the workspace root). AGENTS.md is **policy** — the client's authoritative rules promoted into the privileged zone — NOT a curatable, foldable, READ-able entry; the model cannot FOLD it away. A default-absent path is silent (the section is omitted); an explicit override (env set) that fails to read fails the turn hard — a deliberate setting with a broken path is a misconfig, surfaced not hidden. Read per-turn so edits take effect live. Reference and scratch docs are NOT policy; `PLURNK_SERVICE_MD_*` materializes them as READ-able entries ({§operator-config}).
+§policy-sections One section rides the system slot **after the definition and before capability teaching**: `## Policy` from `PLURNK_SERVICE_POLICY` (default `$XDG_CONFIG_HOME/plurnk/AGENTS.md`, {§host-path-layout}). Policy is the client's authoritative rules promoted into the privileged zone — NOT a curatable, foldable, READ-able entry; the model cannot FOLD it away. A default-absent path is silent (the section is omitted); an explicit override (env set) that fails to read fails the turn hard — a deliberate setting with a broken path is a misconfig, surfaced not hidden. Read per-turn so edits take effect live. The PROJECT `AGENTS.md` is local guidance, not policy: it rides turn 0 as the foisted `worker://~/_plurnk/agents.md` entry ({§turn0-agents-stunt}); all other reference material is skills under the worker's private skills tree ({§skills-functionality}).
 
-On first run, and only when `~/.plurnk` itself is absent, the service seeds
+On first run, and only when `$XDG_CONFIG_HOME/plurnk` itself is absent, the service seeds
 `AGENTS.md` from `@plurnk/plurnk-meta/PLURNK_PERSONALITY.md` ({§teaching-corpus}).
 It reads that required source before creating the service home; a failed read
 surfaces with its cause and leaves no apparently initialized home.
 After that bootstrap the file is user-owned: edits and deletion persist, and a
 later boot never refreshes or recreates it.
 
-§schemes-self-doc-materialization **The scheme self-doc contract.** `@plurnk/plurnk-schemes` owns `example` and `documentation` in `SchemeManifest` ({§manifest-self-doc}); the former is the hot-path operation example set and the latter is the deep pull doc. `SchemeRegistry.teach(workspaceId)` renders the effective directory, `SchemeRegistry.docs(workspaceId)` resolves corpus-or-manifest documentation, and `docEntries(workspaceId)` supplies the current pull-document set when core publishes capabilities for a workspace. Materialization reconciles `worker://plurnk/docs/` exactly under the workspace capability gate: vanished contributions are deleted before current documents are upserted, so an excluded, disabled, detached, or replaced capability cannot leave a stale model-facing contract.
+§legacy-home-transition A legacy `~/.plurnk` is never an ambient fallback. If
+legacy state exists while canonical destinations do not, ordinary startup
+fails with the exact `plurnk-service paths migrate` recovery. That explicit,
+idempotent command refuses destination conflicts and a live database owner,
+moves known user configuration and durable SQLite files to their semantic
+homes, byte-verifies the complete copied set before removing any source,
+discards only recognized generated references, and removes the empty legacy
+directory. A pre-commit failure rolls back canonical files and directories
+created by that attempt. Unknown legacy members or simultaneous
+legacy/canonical state fail without guessing. No dual read or dual write survives
+the transition.
+
+§schemes-self-doc-materialization **The scheme self-doc contract.** `@plurnk/plurnk-schemes` owns `example` and `documentation` in `SchemeManifest` ({§manifest-self-doc}); the former is the hot-path operation example set and the latter is the deep pull doc. Every published pull doc carries an exact H2 `Summary` for ordinary catalog projection. `SchemeRegistry.teach(workerId)` renders the effective directory, `SchemeRegistry.docs(workerId)` resolves corpus-or-manifest documentation, and `referenceEntries(workerId)` supplies the current `/skills/plurnk/` generated-skill set when core publishes worker Functionality ({§skills-functionality}). One materializer reconciles the worker's private scope exactly: vanished contributions are deleted before current documents are upserted, so an excluded scheme or disabled, detached, replaced, or removed runtime cannot leave a stale model-facing contract.
 
 ### §packet-git-status The Git status section — compact repository state
 
@@ -3134,7 +3824,7 @@ active direct child of a running branch batch additionally receives its assigned
 branch and the requirement to commit any project changes and leave the checkout
 clean before concluding ({§worker-branch-batch-return}); no other worker receives
 that instruction. The section never repeats an unbounded path list. Per-path state belongs to
-the durable causal observation: a `source=file` environment-delta row carries
+the runtime actor's durable causal evidence: its `source=file` row carries
 the exact two-character porcelain `XY` value as `git` metadata when the status
 snapshot names that path. The engine takes one snapshot after membership
 reconciliation and uses it for both projections; no per-file Git process exists.
@@ -3285,15 +3975,16 @@ projection, and binary handling. Text scope meaning does not vary by mimetype.
 §render-rule-line-navigable-prefix Every textual content body with a source
 `startLine` renders with a coordinate prefix on each physical line, independent
 of mimetype. A successful exact READ whose active scheme declares
-`textEditScopes: true` and model write authority supplies `@hash N:` with one
+`lineAnchors: true`, or `textEditScopes: true` with model write authority, supplies `@hash N:` with one
 or more ASCII spaces before `N` under
-{§line-anchors}; every other body renders `N:`. JSON, XML, and HTML are therefore just as
+{§line-anchors}; generated FIND rows render a result ordinal left-padded to the
+complete result total's width; every other body renders `N:` left-padded to its own largest line number's width, so every body keeps one stable content column. JSON, XML, and HTML are therefore just as
 line-addressable as markdown and source code. The prefix is a packet
 presentation aid, never part of canonical content; matchers and mutations
 consume canonical bytes before rendering. A producer may set `startLine: null`
 only when its content is already source-numbered, such as an effect receipt.
 
-§render-rule-find-renders-result A log row's canonical full body is resolved once by `LogBody`: READ/FIND, model-emission, prompt, and extension result content comes from `rx.content`; EDIT uses its structured receipt or an environment-delta span; COPY/MOVE concatenate the textual receipt contexts in their ordered `effects`; EXEC and the composed PLAN/SEND/WORK/FORK family use their statement body. Whole-channel COPY/MOVE effects are bodyless rather than fabricating a text projection. Packet rendering applies {§body-projection} and the coordinate projection in {§render-rule-line-navigable-prefix}. READ/FIND over `log:///` and search consume the complete canonical body instead. Status and content are orthogonal: a failed terminal stream READ retains its Problem Details and failure status while rendering captured diagnostic output; failure never erases evidence.
+§render-rule-find-renders-result A log row's canonical full body is resolved once by `LogBody`: READ/FIND, actionless source artifacts, prompt, and extension result content comes from `rx.content`; EDIT uses its structured receipt or an environment-delta span; COPY/MOVE concatenate the textual receipt contexts in their ordered `effects`; PLAN serializes its canonical value through the shared {§json-result-rendering} spread as `application/json`; EXEC and SEND/WORK/FORK use their statement body. Whole-channel COPY/MOVE effects are bodyless rather than fabricating a text projection. Packet rendering applies {§body-projection} and the coordinate projection in {§render-rule-line-navigable-prefix}. READ/FIND over `log:///` and search consume the complete canonical body instead. Status and content are orthogonal: a failed terminal stream READ retains its Problem Details and failure status while rendering captured diagnostic output; failure never erases evidence.
 
 An `EDIT` log row renders its bounded effect receipt (`rx.receipt`) as row
 metadata and join context, not its input statement. Proposal-gated file EDITs
@@ -3343,7 +4034,7 @@ Carried from the contract walk; durable.
   {§copy-move-observation}.
 - **READ rx** prefixes every textual line under {§render-rule}; eligible
   editable resources carry `@hash N:`, and all others carry `N:`.
-- **FIND body matcher** applies to entry content (all dialects), per-candidate via the in-tree `Matcher.matchAgainstContent` ({§matcher-dispatch}; status 200 = content hit → entry selected). The target scope selects candidates; the path-glob is the (target). FIND's signal classifies its own log item ({§log-item-tags}).
+- **FIND body matcher** applies to the addressed entry channel (all dialects), per-candidate via the in-tree `Matcher.matchAgainstContent` ({§matcher-dispatch}; status 200 = content hit → entry selected). The target scope and channel select candidates; the path-glob is the (target). FIND's signal classifies its own log item ({§log-item-tags}).
 - **OPEN/FOLD** operate on the **log** (`log:///`), not entries ({§open-fold}) — FOLD collapses a log row to its path, OPEN restores its body. Aimed at an entry scheme they return 501.
 - **SEND signal `410`** deletes as a side-effect (not the model idiom; {§move}): with `#fragment`, that channel only; without, the whole entry. **SEND signal `499`** resolves the durable open-subscription row and invokes that subscription's exact callable owner through the process-local live registry ({§subscriptions}).
 - **File scheme** detects with `Mimetypes.detect({ path })` and classifies with the same configured service ({§mimetype-classification-consumption}). Handler-declared binary sources materialize through {§membership-source-projection}; projected bodies are READ-able, while source-aware EDIT remains 415.