@plurnk/plurnk-service 1.8.0 → 1.9.0

package/SPEC.md

@@ -47,7 +47,7 @@ their absence never makes a client, plugin, or `_plurnk` turn exceptional.
 | Field | Contract |
 |---|---|
 | `producer` | Required actor class: `model`, `client`, `plugin`, or `_plurnk`. |
-| `kind` | Required purpose: `inference`, `initialization`, `overflow`, or `operation`. Model iff inference; initialization and overflow require `_plurnk`. |
+| `kind` | Required purpose: `inference`, `initialization`, `overflow`, `operation`, or `maintenance`. Model iff inference; initialization, overflow, and maintenance require `_plurnk`. A maintenance turn's successful rows are packet-suppressed — a receipt answers an asker, and maintenance has none ({§actor-boundary-doc-injection}). |
 | `status`, `completed_at` | A new turn is open at status 102 with `completed_at=NULL`. Completion records the exact terminal SEND/operation disposition and timestamp; a completed 102 is therefore distinct from an open 102. |
 | Operations | Ordered by `(turn_id, sequence)` on one exact worker/loop/turn chain. Each row's `origin` is the turn producer or `_plurnk` making a system observation; the observation does not impersonate the producer. |
 | `turnOps` | Every admitted source-backed turn preserves its exact PLAN…SEND program as one undecorated actionless log item under {§turn-ops-entry}. The item supplements rather than replaces the executed operation rows. |
@@ -75,7 +75,7 @@ not fabricate verbatim source.
 
 | Term | Meaning |
 |---|---|
-| **entry** | The unit of canonical state. Identity: `(workspace, owner, scheme, pathname)` ({§entry-identity-no-null}). Holds one or more `channels` of content plus private `attributes`. |
+| **entry** | The unit of canonical state. Identity: `(owner, scheme, authority, pathname)`; the owner Worker determines the workspace ({§entry-identity-no-null}). Holds one or more `channels` of content plus private `attributes`. |
 | **channel** | A named content buffer on an entry. Examples: `body`, `stdout`, `stderr`, `headers`, `symbols`. Each channel has `content`, `mimetype`, curation `weight`, and lifecycle `state`. |
 | **scope** | A scheme-manifest declaration ignored by core; registrations are discovered at boot and are not persisted. Entry sharing and privacy are owner-based; #80 owns retiring this residual axis. |
 | **scheme** | An addressed capability family + handler. Built-ins include `worker`, `prompt`, `log`, and bare/file paths; discovered schemes and executor-runtime tags extend that set. Internal `exec` routes the EXEC op but is not an addressable model namespace. Consumption surface {§scheme-surface}; author contract: [plurnk-schemes](../plurnk-schemes/SPEC.md). |
@@ -214,6 +214,18 @@ clients render and submit actions but contain no engine logic.
 
 OpenTelemetry may observe PLURNK; it never becomes product state, failure transport, scheduler input, model teaching, or client protocol. Domain and client activity remain on AG-UI. Reusable packages depend on the OTel API only; the daemon constructs only the explicitly configured trace and metric providers. An unconfigured or standards-valid disabled process loads no SDK or exporter implementation and keeps the API's no-op behavior with bounded overhead. OTel Logs have no provider or initialization path.
 
+### §standards-discernment Standards discernment
+
+Seven principles govern which exterior standards Plurnk conforms to (#299):
+
+1. **UVP first.** Never conform away what users chose Plurnk for; the OP grammar, curated log, packet, and worker graph are the product, not a compatibility gap.
+2. **Right-fit.** Hobbyist-first: an enterprise-grade feature is acceptable only when its cost lands on the party that wants it, never on general adoption.
+3. **Traction.** Count running counterparties today; integration horizon must be shorter than the standard's expected half-life. Sockets stay configurable with no default until a candidate earns it.
+4. **POSIX app identity.** Decades-stable host-ecosystem conventions (XDG, NO_COLOR, man, completions, service units) outrank months-stable AI-pipeline fashions.
+5. **Faces, never organs.** A standard adopts as one adapter or projection behind an existing seam; if it cannot, that is the alarm, and it goes to a design gate.
+6. **Deletion is the price of admission.** A standard earns adoption by deleting bespoke surface (the ACP Plan object deleted the Markdown plan microformat); parallel representations, second discovery paths, and compatibility grammars are refused.
+7. **Two arbiters.** Model-facing surfaces change only on measured model evidence; human-facing surfaces follow host-ecosystem convention without ceremony. Standards bodies get a vote on neither.
+
 Configuration uses the standard `OTEL_*` environment: `OTEL_TRACES_EXPORTER` / `OTEL_METRICS_EXPORTER` select `otlp` or `console` per signal (a missing or `none` value keeps that signal off; no SDK default selects an exporter), `OTEL_SERVICE_NAME` names the service (default `plurnk-service`), case-insensitive `true` in `OTEL_SDK_DISABLED` turns the boundary off, and OTLP exporters honor `OTEL_EXPORTER_OTLP_*`. An unknown exporter name fails daemon boot; a typo never silently disables observation. OTel Logs and direct draft semantic-convention use are excluded. HTTP spans carry only an AG-UI-owned bounded route class, never an input pathname or query. Spans otherwise carry high-cardinality identifiers; metric labels stay low-cardinality. Prompts, reasoning, file bodies, arbitrary URLs, secrets, and plugin payloads are never recorded as attributes or metric values by default. Exporter failure cannot change product results or client lifecycle. Daemon, telemetry, and database teardown are independent reverse-ownership phases; every phase runs and aggregate failure preserves every cause.
 
 §observability-genai-conventions **GenAI convention projection.** Provider
@@ -287,9 +299,10 @@ preserving the originating failure.
 
 ```mermaid
 flowchart LR
-    actor["Worker A"] -->|"shared file or shared entry op"| state["Shared project files<br/>and shared workspace entries"]
-    state -->|"folded attributed delta<br/>environment door"| log["Worker B log"]
-    actor -->|"SEND to worker B<br/>voice door"| log
+    child["Child worker"] -->|"durable activity<br/>environment door"| parent["Direct parent log"]
+    actor["Any worker"] -->|"mutate worker:/// commons"| commons["Workspace commons"]
+    commons -->|"one folded broadcast occurrence"| logs["Every existing worker log"]
+    actor -->|"SEND to named worker<br/>voice door"| log["Addressed worker log"]
     client["User / client"] -->|"loop.inject<br/>voice door"| log
 ```
 
@@ -304,34 +317,68 @@ render-time filter.
 **attribution** — the delta's provenance ({§env-delta}) — and is never read to
 filter a row.
 
+§actor-boundary-attached-functionality **A client operates in the Worker it is
+attached to.** A client connection is attached to one conversation Worker; its
+management commands mutate that Worker's Functionality ({§module-worker-capabilities}),
+and its operations execute in that Worker's environment — executable families,
+runtime schemes, per-Worker tool admission, flag-scoped scheme availability,
+and effect policy resolve through the attached Worker — while the operation
+journals in the client's own worker ({§connection-lifecycle}) and any entry it
+writes binds its principal through that client worker. Every dispatch therefore
+carries two coordinates: `workerId`, the journaling and entry principal, and
+`functionalityWorkerId`, the Worker whose Functionality applies. They are equal
+for model and `_plurnk` dispatches; a client dispatch names its attached
+Worker, which must belong to the same workspace, and Functionality residency is
+acquired for that Worker. Attachment is a connection fact, not topology: it is
+many-to-one, non-owning, and never expressed as parentage.
+
 §actor-boundary-two-doors **Cross-worker arrival is limited to two doors.**
 An explicit READ is not an arrival: the reading worker deliberately addresses a
 file or ancestry-authorized entry through ordinary dispatch ({§worker-read-scope}).
 
-| Door        | Carries                                                                                 | Wake behavior                                                    |
-| ----------- | --------------------------------------------------------------------------------------- | ---------------------------------------------------------------- |
-| Environment | A change to a shared project file or shared worker entry, as a folded attributed delta. | Ambient state never wakes an idle worker ({§env-delta}).         |
-| Voice       | A directed `loop.inject` or `## SEND0 (worker://name)` message.                          | An active worker folds it into its next turn; an idle one wakes. |
-
-§actor-boundary-no-mutex **Wild west by default; explicit branch batches are the exception.** Ordinary workers share workspace state without locks. Coordination is cooperative and softly fenced (the {§membership} `read-only` overlay, a workspace policy, bounds every worker's writable surface uniformly — {§machine-processes}); a conflict *surfaces* as a delta rather than being prevented. A branch-tagged WORK/FORK opts the whole workspace into the bounded, exclusive Git transaction in {§worker-branch-batch}. It is not a general entry mutex or a hidden per-worker filesystem.
+| Door        | Carries                                                                                                                                      | Wake behavior                                                                                 |
+| ----------- | -------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------- |
+| Environment | A direct child's durable activity to its parent, plus a successful mutation of the deliberately global `worker:///` commons to every worker. | Intermediate activity and commons never wake; a child's terminal disposition wakes its parent. |
+| Voice       | A directed `loop.inject` or `## SEND0 (worker://name)` message.                                                                               | An active worker folds it into its next turn; an idle one wakes.                              |
+
+§actor-boundary-lineage-attention **Addressability is workspace-wide; attention
+is lineage-scoped.** Project files, registered resources, and permitted worker
+entries remain addressable throughout the workspace, but ordinary changes do
+not enter unrelated workers' logs. A child's activity reaches only its direct
+parent. That observer row carries the source occurrence identity and never
+republishes, so grandparents observe what their own direct children do without
+receiving an automatic recursive mirror of every descendant.
+
+§actor-boundary-commons-broadcast **`worker:///` is the explicit global
+attention surface.** A successful mutation whose landed effects touch the
+commons emits one occurrence to every worker that existed when it landed.
+Lineage and commons audiences are a union over that one identity: when a child
+mutates the commons, its parent receives one observer row, never a parent copy
+plus a broadcast duplicate. Ordinary project files, private worker entries,
+and remote resources do not acquire ambient attention merely because they are
+workspace-addressable.
+
+§actor-boundary-no-mutex **Wild west by default; explicit branch batches are the exception.** Ordinary workers share workspace state without locks. Coordination is cooperative and softly fenced (the {§membership} `read-only` overlay, a workspace policy, bounds every worker's writable surface uniformly — {§machine-processes}); stale writes reject at their anchor or compare-and-swap boundary rather than being prevented by a lock ({§line-anchors}, {§membership-edit-write-cas}). A branch-tagged WORK/FORK opts the whole workspace into the bounded, exclusive Git transaction in {§worker-branch-batch}. It is not a general entry mutex or a hidden per-worker filesystem.
 
 §actor-boundary-passive-wake **Passive wake follows ownership.** A directed
 voice wakes an idle worker. A parked continuation resumes when an obligation it
-owns — a child or stream — reaches an observable transition ({§worker-loop-lifecycle}).
-An ambient environment delta never wakes; it queues until one of those directed
-events produces a turn ({§env-delta}). The obligation edge is continuation
-control, not a third door through which arbitrary sibling state can enter.
+owns — a child or stream — reaches an observable terminal transition
+({§worker-loop-lifecycle}). Intermediate child activity and commons broadcasts
+never wake; they queue until another cause produces a turn ({§env-delta}). The
+obligation edge is continuation control, not a third door through which
+arbitrary workspace state can enter.
 
 §actor-boundary-self-hosting **Use the actor path when the work has an
 operation; retain irreducible rails in the kernel.** The workspace has one
 reserved `plurnk` worker. It is durable; `DispatchAsPlurnk` opens a fresh
 administrative loop and turn for each ordinary operation batch. Other workers
-never receive its private log. They deliberately READ its published entries;
-ambient shared-state changes still cross only through the environment door.
+cannot read its private log or entries. Generated references are instead
+materialized directly in the addressed worker's private space; only direct
+lineage activity and explicit commons mutations cross the environment door.
 
 | Work                                    | Owning path                                                         | Why                                                                                 |
 | --------------------------------------- | ------------------------------------------------------------------- | ----------------------------------------------------------------------------------- |
-| Operator/client reference documents     | Reserved `plurnk` worker; ordinary EDIT through engine dispatch.    | Creating or replacing an entry is already an operation.                             |
+| Worker reference documents              | Addressed worker; `_plurnk` EDIT through engine dispatch.           | Creating or replacing a private entry is already an operation.                      |
 | Git membership and disk materialization | Kernel `GitMembership` / entry CRUD.                                | Ingesting existing disk state is not a model-authored EDIT.                         |
 | Disk-divergence narration               | Kernel writes an EDIT-shaped `source=file` row to the `plurnk` log. | It reports an environment event honestly; no operation is fabricated as having run. |
 | Search derivation and catalog render    | Kernel.                                                             | They are indexes and read-only projections, not entry operations.                   |
@@ -341,33 +388,34 @@ Git membership includes tracked and untracked-but-not-ignored project files
 ({§membership-auto-add}); it does not stage them or run `git add`.
 
 §turn0-agents-stunt **The project AGENTS.md is a turn-0 stunt.** When
-`<projectRoot>/AGENTS.md` exists, LoopDocs materializes it as the kernel-owned
-`worker://plurnk/agents.md` entry and the engine foists one READ of it into
-each model worker's first turn — visible, logged, line-addressable. Absent
+`<projectRoot>/AGENTS.md` exists, LoopDocs materializes it as the current worker's private
+`worker://~/_plurnk/agents.md` entry and the engine foists one READ of it into
+that model worker's first turn — visible, logged, line-addressable. Absent
 file: no entry, no stunt, nothing 404s. The global XDG configuration `AGENTS.md`
 remains system-prompt policy ({§policy-sections}); the stunt carries only
 local repo guidance.
 
-§actor-boundary-doc-injection **The project AGENTS.md uses the actor
-path.** The project's `AGENTS.md` is materialized as
-`worker://plurnk/agents.md` through a `DispatchAsPlurnk` EDIT, then foisted as
-one READ into each model worker's turn 0 ({§turn0-agents-stunt}). The
-materializing EDIT remains in the `plurnk` worker's log; the model sees the
-shared entry through its own READ.
+§actor-boundary-doc-injection **Generated documents use the actor path.** The
+project's `AGENTS.md`, skills, and Functionality references are materialized in
+the addressed worker's `_plurnk/` subtree ({§worker-generated-subtree}) through
+ordinary `_plurnk` operation turns. Their exact
+EDIT and SEND programs remain durable in that worker's log; generated state is
+neither a hidden database write nor a kernel-owned mirror.
 
 §actor-boundary-catalog-preview **Catalog preview.** `PLURNK_SERVICE_FILES_ITEMS`
 foists turn-0 discovery into the worker's first turn, so a worker opens with a
-navigable map instead of blank. An enabled preview executes exactly six baseline
-bodyless FIND surveys in order: authored skills (`## FIND0 [+init,+skills]
-(worker://plurnk/skills/*.md) <1,-1>`), Plurnk-generated reference families
-(`## FIND0 [+init,+skills] (worker://plurnk/skills/plurnk/*.md) <1,-1>`), enabled
-tool families (`## FIND0 [+init,+tools] (worker://plurnk/tools/*.md) <1,-1>`),
-project files (`## FIND0 [+init] (*)`), workspace commons (`## FIND0 [+init]
+navigable map instead of blank. An enabled preview executes exactly seven baseline
+bodyless FIND surveys in order: enabled Agent Skills (`## FIND0 [+init,+skills]
+(worker://~/_plurnk/skills/*.md) <1,-1>`), Plurnk-generated reference families
+(`## FIND0 [+init,+skills] (worker://~/_plurnk/skills/plurnk/*.md) <1,-1>`), enabled
+tool families (`## FIND0 [+init,+tools] (worker://~/_plurnk/tools/*.md) <1,-1>`),
+enabled outbound agents (`## FIND0 [+init,+agents] (worker://~/_plurnk/agents/*.md)
+<1,-1>`, {§a2a-agents-catalog}), project files (`## FIND0 [+init] (*)`), workspace commons (`## FIND0 [+init]
 (worker:///*)`), and the worker's own space (`## FIND0 [+init] (worker://~/*)`).
 The catalogs select every direct document independently of its authored body;
 ordinary READ supplies its examples and complete instructions on demand. Their
 log classifications make the opening discovery one `init` set while retaining
-`skills` or `tools` on the corresponding rows ({§log-item-tags}). A shallow
+`skills`, `tools`, or `agents` on the corresponding rows ({§log-item-tags}). A shallow
 result renders direct entries normally and every deeper first-segment directory
 as an actionable `dir/**` summary with its recursive `items` and `tokens`;
 tool-family rows also carry the concise `{§scheme-catalog-summary}` that drives
@@ -382,7 +430,7 @@ direct-entry-plus-directory count; `-1` enables the ordinary markerless page;
 unset / `0` disables previews. `log://` is absent because the current worker's
 log already renders in present mode.
 
-§worker-initialization-entry **Worker initialization is a real `_plurnk` turn.** A worker's first loop begins with one packetless `{ producer="_plurnk", kind="initialization" }` turn submitted through {§turn-ops-admission-path}. It preserves one OPEN exact `turnOps` item and dispatches the same source into ordinary PLAN, orienting READ/FIND, and terminal `SEND0 [102]` rows. Every row is structurally classified `_plurnk` and `init`. The PLAN states `* Discover the tooling available and survey the workspace file root.`; SEND hands off with `Next: Address the prompt.` The first model request occupies the following turn and therefore begins at database/log turn sequence 2; “turn zero” is the initialization phase's model-facing label, not a zero-based database coordinate.
+§worker-initialization-entry **Model-worker initialization is a real `_plurnk` turn.** A model worker's first loop begins with one packetless `{ producer="_plurnk", kind="initialization" }` turn submitted through {§turn-ops-admission-path}. It preserves one OPEN exact `turnOps` item and dispatches the same source into ordinary PLAN, orienting READ/FIND, and terminal `SEND0 [102]` rows. Every row is structurally classified `_plurnk` and `init`. The PLAN is the canonical {§plan-value} with one `medium`, `in_progress` entry whose content is `Discover the tooling available and survey the workspace file root.`; SEND hands off with `Next: Address the prompt.` The first model request occupies the following turn and therefore begins at database/log turn sequence 2; “turn zero” is the initialization phase's model-facing label, not a zero-based database coordinate. Client and `_plurnk` administrative workers execute operation turns and do not receive model initialization.
 
 ### §machine-processes The machine and its processes: workspace, worker, fork
 
@@ -418,19 +466,28 @@ terminal history.**
 | Project files ({§machine-processes-one-filesystem})   | Workspace         | Shared live; a fork does not create another checkout.                                                              |
 | Shared worker entries (`worker:///...`)               | Workspace commons | Shared live.                                                                                                       |
 | Membership overlay ({§machine-processes-one-overlay}) | Workspace         | Shared unchanged; divergent membership requires another workspace.                                                 |
-| Log items ({§machine-processes-fork-copies-the-log})  | Worker            | Rows, event identities, curation effects, tags, folded body intervals, and the matching observation cursor are copied as terminal history. |
+| Log items ({§machine-processes-fork-copies-the-log})  | Worker            | Rows, event identities, curation effects, tags, folded body intervals, and the matching observation cursor are copied as terminal history. Parent-audience occurrences still pending at the fork boundary belong to the snapshot; later sibling activity does not. |
 | §machine-processes-fork-cost **Provider evidence and accounting** | Worker | Turns and their model-facing log history are copied, but `model_calls`, emission-admission rows, and physical provider requests are not: one issued call or request has one owning worker. Parent and fork accounting therefore includes only work issued in that branch, while workspace accounting never double-counts copied history. |
-| Private worker entries (`worker://~/...`)             | Worker            | Deep-copied with ownership remapped; parent and child then diverge.                                                |
+| §machine-processes-entry-inheritance **Worker-owned entries** | Worker | The scheme's mandatory `{§manifest-entry-inheritance}` decides: `snapshot` copies only entries whose channels are all quiescent and remaps ownership; `rederive` copies no bytes and lets the child materializer rebuild them from inherited Functionality; `none` carries nothing. Within a `snapshot` scheme the Worker scheme's generated subtree is always rederived ({§worker-generated-subtree}). Parent and child then diverge. |
 | Active loops, turns, and cancellation                 | Worker            | Never copied as live work; inherited structure is terminal history, then a new loop starts.                        |
 
 §machine-processes-worker-is-its-log **A worker's conversational memory of
 the shared world is its log, with no hidden per-worker snapshot beside it.**
 OPEN/FOLD changes canonical folded body intervals on that worker's rows ({§open-fold});
-environment changes arrive as attributed log entries ({§env-delta}). Private
-worker entries are deliberate scratch that the worker reads and writes through
-`worker://~/...`, not an invisible mirror of shared state. The environment door
-therefore carries only shared project-file and shared-entry changes
-({§env-delta-worker-entry-visibility}).
+lineage activity and explicit commons broadcasts arrive as attributed log
+entries ({§env-delta}). Worker-owned entries include deliberate scratch and
+other private resources; their manifest declares whether a FORK snapshots,
+rederives, or omits each class. They are not an invisible mirror of shared state. Workspace
+addressability does not imply packet membership or ambient notification
+({§actor-boundary-lineage-attention}).
+
+§machine-processes-fork-pending-activity **A fork is a closed snapshot of the
+parent's view.** It copies rows already materialized in the parent and inherits
+parent-audience occurrences newer than the copied observation cursor through
+the occurrence high-water captured by worker creation. Activity addressed to
+the parent after that boundary is sibling activity, not fork history. Global
+commons broadcasts remain live after the fork because the branch is then an
+existing workspace worker in its own right.
 
 §machine-processes-model-worker-readable **A worker's log is private to packets, not to the workspace.** Isolation ({§actor-boundary}) governs what an *actor* sees — its own worker, never a sibling's. It does not wall off the client interface: `readLog({ workspaceId, workerId })` may read any ownership-verified worker in that workspace, and `listWorkers` enumerates them. A client-interface module chooses the default worker from its own conversation binding. The read is observation, never packet membership — no actor sees it.
 
@@ -456,9 +513,9 @@ shared entries, and membership remain live and uncopied.
 histories over one workspace are worker forks. A divergent project filesystem
 or membership overlay requires a new workspace.
 
-### §worker-scheme The worker:// scheme — the knowledgebase (commons, own space, named spaces, the kernel surface) and worker control (spawn, irc, fork, terminate, cap, collect)
+### §worker-scheme The worker:// scheme — the knowledgebase (commons, own space, named spaces) and worker control (spawn, irc, fork, terminate, cap, collect)
 
-§worker-authority-carving **The authority names the OWNER:** `worker:///notes.md` is in the COMMONS — a shared blackboard; `worker://~/draft.md` is the calling worker's own private space; `worker://<name>/result.md` is a named worker's space; `worker://plurnk/skills/…` is the kernel's published surface, world-readable ({§skills-materialization}). Storage keys the owner on the entries.owner_id column ({§entry-owner}) — the pathname is always the bare entry path, and a FIND's result paths re-apply the queried authority so the model sees the address it typed. `~` is the sole current-worker sigil and cannot be minted; `commons` and `plurnk` are internal worker names unavailable for minting. Every other mintable authority, including `self`, is a literal worker name ({§worker-name}).
+§worker-authority-carving **The authority names the OWNER:** `worker:///notes.md` is in the COMMONS — a shared blackboard; `worker://~/draft.md` is the calling worker's own private space; `worker://<name>/result.md` is a named worker's space. Storage keys the owner on the entries.owner_id column ({§entry-owner}) — the pathname is always the bare entry path, and a FIND's result paths re-apply the queried authority so the model sees the address it typed. `~` is the sole current-worker sigil and cannot be minted; `commons` and `plurnk` are internal worker names unavailable for minting. Every other mintable authority, including `self`, is a literal worker name ({§worker-name}).
 
 §worker-name-minting **URI ingestion is permissive; worker minting is not.**
 Every model/client worker-creation door applies the contracts-owned
@@ -472,9 +529,11 @@ continues to decompose other authorities without treating them as mintable.
 | Any other spelling                             | Refused as `name-invalid` before lookup, insertion, or child startup. |
 | Automatic name                                 | Generated, then admitted through the same predicate.                  |
 
-§worker-read-scope **Named spaces are ancestry-gated reads**: the reader is the owner or an ANCESTOR (the recursive parent_worker_id walk) — oversight flows down the tree, a parent reads `worker://child/result` across generations, a child cannot snoop upward, and an unknown name or unpermitted reader resolves 404 with no existence leak. The kernel surface is the one world-readable named space.
+§worker-read-scope **Named spaces are ancestry-gated reads**: the reader is the owner or an ANCESTOR (the recursive parent_worker_id walk) — oversight flows down the tree, a parent reads `worker://child/result` across generations, a child cannot snoop upward, and an unknown name or unpermitted reader resolves 404 with no existence leak. Reserved runtime workers obey the same rule; there is no world-readable named space.
 
-§worker-write-scoping **Writes are own-space-and-commons only**: a model writes `worker://~/` and `worker:///` — every named authority is read-only to it (403), and owner_id is engine-stamped from the dispatch context, never model-set. Nothing worker-authored can land under another principal — `worker://plurnk/` included, which is what makes the kernel surface the trust boundary with no guard to forget (only the kernel, dispatching as itself, authors it). The entry-copy seam (COPY/MOVE) is pathname-keyed and addresses the commons; a space's content moves via READ + EDIT.
+§worker-write-scoping **Writes are own-space-and-commons only**: a model writes `worker://~/` and `worker:///` — every ancestry-readable named authority is read-only to it (403), while an unreadable name remains 404 under {§worker-read-scope}. `owner_id` is engine-stamped from the dispatch context, never model-set. Nothing worker-authored can land under another principal. The entry-copy seam (COPY/MOVE) is pathname-keyed and addresses the commons; a space's content moves via READ + EDIT. The one exception inside a writable space is the generated subtree below.
+
+§worker-generated-subtree **`_plurnk/` is Plurnk's generated subtree in every worker space.** Every Plurnk-generated per-Worker document lives under `worker://~/_plurnk/`: the project instructions (`_plurnk/agents.md`, with nested AGENTS.md files under `_plurnk/instructions/**` preserving their subtree paths — the standard's closest-file scope, materialized without any foisted READ or teaching), standard Agent Skills and Plurnk-generated references (`_plurnk/skills/**`), executable families (`_plurnk/tools/**`), and future family catalogs. The subtree is readable exactly like the rest of the space ({§worker-read-scope}) and writable only by the `_plurnk` writer tier: a model, client, or plugin EDIT, KILL, SEND 410, or COPY/MOVE destination whose pathname begins `/_plurnk/` is refused 403 `worker-generated-read-only`, in the commons as well as in own and named spaces. Its documents are materialized through ordinary `_plurnk` **maintenance** turns ({§actor-boundary-doc-injection}), so provenance is legible at the address and durable in the log — but a receipt answers an asker, and maintenance turns have none: their successful rows never render in the packet (failures remain visible), while READ over `log:///` recovers them exactly and the turn's self-FOLD keeps client waterfalls tidy. On FORK the subtree is never byte-copied; the child rederives it from its inherited Functionality ({§machine-processes-entry-inheritance}). A runtime's `resourcesPath` is relative to this root ({§tools-resource-materialization}). No world-readable kernel authority exists; there is no `worker://plurnk/`.
 
 §worker-control-addressing **Only an exact authority-only address selects worker
 control.** Control is same-workspace only ({§actor-boundary}). Generic URI
@@ -583,13 +642,14 @@ The remaining worker surfaces are:
 - §worker-scheme-terminate **Terminate** — `## KILL0 (worker://<name>)` aborts a named worker and `## KILL0 (worker://~)` aborts the caller: every unresolved loop in that worker's subtree closes 499 and every subscription in the subtree tears down; a literal name with no worker is 404. Cancellation is structured: descendants cannot detach implicitly. The override to the fire-and-forget default is not a parent-power — whoever holds the address may end it; a worker left alone simply ends at its own SEND signal `200`.
 - §worker-scheme-cap **Cap** — `PLURNK_SERVICE_WORKSPACE_WORKERS_MAX_ACTIVE` ceilings the *concurrent* active workers per workspace (a worker with a non-terminal loop); a spawn or fork past it fails hard (508 — no queue, no retry), irc exempt; `-1` disables it. The fork-bomb brake, sized for workspaces that live for months.
 - §worker-scheme-collect **Collect** — a worker's loop reaching a terminal status
-  surfaces to its sisters as an ambient delta ({§env-delta}): a `SEND` from
+  surfaces to its direct parent as an ambient delta ({§env-delta}): a `SEND` from
   `worker://<name>` carrying the loop's exact terminal operation result. A
   **2xx deliverable is born OPEN** (its body
   materialized into the parent's packet, not hidden behind a fold): a child's
   success must reach the parent open and awakening, never a bodyless row. An
   non-2xx result surfaces folded; a failure retains its exact status and Problem. Every death-path is stamped uniformly,
-  so no termination is silent; collection is the shared world moving, never a
+  so no child termination is silent to its owner; collection is lineage
+  supervision, never a
   verb. The **pull** side mirrors the push: a path-absent
   `## READ0 (worker://<name>)` collects that same result on demand for a
   concluded worker; a worker **still running** has not delivered, so the READ
@@ -602,11 +662,11 @@ The remaining worker surfaces are:
   turn the packet's status clump surfaces the live things this worker currently
   holds — open streams (`## Child Streams`) and unconcluded child workers
   (`## Active Child Workers`) — as terse `* <status> <path>` pointers (the same
-  shape as the errors section), just above it. A worker is otherwise marked
-  only at spawn and at conclusion; in between it goes silent, so a model loses
-  track of what it holds and premature-terminates. This is orienting state,
-  never advice: the model sees its live subtree (`* 102 worker://worker-x`,
-  `* active sh:///1/2/3`) and reasons for itself — READ/OPEN/KILL via the path.
+  shape as the errors section), just above it. Folded child activity is durable
+  history; this clump is the current inventory that keeps an active obligation
+  visible even when no new activity arrived. It is orienting state, never
+  advice: the model sees its live subtree (`* 102 worker://worker-x`, `* active
+  sh:///1/2/3`) and reasons for itself — READ/OPEN/KILL via the path.
   Empty sections are omitted, like errors.
 
 ### §worker-loop-lifecycle Worker and loop lifecycle: drain, reap, and passive wake
@@ -629,6 +689,12 @@ stateDiagram-v2
 
 §worker-lifecycle-state-machine The lifecycle store admits only the guarded transitions shown above: `100 → 102`, `102 → 202`, `202 → 100`, and any unresolved state (`100`, `102`, `202`) to a terminal status. Terminal state is immutable. `DrainSupervisor` owns claim, wake, and cancellation; the dispatcher owns model-requested park/conclusion; the daemon owns boot-recovery orchestration; and the engine owns policy terminals. A racing transition that loses observes the durable winner; it does not overwrite it or report the requested state as fact.
 
+§worker-lifecycle-live **Worker liveness is existential, not latest-state.** A
+Worker is live while ANY of its loops is unresolved (`100`, `102`, or `202`). A
+newer terminal loop cannot mask older queued, running, or parked work. Name
+collision, workspace worker caps, child obligations, orientation, and recovery
+all use that one definition.
+
 §stream-catalog-lifecycle Streams are independently durable subscriptions owned by a worker. Payload and
 lifecycle are orthogonal: zero bytes is a valid payload for both success and
 failure, while the closed subscription and its status are the terminal fact.
@@ -741,7 +807,7 @@ boundary.
 - §worker-lifecycle-total-reap **Cancellation is recursive and reaps every held stream.** `loop.cancel`, worker `KILL`, shutdown, and a worker's SEND signal `499` terminalize every unresolved loop in the cancelled worker subtree and iterate each worker's durable open-subscription rows, invoking each exact callable owner from the process-local live registry. The durable rows answer *what is held*; the live registry answers *how this process tears it down*; the abort signal is a fast-path optimization. There is no implicit detachment. Before shutdown awaits drains, it cancels every process-local proposal waiter through {§proposal-cancel-aborts} with outcome `daemon_stopping`, so a stopped-world dispatch cannot hold teardown open. A stream that is running, mid-spawn (its row written before it is killable), or spawned after the cancel is reaped alike. The teardown abort is bounded: the executor sends a polite signal then SIGKILL after a consumer-set grace (`PLURNK_SERVICE_EXEC_KILL_GRACE_MS`). A model `## KILL0 [code]` on one live stream instead delivers exactly that signal once (bare KILL uses the executor's SIGHUP default; `## KILL0 [9]` uses SIGKILL).
 - §worker-lifecycle-exec-epoch-bound **A stream's kill binds to the scope it captured at spawn.** A stream captures the worker's cancellation scope as it registers and wires its kill to it, re-checking `aborted` AFTER wiring — no check-then-listen gap can drop an abort that lands mid-registration. Because the scope is replaced only once aborted, a captured-then-replaced scope is necessarily already aborted, so replacement never strands a live stream.
 - §worker-lifecycle-no-resurrection **A cancelled worker is not resurrected by its own torn-down work.** A stream conclusion delivered to a cancelled, idle worker starts no fresh drain: an aborted (499) conclusion is skipped, and a straggler that concluded cleanly surfaces its deliverable as an environment delta ({§env-delta}), never a revived loop. The cancel was deliberate; only an explicit `runLoop` request resumes the worker.
-- §worker-lifecycle-wake-liveness **A stream conclusion always reaches its worker.** When a backgrounded stream concludes, `DrainSupervisor` routes it through the same inject seam as any loop source ({§actor-boundary-passive-wake}): an active worker folds the conclusion into its next turn; a worker **blocked on a 202 wait** for that stream ({§wait-obligation-matrix}) **awakens that loop in place** — the blocked loop *is* the continuation, so there is no fresh loop and no summary-as-prompt fiction. The result is never lost: a blocked loop sleeps rather than ending, and the stream's status-transition is the arrival ({§actor-boundary-passive-wake}) that wakes it; on resume it reads the concluded stream's own state, not a synthetic prompt.
+- §worker-lifecycle-wake-liveness **A stream conclusion always reaches its worker.** The stream first persists its terminal state. A worker **blocked on a 202 wait** for that stream ({§wait-obligation-matrix}) then **awakens that loop in place** — the blocked loop *is* the continuation, so there is no fresh loop and no summary-as-prompt fiction. An already-active worker needs no injected prompt or second wake because its next packet reads the durable terminal state. A concluded worker receives no synthetic loop from ambient stream closure. The result remains available in the stream's own state under every case.
 - §worker-lifecycle-child-wake **A child worker concluding wakes a parent blocked on it — the topology join.** `worker://` spawn/fork records `parent_worker_id` ({§lifecycle-terms}). When a worker's drain exits having **concluded** — no `202`-blocked loop, no open stream — `DrainSupervisor.#onDrainExit` resumes its parent **in place** through the shared `#wakeParkedWorker`, the same 202→100 resume a stream conclusion uses. So a parent that spawns work and blocks with SEND signal `202` is woken the moment its child finishes; on resume it reads the child's deliverable from the {§worker-scheme-collect} delta in its own log — a control edge, **never an injected prompt**. The wake recurses upward via the parent's own drain-exit. A child still running — or itself blocked at 202 — is not *concluded*, so it does not wake the parent (it's still a live thing the subtree holds). This is the structured-concurrency join: streams and child workers are the same kind of "live thing a worker holds," driving premature-terminate ({§send-premature-terminate}), the wake edge, and the collect delta identically. A worker conclusion is a **bounded, un-loseable** wake: if the conclusion fires while the parent is mid-turn (before its block commits), `#wakeParkedWorker` finds it not-yet-slept and records an **owed wake**, which the drain honors when the parent blocks — so a wait awaiting workers **always returns**, never dead-blocks on a conclude-before-block race. (Only a live exec stream, unbounded absent a timeout, may legitimately hold a wait open.)
 - §worker-optimistic-settlement **Asynchronous settlement receives one bounded worker-local opportunity before model dispatch.** An initiating turn lets only the streams it started settle before its terminal SEND; separately, a stream or direct-child conclusion persists and publishes immediately but holds the parked worker's single `202→100` requeue while another stream or direct child remains live. Both use `PLURNK_SERVICE_OPTIMISTIC_WAIT_MS`, shipped at five seconds; zero disables the opportunity. The wake hold ends as soon as no sibling obligation remains, never extends its original deadline, and coalesces every conclusion that lands within it into one requeue. With no sibling obligation the wake is immediate; at the deadline, surviving work follows the ordinary monitored lifecycle. A conclusion that lands after provider dispatch begins retains its next wake, while poll, park-deadline, prompt, and operator wakes never open this hold. Only packet/provider dispatch waits: terminal state, client events, cancellation, and child execution do not. One redaction-safe span records elapsed time, quiescence versus deadline, and conclusion count without entering the packet.
 - §worker-lifecycle-idle-is-concluded **An idle worker concludes; it does not park.** A loop is idle only when it has neither live obligations nor completed results awaiting their first packet. A live child or stream blocks a SEND signal `202` join; a completed stream, child result, or same-turn retrieval continues directly to the next packet where it is observed. Only after those sets are drained does signal `202` resolve like signal `200`. There is no held-open idle loop and no `loop/quiesced` soft signal. A concluded worker is durable working history and an addressed arrival reawakens it as a new loop.
@@ -914,21 +980,25 @@ Author-facing contract: [`@plurnk/plurnk-schemes`](../plurnk-schemes/SPEC.md). B
 
 When an op carries a target, RFC 3986 supplies the component model and WHATWG
 URL supplies canonical decomposition; an entry key is
-`(workspace, owner, scheme, pathname)` ({§entry-identity-no-null}). Handler
-routing and resource identity are separate:
-
-- §scheme-address-namespace-fold A **registered non-network, non-worker scheme** mechanically folds its authority into the canonical storage pathname (`Dispatcher.#extractTarget` → `foldAuthorityIntoPath`). For an entry namespace, the authority is therefore a leading path segment rather than a separate identity component.
-- The **`worker` scheme is the registered exception**: its authority selects an owner ({§worker-authority-carving}) and remains distinct through dispatch; the handler strips it only after resolving the entry owner.
+`(owner, scheme, authority, pathname)`; the owner Worker determines the
+workspace ({§entry-identity-no-null}).
+The registered manifest's {§manifest-authority} disposition determines the one
+meaning of an authored URI authority before any entry capability is exposed:
+
+- §scheme-address-namespace-fold A **namespace scheme** mechanically folds its authored authority into the canonical storage pathname and persists the empty entry authority. For an entry tree, the authored authority is therefore a leading path segment rather than a separate resource coordinate.
+- An **owner scheme** consumes its authored authority while resolving `entries.owner_id` and persists the empty entry authority. `worker` uses this disposition ({§worker-authority-carving}).
+- A **resource scheme** preserves its canonical authority as the durable entry-authority coordinate. Every capability and exact query is bound to that authority; it cannot collide with or observe the same pathname at another authority.
 - §scheme-address-network A **network resource** uses the shared schemes-layer
   normalization contract {§network-address}:
   `https://example.com:8443/page?b=2&a=1` →
-  `(https, /example.com:8443/page?b=2&a=1)`. The exact protocol, canonical
+  `(https, example.com:8443, /page?b=2&a=1)`. The exact protocol, canonical
   host, non-default port, path, and serialized query are identity; query order,
   duplicates, and an explicit empty `?` survive. A fragment is a Plurnk channel
   selector, not network identity or transport. URL userinfo is rejected and
-  request metadata never enters identity. `https` may route through `http`,
+  request metadata never enters identity. Plain `http` routes through `https`,
   just as `ws` routes through `wss`; those implementation aliases never alias
-  resources. `SchemeCtx.entries` binds every cap to the addressed protocol.
+  resources, and the secure face is the one taught — `http` stays supported
+  for the endpoint that requires it, never advertised as a peer. `SchemeCtx.entries` binds every cap to the addressed protocol.
   Absolute network URLs are single resources even when their path ends `/` —
   folder/glob expansion belongs to entry namespaces, never an HTTP origin.
 - The **`file` class is the workspace filesystem** — a mount namespace with its own resolution and naming law, specified below.
@@ -936,37 +1006,83 @@ routing and resource identity are separate:
 §client-entry-address A client entry read carries the observing `workerId` and
 passes its selector through the registered data scheme's
 {§entry-address-resolution} before querying storage. The scheme returns its
-canonical pathname and semantic owner; core alone resolves that owner to
-`entries.owner_id` and queries the complete `(workspace, owner, scheme,
-pathname)` identity. Worker and capability-stream authorities reuse their
+canonical authority, pathname, and semantic owner; core alone resolves that
+owner to `entries.owner_id` and queries the complete `(owner, scheme,
+authority, pathname)` identity. Worker and capability-stream authorities reuse their
 ancestry checks, so unknown or unauthorized owners return the same 404 and
 cannot select an arbitrary colliding row. The result is the contracts-owned
 {§entry-read-result}; persistence columns never cross the seam.
 
+§scheme-entry-matrix URI authority, entry principal, access, and fork
+inheritance are independent decisions. The built-in surfaces declare them
+explicitly:
+
+| Surface | URI authority | Entry principal | Cross-Worker read | FORK entry disposition |
+|---|---|---|---|---|
+| Project file | Filesystem name | `commons` | Workspace-shared | Shared live; no copy |
+| `worker:///...` | Empty selects commons | `resolved` commons | Workspace-shared | Shared live; no copy |
+| `worker://~/...` | `~` selects caller | `resolved` Worker | Self; parent may use the child's literal name | Quiescent snapshot; `_plurnk/**` rederived |
+| `worker://<name>/...` | Literal Worker selector | `resolved` Worker | Owner or ancestor | Scheme disposition only when the selected owner is the fork source; otherwise no copy |
+| `prompt:///...` | Loop-relative coordinate | Calling Worker | Self-only | Quiescent snapshot |
+| Provisional `skill:///...` | Entry namespace | Calling Worker | Self-only | Quiescent snapshot |
+| `http(s)://...` | Remote resource identity | Calling Worker | Self-only | Quiescent snapshot; an active stream is omitted |
+| `wss://...` | Remote resource identity | Calling Worker | Self-only | None |
+| Executor/MCP output | Optional named actor selector | `resolved` Worker | Owner or ancestor | None |
+| `a2a://...` outbound resource | Remote-agent identity | Calling Worker | Self-only | None |
+
+A resolved-owner scheme authorizes the actor selector before returning its
+principal; a numeric Worker id is never extension input. `worker` ownership has
+no cross-actor form. Thus identical HTTP, WSS, A2A, prompt, Skill, or unqualified
+executor addresses in independent root Workers are distinct resources without
+render-time filtering.
+
 §fs-namespace **The workspace is a mount namespace; `project_root` is the model's `/`.** Chroot semantics: host paths do not exist inside the jail, and no engine surface folds a host-absolute spelling onto a member. The root is **fixed immutably at workspace creation** (headless is forever); the namespace's mount table changes only through the declared membership overlay ({§membership}), never by re-rooting. At `project_root = /` the jail is the whole filesystem and every rule below degenerates to identity — the design's proof case, and the common benchmark topology.
 
 §fs-namei **Resolution is namei over the mount table.** The model's CWD is permanently `/`, so `src/x.md` and `/src/x.md` are the same name — the slash rule is a corollary, never a legislated equivalence. Resolution is lexical: `.` and `..` resolve before anything touches storage (`..` is legal *during* traversal); the final name lands in the root subtree (a bare key), on a declared outside-root mount (a `../`-prefixed key — the git-style overlay), or names nothing (404 carrying the resolved form). Containment is the resolution semantics — there is no separate traversal check to forget.
 
 §fs-canonical-name **One canonical name, storage ≡ wire: the git pathspec.** Member keys follow gitformat-index(5) verbatim (reference edition: git 2.47.3): relative to the workspace `project_root`, without leading slash, `/`-separated, no trailing slash or NUL. Directories are never entries and the root needs no name. When `project_root` is below the containing repository's top level, Git members above it naturally use the same `../`-prefixed CWD-relative names that `git ls-files` emits without `--full-name`; these are not outside-repository mounts. The database stores that root-relative key directly because workspace identity is rooted at the access point. Every model spelling canonicalizes before storage or comparison.
 
-§fs-visibility-grantors **Visibility has three grantors; plurnk is never one of them.** A file is visible to the model only when admitted by (1) the client's explicit `pick` grant, (2) the containing repository's inclusion semantics (ls-files ∪ untracked-not-ignored − ignored), or (3) the AGENTS.md knob ({§policy-sections} — auto-pulled as POLICY, deliberately not a member; a git-tracked AGENTS.md may separately be an ordinary member via grantor 2). Model creation is a WRITE permission, never a visibility source — the created file's visibility rides git's rules, so a gitignored creation would be invisible even to its creator (which is why the write gate refuses it — the blind-write closure in {§fs-write-surface}). **Counterintuitive on purpose**: a file physically inside the root that no grantor admits DOES NOT EXIST for the model. Every visible byte traces to the client's constraint table or the operator's Git rules, never to a Plurnk guess.
-
-§fs-write-surface **The write surface — mount semantics, grantor-keyed.** The project root is the model's one read-write mount; writability elsewhere tracks the grantor: *write permission = inside the root, or client-granted outside it — Git grants read-write only within the project.*
-
-| Location               | Path state          | Admission                 | Result |
-|------------------------|---------------------|---------------------------|--------|
-| Project root           | Absent              | Git or client after write | Exclusive CREATE (`open(O_CREAT\|O_EXCL)` semantics), only when the result will remain visible. |
-| Project root           | Existing member     | Any grantor               | Proposal-gated EDIT. |
-| Project root           | Existing non-member | None                      | Refuse; reveal occupancy only, never content. |
-| Declared outside mount | Existing member     | Client                    | Read-write, proposal-gated; the explicit pick acts as a per-file rw bind mount. |
-| Declared outside mount | Existing member     | Git                       | Read-only. |
-| Declared outside mount | Absent              | Any                       | Refuse; only the project root mints files. |
-
-The **blind-write closure** refuses a root create that Git would ignore and no
-client pick covers, because Plurnk never writes bytes its own sandbox cannot
-subsequently see. A non-Git root grants nothing by itself. Refusing an occupied
-non-member follows the POSIX exclusive-create precedent: namespace occupancy is
-not secret, but content remains dark.
+§fs-visibility-grantors **File visibility has two represented grantors; Plurnk never invents a private third one.** A file member is admitted by the active Git substrate or by an ordinary `pick` constraint. A `pick` is either explicit client policy or the exact, inspectable record of an accepted creation ({§fs-create-generated-pick}); both resolve to `constraint` membership. AGENTS.md remains auto-pulled as POLICY ({§policy-sections}), deliberately not a file member. A physically existing path that neither Git nor `pick` admits does not exist for the model and cannot be overwritten.
+
+§fs-write-surface **The write surface — one admission and incorporation path.** Existing writes remain membership-gated. An absent path additionally crosses the effective creation scope and the complete constraint/Git policy before a proposal is issued. EDIT, COPY destinations, and MOVE destinations use this same path regardless of whether the producer is a model, client, plugin, or `_plurnk`.
+
+| Case | Required admission | Accepted result |
+|------|--------------------|-----------------|
+| §fs-create-disabled Absent path, effective scope `none` | None | Refuse without touching disk. |
+| §fs-create-root Absent path inside `project_root` | Effective scope `root` or `namespace`; no matching `hide` or `view` | Exclusive CREATE (`open(O_CREAT\|O_EXCL)` semantics), then incorporation below. |
+| §fs-create-namespace Absent canonical `../` path | Effective scope `namespace`; no matching `hide` or `view` | Exclusive CREATE, then an exact `pick` so the outside member is read-write. |
+| §fs-create-ignored Absent path ignored by active Git | Matching **explicit** `pick` | Exclusive CREATE through that pick; an automatic/generated pick never overrides Git ignore. |
+| §fs-create-git Absent in-root path admitted by active Git | Not ignored | Exclusive CREATE followed by successful `git add -- <path>`; a staging failure falls back to an exact generated pick. |
+| §fs-create-pick Absent admitted path without Git incorporation | Existing explicit pick or automatic incorporation permitted | Exclusive CREATE followed by an exact generated pick when no explicit pick already covers it. |
+| §fs-write-member Existing in-root member | Git or pick membership; no matching `view` | Proposal-gated EDIT. |
+| §fs-write-outside Existing canonical `../` member | Pick membership; no matching `view` | Proposal-gated EDIT. Git-only outside members are read-only. |
+| §fs-write-nonmember Existing non-member | None | Refuse; reveal occupancy only, never content. |
+
+§fs-create-incorporation **Creation incorporation is durable workspace state, not a transient entry exception.** `workspace_constraints.source` distinguishes an operator/client-authored `explicit` constraint from a runtime-authored `create` constraint. An explicit row interprets `glob` as a pattern; a generated row interprets the same field as one literal canonical path, so legal filename metacharacters never become wildcard syntax. Generated constraints appear through the ordinary `workspace.constraints` client surface. An explicit pick covering the same path always wins and is never demoted.
+
+| Event | Generated-pick lifecycle |
+|-------|--------------------------|
+| §fs-create-generated-pick Successful creation not incorporated by Git or an existing explicit pick | Insert exact `{ effect: "pick", glob: canonicalPath, source: "create" }`. |
+| §fs-create-copy COPY to a new path | Incorporate the destination independently; the source is unchanged. |
+| §fs-create-move MOVE to a new path | Incorporate the destination, then remove the source's generated exact pick after deleting the source. |
+| §fs-create-kill KILL or accepted whole-resource deletion | Remove the deleted path's generated exact pick. |
+| §fs-create-explicit-promotion Explicit `pick` added at the same exact path | Promote/retain the row as `source: "explicit"`; later automatic cleanup cannot remove it. |
+| §fs-create-masked A later `hide` or active Git-ignore rule excludes a generated-pick member | Preserve the generated pick as dormant policy; removing the exclusion restores membership when the file still exists. A later `view` leaves it visible but read-only. |
+| §fs-create-ambient-delete Reconciliation confirms a generated-pick path disappeared outside Plurnk | Remove the generated exact pick; explicit picks remain operator policy. |
+
+The file-creation invariants are deliberately redundant with the matrices only
+where the invariant closes an architectural failure mode:
+
+- §file-create-no-orphans A successful create always ends in Git membership or a real pick; no accepted file is orphaned from the workspace that created it.
+- §file-create-no-clobber Creation is exclusive and an existing non-member remains unreadable and non-overwritable.
+- §file-create-exclusions-win `hide` and `view` outrank all automatic creation; active Git ignore is overridden only by an explicit pick.
+- §file-create-scope The effective creation scope is the minimum of the service ceiling and workspace setting; no call site or producer may widen it.
+- §file-create-producer-neutral The file contract depends on the operation and target, never the producer identity.
+- §file-create-single-owner File membership owns prospective admission, incorporation choice, and generated-pick lifecycle; file operations consume that decision rather than re-deriving Git and constraint policy.
+- §file-create-transaction Success requires both exclusive disk creation and durable incorporation. Approval re-resolves physical containment and policy, so a proposal-time parent cannot be swapped for an outside-pointing symlink. Incorporation failure removes the created entry and file; incomplete rollback is an explicit partial-failure Problem.
+
+Refusing an occupied non-member follows the POSIX exclusive-create precedent:
+namespace occupancy is not secret, but content remains dark.
 
 §fs-answer-in-canon **The engine answers in canon.** Every engine-authored address — log-row pathname columns, rx spans and error facts, FIND results, the catalog, the foists — renders the one canonical form: exactly what `git ls-files --full-name` prints, byte-for-byte on the git-membership subset. A miss names the RESOLVED form, never an echo of the model's spelling. The single verbatim survivor is the model's own emission text — history is never rewritten. There is no shadow universe of model-preferred addressing.
 
@@ -983,7 +1099,7 @@ Every fact names the canonical key, never the host root or an echo of the
 model's spelling. These classes let a caller distinguish a wrong address, an
 invalid range, read-only authority, and occupied hidden state without guessing.
 
-§fs-world-state **The world-state harness — coverage that closes the class.** Op-outcome tests check what an op returned; the harness checks the resulting world. `WorldState.check(db)` asserts, pure-db and read-only: identity uniqueness in practice (no tuple holds two rows), the canonical fixpoint on every file-class key, channel orphan-freedom, the closed admission set (a file row's grantor is git or a client act — or the create-accepted transient NULL the next reconcile stamps), and sig-coherence. It runs as a lifecycle-test epilogue and at every soak turn boundary, where the delta half applies: an idle turn grows the entries table by ZERO. A violation names its law and its row.
+§fs-world-state **The world-state harness — coverage that closes the class.** Op-outcome tests check what an op returned; the harness checks the resulting world. `WorldState.check(db)` asserts, pure-db and read-only: identity uniqueness in practice (no tuple holds two rows), the canonical fixpoint on every file-class key, channel orphan-freedom, the closed admission set (every file row's origin is Git or constraint), and sig-coherence. Generated-pick incorporation and lifecycle require filesystem/Git evidence and are covered by the composed creation matrix rather than a false pure-database proxy. The harness runs as a lifecycle-test epilogue and at every soak turn boundary, where the delta half applies: an idle turn grows the entries table by ZERO. A violation names its law and its row.
 
 ### §scheme-manifest Manifest
 
@@ -1098,7 +1214,7 @@ Engine → scheme guarantees:
 - `ctx` is fresh per call. No mutation across calls.
 - §universal-read-composition **Exact READ has one composition.** Core resolves
   canonical identity and owner once, gives a data scheme its optional
-  `prepareRepresentation({ target, pathname })` opportunity, reads the complete
+  `prepareRepresentation({ target, authority, pathname })` opportunity, reads the complete
   canonical channels, selects the authored channel, applies binary and
   text-coordinate rules, and finally composes that channel's durable producer
   result. Preparation receives neither fragment nor `lineMarker`; finite work
@@ -1253,7 +1369,7 @@ flowchart LR
     G --> Q
 ```
 
-§derivation-exhaustive Identical projections attach the same immutable artifact regardless of their source table. Search primitives therefore consume only `{key, deepHash}` candidates and cannot depend on entry or log storage. Semantic and graph FIND require every selected channel candidate—and every channel in graph's relationship universe—to be attached. An incomplete set returns 503 with `problem.search = {state:"incomplete", indexed, total}`; it never silently searches a partial corpus. Normal execution joins the eager workspace warm before model dispatch, so that response is an interface invariant and diagnostic, not a lazy-search mode.
+§derivation-exhaustive Identical projections attach the same immutable artifact regardless of their source table. Search primitives therefore consume only `{key, deepHash}` candidates and cannot depend on entry or log storage. Semantic and graph FIND require every selected channel candidate—and every channel in graph's relationship universe—to be attached. An incomplete set returns 503 with `problem.search = {state:"incomplete", indexed, total}`; it never silently searches a partial corpus. Explicit membership changes may warm eagerly; every model turn joins exhaustive derivation before dispatch. Passive workspace creation and attachment do not launch it. The incomplete response is therefore an interface invariant and diagnostic, not a lazy-search mode.
 
 The graph projection stores only addressable symbol names. A structured-data handler may legitimately emit an empty key into its symbols channel, but the `@graph` matcher cannot name an empty symbol; that one definition is omitted from graph storage without suppressing FTS, vectors, or the remaining definitions. Invalid references and other persistence violations still fail the resource derivation explicitly.
 
@@ -1449,9 +1565,9 @@ OPEN/FOLD operate on the **log** (`log:///`) - the model's context-curation surf
 
 ### §jsonplurnk The Log's wire format
 
-The `## Log` section renders as a fixed three-backtick `jsonplurnk` fence - a JSON array of entry objects, otherwise-valid JSON with **exactly one** deviation: an open, nonempty `body` is a raw multiline string. Its opening JSON quote is followed by a physical newline, every visible content line retains its canonical numeric `N:` or anchored `@hash N:` coordinate, and its closing quote appears at column zero before either the object close or a following member. Source quotes, braces, fences, and headings cannot collide with either boundary because source text never occupies column zero after projection; source backticks therefore cannot form a CommonMark closing fence. The fixed opener keeps the packet prefix stable across content changes. The carve-out is localized to `body`, so the strip-parser recognizes `"body":"` followed by a newline, consumes one or more coordinate-prefixed lines, and replaces the raw multiline value with an escaped JSON string while preserving following members to recover strict JSON. `"display":"none","body":""` means no canonical body, `"display":"folded"` withholds the whole body, and `"display":"open"` appends the visible body. A partially hidden open row also carries `"folded":["<scope>",...]`; coordinate gaps in its body make the omission explicit without renumbering later lines. `path` is the complete model-facing log identity: when a projected operation exists it ends in `/OP`, and no separate `op` field duplicates it. It leads each entry object; the remaining members follow in stable alphabetical order. A present authored operation annotation appears as `annotation`; its absence omits the field. Nonempty `tags` is the row's complete deduplicated, sorted folksonomy; an untagged row omits it. When an automatic bounded projection differs from the visibility-selected body, it appends `"chunk":"showing <selected> of <complete>"` after `body`; otherwise it omits `chunk`. Complete-line extents use inclusive two-coordinate line regions. A cut inside a line uses four-coordinate, start-inclusive and end-exclusive regions with 1-based Unicode code-point columns. The row's `path` remains the canonical READ target. The block is data only - no prose leads the fence. Every row's accounting: {§packet-token-accounting}.
+The `## Log` section renders as a fixed three-backtick `jsonplurnk` fence - a JSON array of entry objects, otherwise-valid JSON with **exactly one** deviation: an open, nonempty `body` is a raw multiline string. Its opening JSON quote is followed by a physical newline, every visible content line retains its canonical numeric `N:` or anchored `@hash N:` coordinate, and its closing quote appears at column zero before either the object close or a following member. Source quotes, braces, fences, and headings cannot collide with either boundary because source text never occupies column zero after projection; source backticks therefore cannot form a CommonMark closing fence. The fixed opener keeps the packet prefix stable across content changes. The carve-out is localized to `body`, so the strip-parser recognizes `"body":"` followed by a newline, consumes one or more coordinate-prefixed lines, and replaces the raw multiline value with an escaped JSON string while preserving following members to recover strict JSON. The three body states are self-describing through field presence alone: a `body` field means open, `tokensBody` without `body` means folded (the value prices the OPEN), and neither means no canonical body; no `display` label exists. Two defaults are likewise field absence: `origin` is omitted for the worker's own model authorship (exactly as `source` absence means the owning worker), and `status` is omitted for a routine 200 on a non-SEND row — SEND always carries its submit code and every non-200 stays explicit. A partially hidden open row also carries `"folded":["<scope>",...]`; coordinate gaps in its body make the omission explicit without renumbering later lines. `path` is the complete model-facing log identity: when a projected operation exists it ends in `/OP`, and no separate `op` field duplicates it. It leads each entry object; the remaining members follow in stable alphabetical order. A present authored operation annotation appears as `annotation`; its absence omits the field. Nonempty `tags` is the row's complete deduplicated, sorted folksonomy; an untagged row omits it. When an automatic bounded projection differs from the visibility-selected body, it appends `"chunk":"showing <selected> of <complete>"` after `body`; otherwise it omits `chunk`. Complete-line extents use inclusive two-coordinate line regions. A cut inside a line uses four-coordinate, start-inclusive and end-exclusive regions with 1-based Unicode code-point columns. The row's `path` remains the canonical READ target. The block is data only - no prose leads the fence. Every row's accounting: {§packet-token-accounting}.
 
-- §packet-token-accounting Every row reports its real weight so the packet self-reconciles against the budget: `tokensMetadata` is its active non-body share (always present — no row reads as free), `tokensBody` is the projected body's weight whenever a canonical body exists, and `tokensActive` is the complete row's weight in the packet right now. A folded or bodyless row has `tokensActive = tokensMetadata`; a wholly or partially open row has `tokensActive = tokensMetadata + tokensBody`. Thus FOLD removes the rendered body's weight while KILL removes `tokensActive`; on a folded row `tokensBody` previews the body share an OPEN would activate. The completed row, including its accounting fields and framing, is measured to a fixed point. A FIND's nonzero `itemsTokenTotal` weighs the complete matched set; a nonzero `returnedItemsTokenTotal` appears only when the returned page has a different weight. These are curation weights, not dollars. The invariants bind regardless of shape ({§packet}): addressability (`path`/`target`/`#channel`/coordinate-prefixed bodies), weighability (per-item `tokens`), honesty (every 4xx/5xx row and the exact body/display state). {§jsonplurnk} {§packet-jsonplurnk-exception}
+- §packet-token-accounting Every row reports its real weight so the packet self-reconciles against the budget: `tokensBody` is the projected body's nonzero weight whenever a canonical body would render (never `0` — a priceless OPEN is field absence), and `tokensActive` is the complete row's weight in the packet right now. The metadata share is derivable (`tokensActive − tokensBody` when open; `tokensActive` otherwise) and is never serialized — it feeds no curation decision. Thus FOLD removes the rendered body's weight while KILL removes `tokensActive`; on a folded row `tokensBody` previews the body share an OPEN would activate. The completed row, including its accounting field and framing, is measured to a fixed point. A FIND's nonzero `itemsTokenTotal` weighs the complete matched set; a nonzero `returnedItemsTokenTotal` appears only when the returned page has a different weight. These are curation weights, not dollars. The invariants bind regardless of shape ({§packet}): addressability (`path`/`target`/`#channel`/coordinate-prefixed bodies), weighability (per-item `tokens`), honesty (every 4xx/5xx row and the exact body state). {§jsonplurnk} {§packet-jsonplurnk-exception}
 
 ### §retrieval-packet-metadata READ/FIND packet metadata
 
@@ -1569,10 +1685,10 @@ Log history preserved — `log_entries` stores path tuple as text, not FK to `en
 AST: `{ op: "FIND", target (scope), body: MatcherBody | null (predicate), signal: tags | null, lineMarker? }`.
 
 - §find-scope-prefix-filter Filters entries within scope. A **bare** path is the exact entry; an explicit **shell glob**, classified once by {§path-glob}, expands to a scope. Path globs use segment semantics: `*` and `?` never cross `/`; `**` does. Terminal `*` and `**` are structural catalog selectors and include dot-prefixed entries, so a complete map does not hide `.env.defaults` or `.github`; richer patterns retain native shell behavior. SQLite prefix queries may reduce the candidate set but never decide the match. A trailing slash is a recursive FIND scope only for a scheme whose manifest declares `folderScopes: true`; otherwise it is ordinary resource syntax. This is an explicit plugin contract, never inferred from URL punctuation.
-- An exact target resolves to the same canonical `(scheme, pathname)` identity
+- An exact target resolves to the same canonical `(scheme, authority, pathname)` identity
   as READ, entry CRUD, and any preceding `prepareFind()`. URI authorities are
   identity-bearing: `https://example.com/page` queries
-  `(https, /example.com/page)`, never `(https, /page)`.
+  `(https, example.com, /page)`, never an empty-authority row at `/page`.
 - §find-channel-selection The target selects a channel under {§channel-selection}. That channel controls candidate eligibility, every matcher dialect's content or derivation, match-evidence coordinates, and exact producer-result composition. A selected channel absent from an exact entry is 404; a broad scope simply excludes entries lacking it. Successful resource-mode results remain complete default-first channel groups, so sibling channels are navigable catalog metadata rather than additional matches.
 - §find-glob-filter-on-content `body` matcher operates on the addressed entry channel (glob/regex/jsonpath/xpath), per `plurnk.md` "Pattern Filtering"; the path-glob lives in the (target), not the body.
 - §find-semantic-selection Every matcher operates only over the candidate set selected by `(target)`; relation matchers do not bypass that selection. Semantic ranking is exhaustive within that candidate set, then applies the ordinary FIND result scope. Markerless semantic FIND therefore uses the same `<1,16>` default as every other matcher. Integers retain FIND's positional contract: `<N>` selects result N and `<N,M>` selects the inclusive range. A leading decimal first applies a minimum cosine-similarity threshold; following integers select positions within that ranked threshold set. Thus `<0.7,10,20>` means threshold 0.7 followed by results 10 through 20, while `<0.7>` applies the threshold and the ordinary first-16 page.
@@ -1674,7 +1790,7 @@ the loop continue; repeated offenses terminate through the engine's 500.
 
 - §send-idle-turn **Idle turn** — a continuing turn (102) whose ops are only PLAN/SEND — no work op. The model continued with nothing to do. The steer, verbatim: *"If your work is done, conclude with `## SEND0 [200]`. If you're waiting on a child or stream you spawned, use `## SEND0 [202]` to block on it — a 202 with nothing to wait on simply concludes."* A successful same-turn FOLD is the exception: its `202` continues without a strike so the curated packet can support the next reasoning turn.
 - §send-premature-terminate **Premature terminate — the pending set.**
-  Completion is gated by one rule: *nothing pending may be silently
+  A model's completion claim is gated by one rule: *nothing pending may be silently
   discarded*. Pending work has two states: **live obligations** (open
   streams/spawns and live child workers) and **completed-but-unobserved
   results** (same-turn READ/FIND/OPEN results, failed operations, terminal
@@ -1684,6 +1800,11 @@ the loop continue; repeated offenses terminate through the engine's 500.
   and the loop continues; every refusal strikes uniformly, including a
   retrieval-only refusal. The pending kind changes the corrective message, not
   rail accounting. `[499]` deliberately abandons regardless.
+- §send-administrative-terminal **An administrative terminal closes its own
+  transaction.** A client, plugin, or `_plurnk` operation program runs in its
+  own administrative loop. Its SEND signal `200` concludes exactly that loop;
+  it neither claims nor consumes the Worker's model-visible pending set. Model
+  completion rails therefore apply only to a model-authored disposition.
 - §send-undelivered-child-term **Completion is not delivery.** A result becomes
   observed only after crossing a packet boundary. SEND signal `202` parks only on
   live obligations. If work has completed but is unobserved, it continues
@@ -1766,18 +1887,18 @@ effect-qualified hold policy. The post-acceptance materialization path never
 triggers reclassification.
 
 §exec-registry-resolves The runtime slot (`signal`) selects an executor from
-the current workspace snapshot. Installed siblings form the immutable base:
+the current worker snapshot. Installed siblings form the immutable base:
 they are discovered and probed at startup, and availability is cached.
-Workspace capability providers may atomically overlay additional names under
-{§module-workspace-capabilities}; a name has one owner within a workspace, while
-independent workspaces may use the same name. An absent or empty tag selects
+Worker Functionality providers may atomically overlay additional names under
+{§module-worker-capabilities}; a name has one owner within a worker, while
+independent workers may use the same name. An absent or empty tag selects
 `sh`; a non-empty tag selects exactly that registered executable tool. Unknown
 tags are refused 501 with direction to use only the advertised catalogue or
 put a complete command in bare `EXEC`; they are never reinterpreted as shell
 command words. An unavailable runtime is also 501 and carries the probe
 `detail`.
 
-For a family runtime, `ExecutorRegistry.toolRegistry(tag, workspaceId)`
+For a family runtime, `ExecutorRegistry.toolRegistry(tag, workerId)`
 validates the one executor-owned snapshot used by packet presentation,
 dispatch admission, and pull-document materialization. Core performs no
 protocol discovery while building a packet and has no alternate tool
@@ -1820,7 +1941,17 @@ edge. Stream closure remains a wake edge under every poll policy.
 
 §exec-host-proposes **Effect-gating.** Each executor declares an `effect` (`pure` | `read` | `host`); the service maps it to policy (`EffectPolicy`). A `host` runtime (subprocess; file-backed sqlite) mutates the host → **propose** (lifecycle {§proposal}): the worker waits for a human gate, then spawns and writes stdout/stderr to channels of a `<runtime>:///<loop>/<turn>/<seq>` entry (the runtime tag is the URI scheme, {§exec}; the coordinate matches the op's log-row coordinate, e.g. `sh:///1/1/2`), returning `102 Processing` immediately. Channel state transitions (`active` → `closed`/`errored`) drive what the model sees at subsequent turn boundaries ({§channel-state}).
 
-§entry-owner **Every entry is owned by a worker.** `entries.owner_id` is a real worker row, part of the identity key — the workspace's reserved `commons` worker for shared content, the spawning worker for capability streams. Never NULL (NULLs are distinct under UNIQUE — a nullable owner would let the shared-content identity fragment into duplicate rows), never rendered into a URI or packet: the model addresses owners by NAME in the authority slot. `plurnk` (the kernel) and `commons` are the two reserved rows; no spawn or client may take their names (nor `~`, the current-worker sigil).
+§entry-owner **Every entry has one structurally bound principal.**
+`entries.owner_id` is a real Worker row and part of the identity key: the
+workspace's reserved `commons` Worker for deliberately shared content, the
+effective Worker for private resources, or the exact authorized Worker selected
+by a resolved-owner scheme. It is never nullable or supplied by a plugin call.
+Core binds it once through {§entry-address-resolution} before exposing any
+entry, channel, notification, subscription, mutation, proposal, client-read, or
+cancellation capability. URI authority remains a separate coordinate; a scheme
+may use a semantic Worker name there, but the private numeric id never appears
+in a URI or packet. `plurnk` and `commons` are reserved Workers, and `~` is the
+current-Worker sigil; none can be minted by a spawn or client.
 
 §stream-owner-scoped **Capability streams are owner-scoped.** Concurrent workers' stream coordinates are loop-relative and IDENTICAL (every worker's first loop is sequence 1), so the entry identity keys on the owner and identical coordinates across workers are distinct rows. The address's authority names the owner: **empty = the calling worker** — your own streams need no qualifier, so a fan-out sibling's output can never surface under your READ — and a **named authority** reaches that worker's streams gated by ancestry (the reader is the owner or an ancestor; oversight flows down the tree, unknown-or-unpermitted resolves 404 with no existence leak). KILL stays self-only — a parent controls a child through the worker lifecycle, never by reaching into its streams. The storage pathname stays the bare loop coordinate; the owner rides the column, so nothing model-facing carries a worker id.
 
@@ -1849,14 +1980,18 @@ from each owned channel as an `origin=_plurnk` READ at
 | `application/jsonl` or `application/x-ndjson` | complete newline-terminated records | every remaining record |
 | every other mimetype | nothing | the complete atomic document |
 
-The per-channel cursor advances only through content actually published, so an
-active atomic document or trailing partial JSONL record never reaches the model
-as malformed structured data. Ongoing observations are folded and a terminal
-observation is born OPEN; a terminal state with no newly publishable body still
-produces one bodyless conclusion row. Every READ then obeys {§body-projection} and
-therefore renders its selected result complete. A stream that closes before a
-same-turn wait remains pending until this terminal READ crosses the next packet
-boundary. The EXEC row separately records the authored invocation.
+The durable per-subscription, per-channel cursor advances only through content
+actually published, so an active atomic document or trailing partial JSONL
+record never reaches the model as malformed structured data. Its transition and
+the generated READ commit atomically. Ongoing observations are folded and a
+terminal observation is born OPEN; a terminal state with no newly publishable
+body still produces one bodyless conclusion row. OPEN, FOLD, or KILL may curate
+that log row without rewinding the cursor or publishing the terminal result
+again; the exact terminal result and channel content remain READable at the
+stream address. Every READ then obeys {§body-projection} and therefore renders
+its selected result complete. A stream that closes before a same-turn wait
+remains pending until every selected channel's terminal READ crosses the next
+packet boundary. The EXEC row separately records the authored invocation.
 
 `## KILL0 (<runtime>:///<loop>/<turn>/<seq>)` cancels an active subprocess via
 the subscription registry's stored controller. A terminal stream is immutable:
@@ -1899,11 +2034,10 @@ Core derives the contracts-owned `ProposalProjection` from the durable proposed
 | Projection field      | Durable authority                                                                                                  |
 | --------------------- | ------------------------------------------------------------------------------------------------------------------ |
 | identity              | proposed log row `id`, `worker_id`, `loop_id`, `turn_id`, and validated `op`                                       |
-| `target`              | canonical `attrs.proposalTarget` for staged COPY/MOVE, otherwise the log row target                                |
+| `target`              | canonical `{ scheme, authority, pathname }` from `attrs.proposalTarget` for staged COPY/MOVE, otherwise the log row target |
 | `body`                | proposed operation result `rx.body`; absent means the empty review body                                            |
 | `attrs`               | proposed log row `attrs` object                                                                                    |
 | `flags`               | validated persisted loop flags expanded over contracts-owned defaults                                              |
-| `staleClobberRisk`    | target-matched ambient file divergence in the proposal's worker and turn                                           |
 | `disposition`         | {§proposal-disposition}; the same value drives automatic settlement and client presentation                        |
 
 Workspace scope remains the event envelope / seam argument ({§notifications-envelope-carries-workspaceid}); it is not forged into `ProposalProjection`. Malformed durable JSON, target metadata, result envelopes, loop policy, or final projection fails at core with its cause; after insertion, core terminalizes that row as a 500 `policy_failed` before propagating the internal failure, so no waiter or durable stopped world is orphaned.
@@ -1929,12 +2063,11 @@ removes ownerless rows without fabricating cancellation, payload, or replay.
 
 `ProposalDisposition` is either `{ owner: "client" }` or `{ owner: "loop", decision: "accept" | "reject", outcome? }`. The decision table is complete and ordered:
 
-| `auto` | stale target | `noProposals` | Disposition                                               |
-| ------ | ------------ | ------------- | --------------------------------------------------------- |
-| true   | true         | any           | loop reject, outcome `stale_read_clobber`                 |
-| true   | false        | any           | loop accept                                               |
-| false  | any          | true          | loop reject, outcome `no_review_channel`                  |
-| false  | any          | false         | client                                                    |
+| `auto` | `noProposals` | Disposition                              |
+| ------ | ------------- | ---------------------------------------- |
+| true   | any           | loop accept                              |
+| false  | true          | loop reject, outcome `no_review_channel` |
+| false  | false         | client                                   |
 
 Thus `auto` wins the otherwise nonsensical `auto + noProposals` combination. Loop-owned settlement occurs before observational notification; observer failures are diagnosed with their cause and cannot change disposition or leave an eligible automatic proposal pending.
 
@@ -1948,7 +2081,7 @@ Thus `auto` wins the otherwise nonsensical `auto + noProposals` combination. Loo
 
 §subscriptions-subscription-registry-routes-cancellation READ on a streaming scheme is a subscription, not a one-shot. The scheme establishes its protocol-specific acquisition boundary, returns `102 Processing`, and stays alive through the `StreamSubscription` returned by `subscriptions.open()`. The service commits that initial operation result normally; later chunk and terminal work cannot rewrite it. Durable terminal truth lives on the subscription and its channels. The service records durable subscription identity and metadata in SQLite and retains the callable `SubscriptionHandle` only in its process-local live registry. SEND signal `499`, worker cancellation, turn-scoped reap, and shutdown all route through that one live registry; no handler-specific cancellation hook or database access is part of the plugin contract.
 
-The durable row is lifecycle evidence and the lookup key, not a serialized callback. `subscriptions.open()` establishes both halves before yielding a composed `StreamSubscription`: an `AbortSignal` whose fused `notifyChunk` and terminal `close` methods are safe to retain without the operation's general `SchemeCtx`. `close(result, summary?)` validates and persists the exact universal operation result, settles channel state, closes the durable row, wakes the worker when appropriate, and unregisters the live handle. `close_status` is a constrained relational projection of `close_result.status`, never an independent result. A durable open row without a live handle is an explicit lifecycle failure, never a fabricated cancellation success. Channel state ({§channel-state}) + log entries ({§no-chunk-rows}) carry lifecycle.
+The durable row is lifecycle evidence and the lookup key, not a serialized callback. `subscriptions.open()` establishes both halves before yielding a composed `StreamSubscription`: an `AbortSignal` whose fused `notifyChunk` and terminal `close` methods are safe to retain without the operation's general `SchemeCtx`. `close(result, summary?, channelResults?)` validates one universal terminal producer result plus exact named channel overrides. One SQLite transition closes the subscription and installs each channel's terminal `producerResult`; its lifecycle state derives from that result. The transition then wakes the worker when appropriate and unregisters the live handle. `close_status` is a constrained relational projection of `close_result.status`, never an independent result, while `channel_results` preserves historical overrides after a later subscription replaces the channel's current evidence. A durable open row without a live handle is an explicit lifecycle failure, never a fabricated cancellation success. Channel state ({§channel-state}) + log entries ({§no-chunk-rows}) carry lifecycle.
 
 At process restart every still-open row is necessarily missing its callable owner. Boot
 settles it as interruption (`500`) and errors active channels before evaluating parked
@@ -2009,7 +2142,7 @@ No generator. SQLite-optimal: STRICT (3.37+), `INTEGER PRIMARY KEY` aliasing, ex
 
 - **Schema-alignment test**: loads `@plurnk/plurnk-contracts/schema/*.json`, parses DDL via `node:sqlite` introspection, asserts every required schema field has a corresponding `NOT NULL` column. Contract drift fails CI.
 - DDL = storage truth; JSON Schemas = wire truth. Tested-aligned, allowed to differ where ergonomics demand.
-- §entry-identity-no-null **Identity components are never NULL.** The entries identity tuple — (workspace, owner, scheme, pathname) — admits no NULL component because SQLite treats NULLs as distinct under a UNIQUE index, allowing duplicate logical identities. File members persist under the reserved **`file`** scheme (`storedScheme: "file"`; they still render as bare paths); `entries.scheme` is `NOT NULL`; a manifest declaring `storedScheme: null` is refused at registration.
+- §entry-identity-no-null **Identity components are never NULL.** The entries identity tuple — `(owner, scheme, authority, pathname)` — admits no NULL component because SQLite treats NULLs as distinct under a UNIQUE index, allowing duplicate logical identities. `owner_id` references one Worker, which is the sole workspace coordinate; `entries` stores no redundant `workspace_id` that could contradict it. `authority` defaults to the canonical empty string for namespace and owner schemes; resource schemes persist their canonical authority there. File members persist under the reserved **`file`** scheme (`storedScheme: "file"`; they still render as bare paths); `entries.scheme` and `entries.authority` are `NOT NULL`; a manifest declaring `storedScheme: null` is refused at registration.
 
 ### §sql-ts-boundary SQL/TS responsibility boundary
 
@@ -2201,6 +2334,7 @@ Model selection uses one selector vocabulary in `ProviderRegistry` ({§provider-
 | `PLURNK_HOST`                                               | `127.0.0.1` | Bind address for the listener. Local-only by default. |
 | `PLURNK_PORT`                                               | `3044` | TCP port for THE client surface — the AG-UI+ listener (the plurnk-agui plugin module binds it at boot). Production is single-listener. |
 | §operator-config-git-ceiling `PLURNK_SERVICE_GIT_ALLOWED`   | `1` | Hard service ceiling: only `1` admits Git membership, status, branch batching, and `git`/`isogit` executors; every other value denies them before executor registration or packet teaching. |
+| §operator-config-file-create-scope `PLURNK_SERVICE_FILE_CREATE_SCOPE` | `root` | Hard file-creation ceiling: `none < root < namespace`. `none` denies new filesystem files, `root` admits only paths inside `project_root`, and `namespace` also admits canonical outside-root paths. Existing-member writes are unaffected. |
 | `PLURNK_SERVICE_MAX_TURNS`                                  | `-1` | Operator inference-turn **ceiling** — `-1` = no cap; a positive value clamps `runLoop({maxTurns})`. The effective value is persisted on the durable loop and counts completed model/inference turns cumulatively across every `202` park/resume; `_plurnk`, client, and plugin turns remain chronology but consume none of this allowance. |
 | `PLURNK_SERVICE_MAX_COMMANDS`                               | `-1` | Per-emission action ceiling; `-1` = no cap (default) — every generated op dispatches. A positive value caps dispatched actions: overflow ops drop with one durable `max-commands-exceeded` error row on the next packet. PLAN and the final disposition always dispatch. Tightened per workspace via `settings.maxCommands` (min wins). |
 | §operator-config-loop-timeout `PLURNK_SERVICE_LOOP_TIMEOUT` | `86400000` | ms wall-clock budget for a single core loop: expiry aborts the loop signal mid-flight (a stuck `generate` included) and the loop terminates `504 loop_timeout` — a legible engine terminal, kin to the exec `<T>` reap's 504 ({§exec-timeout}). |
@@ -2217,12 +2351,14 @@ Model selection uses one selector vocabulary in `ProviderRegistry` ({§provider-
 | `PLURNK_SERVICE_REQUIEM_RETRY_MAX_TOKENS`                   | `32768` | Retry allowance; must be at least the initial requiem allowance ({§digest-requiem}). |
 | `PLURNK_SERVICE_FILES_ITEMS`                                | `-1` | Turn-0 catalog preview. Folder-capable schemes render a one-level `*` map with `dir/**` rollups; kernel docs remain recursive and explicitly complete. `-1` = markerless first pages; positive `N` explicitly caps only file-map rows; `0` / unset = off ({§actor-boundary-catalog-preview}). |
 | `PLURNK_SERVICE_PROPOSAL_TIMEOUT_MS`                        | (empty — waits indefinitely) | Finite positive milliseconds before cancellation with outcome `timeout`; empty waits, and every other explicit value fails ({§proposal-timeout-cancels}). |
+| §operator-config-worker-warm `PLURNK_SERVICE_WORKER_WARM_MS` | `900000` | Milliseconds a lease-free worker Functionality snapshot remains warm; `0` cools without grace and `-1` disables time-based cooling ({§module-worker-residency}). |
+| `PLURNK_SERVICE_WORKER_WARM_MAX`                            | `2` | Maximum lease-free worker Functionality snapshots retained process-wide; `0` retains none and `-1` disables the idle-LRU bound ({§module-worker-residency}). |
 
 Every core knob listed is enforced at its owning read site; `.env.defaults` is the authoritative default ({§operator-config-env-defaults}). Provider, scheme, executor, mimetype, and client-interface knobs are documented by their owning packages and appear in the assembled catalog.
 
 **Two override semantics — ceiling vs default.** Which kind a var is determines what "override" means across the cascade:
 
-- **Ceiling** (most-restrictive-wins) — an operator-set hard bound nothing downstream may exceed: not a lower-precedence file, not a per-workspace constraint, not a per-call seam argument. `PLURNK_SERVICE_GIT_ALLOWED` ({§operator-config-git-ceiling}), `PLURNK_SERVICE_MAX_COMMANDS`, `PLURNK_SERVICE_MAX_STRIKES`, and `PLURNK_SERVICE_MAX_TURNS` (`-1` ships it off; a positive value caps the per-call request). The sandbox/cost guarantee: the operator caps it; no client widens it.
+- **Ceiling** (most-restrictive-wins) — an operator-set hard bound nothing downstream may exceed: not a lower-precedence file, not a per-workspace constraint, not a per-call seam argument. `PLURNK_SERVICE_GIT_ALLOWED` ({§operator-config-git-ceiling}), `PLURNK_SERVICE_FILE_CREATE_SCOPE` ({§operator-config-file-create-scope}), `PLURNK_SERVICE_MAX_COMMANDS`, `PLURNK_SERVICE_MAX_STRIKES`, and `PLURNK_SERVICE_MAX_TURNS` (`-1` ships it off; a positive value caps the per-call request). The sandbox/cost guarantee: the operator caps it; no client widens it.
 - **Default** (explicit-wins) — a fallback the most-specific setter replaces freely: `PLURNK_MODEL` (a `runLoop({selector})` request overrides it) and the config-time vars (`HOST` / `PORT` / `DB_PATH`).
 
 §operator-config-shipped-defaults **The shipped `.env.defaults` is itself under
@@ -2279,6 +2415,7 @@ boundary. Operator-arcane knobs stay environment-only.
 | `settings.filesItems`  | Integer `>= -1`                                | Explicit replacement {§operator-config-workspace-files-items} |
 | `settings.maxCommands` | Non-negative integer                           | Tightening ceiling {§operator-config-workspace-max-commands}  |
 | `settings.git`         | Boolean                                        | Tightening denial {§operator-config-workspace-git}            |
+| `settings.fileCreateScope` | `none`, `root`, or `namespace`             | Tightening ceiling {§operator-config-workspace-file-create-scope} |
 | `settings.client`      | Nonempty string                                | Stable self-identification {§client-metadata}                 |
 | `settings.execs`       | Record of policy-key to string                 | Subtractive executor layer {§operator-config-workspace-execs} |
 
@@ -2295,10 +2432,11 @@ leak into another.
   workspace: a client tightens the runaway-op guard and never raises it past
   the operator's.
 - §operator-config-workspace-max-commands-floor The cap bounds *actions* only.
-  PLAN (intended goals) and the final disposition `SEND` (`102`, `200`, `202`,
+  PLAN (complete current Plan) and the final disposition `SEND` (`102`, `200`, `202`,
   `300`, or `499`) are never counted and always dispatch, so `0` is a valid
   floor — the tightest — admitting a plan and disposition with zero actions.
 - §operator-config-workspace-git `settings.git` (`false`) **denies** git for the workspace (`PLURNK_SERVICE_GIT_ALLOWED` AND workspace) — the client opts its workspace out of git membership and working-tree status; it can never re-enable git past the operator's service-wide lockout.
+- §operator-config-workspace-file-create-scope `settings.fileCreateScope` narrows `PLURNK_SERVICE_FILE_CREATE_SCOPE` by the ordered lattice `none < root < namespace`; a workspace may disable creation or confine a namespace-enabled service to its root, but never widen the operator's ceiling. Unknown service values fail configuration validation and unknown workspace values fail `workspace.create`.
 - §operator-config-workspace-execs `settings.execs` is a workspace-stable
   snapshot of one `Record<string, string>` policy layer using
   {§executor-policy}. Keys are matched case-insensitively and must be
@@ -2307,7 +2445,7 @@ leak into another.
   effective workspace registry is authoritative and the settings layer only
   intersects it: settings cannot register or re-enable a runtime. A canonical
   key for a currently absent tag is accepted as inert policy and applies if a
-  workspace capability provider later publishes that tag. Dispatch and
+  worker Functionality provider later publishes that tag. Dispatch and
   model-facing tool-resource materialization use the same registered-set intersection and policy
   predicate, so a workspace-disabled tag is neither executable nor taught.
 
@@ -2321,7 +2459,8 @@ External plugins declare their own env vars in their own `.env.defaults`, assemb
 
 ## §rpc Module seam
 
-Core owns a typed in-process module seam. It owns no external listener, public
+Core implements the contracts-owned {§application-port} and owns the typed
+module setup seam. It owns no external listener, public
 action-name catalog, or generic string-dispatched method registry. A
 client-interface module such as `plurnk-agui` owns its public protocol, action
 names, request validation, discovery result, and event projection.
@@ -2331,21 +2470,36 @@ names, request validation, discovery result, and event projection.
 ```mermaid
 flowchart LR
     register["Daemon.registerModule"] --> setup["module.setup(ModuleSetupSeam)"]
-    setup --> capabilities["Register static capabilities,<br/>workspace providers, and actions"]
-    capabilities --> ready["Schemes ready; docs published;<br/>durable lifecycle recovered"]
-    ready --> start["module.start(CoreSeam)"]
+    setup --> capabilities["Register static capabilities,<br/>workspace activators, and actions"]
+    capabilities --> ready["Process-wide schemes ready"]
+    ready --> recovery["Reconcile durable lifecycle"]
+    recovery --> start["module.start(ApplicationPort)"]
     start --> interface["Module-owned listener<br/>and client protocol"]
-    interface --> calls["Typed CoreSeam calls"]
+    recovery -->|durable workspace work| demand["First workspace demand"]
+    interface -->|client workspace work| demand
+    demand --> lease["Acquire capability residency"]
+    lease --> activate["Activate if cold;<br/>publish workspace docs"]
+    activate --> calls["Typed ApplicationPort calls"]
+    calls --> release["Release demand lease"]
+    release --> warm["Bounded warm grace / idle LRU"]
+    warm -->|new demand| lease
+    warm -->|idle bound| cool["Deactivate providers;<br/>withdraw runtime projections"]
+    interface -->|worldless call| calls
     calls --> core["Core state and orchestration"]
     core --> events["subscribeToEvents<br/>(workspaceId, event, payload)"]
     events --> interface
 ```
 
 Every registered module's `setup` runs in registration order before any
-module's `start`. Core then readies schemes, publishes installed capabilities,
-recovers durable lifecycle, and starts modules in registration order. Shutdown
-closes started and self-closing modules in reverse order and surfaces aggregated
-close failures.
+module's `start`. Core then readies process-wide schemes, reconciles durable
+lifecycle, and starts modules in registration order. Persisted workspaces with
+no durable work stay passive until first demand; activation publishes their
+complete capabilities and documentation before the demanding operation
+proceeds. `setup` is the readiness boundary for every capability registered
+with Core: recovery may demand a workspace provider before `start`. `start`
+opens module-owned exterior ingress only after recovery, so no registered
+capability may depend on it. Shutdown begins started and self-closing module
+closure in reverse order and surfaces aggregated close failures.
 
 §module-discovery **Third-party daemon-module composition is manifest
 discovery.** A package declares `plurnk: { kind: "module", module:
@@ -2353,18 +2507,22 @@ discovery.** A package declares `plurnk: { kind: "module", module:
 factory returning one). At boot, core scans installed packages under the
 executor family's discovery and trust rules ({§plugin-discovery}) and
 registers every trusted declaring module before any module setup runs, in
-package-enumeration order. The service's explicit composition — the AG-UI,
+package-name order. The service's explicit composition — the AG-UI,
 hooks, and MCP modules — carries init options and is wired in service.ts;
 discovery never duplicates those packages. An untrusted declaring package is
 skipped with a boot warning, never executed. A module export that is neither
-an object nor a no-arg factory fails boot loudly.
-
-§module-shutdown-order `Daemon.stop()` returns only after active worker drains,
-streaming producers, derivations, mimetypes, schemes, and every accepted
-conclusion-wake task have settled in dependency order. The supervisor owns each
-asynchronous wake task from acceptance through settlement; a task failure
-participates in the shutdown aggregate. The database may be released only after
-the final wake barrier resolves.
+an object nor a no-arg factory, a factory returning a non-object, or an object
+with a non-function lifecycle member fails boot loudly.
+
+§module-shutdown-order `Daemon.stop()` first rejects new capability demand and
+aborts proposals, branches, derivations, and worker scopes. It simultaneously
+begins every module closer in reverse registration order, allowing exterior
+listeners to stop accepting work while active requests observe those
+cancellations. It then settles branches, drains, module closers, streaming
+producers, derivations, mimetypes, and schemes before its final conclusion-wake
+barrier. The supervisor owns each asynchronous wake task from acceptance
+through settlement; a task failure participates in the shutdown aggregate. The
+database may be released only after the final wake barrier resolves.
 
 §crash-only-stop The settle sequence is deadline-bounded
 (`PLURNK_SERVICE_STOP_TIMEOUT_MS`, default 30000): past the deadline each wait
@@ -2374,8 +2532,12 @@ unbounded one.
 
 ```mermaid
 flowchart LR
-    stop[Stop accepting work] --> drains[Settle worker drains]
-    drains --> producers[Settle streaming producers]
+    stop[Begin stop] --> abort[Abort core producers]
+    stop --> moduleClose[Begin reverse module closure]
+    abort --> drains[Settle worker drains]
+    drains --> joined[Settle module closures]
+    moduleClose --> joined
+    joined --> producers[Settle streaming producers]
     producers --> resources[Dispose derivations,<br/>mimetypes, and schemes]
     resources --> wakes[Settle conclusion wakes]
     wakes --> database[Release database]
@@ -2385,30 +2547,166 @@ flowchart LR
 |---|---|
 | `registerRuntimes([{ decl, executor, availability, scheme? }, ...])` | Validates the complete canonical tag set under {§executor-runtime-declaration}, then publishes every process-wide executor and optional claimed scheme facet atomically. |
 | `registerScheme(name, handler)` | Adds one process-wide addressable scheme handler; scheme readiness and model-facing capability publication remain core-owned. |
-| §module-action-registration `registerModuleAction({ name, scope, handler })` | Adds one non-empty, extension-unique action. `scope` is exactly `worldless` or `workspace`; the handler receives validated params and a separate matching context. A workspace context contains the trusted bound `workspaceId`, never a client parameter. A client-interface module decides whether and how the name becomes public and owns collisions with its built-ins. |
-| §module-workspace-provider `registerWorkspaceCapabilityProvider(namespaceOwner, provider)` | Registers one extension-unique provider whose `hydrate(workspaceId)` reconstructs its effective snapshot. Core invokes every provider for existing workspaces before capability publication and for a new workspace before that workspace is returned or advertised. |
-| §module-workspace-state `readWorkspaceModuleState(workspaceId, namespaceOwner)` | Reads the provider's one nullable JSON state value. Core owns workspace isolation and storage; the provider owns and validates its schema. Secret values are forbidden when a durable symbolic reference can identify their authoritative source. |
-| §module-workspace-capabilities `replaceWorkspaceCapabilities({ workspaceId, namespaceOwner, state, runtimes })` | Replaces one provider's complete durable state and runtime/scheme snapshot at a quiescent workspace boundary. Core validates base/peer namespace claims before mutation, blocks new turns, commits the snapshot, and reconciles pull docs as one operation. Failure restores the prior state and presentation. The empty runtime set removes that provider's workspace namespace. |
-
-§module-workspace-quiescence **A capability snapshot changes only between
-workspace operations.** A replacement attempt while a turn or another
+| §module-action-registration `registerModuleAction({ name, scope, inputSchema, outputSchema, handler })` | Adds one non-empty, extension-unique action with resolvable JSON Schemas. `scope` is exactly `worldless`, `workspace`, or `worker`; the handler receives schema-validated params and a separate matching context. Scoped contexts contain trusted bound identifiers, never client parameters. A client-interface module decides whether and how the name becomes public, validates successful output, and owns collisions with its built-ins. |
+| §module-worker-provider `registerWorkerCapabilityProvider(namespaceOwner, provider)` | Registers one extension-unique Functionality provider. `activate({ workspaceId, workerId, retain })` reconstructs that worker's effective snapshot; idempotent `deactivate({ workspaceId, workerId })` releases its process-local resources. Core coalesces activation and cooling, publishes complete private documentation before use, and supplies `retain()` so provider work that outlives its caller holds an idempotently releasable residency lease. Dormant workers perform no provider work at boot. |
+| §module-worker-state `readWorkerModuleState(workerId, namespaceOwner)` | Reads the provider's one nullable JSON state value for one worker. Core owns worker isolation and storage; the provider owns and validates its schema. Secret values are forbidden when a durable symbolic reference can identify their authoritative source. |
+| §module-functionality-adapter `registerFunctionalityAdapter(adapter)` | Registers one family of managed Functionality beneath the shared coordinator ({§functionality-coordinator}). The adapter owns protocol truth; the coordinator owns lifecycle, durable state, publication, and both projections. |
+| §module-worker-capabilities `replaceWorkerCapabilities({ workspaceId, workerId, namespaceOwner, state, runtimes })` | Replaces one provider's complete durable state and runtime/scheme snapshot for one worker at a quiescent workspace-operation boundary. Core validates worker membership and base/peer namespace claims before mutation, commits the snapshot, and reconciles that worker's private pull docs as one operation. Failure restores the prior state and presentation. The empty runtime set removes that provider from the worker's Functionality. |
+
+§module-worker-quiescence **A worker's Functionality snapshot changes only
+between workspace operations.** A replacement attempt while a turn or another
 capability mutation owns the workspace fails 409 instead of waiting behind an
 unbounded proposal. Candidate discovery may occur before the gate, but the
 provider must re-check its old connection for active user work after acquiring
 the gate. Infrastructure-owned watches may be cancelled during replacement;
 an active request, input exchange, or Task keeps the old snapshot authoritative
-and makes replacement fail 409.
-
-The version-1 baseline table `workspace_module_state` stores one JSON value per
-`(workspace_id, namespace_owner)`. It is not an alternate registry: executable
-and resource presentation always comes from the in-memory snapshot reconstructed
-by the registered provider. Deleting a workspace cascades its module state.
-
-### §methods CoreSeam function set
-
-`CoreSeam` is a curated `Pick<Daemon, ...>` and therefore changes with the
-implementation at compile time rather than through a parallel method catalog.
-Its function names are transport-neutral library calls, not public wire names.
+and makes replacement fail 409. The workspace-wide gate is an atomicity
+boundary, not ownership: only the addressed worker's snapshot changes. A Worker's
+own accepted Functionality mutation is the one replacement that waits instead of
+failing: it queues fairly behind the turn that raised it and publishes at that
+turn's boundary ({§functionality-model-mutation}). Two publications take no
+gate of their own because their demand already holds whatever applies: a
+Worker's activation (demanded from a client action, an operation, or a child's
+turn inside its parent's held lineage) and a family's turn-admission refresh
+({§skills-hotload}), which republishes inside the turn it is admitting. The
+three modes are explicit at the host boundary — `try` (409 while held),
+`wait` (queue behind the holder), `none` (publish within the demand) — and
+nothing else may choose `none`.
+
+§module-worker-inheritance **Functionality inherits by value.** Creating a
+child copies every parent `worker_module_state` row into the child in the same
+database transaction. Parent and child thereafter mutate independently;
+activation reconstructs each worker's own snapshot and generated references.
+Workers that merely share a workspace never share enabled Functionality.
+
+§module-worker-residency **Persistence is not residency.** Model execution,
+capability-aware client reads and operations, worker module actions, and
+provider work retained through the setup context hold that worker's Functionality
+resident. Daemon boot, workspace or worker creation, attachment, listing,
+renaming, an idle client, and durable queued or parked state do not. After the
+final lease releases, core keeps the complete snapshot warm for
+`PLURNK_SERVICE_WORKER_WARM_MS` (default `900000`) while an idle LRU keeps at
+most `PLURNK_SERVICE_WORKER_WARM_MAX` (default `2`) lease-free workers.
+`0` disables the respective grace or idle allowance; `-1` disables that bound.
+Only lease-free workers cool. New demand cancels pending cooling or waits for
+in-progress cooling before one coalesced reactivation.
+
+Cooling runs at a quiescent workspace-operation boundary. It deactivates every
+provider for that worker, withdraws its ephemeral executor and scheme snapshots,
+and evicts its passive process caches; durable workspace, worker, history,
+module-state, and reference-entry rows remain unchanged. Client connection
+presence and naming never participate in this lifecycle. Shutdown cancels warm
+timers and closes all still-resident provider resources through their module
+owner.
+
+The version-1 baseline table `worker_module_state` stores one JSON value per
+`(worker_id, namespace_owner)`. It is not an alternate registry: executable and
+resource presentation always comes from the in-memory snapshot reconstructed by
+the registered provider. Deleting a worker cascades its state; child creation
+applies {§module-worker-inheritance}.
+
+### §functionality Worker Functionality: one lifecycle above every family
+
+§functionality-coordinator **Core owns one coordinator above every family
+adapter.** Agent Skills, MCP servers, and outbound A2A agents are families of
+managed Functionality. Each family registers one adapter
+({§functionality-adapter}); the coordinator owns the common lifecycle —
+`list | discover | add | enable | disable | remove` — its durable per-Worker
+state ({§functionality-state}), serialization per Worker and family, atomic
+publication ({§functionality-publication}), and both projections: worker-scoped
+client actions `worker.<family>.<verb>` and one generated executor family per
+Worker ({§functionality-model-projection}). An explicit client action and an
+accepted model proposal converge on the same coordinator method; no family
+invents a third management grammar, configuration path, proposal policy, or
+hotload mechanism.
+
+| Verb | Common contract |
+|---|---|
+| `list` | Project every definition with its origin, desired enabledness, and current state — `disabled`, `active`, `unavailable` with its exact Problem, or `authorization-required` — without exposing credentials. |
+| `discover` | Inspect a query or source and return inert candidates with provenance. Discovery never installs, persists, enables, executes, or widens authority. |
+| `add` | Admit one exact definition through the adapter, persist it as a worker-origin definition, prepare it, and enable it atomically. A worker definition may shadow a same-alias service definition; a second worker definition for one alias is a 409 collision. |
+| `enable` | Prepare and publish one available definition; re-enabling an unavailable one retries its preparation. |
+| `disable` | Withdraw the effective capability while keeping the definition available and client-visible. |
+| `remove` | Disable and forget the Worker's own definition; a same-alias service definition becomes visible again, disabled. Service definitions are disable-only. |
+
+§functionality-adapter **An adapter owns protocol truth and nothing else.** It
+declares its family (the action segment and EXEC tag), its one namespace owner,
+the exact definition schema one `add` accepts, its service-contributed
+definitions with their default enabledness, inert discovery, admission of an
+authored definition, two-phase preparation of the enabled set, and teardown.
+Preparation returns the family's runtimes, its generated documents, one outcome
+per enabled alias, and a snapshot with `commit`/`abort`; the coordinator
+never tears down a previous snapshot behind the adapter — it commits after a
+successful publication, aborts after a failed one, and tears down only on
+deactivation. Protocol continuations (an OAuth completion, an input-required
+answer) remain adapter-registered actions beneath the common grammar. An
+adapter may declare `forget`: before the coordinator forgets a Worker-origin
+definition on `remove` it lets the adapter release what that definition
+installed or provisioned ({§skills-remove}); a failed release rejects the
+removal and changes nothing.
+
+§functionality-state **One durable value per Worker and family.** The
+coordinator stores `{ version: 1, definitions: { [alias]: { origin, enabled,
+definition? } } }` in `worker_module_state` under the adapter's namespace
+owner. A `service` alias persists only its enabledness; a `worker` alias
+persists its exact definition. Enabledness is durable desired state; active,
+unavailable, and authorization-required are the current preparation outcome.
+Inheritance by value is the table's own birth snapshot
+({§module-worker-inheritance}); service, user, project, and client configuration
+contribute available definitions and defaults but are never the live effective
+authority.
+
+§functionality-publication **One replacement publishes a family.** The
+coordinator prepares the enabled set, then replaces the family's state and
+runtimes — the family's manager runtime first, the adapter's capabilities after
+it — in one {§module-worker-capabilities} call, so admission, generated
+documentation, resources, effects, Turn 0, client status, and teardown derive
+from one committed snapshot. A failed replacement aborts the preparation and
+keeps the previous snapshot authoritative. Mutations serialize per Worker and
+family; shutdown — and any caller that must observe a boundary publication
+before acting, through `settleFunctionality` — settles every queued
+publication before closing the database.
+
+§functionality-documents **A family's generated documents travel with its
+snapshot.** Preparation may return documents addressed relative to the
+Worker's generated subtree ({§worker-generated-subtree}); the coordinator
+contributes them to the Worker's reference entries so they reconcile with the
+same `_plurnk` materialization as every other generated document. The model
+surface is silent until active (operator ruling, #333): a disabled or
+enabled-but-unavailable definition publishes no document and no Turn 0 row —
+the hot path carries only working capability, never "a thing you cannot do."
+An unavailable definition's exact Problem stays reachable on demand: the
+family's `list` verb returns it and invoking the alias is rejected with it.
+
+§functionality-model-projection **The model face is a generated executor
+family per Worker.** Every activated Worker publishes, for each registered
+family, one executor tagged with the family name whose registered targets are
+exactly the six verbs; its documents render through
+{§tools-resource-materialization} like every family, so the model learns the
+manager from `_plurnk/skills/plurnk/<family>.md` and never from hand-written
+teaching. `list` and `discover` are `read` effects and run ungated; `add`,
+`enable`, `disable`, and `remove` are `host` effects and propose through
+the ordinary Exec proposal lifecycle. A verb's JSON outcome streams into the
+family's output entry. `ExecArgs` carries no Worker identity, which is why
+the manager is published per Worker rather than once.
+
+§functionality-model-mutation **An accepted mutation publishes at its turn
+boundary.** The verb runs inside the turn that raised it, which holds the
+workspace; the coordinator persists desired state and prepares immediately —
+so the result reports `active`, `unavailable`, or `authorization-required`
+— and a failed preparation publishes an enabled-but-unavailable outcome rather
+than rejecting. Publication queues behind that turn in the family's serialized
+lane and settles before the Worker's next operation or packet. An explicit
+client action instead publishes now, rejects a failed preparation, and fails
+409 while the workspace is held ({§module-worker-quiescence}). Rejecting a
+proposal prepares, persists, and publishes nothing.
+
+### §methods ApplicationPort function set
+
+`ApplicationPort` is the contracts-owned interface implemented by `Daemon` and
+consumed by every exterior adapter ({§application-port}). Its function names are
+transport-neutral library calls, not public wire names; this table specifies
+Core's behavior behind them.
 
 | Area                                              | Function | Core contract |
 |---------------------------------------------------|----------|---------------|
@@ -2417,16 +2715,16 @@ Its function names are transport-neutral library calls, not public wire names.
 | §methods-proposal-resolve Proposals               | `resolveProposal(logEntryId, resolution)` | Validates and delivers one accept, reject, or cancel decision to the engine. An unknown or already-resolved id fails; the client protocol owns how the decision arrived. |
 | §client-interaction-list Client interactions      | `pendingClientInteractions(workspaceId)` | Intersects durable interaction rows with their live operation waiters and returns the contracts-owned projection; a row alone is not a resumable interaction. |
 | §methods-client-interaction-resolve Client interactions | `resolveClientInteraction(interactionId, resolution)` | Validates and delivers one resolved payload or cancellation. Unknown, ownerless, and already-resolved identities fail before affecting an operation. |
-| §methods-loop-run Loops                           | `runLoop({ workspaceId, workerId, prompt, maxTurns?, flags?, openPaths?, selector?, childSelector? })` | Validates a model worker and provider policy, persists it with the effective turn ceiling, then returns an immediate status-100 acknowledgement with `loopId` and `action`. The exact terminal result arrives only through `loop/terminated`; parking and resuming do not replace the loop. |
-| §methods-loop-cancel Loops                        | `cancelDrain(workerId, reason?)` | Begins durable structured cancellation of the worker tree and reaps its process-local scopes. The boolean reports whether process-local work existed when called; queued or parked durable work is still terminalized when it is `false`. |
-| §methods-op-mirror Client dispatch                | `dispatchClientAction({ workspaceId, workerId, statements })` | Dispatches already-parsed grammar statements as one client action in one administrative loop. Every statement is an ordered client/operation turn, and every committed `log/entry` is emitted before the action promise resolves; a proposal may keep its turn, loop, and action promise open until resolution. Core exposes no per-op method family. |
-| Client observation                                | `look({ workspaceId, workerId, statement })` | Runs an already-parsed READ through the full resolver without a log row. A non-READ statement is rejected ({§op-look}). |
+| §methods-loop-run Loops                           | `runLoop({ workspaceId, workerId, prompt, source?, maxTurns?, flags?, openPaths?, selector?, childSelector? })` | Validates a model worker and provider policy, persists it with the effective turn ceiling, then returns an immediate status-100 acknowledgement with `loopId` and `action`. A trusted adapter may identify the prompt's causal actor with one canonical `source`; ordinary clients cannot author it through their protocol surface. The exact terminal result arrives only through `loop/terminated`; parking and resuming do not replace the loop. |
+| §methods-loop-cancel Loops                        | `cancelDrain(workerId, reason?)`; `cancelWorker({ workspaceId, workerId, reason? })` | `cancelDrain` begins durable structured cancellation and reports whether process-local work existed when called; queued or parked durable work is still terminalized when it is `false`. The ownership-bounded `cancelWorker` awaits that same tree cancellation and stream reap, so an exterior protocol can project the settled durable result without polling or fabricating state. |
+| §methods-op-mirror Client dispatch                | `dispatchClientAction({ workspaceId, workerId, functionalityWorkerId, statements })` | Dispatches already-parsed grammar statements as one client action in one administrative loop in the client worker, executing in the attached Worker's Functionality ({§actor-boundary-attached-functionality}). Every statement is an ordered client/operation turn, and every committed `log/entry` is emitted before the action promise resolves; a proposal may keep its turn, loop, and action promise open until resolution. Core exposes no per-op method family. |
+| Client observation                                | `look({ workspaceId, workerId, functionalityWorkerId, statement })` | Runs an already-parsed READ through the full resolver in the attached Worker's Functionality without a log row. A non-READ statement is rejected ({§op-look}). |
 | §methods-log-read Reads                           | `readLog({ workspaceId, workerId, ...coordinate })` | Ownership-checks the worker, then reads by ids, recency, or the complete `loopSeq`/`turnSeq`/`sequence` display coordinate. `limit` defaults to 100 and is capped at 1000. |
 | §methods-entry-read Reads                         | `readEntry({ workspaceId, workerId, target, channel?, offset? })` | Resolves the selector from that worker's perspective and returns {§entry-read-result}, either complete or as one channel suffix, without creating action evidence. |
 | Providers                                         | `listProviders()` | Lists configured aliases with provider/model identity, active state, and the effective provider-derived `inputCapacity` when known. |
 | Model catalog                                     | `listModels(query)` | Returns one validated bounded {§model-catalog-wire} page under {§model-catalog}; performs no provider request or selection. |
 | Client capabilities                               | `listClientDisplayCapabilities()` | Composes sorted scheme declarations ({§manifest-client-display}) followed by sorted MIME declarations ({§mimetype-client-display}) into the validated shared wire ({§client-display-capabilities}). The internal `exec` operation handler is excluded; its addressable runtime-tag scheme faces remain included. |
-| §methods-workspace-create Workspace lifecycle     | `createWorkspace({ name?, projectRoot?, settings?, constraints? })` | Validates `settings` through {§operator-config-workspace-settings}, creates the world and its client envelope, materializes current docs and constraints, starts derivation warming, and emits global `workspace/created`. `projectRoot` is established here or the workspace remains headless. |
+| §methods-workspace-create Workspace lifecycle     | `createWorkspace({ name?, projectRoot?, settings?, constraints? })` | Validates `settings` through {§operator-config-workspace-settings}, creates the world and its client envelope, applies constraints, and emits global `workspace/created`. Creation and attachment are passive: neither starts derivation nor activates worker Functionality. `projectRoot` is established here or the workspace remains headless. |
 | §methods-workspace-attach Workspace lifecycle     | `attachWorkspace({ workspaceId, workerId?, workerName? })` | Validates ownership and returns a client envelope for an existing world. It does not retain caller or transport binding state in core. |
 | §methods-model-worker Workspace lifecycle         | `ensureModelWorker(workspaceId)` | Returns the workspace's stable default model worker, creating it on first use. A durable default-conversation role identifies it independently of worker name and root creation order. Repeated and concurrent calls return the same root; fresh conversations and forks do not replace it. |
 | §methods-conversation-worker Workspace lifecycle  | `createConversationWorker({ workspaceId, name? })` | Creates a distinct model-origin root worker with empty private history: a fresh conversation over the same world, not a fork or the stable default. |
@@ -2434,8 +2732,11 @@ Its function names are transport-neutral library calls, not public wire names.
 | §methods-workspace-rename Workspace metadata      | `renameWorkspace(workspaceId, name)` | Changes only the world's unique mutable name; workers, log, and membership remain intact. |
 | Workspace metadata                                | `constrain(...)`, `unconstrain(...)`, `listConstraints(...)`, `listMembers(...)` | Owns the membership overlay and returns its resolved effects; clients do not reimplement constraint semantics. |
 | §methods-workspace-prompts Workspace metadata     | `listPrompts(workspaceId, limit?)` | Returns nonempty loop-seed prompts from the workspace's model-origin root conversations, newest-first. The positive limit defaults to 100; spawned and forked child prompts are excluded. |
-| Workspace metadata                                | `listWorkspaces()`, `listWorkers(...)`, `workspaceDerivationStatus(...)` | Reads current workspace topology and derivation progress. |
-| Extension actions | `listModuleActions()`, `invokeModuleAction(name, params, context)` | Lists setup-registered `{ name, scope }` descriptors in sorted order. Invocation requires a context matching the registered scope; missing names, forged scope, and missing workspace identity fail before the owner runs. Handler values remain opaque to core. |
+| Workspace metadata                                | `listWorkspaces()`, `workspaceDerivationStatus(...)` | Reads current workspace identity and derivation progress. |
+| §methods-worker-read Worker topology              | `readWorker({ workspaceId, identity })` | Ownership-bounds an exact id-or-name lookup and returns one durable Worker projection or `null` under {§application-worker-observation}. Supplying both identities or neither is invalid. |
+| §methods-worker-list Worker topology              | `listWorkers(workspaceId, query?)` | Returns the workspace's durable Worker projections under {§application-worker-observation}. The origin filter is exact; an explicitly present `parentWorkerId` filters roots (`null`) or one immediate parent (id), while omission returns every lineage position. |
+| §methods-worker-loops Loop lifecycle              | `listWorkerLoops({ workspaceId, workerId })` | Ownership-checks the Worker and returns its Loops in sequence order under {§application-loop-observation}, including the validated exact terminal result when one exists. It performs no scheduling or event replay. |
+| Extension actions | `listModuleActions()`, `invokeModuleAction(name, params, context)` | Lists setup-registered `{ name, scope, inputSchema, outputSchema }` descriptors in sorted order. Invocation requires a context matching the registered scope; missing names, forged scope, and missing workspace identity fail before the owner runs. Handler values remain opaque to core. |
 
 §methods-loop-run-fold-consistency **A folded prompt cannot silently reconfigure
 its loop.** When `runLoop` targets an active or 202-parked loop, core appends the
@@ -2633,6 +2934,7 @@ active lifecycle behind. LOOK text anchors resolve through the same
 | §notifications-stream-event-on-channel-change `stream/event` | `{ entryId, workerId, target, channel, state, contentLength, mimetype?, loop_seq?, turn_seq?, sequence? }` | Channel content grows or channel state transitions. `workerId` is the entry owner and read perspective; `target` is its canonical URI. The optional coordinate is copied from schemes whose addresses carry one. Core-managed channel writes include the current stored `mimetype`, which may change per call ({§channel-mimetype}); the generic plugin notification capability does not require it. It carries metadata, not content; consumers read bytes from the stated worker perspective. |
 | §notifications-stream-concluded `stream/concluded`           | `{ entryId, workerId, target, subscriptionId, scheme, result, summary, wakeAction, wakeLoopId?, loop_seq?, turn_seq?, sequence? }` | A subscription closes. `workerId` identifies the entry owner; `target` is its canonical URI. The optional coordinate is copied from schemes whose addresses carry one, so clients never parse it back out of `target`. Exact result truth is preserved; `wakeAction` records whether core resumed a parked loop, folded into an active loop, skipped an aborted/cancelled worker, or found no loop. |
 | §notifications-notice-event `notice/event`                   | `{ loopId, notice: Notice }` | A transient observation or progress notice occurs. It cannot alter durable history, scheduling, recovery, or model-visible failure truth. |
+| §notifications-reasoning-event `reasoning/event`             | `{ workerId, loopId, turnId, modelCallId, phase, delta? }` | A main emission call exposes readable reasoning. A nonempty stream is balanced start/content/end; only content carries a nonempty exact delta. It is transient presentation evidence, never a log row, Notice, packet field, or BARE/child channel. The settled provider response remains the durable authority. |
 
 §notifications-stream-event-failure-isolation The plugin-facing
 `NotifyCaps.streamEvent()` remains a synchronous advisory call while core
@@ -2654,7 +2956,9 @@ outward envelope that requires it and owns workspace fan-out.
 ### §connection-lifecycle Client action evidence
 
 A module client is an actor ({§machine-processes}). Its dispatched side effects
-write to its own client worker with `origin="client"`; one client action owns
+write to its own client worker with `origin="client"` and execute in the
+Functionality of the Worker the client is attached to
+({§actor-boundary-attached-functionality}); one client action owns
 one administrative loop, and its statements become ordered operation turns
 inside that loop. A proposal may hold its turn and loop across an external
 interrupt/resume, but those records preserve durable evidence rather than
@@ -2764,7 +3068,7 @@ time of measurement.
 
 §tokenomics-client-gauge **Clients receive curation and physical occupancy as separate pairs.** `loop/terminated.usage` carries latest packet-bearing model-turn `curationWeight`/`curationBudget` and latest-emission-call `contextTokens`/`contextCapacity`; each unknown fact is `null`. Packetless chronology cannot erase an assembled-request gauge. Both physical facts bind to that same call: a preflight rejection may report capacity while its absent physical request leaves `contextTokens=null`, never borrowed from an earlier call. Clients never divide provider-reported physical tokens by Core curation weight. `providers.list` exposes each instantiated alias's `inputCapacity`. A model switch replaces the latest-turn facts together; aggregate provider accounting remains cardinal monetary evidence, not a gauge input.
 
-- **Derivation is eager and exhaustive.** Workspace creation and searchable-resource changes start one coalesced warm. The first model turn joins that warm; later turns derive intervening changes before dispatch. No model operation observes partial graph or vector coverage. A semantic query ranks every eligible candidate in scope, so lexical overlap never gates vector recall. With no embedder, readable-content FTS is the explicit keyword fallback. Progress notices make the wait visible; latency is never hidden by partial semantics. {§derivation-exhaustive}
+- **Derivation is exhaustive and demand-led.** Explicit searchable-resource changes may start one coalesced warm. Passive creation and attachment do not. The first model turn starts or joins that warm; later turns derive intervening changes before dispatch. No model operation observes partial graph or vector coverage. A semantic query ranks every eligible candidate in scope, so lexical overlap never gates vector recall. With no embedder, readable-content FTS is the explicit keyword fallback. Progress notices make the wait visible; latency is never hidden by partial semantics. {§derivation-exhaustive}
 - §membership-binary-sniff **Binary truth beats the label; no entry dominates the corpus.** A tracked member whose HEAD bytes contain NUL enters {§membership-source-projection} as `application/octet-stream` **regardless of what extension-based detection claims**; byte-level evidence outranks a default label. Every eligible text is tiled losslessly to the embedder window and every tile is embedded before its derivation attaches; semantic ranking max-pools the best chunk per candidate.
 - §tokenomics-agnostic-ruler **One model-agnostic curation ruler.** The daemon runs workers on different models in one workspace concurrently, while catalog and log accounting are workspace-wide. `contentWeight = ceil(chars/2)` therefore gives one content one stable number without per-model workspace state or recount passes. It controls curation only; every provider call independently measures the complete request as well as it can.
 - §tokenomics-neutral-telemetry **Curation telemetry is state, not response allowance.** The model-facing `Context Token Budget` section contains exactly two fields on separate lines: `tokensActiveTotal: N (P%)` and `tokensActiveMax: M`. It never presents their difference as free response tokens. The protocol definition directly requires FOLD, KILL, or trimming of irrelevant log items to keep the next packet within the maximum. Per-entry weights remain on log rows where they describe OPEN cost and FOLD savings. Packet-level composition, rankings, and physical token speculation are absent.
@@ -2835,14 +3139,14 @@ and never re-fetch a match.
 - §membership-git-hermetic Native Git runs with ambient `GIT_*` and
   global/system config scrubbed, so repository identity follows `project_root`,
   never the daemon's launch environment.
-- §membership-edit-membership-gate **Membership-gated edits.** EDIT is bounded by membership exactly as READ is. An existing **member**'s baseline is its entry snapshot — the body channel the model READ, not a fresh disk read — so the diff is naive against the view the model saw, never empty (the write-side CAS, {§membership-edit-write-cas}, prevents the silent overwrite of out-of-band drift). An existing **non-member** is refused (403) *before* any read or write: the model never reads a file it can't see (no leak into the proposal) and never overwrites one (no wiping a gitignored `.env` it never added). A **new path** stays open — proposal→accept adds it to the manifest. Reaching past membership is `## EXEC0 [sh]`'s job, not the file scheme's.
+- §membership-edit-membership-gate **Membership-gated edits.** EDIT is bounded by membership exactly as READ is. An existing **member**'s baseline is its entry snapshot — the body channel the model READ, not a fresh disk read — so the diff is naive against the view the model saw, never empty (the write-side CAS, {§membership-edit-write-cas}, prevents the silent overwrite of out-of-band drift). An existing **non-member** is refused (403) *before* any read or write: the model never reads a file it can't see (no leak into the proposal) and never overwrites one (no wiping a gitignored `.env` it never added). A **new path** crosses the creation matrix in {§fs-write-surface}; proposal acceptance cannot bypass its scope, exclusion, or incorporation rules. Reaching past membership is `## EXEC0 [sh]`'s job, not the file scheme's.
 - §membership-create-parents **Parent-complete creation.** An accepted File creation—whether authored as EDIT or as a COPY/MOVE destination—recursively creates missing parent directories before writing and registering the new member.
 
 **The overlay — `pick | view | hide`, removed by `drop`.** A `workspace_constraints` table is the client's supersede over Git. Resolved membership is `(project repository files ∪ pick) − hide`, with `view` enforced at the edit gate.
 
-- §membership-auto-add **Auto-add** — the project repository's membership is its tracked `ls-files` plus untracked-but-not-ignored files (`git ls-files --others --exclude-standard`), with `git` origin. A model-created file is a member the moment it exists—no `git add`—while `.gitignore` still filters it.
-- §membership-overlay-pick **`pick`** — admit an untracked file git misses: a targeted client-dictated `node:fs` glob scan over untracked matches (files only), 'constraint' origin, reconciled like git members. Enumerated, so the manifest stays exhaustive. git-absent, `pick` is the *sole* membership source.
-- §membership-overlay-hide **`hide`** — exclude a tracked file: resolution drops matches (`node:path.matchesGlob`) and reconciles so the entry set *equals* the member set. The lever to exclude a committed-but-sensitive tracked file; `entries.membership_origin` keeps reconciliation off model-created members.
+- §membership-auto-add **Auto-add** — the project repository's ambient membership is its tracked `ls-files` plus untracked-but-not-ignored files (`git ls-files --others --exclude-standard`), with `git` origin. An accepted creation selected for Git incorporation is explicitly staged; failure falls back to an exact generated pick, never an orphan ({§file-create-no-orphans}).
+- §membership-overlay-pick **`pick`** — admit a file Git misses through a targeted constraint scan (files only), with `constraint` origin. `source: "explicit"` records operator/client policy; `source: "create"` is the exact durable record of an accepted creation. Only explicit picks override active Git ignore. In a Git-absent root, picks are the sole file-membership source.
+- §membership-overlay-hide **`hide`** — exclude a tracked or picked file: resolution drops matches (`node:path.matchesGlob`) and reconciles so the entry set *equals* the member set. The lever to exclude a committed-but-sensitive tracked file; exclusions mask generated creation picks without deleting their provenance ({§fs-create-masked}).
 - §membership-overlay-view **`view`** — keep a member readable but refuse `File.edit`, 403'd at the membership check before any diff. (Admitting an untracked file as `view` rides on `pick`'s scan.)
 - §membership-resolved-effects **Resolved effect is a read, not a re-derivation.** `workspace.members` surfaces each candidate's resolved effect — `(ls-files ∪ pick) − hide` tagged `member` / `view`, plus the `hide`-excluded `hidden` set — so a client signs file visibility (member / read-only / ignored) without reimplementing the overlay glob-matching. The daemon owns git + the globs; the per-file effect is its to resolve, the client's to render.
 
@@ -2888,13 +3192,13 @@ Lossless chunk admission requires either the embedder's own counter or an exact
 
 §membership-change-gated-sync **Sync is idempotent and change-gated.** Per turn, membership materializes every member's model-readable snapshot into its entry. Text with an unchanged disk signature is a stat-only no-op. The version token is either the observed `mtime:size` or the explicit `absent` state; an observed deletion removes the stale readable channels, and a later reappearance is therefore a new divergence rather than a first-sight materialization. Binary sources additionally compare the cached per-mimetype projection identity; unchanged bytes are never reacquired, while changed reader behavior rematerializes without fabricating a filesystem-divergence event. Coverage is exhaustive across the project repository while work is proportional to source or projection change. After a pass every member carries the current representation defined by {§membership-source-projection}.
 
-§membership-emi-divergence-signal **EMI divergence signal.** The detector that gates the work *is* the one that fires this — one mechanism, not a second full read. When the change-detect finds a member moved out-of-band, the delta detector ({§env-delta}) surfaces it as a system `EDIT` log row naming the file, `source="file"` — the model sees what changed without diffing the manifest against memory. The model's own edits are write-through (the entry equals disk after a File write), so the scan never mis-attributes them as external divergence.
+§membership-emi-divergence-signal **EMI divergence evidence.** The detector that gates the work *is* the one that records this — one mechanism, not a second full read. When change detection finds a member moved out-of-band, the runtime actor records an `EDIT`-shaped row naming the file with `source="file"`; it does not broadcast that workspace change into unrelated workers' logs ({§env-delta-filesystem-narration}). The model's own edits are write-through (the entry equals disk after a File write), so the scan never mis-attributes them as external divergence. The current file remains ordinarily addressable. A stale anchored edit rejects under {§line-anchors}; a disk race after proposal rejects under {§membership-edit-write-cas}.
 
-§membership-edit-write-cas **The write-back is a compare-and-swap — never a clobber, never a clever merge.** EDIT is *naive against the editable text snapshot*: it diffs the model's change onto the entry's body channel — the exact Unicode the model READ — and the proposal carries the `synced_sig` that snapshot was taken at. Binary sources are refused before this path ({§membership-source-projection}). At accept, `applyResolution` re-stats disk and lands the proposed content only if that signature still matches. If disk moved out-of-band in the propose→accept window — a sibling worker, the user's editor, a build step — the write is **refused** with the same neutral `edit-collision` as {§edit-collision}, and **nothing is written**. The engine neither blind-writes over the ambient change (a *clobber*) nor silently re-diffs the model's edit against a state it never saw (getting *clever*) — both would bury a stale-view contract violation under a fallback. The collision surfaces instead: a ≥400 apply downgrades to a reject ({§proposal}), so the model sees that EDIT **did not occur** (400; the `edit_collision` outcome is forensics-only), the next reconcile narrates the real disk content as a `source=file` divergence ({§membership-emi-divergence-signal}), and the model re-reads and re-proposes against the fresh snapshot.
+§membership-edit-write-cas **The write-back is a compare-and-swap — never a clobber, never a clever merge.** EDIT is *naive against the editable text snapshot*: it diffs the model's change onto the entry's body channel — the exact Unicode the model READ — and the proposal carries the `synced_sig` that snapshot was taken at. Binary sources are refused before this path ({§membership-source-projection}). At accept, `applyResolution` re-stats disk and lands the proposed content only if that signature still matches. If disk moved out-of-band in the propose→accept window — a sibling worker, the user's editor, a build step — the write is **refused** with the same neutral `edit-collision` as {§edit-collision}, and **nothing is written**. The engine neither blind-writes over the ambient change (a *clobber*) nor silently re-diffs the model's edit against a state it never saw (getting *clever*) — both would bury a stale-view contract violation under a fallback. The collision surfaces instead: a ≥400 apply downgrades to a reject ({§proposal}), so the model sees that EDIT **did not occur** (400; the `edit_collision` outcome is forensics-only). Reconciliation aligns the current file projection and records the `source=file` evidence in the runtime log ({§membership-emi-divergence-signal}); the model re-reads and re-proposes against the fresh snapshot.
 
 The version travels *with the proposal*, never re-read from the entry at accept: a sibling worker in the same workspace may reconcile while this proposal sits paused, advancing the entry's `synced_sig` to the drifted disk — comparing against the *current* entry sig would wave that clobber through, so the comparison is always against the sig the proposal was computed at. A proposal that assumed an **absent** path (a create) conflicts only if a file has since appeared; a member with **no recorded snapshot** (an un-materialized entry, null `synced_sig`) has no baseline to guard and writes through — the two are told apart by the proposal's `existed` flag, not by a null sig alone. On a clean landing the entry refreshes to the written content and `synced_sig` is **restamped** to it, so the next reconcile recognizes the model's own write (not an external divergence) and a second same-turn edit bases on the landed bytes, not a stale sig. This is the write-side twin of the read-side change-gate ({§membership-change-gated-sync}): one `synced_sig`, gating both the re-read and the write.
 
-The CAS is the **hard backstop**, at the moment of writing, on every accept path. It composes with — and is distinct from — the loop-auto `staleClobberRisk` guard ({§proposal-ownership-auto-stale-clobber}): that guard refuses to resolve an edit whose target already diverged earlier this turn (the read→propose window, auto path only); the CAS refuses to write against a snapshot disk has left (the propose→write window, every path). Together they bracket the full read→write span.
+The CAS is the **hard backstop**, at the moment of writing, on every accept path. It composes with the model-facing {§line-anchors}: an anchor rejects a target whose relevant neighborhood changed before dispatch, while the CAS refuses to write against a snapshot disk left after proposal. An unanchored edit deliberately claims no pre-dispatch stale-view guarantee.
 
 §membership-git-flags **Permission flags.** Service-wide Git admission comes from {§operator-config-git-ceiling}. `PLURNK_SERVICE_GIT_AUTO=1` (default) includes the repository containing `project_root`; `=0` disables automatic Git membership, leaving `pick` as the only membership source. `ALLOWED` gates `AUTO`.
 
@@ -2940,7 +3244,7 @@ becomes a packetless `_plurnk` turn. Packetless initialization and recovery turn
 remain ordinary turn chronology but do not consume `maxTurns`, model-call,
 emission-attempt, usage, or cost accounting.
 
-- §overflow-turn-script **Recovery is one ordinary admitted `_plurnk` program.** Its PLAN body is `Automatically FOLD log bodies newly active at token-budget overflow.`, followed by every causal whole-body FOLD and terminal `SEND0 [102]` with body `Next: YOU MUST ONLY FOLD, KILL, or trim ALL superseded, stale, or irrelevant log content in bulk in the next turn.` The final sentence requires the successor's substantive operations to be one dedicated, comprehensive bulk-curation program; mandatory PLAN and SEND framing still applies. Its exact `turnOps` is born FOLDED; successful FOLD rows follow {§fold-open-meta-operations} and therefore remain durable but packet-suppressed. Every recovery row carries `_plurnk` and `overflow`; no model call, synthetic receipt, or parallel explanation exists.
+- §overflow-turn-script **Recovery is one ordinary admitted `_plurnk` program.** Its canonical {§plan-value} has one `medium`, `in_progress` entry whose content is `Automatically FOLD log bodies newly active at token-budget overflow.`, followed by every causal whole-body FOLD and terminal `SEND0 [102]` with body `Next: YOU MUST ONLY FOLD, KILL, or trim ALL superseded, stale, or irrelevant log content in bulk in the next turn.` The final sentence requires the successor's substantive operations to be one dedicated, comprehensive bulk-curation program; mandatory PLAN and SEND framing still applies. Its exact `turnOps` is born FOLDED; successful FOLD rows follow {§fold-open-meta-operations} and therefore remain durable but packet-suppressed. Every recovery row carries `_plurnk` and `overflow`; no model call, synthetic receipt, or parallel explanation exists.
 - §overflow-turn-curation **The preceding turn owns the pressure it introduced.** Core deterministically selects every body already created in the packetless candidate turn, every body created by the immediately preceding completed turn in that worker's chronology, and every older body whose visibility that preceding turn's successful OPEN increased. Every selected body is FOLDed whole (`<1,-1>`) through ordinary dispatch. Already-wholly-folded and bodyless rows require no operation. Core performs no relevance judgment, exempts no operation or resource kind, reconstructs no interval delta, re-runs no authored selector, and chooses no unrelated older history.
 - §overflow-turn-hard-413 **Recovery fails hard when the causal fold cannot fit.** After the ordinary FOLDs land, Core rebuilds and remeasures once. If the plan changes no visibility or the rebuilt request still exceeds the ceiling, the loop terminalizes with an exact `engine/context/token-budget-overflow` 413 Problem; Core neither submits excess bytes nor chooses unrelated older history. Separately, every `provider.generate` assesses physical capacity under {§provider-surface-capacity}. Core may retry a provider capacity rejection only after withholding automatic prompt-body projection when that changes the request. If it cannot produce changed bytes or the changed request is still rejected, the request-only model turn and provider-owned Problem terminalize at **413 Content Too Large**.
 
@@ -2961,55 +3265,56 @@ to reverse or refine that curation through ordinary log operations.
 ### §env-delta The environment delta: what changed since the model last looked
 
 Catalog FIND results ({§packet-catalog}) state what existed when observed. The
-environment delta supplies the events that made a worker's prior view stale
-without copying the shared world into worker-private state.
+environment delta supplies structurally addressed activity without copying the
+workspace into every worker's private state.
 
 ```mermaid
 flowchart LR
-    sibling["Sibling resolves EDIT<br/>on shared entry"] --> events["Durable shared-event record"]
-    disk["Project file diverges<br/>from materialized snapshot"] --> kernel["Reserved plurnk worker<br/>records source=file EDIT"]
-    sink["Executor entry() sink<br/>materializes readable entry"] --> typed["Reserved plurnk worker<br/>records typed EDIT event"]
-    kernel --> events
-    typed --> events
-    events --> pull["Pre-turn lossless pull<br/>(cursor, captured high-water]"]
-    pull --> log["Observer's self-contained log<br/>origin=_plurnk; born FOLDed"]
+    child["Child commits activity"] --> event["One durable occurrence"]
+    commons["Any worker mutates worker:///"] --> event
+    event --> parent["Direct-parent audience"]
+    event -->|"commons only"| global["Workspace audience"]
+    parent --> pull["Pre-turn lossless pull<br/>(cursor, captured high-water]"]
+    global --> pull
+    pull --> log["Observer's self-contained log<br/>origin=_plurnk"]
     log --> packet["Packet lists coordinate;<br/>OPEN recalls exact body"]
 ```
 
 §env-delta-log-pull **Pull the event record, never a world snapshot.** At
-pre-turn, a worker materializes every other actor's event on shared state after
-its last completed observation boundary into its own log. The set is
-exhaustive, unranked, and exactly once; the engine makes no relevance decision.
-Each copied event retains its effect, cause, typed attributes, and initial
-log classifications ({§log-item-tags}). Every
-producer appends to one workspace-scoped occurrence journal with a monotonic
-identity. A pull captures one closed `(worker cursor, high-water]` interval,
-materializes each identity idempotently, then advances the cursor only after the
-whole interval is durable. An event racing the capture is therefore in this
-interval or a later one, never neither or both. Source-log curation cannot erase
-the occurrence record.
-
-The cursor is observation progress, not a private copy of entry contents. A
-fresh worker baselines the current high-water immediately after opening its
-first turn: older state arrives through the ordinary current-world projections,
-while events racing that first packet remain deliverable. A fork copies the
-parent's captured cursor with its log; copied event identities cannot republish,
-and occurrences the parent had not observed remain pending independently for
-both workers.
-
-§env-delta-worker-entry-visibility **Worker-entry visibility follows the
-authority contract.** Commons mutations (`worker:///...`) and mutations to the
-published kernel surface (`worker://plurnk/...`) are shared-state events and
-retain that authority in the observer row. Current-worker scratch
-(`worker://~/...`) and every ordinary named worker space are private: they never
-cross this door, while an ancestry-authorized explicit READ remains available.
-
-| Producer                                                 | Durable event                                                                                                               | Observer projection                                                                                                                                    |
-| -------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| §env-delta-sibling-edit Sibling commons mutation         | The sibling's successful resolved `EDIT` row and its receipt.                                                               | One folded `EDIT` retaining the exact effect and typed attributes.                                                                                     |
-| §env-delta-kernel-entry-edit Kernel-published mutation   | The reserved `plurnk` worker's successful resolved `EDIT` row on `worker://plurnk/...`.                                     | One folded `EDIT` retaining the published authority, exact effect, and typed attributes.                                                               |
-| §env-delta-filesystem-narration Project-file divergence  | The reserved `plurnk` worker records one `source=file` EDIT-shaped event during pre-turn membership reconciliation.         | One folded `EDIT` naming the file and carrying the net changed span plus the exact two-coordinate Git porcelain status in `git` metadata when Git reports that path. No model operation is fabricated as having run. |
-| §env-delta-entry-materialization Executor `entry()` sink | The reserved `plurnk` worker records a typed `EDIT` event with `kind="entry_materialized"` and the calling worker as cause. | One folded system `READ` projection advertising newly readable state; the durable event remains an EDIT for replay and forensics ({§exec-entry-sink}). |
+pre-turn, a worker materializes only occurrences whose structural audience
+includes that worker. The set is exhaustive, unranked, and exactly once; the
+engine makes no relevance decision. Each copied event retains the operation,
+result, typed attributes, and initial log classifications ({§log-item-tags}).
+Every producer appends to one workspace-scoped occurrence journal with a
+monotonic identity. A pull captures one closed `(worker cursor, high-water]`
+interval, materializes each addressed identity idempotently, then advances the
+cursor only after the whole interval is durable. An event racing the capture is
+therefore in this interval or a later one, never neither or both. Source-log
+curation cannot erase the occurrence record.
+
+The cursor is observation progress, not a private copy of resource contents. A
+fresh worker captures the current high-water when its worker row is created, so
+pre-existing broadcast history stays out while later occurrences remain
+deliverable even before its first packet. A fork instead copies the parent's
+cursor and captures its own fork high-water atomically with worker creation
+({§machine-processes-fork-pending-activity}). Observer rows retain the source
+identity and never publish another occurrence.
+
+§env-delta-worker-entry-visibility **The commons is global; every other
+resource follows lineage.** A successful state-changing `EDIT`, `COPY`, `MOVE`,
+entry-path `KILL`, or entry-path `SEND` signal `410` whose landed effects touch `worker:///...` acquires the workspace
+audience and retains the commons address in its observer row. Mutations to
+`worker://~/...`, named worker spaces, project files, and remote resources do
+not broadcast. When authored by a child, their
+ordinary operation evidence still reaches that child's direct parent.
+
+| Producer / event                                      | Durable occurrence                                                                                     | Observer projection                                                                                                                |
+| ----------------------------------------------------- | ------------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------- |
+| §env-delta-child-activity Direct-child activity       | Every final op-bearing child log row except runtime-private `_plurnk/operation` maintenance: prompt, PLAN, operation result, or actionless error. | Direct parent only; one exact attributed row born folded. Provider reasoning, calls, rejected emissions, turnOps, and harness maintenance do not cross. |
+| §env-delta-child-termination Direct-child termination | The child's exact terminal loop result when the loop contains at least one non-maintenance turn.       | Direct parent only; a 2xx deliverable is born open and every failure is folded ({§worker-scheme-collect}).                         |
+| §env-delta-commons-mutation Commons mutation          | One successful resolved operation whose landed effects touch `worker:///...`.                         | Every existing worker; one folded row per observer, deduplicated with any lineage audience.                                       |
+| §env-delta-filesystem-narration Project-file divergence | Runtime-owned reconciliation evidence remains in the runtime actor's own log.                        | No ambient observer row. Current content remains addressable and stale hash edits reject at their owned boundary.                 |
+| §env-delta-entry-materialization Executor `entry()` sink | The runtime records typed materialization evidence under its owning actor.                           | No ambient observer row unless the resulting operation itself is direct-child activity or a commons mutation ({§exec-entry-sink}). |
 
 §env-delta-attribution **Ownership, authorship, and cause are independent.**
 
@@ -3017,21 +3322,19 @@ cross this door, while an ancestry-authorized explicit READ remains available.
 | ----------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | `worker_id` | The worker whose self-contained log owns the materialized row.                                                                                                                          |
 | `origin`    | The actor tier that wrote the row; a materialized delta is `_plurnk`.                                                                                                                   |
-| `source`    | The causal identity. Worker causes use the canonical `worker://<name>` control identity; non-worker causes use a stable subsystem token (currently `file`); self-authored rows omit it. |
+| `source`    | The immediate causal identity in this log. A lineage or commons observation uses the canonical `worker://<producer>` control identity; self-authored rows omit it. |
 
-§env-delta-no-coalescing **Only filesystem observation nets.** One filesystem
-event is `editedSpan(entry-as-of-last-align, disk-now)`, inherently netting any
-number of out-of-band writes before reconciliation. Sibling edits are discrete
-events already in the log and remain discrete. Coalescing them would destroy
-the record and conflate state comparison with event replay.
+§env-delta-no-coalescing **Activity is never coalesced.** Each admitted child
+operation and each commons mutation has one occurrence identity. Combining
+them would destroy causal order and conflate event replay with a state
+comparison.
 
 §env-delta-passive **Observation never forces a turn.** Deltas materialize only
-while a packet is already assembling, so an ambient change cannot wake an idle
-worker. Urgent directed communication uses the voice door
-({§actor-boundary-two-doors}). Sibling loop conclusions and owned stream
-progress reuse durable ambient log delivery under {§worker-scheme-collect} and
-{§exec-stream}; their lifecycle-specific open/fold and wake rules remain owned
-there.
+while a packet is already assembling. Intermediate child activity and commons
+broadcasts therefore cannot wake an idle worker. Urgent directed communication
+uses the voice door ({§actor-boundary-two-doors}); direct-child terminal
+disposition alone carries the structured-concurrency wake owned by
+{§worker-scheme-collect}. Stream progress remains owned by {§exec-stream}.
 
 ### §edit-result-render Mutation log rows render truthful effects
 
@@ -3150,8 +3453,6 @@ only after authority crosses the client boundary.
 
 §proposal-ownership-notification **The notification carries disposition, not policy inputs.** `loop/proposal` carries the core-owned `ProposalDisposition` ({§notifications}, {§proposal-disposition}). A connected client presents only `owner="client"`; it never reimplements precedence from flags, operation, or attrs.
 
-§proposal-ownership-auto-stale-clobber **Auto is not blind — it refuses a stale clobber.** When an EDIT's target diverged on disk this turn, accepting it would overwrite an ambient change. The projection carries `staleClobberRisk=true`, and core's loop disposition rejects it; the model can re-READ and retry. This brackets the read→propose window for loop auto, while the compare-and-swap ({§membership-edit-write-cas}) brackets propose→write for every accept path.
-
 ---
 
 ## §packet Packet shape
@@ -3245,16 +3546,18 @@ evidence when a downstream standard cannot represent the complete list.
 | row producer | ordinary OPEN projection |
 |---|---|
 | any `READ` or `FIND` | complete selected operation result |
-| any `PLAN` | complete authored working memory |
+| any `PLAN` | complete canonical Plurnk Plan JSON {§plan-value} |
 | actionless lowercase `prompt` | budgeted head under {§prompt-projection} |
 | structured `EDIT` receipt or textual `COPY`/`MOVE` effects | complete receipt-owned join context |
 | every other nonempty body | head bounded independently by `PLURNK_SERVICE_PREVIEW_LINES` and `PLURNK_SERVICE_PREVIEW_CHARS` |
 | bodyless row | `"display":"none","body":""` |
 
-READ and FIND own their range or pagination before packet rendering; the packet never applies a second hidden substring bound to their selected result. PLAN is likewise complete while OPEN: it is the model's explicit persistent reasoning inventory, not ordinary content that the model should have to retrieve from itself. Prompt rows follow their separate adaptive projection contract. Structured mutation contexts already carry the receipt-owned bound in {§edit-result-receipt-truth}, so packet rendering does not preview them again. Actionless source artifacts, SEND/WORK/FORK bodies, EXEC commands, environment-delta EDIT spans, and extension-produced bodies use the ordinary fixed bound. When an OPEN projection differs from its canonical body, `chunk` follows the displayed `body` with the exact selected and complete extents defined by {§jsonplurnk}; complete and FOLDED bodies omit it. `## READ0 (log:///<coordinate>/<OP>)` applies its default or explicit text range to the canonical body; the unsuffixed exact shorthand and authoritative suffix behavior are defined by {§log-coordinate-hierarchy}. `## FIND0 (log:///...)` and search match that same full body. FOLD hides the ordinary projection, and OPEN restores the producer's projection without changing its bound. System/policy sections are not log bodies. Notices are transient non-log observations; they share the ordinary line/character bounds but have no durable body or recovery URI.
+READ and FIND own their range or pagination before packet rendering; the packet never applies a second hidden substring bound to their selected result. PLAN is likewise complete while OPEN: it is the model's explicit persistent reasoning inventory, serialized once as compact JSON rather than clipped or reparsed from source text. Prompt rows follow their separate adaptive projection contract. Structured mutation contexts already carry the receipt-owned bound in {§edit-result-receipt-truth}, so packet rendering does not preview them again. Actionless source artifacts, SEND/WORK/FORK bodies, EXEC commands, environment-delta EDIT spans, and extension-produced bodies use the ordinary fixed bound. When an OPEN projection differs from its canonical body, `chunk` follows the displayed `body` with the exact selected and complete extents defined by {§jsonplurnk}; complete and FOLDED bodies omit it. `## READ0 (log:///<coordinate>/<OP>)` applies its default or explicit text range to the canonical body; the unsuffixed exact shorthand and authoritative suffix behavior are defined by {§log-coordinate-hierarchy}. `## FIND0 (log:///...)` and search match that same full body. FOLD hides the ordinary projection, and OPEN restores the producer's projection without changing its bound. System/policy sections are not log bodies. Notices are transient non-log observations; they share the ordinary line/character bounds but have no durable body or recovery URI.
 
 §prompt-entry **Prompt as a first-class entry and log row.** Each prompt is stored once at `prompt:///<loop>/<N>` as an owner-keyed text/markdown entry, then published to its turn as one actionless lowercase `prompt` log row. No synthetic EDIT or READ operation is invented. The row is born OPEN and obeys {§body-projection}. The **Active User Prompts** section closes the user-slot status clump as a paths-only list (`* prompt:///<loop>/<N>`), so every frame remains directly READable even after its log row is folded or killed.
 
+§prompt-causal-source **Prompt authorship and delivery are distinct facts.** The harness publishes every prompt row with `origin="_plurnk"`; the row's existing `source` carries the canonical address of a different causal actor. Native WORK, FORK, and directed worker SEND derive `worker://<sender>` from the authenticated sender worker ID. A trusted exterior adapter may supply its own canonical actor address through {§methods-loop-run}. An absent source means the owning worker itself. Attribution persists with the prompt frame through active delivery, parking, orphan recovery, restart, and later log projection; model syntax cannot author it.
+
 §prompt-projection **Prompt storage is unbounded by model context; automatic materialization is not.** Core persists every accepted prompt completely before packet assembly. The selected provider's derived `inputCapacity` and the alias-resolved percentage from `PLURNK_SERVICE_PROMPT_PROJECTION` derive one aggregate curation-weight allowance for OPEN prompt bodies. Complete prompt bodies render when their aggregate weight fits. Otherwise all OPEN prompt rows share the allowance: full bodies consume only their required share, unused shares are redistributed, and partial bodies render the largest leading complete-line region that fits their share or an exact character-bound prefix when the first physical line alone is larger. The sum of their rendered body weights never exceeds the allowance. Every partial body carries its exact `chunk` after `body`; the canonical `prompt:///` entry and `log:///` body remain complete and READ/FIND-addressable. When provider input capacity is unknown the percentage is underivable, so prompt rows retain the ordinary bounded projection rather than inventing capacity. This policy never rejects, summarizes, or discards a prompt because it exceeds a context window.
 
 §prompt-self-only The frame is self-only and owner-keyed:
@@ -3344,7 +3647,7 @@ retain distinct contracts and lifetimes.
 | `workerId`                             | Narrows workers and every dependent loop, turn, logical model call, emission attempt, physical request, and log row to that one worker.             |
 | `workspaceId`                          | Narrows workers and dependent evidence to one workspace; when both selectors are present they intersect.                                            |
 
-§digest-forensic-fidelity **Forensic fidelity and cardinality.** The digest's machine-readable JSON preserves every log row, including causal `source` and structured `attrs`, every exact OPEN/FOLD target effect from {§fold-open-meta-operations}, the exact Problem on every failed row, each loop's exact terminal result, and every ordered physical provider request. Accounting on broader rows is the shared exact derivation from that ledger, never a second stored fact. The human Markdown waterfall shows a present causal source and may preview only the Problem detail because it remains a triage projection, not the machine record. Targets reconstruct the model-visible address, including hostname, port, serialized query, and fragment; an authority-bearing URL must never degrade from `https://host/path` to `https:///path`, and folded network-entry storage paths render back to their authority form. Its human Markdown waterfall groups identical per-turn op outcomes and typed `entry_materialized` narrations, reporting the exact count and sequence span (`xN (seq A-B)`). Grouping keys include source and the complete target, so distinct causes, authorities, or channels never collapse. Thus amplification is conspicuous without making the diagnostic artifact itself pathological; packet files remain byte-identical records of what the model saw.
+§digest-forensic-fidelity **Forensic fidelity and cardinality.** The digest's machine-readable JSON preserves every log row, including causal `source` and structured `attrs`, every exact OPEN/FOLD target effect from {§fold-open-meta-operations}, the exact Problem on every failed row, each loop's exact terminal result, and every ordered physical provider request. Accounting on broader rows is the shared exact derivation from that ledger, never a second stored fact. The human Markdown waterfall shows a present causal source and may preview only the Problem detail because it remains a triage projection, not the machine record. Targets reconstruct the model-visible address, including hostname, port, serialized query, and fragment; an authority-bearing URL must never degrade from `https://host/path` to `https:///path`, and durable resource coordinates render back to their authority form. Its human Markdown waterfall groups identical per-turn op outcomes and typed `entry_materialized` narrations, reporting the exact count and sequence span (`xN (seq A-B)`). Grouping keys include source and the complete target, so distinct causes, authorities, or channels never collapse. Thus amplification is conspicuous without making the diagnostic artifact itself pathological; packet files remain byte-identical records of what the model saw.
 
 §digest-requiem **A requiem is an out-of-band forensic interview, not a worker
 turn.** It cannot execute operations or alter the audited history.
@@ -3366,79 +3669,115 @@ turn.** It cannot execute operations or alter the audited history.
 
 §tools-resource-discovery **Executable capability discovery uses ordinary
 Plurnk resources.** No generated tool table rides the system packet. Every
-available, workspace-enabled runtime with an admitted invocation materializes one family document at
-`worker://plurnk/skills/plurnk/<runtime>.md`. A general runtime's document contains its
-{§executor-tool-document}; a runtime with an exact
-{§executor-tool-registry} instead materializes one child document per enabled
-target at `worker://plurnk/skills/plurnk/<runtime>/<encoded-target>.md`. Its compact
-family document summarizes the server or runtime and lists every enabled target
-as a directly copyable `## EXEC0` heading with its input signature. Each heading
-uses {§operation-annotation} for the target summary and an exact child-document
-address; it never advertises a generic invocation that dispatch would reject.
-Target filenames use one deterministic percent-encoded path segment; the child
-document retains the exact unencoded target as invocation authority, exposes its
-annotated invocation form through Summary metadata, and carries the richer
-input-side contract. General-runtime summaries similarly expose their compact
-executable witness ({§executor-tool-document}). Tool-result/output schemas remain
-ordinary evidence and never enter these documents.
+runtime enabled for the current worker with an admitted invocation materializes exactly one
+family document at `worker://~/_plurnk/skills/plurnk/<runtime>.md`. A general runtime's
+document contains its {§executor-tool-document}; a runtime with an exact
+{§executor-tool-registry} materializes the same single document — per-target
+child documents do not exist, shown or stored. The family document summarizes
+the server or runtime, lists every enabled target as a directly copyable
+`## EXEC0` heading with its input signature ({§operation-annotation} carries the
+target one-liner; no invocation dispatch would reject is ever advertised), and
+carries each detailed target's richer input-side contract as a
+`## <target>` section of the same document, that target's own headings demoted
+one level beneath it. A detail-less target's invocation line is its whole
+teaching. Tool-result/output schemas remain ordinary evidence and never enter
+this document.
 
 ```mermaid
 flowchart LR
     Survey["Turn 0 FIND<br/>tools/*.md"] --> Families["family paths + summaries"]
-    Families --> Read["READ selected family"]
+    Families --> Read["READ selected family<br/>only when needed"]
     Read --> Exec["EXEC annotated invocation"]
-    Read --> Detail["READ exact child<br/>only when needed"]
-    Detail --> Exec
 ```
 
-§tools-resource-materialization The runtime registry, workspace executor
-policy, tool resources, and dispatch use one effective workspace snapshot. A
-workspace-disabled, unavailable, detached, replaced, or removed runtime has no
+§tools-resource-materialization The runtime registry, worker executor policy,
+tool resources, and dispatch use one effective worker snapshot. A
+worker-disabled, unavailable, detached, replaced, or removed runtime has no
 tool resource; an exact registry's empty set publishes no executable family and
-admits no invocation. Reconciliation deletes stale family and child documents
+admits no invocation. Reconciliation deletes stale documents
 before upserting the current set. `PLURNK_SERVICE_DOCS_EXCLUDE` does not hide an
 enabled executable; executor enablement is the sole user-configured filter
 shared by discovery and dispatch. A runtime declaration may carry
-`resourcesPath` — the generated-doc root. Absent, its docs live in the internal
-`/skills/plurnk` namespace; present (attached MCP families: `/tools`), the
-family and its child tool docs materialize under that root. Turn 0 surveys the
-families (`## FIND0 [+init,+tools] (worker://plurnk/tools/*.md)`, one row per
+`resourcesPath` — its generated-doc root relative to the worker's generated
+subtree ({§worker-generated-subtree}). Absent, its docs live in the internal
+`_plurnk/skills/plurnk` namespace; present (attached MCP families: `/tools`),
+the family document materializes at `_plurnk` + that root in the
+worker's private entry space. Turn 0 surveys the families (`## FIND0 [+init,+tools]
+(worker://~/_plurnk/tools/*.md)`, one row per
 server carrying its summary) and, for each server named in
-`PLURNK_MCP_EXPANDED`, its complete tool tree (`tools/<server>/**`). The child
-summary IS its invocation form so the discovery row teaches the call.
+`PLURNK_MCP_EXPANDED`, adds one complete family-document READ
+(`_plurnk/tools/<server>.md <1,-1>`) so turn 0 names every tool it exposes.
 Attached tools are capabilities like every other runtime; the model never
 learns an origin.
 
-§skills-materialization **The workspace skills surface.** Plurnk discovers one
-ordered union of standard Agent Skills: project
-`<projectRoot>/.agents/skills/<name>/SKILL.md`, user-global
-`~/.agents/skills/<name>/SKILL.md`, then the exact bundled skill
-membership published by `@plurnk/plurnk-meta`. Collisions resolve project over
-global over bundled by directory/name before a shadowed lower-precedence body
-is read. Plurnk never seeds or mutates the shared global root absent an explicit
-user installation action. Every admitted skill requires standard `name` and
-`description` frontmatter with `name` matching its directory; an invalid or
-unreadable discovered skill fails materialization with its path and cause.
-
-Each admitted skill becomes one kernel-owned
-`worker://plurnk/skills/<name>.md` entry at workspace boot and creation.
-`worker://plurnk/skills/index.md` always exists and lists the effective union,
-including the bundled discovery skill, so the turn-0 `+init,+skills` FIND survey always
-shows the surface. The materialized index and each standard skill expose an
-exact H2 `Summary`; a skill's required `description` becomes that summary while
-its instructions body is preserved verbatim. Frontmatter is parsed as YAML;
-admission consumes its standard discovery keys. Reconciliation deletes retired skill entries
-before upserting the current set; turn admission refreshes the surface under the
-workspace gate before packet assembly, so an explicitly installed or removed
-skill is discoverable in the first subsequent model turn while an unchanged set
-dispatches nothing.
-The bundled `find-skills` skill is an attributed, release-pinned adaptation of
-the upstream standard skill and targets the universal Agent Skills location;
-it does not create a Plurnk registry or MCP-like enablement mechanism. Skills
-are user-, project-, or package-installed teaching admitted through the kernel
-surface; they never override instruction authority.
-
-The catalog describes workspace capabilities, not temporary authority. Loop
+§skills-functionality **Agent Skills are one Worker Functionality family.**
+Core registers the `skills` family with the coordinator ({§functionality-coordinator});
+its adapter owns protocol truth for standard Agent Skills and nothing else. A
+definition is `SkillDefinition` — the standard skill `name`, the universal
+root `scope` (`project` = `<projectRoot>/.agents/skills`, `global` =
+`~/.agents/skills`), and for a Worker-installed skill the standard installer
+`source` that provides it. Plurnk bundles no skills of its own and never
+seeds or mutates a universal root absent an explicit `add`/`remove`.
+
+*Available definitions.* The filesystem is the only truth about installation:
+every `<root>/<name>/SKILL.md` directory under the project then the global
+root is one service-origin definition, enabled by default, project shadowing
+global by name; when the standard installer's `skills-lock.json` records a
+source it rides the definition. A Worker's durable state owns enablement
+({§functionality-state}); a disabled skill stays client-visible and leaves no
+model-facing trace.
+
+*Discovery is inert.* `discover {query}` searches the ecosystem registry
+(`PLURNK_SERVICE_SKILLS_REGISTRY_URL`, default `https://skills.sh`; empty disables it
+with 501 `registry-not-configured`) and returns one candidate per hit with
+`registry` provenance and the exact `owner/repo` source. `discover {source}`
+lists the skills one standard package reference contains with `source`
+provenance. Neither installs, persists, or enables. Client `configuration`
+contributes nothing and is refused with 400.
+
+*Admission.* `add {alias, definition}` requires `alias = name`, a `source`,
+and a project root when `scope` is `project`; the Worker's own definition may
+shadow a service skill of the same name.
+
+*Preparation.* For each enabled alias the adapter locates the directory at the
+definition's scope; a Worker definition whose directory is absent is installed
+through the standard CLI (`PLURNK_SERVICE_SKILLS_CLI`, default `npx --yes skills`:
+`add <source> --agent universal --skill <name> --yes [--global]`, run with
+`HOME` set to the service's user home so the installer's `~` is the global
+root) and the installed `SKILL.md` — never the installer's output — is the
+evidence.
+Each admitted skill requires standard `name` and `description` frontmatter
+with `name` matching its directory. A missing, uninstallable, or invalid skill
+is `unavailable` with its exact Problem (`skill-missing`, `install-failed`,
+`skill-invalid`) under the coordinator's failure policy
+({§functionality-model-mutation}); one bad skill never fails the family.
+
+*Documents.* The family publishes `worker://~/_plurnk/skills/index.md` —
+which always exists and lists the active skills by name and description — and
+one `worker://~/_plurnk/skills/<name>.md` per active skill, with an exact H2
+`Summary` carrying the standard `description` and the instruction body
+preserved verbatim ({§functionality-documents}). They are discovered by the
+turn-0 `+init,+skills` FIND survey; disabled and unavailable skills are
+absent from model teaching.
+
+§skills-remove **`remove` uninstalls what the Worker installed.** Before the
+coordinator forgets a Worker-origin skill definition the adapter removes that
+skill from the definition's scope through the standard CLI (`remove <name>
+--yes [--global]`), verified by the directory's absence; a failed removal
+rejects the mutation. A same-named skill at a lower-precedence root is then
+revealed as a service definition, disabled ({§functionality-coordinator}).
+Service definitions are disable-only.
+
+§skills-hotload **Out-of-band installers are admitted at the next turn.** The
+family keeps one signature of the installed roots per resident Worker; turn
+admission recomputes it under the workspace gate before packet assembly and
+republishes the family through the coordinator when it changed, so a skill
+installed or removed by any other tool is discoverable in the first subsequent
+model turn while an unchanged set dispatches nothing. The model manages skills
+only through the generated `EXEC [skills]` family
+({§functionality-model-projection}); it is never taught a package manager.
+
+The catalog describes this worker's Functionality, not temporary authority. Loop
 mode remains a dispatch concern: an ask-mode EXEC receives the ordinary exact
 403 restriction instead of requiring a second per-loop documentation overlay.
 Optional non-EXEC operations remain a separate `## Enabled Optional Operations`
@@ -3446,7 +3785,7 @@ section because they are language extensions rather than executable tools.
 
 ### §schemes user.schemes — the resource directory
 
-§schemes-directory A `## Resources` section renders in the system slot **after the policy sections** — a terse directory of the scheme families available this workspace, so the model knows what URI resources and operations exist before it acts. Each scheme that ships a `manifest.example` contributes one or more concise canonical ops (no scheme prefix; each example self-documents) into a `plurnk` fence. Scheme example sets are separated by one blank line. The doc is NOT linked inline — it is materialized as the kernel-generated skill `worker://plurnk/skills/plurnk/<scheme>.md` and discovered via the turn-0 `## FIND0 [+init,+skills] (worker://plurnk/skills/plurnk/*.md)` survey ({§skills-materialization}), keeping the raw packet free of doc links. Meta-owned `worker` depth is required teaching ({§teaching-corpus}); a failed source read rejects materialization with its cause and never falls back. Other core and plugin schemes may supply optional `manifest.documentation`; absence contributes no pull doc. The verbose semantics live in that pull doc (materialized like any entry, READ on demand), not the hot path — terse pushes, depth pulls. A scheme with no example (provisional) is omitted; `PLURNK_SERVICE_DOCS_EXCLUDE` drops a named scheme's examples + doc.
+§schemes-directory A `## Resources` section renders in the system slot **after the policy sections** — a terse directory of the scheme families available to this worker, so the model knows what URI resources and operations exist before it acts. Each scheme that ships a `manifest.example` contributes one or more concise canonical ops (no scheme prefix; each example self-documents) into a `plurnk` fence. Scheme example sets are separated by one blank line. The doc is NOT linked inline — it is materialized as the worker-private skill `worker://~/_plurnk/skills/plurnk/<scheme>.md` and discovered via the turn-0 `## FIND0 [+init,+skills] (worker://~/_plurnk/skills/plurnk/*.md)` survey ({§skills-functionality}), keeping the raw packet free of doc links. Meta-owned `worker` depth is required teaching ({§teaching-corpus}); a failed source read rejects materialization with its cause and never falls back. Other core and plugin schemes may supply optional `manifest.documentation`; absence contributes no pull doc. The verbose semantics live in that pull doc (materialized like any entry, READ on demand), not the hot path — terse pushes, depth pulls. A scheme with no example (provisional) is omitted; `PLURNK_SERVICE_DOCS_EXCLUDE` drops a named scheme's examples + doc.
 
 ### §inject system.inject — the operator injection
 
@@ -3454,7 +3793,7 @@ section because they are language extensions rather than executable tools.
 
 ### §policy system.policy — the client's policy injection
 
-§policy-sections One section rides the system slot **after the definition and before capability teaching**: `## Policy` from `PLURNK_SERVICE_POLICY` (default `$XDG_CONFIG_HOME/plurnk/AGENTS.md`, {§host-path-layout}). Policy is the client's authoritative rules promoted into the privileged zone — NOT a curatable, foldable, READ-able entry; the model cannot FOLD it away. A default-absent path is silent (the section is omitted); an explicit override (env set) that fails to read fails the turn hard — a deliberate setting with a broken path is a misconfig, surfaced not hidden. Read per-turn so edits take effect live. The PROJECT `AGENTS.md` is local guidance, not policy: it rides turn 0 as the foisted `worker://plurnk/agents.md` entry ({§turn0-agents-stunt}); all other reference material is skills under the skills tree ({§skills-materialization}).
+§policy-sections One section rides the system slot **after the definition and before capability teaching**: `## Policy` from `PLURNK_SERVICE_POLICY` (default `$XDG_CONFIG_HOME/plurnk/AGENTS.md`, {§host-path-layout}). Policy is the client's authoritative rules promoted into the privileged zone — NOT a curatable, foldable, READ-able entry; the model cannot FOLD it away. A default-absent path is silent (the section is omitted); an explicit override (env set) that fails to read fails the turn hard — a deliberate setting with a broken path is a misconfig, surfaced not hidden. Read per-turn so edits take effect live. The PROJECT `AGENTS.md` is local guidance, not policy: it rides turn 0 as the foisted `worker://~/_plurnk/agents.md` entry ({§turn0-agents-stunt}); all other reference material is skills under the worker's private skills tree ({§skills-functionality}).
 
 On first run, and only when `$XDG_CONFIG_HOME/plurnk` itself is absent, the service seeds
 `AGENTS.md` from `@plurnk/plurnk-meta/PLURNK_PERSONALITY.md` ({§teaching-corpus}).
@@ -3475,7 +3814,7 @@ created by that attempt. Unknown legacy members or simultaneous
 legacy/canonical state fail without guessing. No dual read or dual write survives
 the transition.
 
-§schemes-self-doc-materialization **The scheme self-doc contract.** `@plurnk/plurnk-schemes` owns `example` and `documentation` in `SchemeManifest` ({§manifest-self-doc}); the former is the hot-path operation example set and the latter is the deep pull doc. Every published pull doc carries an exact H2 `Summary` for ordinary catalog projection. `SchemeRegistry.teach(workspaceId)` renders the effective directory, `SchemeRegistry.docs(workspaceId)` resolves corpus-or-manifest documentation, and `referenceEntries(workspaceId)` supplies the current `/skills/plurnk/` generated-skill set when core publishes workspace capabilities ({§skills-materialization}). One materializer reconciles the reserved scope exactly: vanished contributions are deleted before current documents are upserted, so an excluded scheme or disabled, detached, replaced, or removed runtime cannot leave a stale model-facing contract.
+§schemes-self-doc-materialization **The scheme self-doc contract.** `@plurnk/plurnk-schemes` owns `example` and `documentation` in `SchemeManifest` ({§manifest-self-doc}); the former is the hot-path operation example set and the latter is the deep pull doc. Every published pull doc carries an exact H2 `Summary` for ordinary catalog projection. `SchemeRegistry.teach(workerId)` renders the effective directory, `SchemeRegistry.docs(workerId)` resolves corpus-or-manifest documentation, and `referenceEntries(workerId)` supplies the current `/skills/plurnk/` generated-skill set when core publishes worker Functionality ({§skills-functionality}). One materializer reconciles the worker's private scope exactly: vanished contributions are deleted before current documents are upserted, so an excluded scheme or disabled, detached, replaced, or removed runtime cannot leave a stale model-facing contract.
 
 ### §packet-git-status The Git status section — compact repository state
 
@@ -3485,7 +3824,7 @@ active direct child of a running branch batch additionally receives its assigned
 branch and the requirement to commit any project changes and leave the checkout
 clean before concluding ({§worker-branch-batch-return}); no other worker receives
 that instruction. The section never repeats an unbounded path list. Per-path state belongs to
-the durable causal observation: a `source=file` environment-delta row carries
+the runtime actor's durable causal evidence: its `source=file` row carries
 the exact two-character porcelain `XY` value as `git` metadata when the status
 snapshot names that path. The engine takes one snapshot after membership
 reconciliation and uses it for both projections; no per-file Git process exists.
@@ -3645,7 +3984,7 @@ presentation aid, never part of canonical content; matchers and mutations
 consume canonical bytes before rendering. A producer may set `startLine: null`
 only when its content is already source-numbered, such as an effect receipt.
 
-§render-rule-find-renders-result A log row's canonical full body is resolved once by `LogBody`: READ/FIND, actionless source artifacts, prompt, and extension result content comes from `rx.content`; EDIT uses its structured receipt or an environment-delta span; COPY/MOVE concatenate the textual receipt contexts in their ordered `effects`; EXEC and the composed PLAN/SEND/WORK/FORK family use their statement body. Whole-channel COPY/MOVE effects are bodyless rather than fabricating a text projection. Packet rendering applies {§body-projection} and the coordinate projection in {§render-rule-line-navigable-prefix}. READ/FIND over `log:///` and search consume the complete canonical body instead. Status and content are orthogonal: a failed terminal stream READ retains its Problem Details and failure status while rendering captured diagnostic output; failure never erases evidence.
+§render-rule-find-renders-result A log row's canonical full body is resolved once by `LogBody`: READ/FIND, actionless source artifacts, prompt, and extension result content comes from `rx.content`; EDIT uses its structured receipt or an environment-delta span; COPY/MOVE concatenate the textual receipt contexts in their ordered `effects`; PLAN serializes its canonical value through the shared {§json-result-rendering} spread as `application/json`; EXEC and SEND/WORK/FORK use their statement body. Whole-channel COPY/MOVE effects are bodyless rather than fabricating a text projection. Packet rendering applies {§body-projection} and the coordinate projection in {§render-rule-line-navigable-prefix}. READ/FIND over `log:///` and search consume the complete canonical body instead. Status and content are orthogonal: a failed terminal stream READ retains its Problem Details and failure status while rendering captured diagnostic output; failure never erases evidence.
 
 An `EDIT` log row renders its bounded effect receipt (`rx.receipt`) as row
 metadata and join context, not its input statement. Proposal-gated file EDITs