@plurnk/plurnk-service 3.1.0 → 3.3.0

package/SPEC.md

@@ -349,7 +349,7 @@ plus a broadcast duplicate. Runtime maintenance turns produce no broadcast ({§a
 and remote resources do not acquire ambient attention merely because they are
 workspace-addressable.
 
-§actor-boundary-no-mutex **Wild west, no exceptions.** Workers share workspace state without locks. Coordination is cooperative and softly fenced (the {§membership} overlay, a workspace policy, bounds every worker's visible surface uniformly — {§machine-processes}); stale writes reject at their anchor or compare-and-swap boundary rather than being prevented by a lock ({§line-anchors}, {§membership-edit-write-cas}).
+§actor-boundary-no-mutex Workers share workspace state without worker-owned locks or reservations. Coordination is cooperative; membership bounds their visible surface uniformly ({§machine-processes}). Stale writes reject at their anchor or commit boundary ({§line-anchors}, {§membership-edit-write-revision}). Internal storage serialization does not confer ownership: {§file-commit-serialization} holds no file across reasoning, operation selection, or approval.
 
 §actor-boundary-passive-wake **Passive wake follows ownership.** A directed
 voice wakes an idle worker. A parked continuation resumes when an obligation it
@@ -422,7 +422,7 @@ direct-entry-plus-directory count; `-1` enables the ordinary markerless page;
 unset / `0` disables previews. `log://` is absent because the current worker's
 log already renders in present mode.
 
-§worker-initialization-entry **Model-worker initialization is a real `_plurnk` operation turn.** A model worker's first loop begins with one packetless `{ producer="_plurnk", kind="initialization" }` turn submitted through {§turn-ops-admission-path}. Its program — the READ/FIND surveys, led by one NOTE when the surveys run — is recorded as the turn's `ops://` source and executed through {§op-execution-order} exactly as a model's program is; it authors no reasoning and reads none back. The NOTE keeps the example turn within the card's NOTE-per-turn teaching and reads, exactly, `Surveyed tooling, documentation, extended context, and project root.` No emission row is fabricated ({§emission-row}): the first request sees the NOTE and the surveys' ordinary results, never an assistant-content copy of the program. The initial message arrives as an inbound SEND in the first model turn ({§message-arrival}); initialization never READs it, and neither initialization nor later turns manufacture a task inventory. Every orienting row is structurally classified `_plurnk` and `init`. The namespace surveys and their asides follow {§actor-boundary-catalog-preview}.
+§worker-initialization-entry **Model-worker initialization is a real `_plurnk` operation turn.** A model worker's first loop begins with one packetless `{ producer="_plurnk", kind="initialization" }` turn submitted through {§turn-ops-admission-path}. Its program — the READ/FIND surveys, led by one NOTE when the surveys run — is recorded as the turn's `ops://` source and executed through {§op-execution-order} exactly as a model's program is; it authors no reasoning and reads none back. The NOTE keeps the example turn within the card's NOTE-per-turn teaching: it carries the aside of the card's first NOTE example, `<!-- summary -->`, and reads, exactly, `Surveyed tooling, documentation, extended context, and project root.` No emission row is fabricated ({§emission-row}): the first request sees the NOTE and the surveys' ordinary results, never an assistant-content copy of the program. The initial message arrives as an inbound SEND in the first model turn ({§message-arrival}); initialization never READs it, and neither initialization nor later turns manufacture a task inventory. Every orienting row is structurally classified `_plurnk` and `init`. The namespace surveys and their asides follow {§actor-boundary-catalog-preview}.
 
 Incoming messages publish once as inbound SEND rows in the first model turn
 ({§message-arrival}); initialization neither READs nor archives them. The turn
@@ -566,7 +566,7 @@ Every admitted authority is a literal `workers.name`; self-addressing uses the c
 | `READ`    | existing literal name       | Collect the named worker's deliverable. |
 | `KILL`    | existing literal name  | Terminate the named worker or caller.   |
 
-- §worker-scheme-spawn **Spawn** — ```` ```WORK (worker://<name>)? ```` with a task body creates a new child worker (empty log) and starts it with that task on its first loop. WORK/FORK are the worker-creation verbs: EDIT is file/entry only, so EDIT on the bare worker entity is a **400** steering to WORK/FORK — the entity is not an entry. Names remain unique within a workspace for the lifetime of retained Worker rows, including after termination. An existing name returns 409 whose receipt names the working forms — `SEND (worker://<name>)` with the task as the body to give the live worker more work, or a name no worker holds for another; concurrent claims cannot redirect a published address or expose a raw uniqueness failure.
+- §worker-scheme-spawn **Spawn** — ```` ```WORK (worker://<name>)? ```` with a task body creates a new child worker (empty log) and starts it with that task on its first loop. WORK/FORK are the worker-creation verbs: EDIT is file/entry only, so EDIT on the bare worker entity is a **400** steering to WORK/FORK — the entity is not an entry. Names remain unique within a workspace for the lifetime of retained Worker rows, including after termination. A WORK whose name a worker already holds is the voice door ({§worker-scheme-irc}): its body is delivered to that worker as a message, nothing is created, the receipt names the worker and `delivered: message`, and an `env` option is refused by name since a message takes none. A FORK whose name a worker holds is `409 worker-name-conflict` whose recovery names the working forms, WORK or `SEND (worker://<name>)` to message the live worker, or a name no worker holds to branch; concurrent claims cannot redirect a published address or expose a raw uniqueness failure.
 - §worker-spawn-prompt-resource **The spawn slot is overloaded by scheme.** A `worker://` path is
   the child's address and keeps the address rules ({§worker-control-addressing}). A path of any
   other scheme is the child's prompt resource: it is read whole (`<1,-1>`) under the caller's read capabilities, composed with
@@ -620,9 +620,10 @@ Every admitted authority is a literal `workers.name`; self-addressing uses the c
 - §child-orientation **Child orientation.** Beyond the conclusion delta, every
   turn the packet's status clump surfaces the live things this worker currently
   holds under the teaching's own word for handing work out: `## Delegation` is
-  one JSON object, `{"workers": [...], "streams": [...]}`, its unconcluded child
-  workers and its open streams as `{status, path}` pointers (the same shape as
-  the errors section). Body-suppressed child activity is durable
+  one JSON object, `{"workers": [...], "streams": [...], "messages": [...]}`, its
+  unconcluded child workers, its open streams and the messages it sent that await
+  completion ({§worker-obligations}) as `{status, path}` pointers (the same shape as
+  the errors section); a message pointer carries the recipient loop's status. Body-suppressed child activity is durable
   history; this section is the current inventory that keeps an active obligation
   visible even when no new activity arrived. Each open stream pointer carries
   elapsed runtime, output inactivity, and its channels' sizes and growth since
@@ -649,15 +650,17 @@ Every admitted authority is a literal `workers.name`; self-addressing uses the c
   notices, and the rest keep that rule. The parent is not a section: the
   `## Worker` identity block carries `"parent": "worker://<name>"`, or
   `"parent": null` at a root, so a worker never infers its rank from silence.
-- §packet-current-turn **The packet says who and which turn, below the log.** The
+- §packet-current-turn **The packet says who, which turn and who attends, below the log.** The
   `## Worker` block, in the status clump below the log ({§packet-cache-monotone}), carries
-  `{"path": "worker://<name>", "parent": <address or null>, "loop": L, "turn": T}`: the actor,
-  whose child it is, and the coordinate this packet's response becomes, so `reasoning://<worker>/L/T`
-  and `ops://<worker>/L/T` are the model's own and `log:///L/T/*` its rows; a model never infers the
-  present from the last row's coordinate, which may or may not be its own turn. The block
-  changes every turn, so nothing of it precedes the log, and the packet carries no date, time
-  or zone anywhere. The coordinate only; the source addresses stay
-  documented, not taught.
+  `{"path": "worker://<name>", "parent": <address or null>, "loop": L, "turn": T, "owner":
+  {"address": "<owner>", "interactive": <boolean>}}`: the actor, whose child it is, the coordinate
+  this packet's response becomes, so `reasoning://<worker>/L/T` and `ops://<worker>/L/T` are the
+  model's own and `log:///L/T/*` its rows, and its approval owner ({§worker-ownership}) with whether
+  a person attends that owner; a model never infers the present from the last row's coordinate,
+  which may or may not be its own turn, and never infers from a missing tool alone that nobody can
+  answer. The block changes every turn, so nothing of it precedes the log, and the packet carries no
+  date, time or zone anywhere. The coordinate only; the source addresses stay documented, not
+  taught.
 
 Worker control rides the daemon's inject seam (active→fold, idle→enqueue+drain), so the handler creates/branches the worker and hands off; the daemon owns provider + system prompt. FORK/WORK carry the seed task in the body and are their own ops, dispatched to worker control — never the entry-copy path.
 
@@ -677,7 +680,7 @@ flowchart LR
     materialize --> read["READ snapshot"]
     materialize --> edit["EDIT against snapshot"]
     edit --> proposal["Proposal"]
-    proposal -->|"client accepts or loop auto"| cas["synced_sig compare-and-swap"]
+    proposal -->|"client accepts or loop auto"| cas["Validate captured file revision"]
     cas -->|"file snapshot → disk"| project["Project file"]
     project --> materialize
 ```
@@ -761,18 +764,18 @@ and never re-fetch a match.
   `engine:membership` / `git_inspection_refused` notice names the key, once per
   workspace until it changes or clears. User- and model-requested Git commands
   stay on their explicit execution path.
-- §membership-edit-membership-gate **Membership-gated edits.** EDIT is bounded by membership exactly as READ is. An existing **member**'s baseline is its entry snapshot — the body channel the model READ, not a fresh disk read — so the diff is naive against the view the model saw, never empty (the write-side CAS, {§membership-edit-write-cas}, prevents the silent overwrite of out-of-band drift). An existing **non-member** is refused (403) *before* any read or write: the model never reads a file it can't see (no leak into the proposal) and never overwrites one (no wiping a gitignored `.env` it never added). A **new path** crosses the creation matrix in {§fs-write-surface}; proposal acceptance cannot bypass its scope, exclusion, or incorporation rules. Shell execution reaches beyond file membership; the file scheme does not.
+- §membership-edit-membership-gate **Membership-gated edits.** EDIT is bounded by membership exactly as READ is. An existing **member**'s baseline is its materialized entry snapshot, not an empty body or a fresh disk read at approval ({§membership-edit-write-revision}). An existing **non-member** is refused (403) *before* any content read or write: its bytes never leak into the proposal. A **new path** crosses the creation matrix in {§fs-write-surface}; proposal acceptance cannot bypass its scope, exclusion, or incorporation rules. Shell execution reaches beyond file membership; the file scheme does not.
 - §membership-create-parents **Parent-complete creation.** An accepted File creation—whether authored as EDIT or as a COPY/MOVE destination—recursively creates missing parent directories before writing and registering the new member.
 
 **The overlay — `include | exclude`.** `workspace_constraints` holds the `members` family's projected definitions and the engine's creation records ({§members-projection}). Resolved membership is `(project repository files ∪ include) − exclude`.
 
 - §membership-auto-add **Auto-add** — the project repository's ambient membership is its tracked `ls-files`, with `git` origin; an untracked file is never an ambient member ({§membership-baseline}). An accepted creation is incorporated by an exact creation record, never by `git add` ({§membership-model-universe}); a record that cannot be written fails the creation transaction, never an orphan ({§file-create-no-orphans}).
 - §membership-overlay-include **`include`** — admit a file Git misses through a targeted pattern scan (files only), with `constraint` origin. `source: "members"` is a projected human definition, `source: "model"` a projected model definition, `source: "create"` the exact durable record of an accepted creation. Only `members` inclusions override active Git ignore. In a Git-absent root, inclusions are the sole file-membership source.
-- §membership-overlay-exclude **`exclude`** — a `!glob` definition removes a tracked or included file: resolution drops matches (`node:path.matchesGlob`) and reconciles so the entry set *equals* the member set. The lever to exclude a committed-but-oversized or sensitive tracked file; exclusions mask creation records without deleting their provenance ({§fs-create-masked}).
+- §membership-overlay-exclude **`exclude`** — a `!glob` definition removes a tracked or included file: resolution drops matches ({§path-glob-matching}) and reconciles so the entry set *equals* the member set. The lever to exclude a committed-but-oversized or sensitive tracked file; exclusions mask creation records without deleting their provenance ({§fs-create-masked}).
 - §membership-reconcile-sets **Reconciliation is two set statements.** Once the desired set is composed — `(git ls-files ∪ include) − exclude`, glob evaluation and Git shell-outs being the process's own — it lands as one `INSERT … SELECT FROM json_each` with the same idempotent provenance update as a single registration, and every overlay-owned member outside it leaves in one `DELETE … WHERE pathname NOT IN (json_each) RETURNING`, its prior body riding out of the statement. A path that also left disk truth (no longer a candidate at all) becomes a divergence from that prior content; an exclusion is silent. No per-path statement, no set difference outside the database.
-- §membership-glob-in-sql **A constraint is evaluated where it lives.** `glob_match(pathname, glob)` is `node:path.matchesGlob` registered into SQLite (`src/core/glob_match.ts`, deterministic), the one matcher every overlay decision uses, so a lookup that asks the constraints table a question — which exclusion covers this key, whether a members definition includes it, which inclusion owns each untracked path — is one statement over `workspace_constraints`, never a listing filtered in the process. Transient inputs the process already holds (a `git ls-files` listing against the exclude globs) stay filtered in the process; the function exists so the database's own rows can be asked, not so process data makes a round trip.
+- §membership-glob-in-sql **A constraint is evaluated where it lives.** `glob_match(pathname, glob)` exposes {§path-glob-matching} to SQLite (`src/core/glob_match.ts`, deterministic), the same matcher every overlay decision uses, so a lookup that asks the constraints table a question — which exclusion covers this key, whether a members definition includes it, which inclusion owns each untracked path — is one statement over `workspace_constraints`, never a listing filtered in the process. Transient inputs the process already holds (a `git ls-files` listing against the exclude globs) stay filtered in the process; the function exists so the database's own rows can be asked, not so process data makes a round trip.
 
-**File ops act on the entry, not the disk; the two reconcile only at gates.** A `file:///` member is a row whose body channel holds its *materialized model-readable snapshot*. READ returns that channel; EDIT diffs against editable text snapshots — neither reaches the filesystem directly. Entry and disk reconcile at exactly two gates: the **pre-turn materialize** (disk → entry, below) and the **accept-time write-back** (entry → disk, {§proposal}). Between the gates the entry is the truth the model curates against, and `synced_sig` — the member's last-synced disk stat (`mtime:size`) — is the version token both gates compare on.
+**File ops act on the entry, not the disk; the two reconcile at gates.** A `file:///` member's body is its materialized model-readable snapshot. READ returns that channel; EDIT computes against it, not a newly read replacement. Pre-turn materialization acquires disk state; accepted write-back validates the captured revision before changing disk ({§proposal}, {§membership-edit-write-revision}).
 
 §membership-source-projection Binary acquisition is transient and bounded by
 {§mimetype-binary-input}; durable entry channels remain Unicode text. Core-private
@@ -795,10 +798,12 @@ with an empty body channel carrying a durable 413 producer result; no diagnostic
 sentinel impersonates file content. READ therefore names the path, observed bytes,
 ceiling, and recovery through the ordinary result contract, while EDIT returns the
 same 413 instead of diffing against a fictitious empty baseline. Core records the
-materialization disposition and ceiling privately, so an unchanged disk member is
-reconsidered when the operator changes the policy and otherwise remains a stat-only
-no-op. The file write gate independently stats the source against the same ceiling,
+materialization disposition and ceiling privately; an unchanged oversized marker
+is reconsidered when the policy changes and otherwise remains stat-gated.
+Ordinary members follow {§membership-change-gated-sync}.
+The file write gate independently stats the source against the same ceiling,
 so safety does not depend on a background warm winning a client-operation race.
+Whole-file deletion does not need a materialized body ({§file-delete-revision}).
 
 §derivation-dedup-parallel **The index dedups then parallelizes.** The derivation identity hashes the exact READ channel representation, mimetype, reader behavior, and applicable search exclusion. A channel or log projection attaches the immutable artifact only after it is complete; identical projections therefore share one FTS row and one symbol graph without copying, and the FTS index reads its text from the content store ({§content-store}) instead of keeping a copy. The identity hashes the representation's own SHA-256 ({§tokenomics-content-hash-identity}), never its body, so a maintenance pass judges an entry channel from its stored `content_hash` without the body crossing into the process; a body is acquired only for a derivation that runs, under that same identity (a representation that moved on since it was judged returns nothing and is judged again next pass), or for a channel with no stored identity, an open or streamed channel, which must be read to be judged. Log rows and turn sources still arrive whole. The pass reports the bytes it acquired beside the derivations it ran, and an unchanged workspace acquires none of its channel bodies at any concurrency. Distinct artifacts run with bounded producer concurrency (`PLURNK_SERVICE_DERIVE_CONCURRENCY`). Pending artifacts sort by readable content length before entering that pool, so small resources start first while every outlier still derives fully. Unset uses a host-relative square-root fan-out; a positive integer is an exact operator budget and `-1` claims every core. Graph persistence writes at most `PLURNK_SERVICE_DERIVE_STORE_BATCH` definitions or references per SQLite statement. Every launched worker settles before the maintenance pass reports success or failure, so one failed artifact cannot orphan sibling derivations. Every representation completed by a successful pass attaches a terminal classified artifact, identically at concurrency 1 and N. A changed pass emits one immediate `preparing` state, intermediate `indexing` heartbeats at `PLURNK_SERVICE_DERIVE_PROGRESS_HEARTBEAT_MS`, and one immediate `complete` or `failed` state. A no-op pass emits no lifecycle, an indexing heartbeat never claims 100%, and the model-facing Notice buffer retains only the current derivation state while live clients observe each heartbeat.
 
@@ -836,15 +841,29 @@ with their reasons. Successful optional projection degradations continue indexin
 and surface their framework Notice once per identical observation in a maintenance
 pass.
 
-§membership-change-gated-sync **Sync is idempotent and change-gated.** Per turn, membership materializes every member's model-readable snapshot into its entry. Text with an unchanged disk signature and materialization policy is a stat-only no-op. The version token is either the observed `mtime:size` or the explicit `absent` state; an observed deletion removes the stale readable channels, and a later reappearance is therefore a new divergence rather than a first-sight materialization. Binary sources additionally compare the cached per-mimetype projection identity; unchanged bytes are never reacquired, while changed reader behavior rematerializes without fabricating a filesystem-divergence event. Coverage is exhaustive across the project repository while work is proportional to source or projection change. After a pass every member carries the current representation defined by {§membership-source-projection} and {§membership-materialization-limit}.
+§membership-change-gated-sync **Projection is idempotent and change-gated.** Membership checks every member's physical identity and raw-byte digest within the materialization ceiling; timestamps alone never establish content identity. Unchanged source revision and policy avoid projection and database publication. Binary projections also compare their reader identity. Input-limited markers remain stat-gated because they expose no acquired body. An acquisition whose observed file identity or metadata changes is discarded and retried on the next pass. An observed absence removes stale channels and records `absent`; reappearance is a divergence, not first sight. This is observed state subject to {§file-external-race}, not an instantaneous snapshot of a concurrently changing project.
 
-§membership-emi-divergence-signal **EMI divergence evidence.** The detector that gates the work *is* the one that records this — one mechanism, not a second full read. When change detection finds a member moved out-of-band, the runtime actor records an `EDIT`-shaped row naming the file with `source="file"`; it does not broadcast that workspace change into unrelated workers' logs ({§env-delta-filesystem-narration}). The model's own edits are write-through (the entry equals disk after a File write), so the scan never mis-attributes them as external divergence. The current file remains ordinarily addressable. A stale anchored edit rejects under {§line-anchors}; a disk race after proposal rejects under {§membership-edit-write-cas}.
+§membership-emi-divergence-signal **EMI divergence evidence.** The materialization pass records observed source changes as an `EDIT`-shaped row naming the file with `source="file"`; it does not broadcast them into unrelated workers' logs ({§env-delta-filesystem-narration}). A native write publishes its own projection and revision, so unchanged landed bytes are not narrated as external divergence. Later external changes remain independently detectable. A stale anchored edit rejects under {§line-anchors}; write-back protection and its external race limit are defined by {§membership-edit-write-revision} and {§file-external-race}.
 
-§membership-edit-write-cas **The write-back is a compare-and-swap — never a clobber, never a clever merge.** EDIT is *naive against the editable text snapshot*: it diffs the model's change onto the entry's body channel — the exact Unicode the model READ — and the proposal carries the `synced_sig` that snapshot was taken at. Binary sources are refused before this path ({§membership-source-projection}). At accept, `applyResolution` re-stats disk and lands the proposed content only if that signature still matches. If disk moved out-of-band in the propose→accept window — a sibling worker, the user's editor, a build step — the write is **refused** with the same neutral `edit-collision` as {§edit-collision}, and **nothing is written**. The engine neither blind-writes over the ambient change (a *clobber*) nor silently re-diffs the model's edit against a state it never saw (getting *clever*) — both would bury a stale-view contract violation under a fallback. The collision surfaces instead: a ≥400 apply downgrades to a reject ({§proposal}), so the model sees that EDIT **did not occur** (400; the `edit_collision` outcome is forensics-only). Reconciliation aligns the current file projection and records the `source=file` evidence in the runtime log ({§membership-emi-divergence-signal}); the model re-reads and re-proposes against the fresh snapshot.
+§membership-edit-write-revision **File write-back is conditional on its captured revision.** EDIT computes against the materialized text; COPY/MOVE mutations retain the revision of the state they selected. Approval never substitutes a newer baseline. Immediately before publication, physical identity and exact content must still match; otherwise the operation returns `edit-collision` (409) without changing the target. A member without a recorded source revision must be materialized before mutation, not treated as permission to overwrite. New-path publication is exclusive. Anchors separately protect the addressed text neighborhood before proposal ({§line-anchors}); an unanchored edit does not claim to preserve an earlier READ's view.
 
-The version travels *with the proposal*, never re-read from the entry at accept: a sibling worker in the same workspace may reconcile while this proposal sits paused, advancing the entry's `synced_sig` to the drifted disk — comparing against the *current* entry sig would wave that clobber through, so the comparison is always against the sig the proposal was computed at. A proposal that assumed an **absent** path (a create) conflicts only if a file has since appeared; a member with **no recorded snapshot** (an un-materialized entry, null `synced_sig`) has no baseline to guard and writes through — the two are told apart by the proposal's `existed` flag, not by a null sig alone. On a clean landing the entry refreshes to the written content and `synced_sig` is **restamped** to it, so the next reconcile recognizes the model's own write (not an external divergence) and a second same-turn edit bases on the landed bytes, not a stale sig. This is the write-side twin of the read-side change-gate ({§membership-change-gated-sync}): one `synced_sig`, gating both the re-read and the write.
+§file-snapshot-revision A materialized source revision records its physical path, filesystem identity/change fingerprint and raw-byte digest, distinct from the derived readable body. Its revision and channels publish in one database statement. An input-limited marker has no acquired digest; it cannot authorize a content replacement. Successful writes stamp the revision acquired from their own bytes, never a later pathname stat. Unversioned projections are rematerialized, including those retained through an upgrade.
 
-The CAS is the **hard backstop**, at the moment of writing, on every accept path. It composes with the model-facing {§line-anchors}: an anchor rejects a target whose relevant neighborhood changed before dispatch, while the CAS refuses to write against a snapshot disk left after proposal. An unanchored edit deliberately claims no pre-dispatch stale-view guarantee.
+§file-commit-serialization Final validation, publication/deletion, and projection settlement are serialized per physical path within one daemon, across workers and workspaces. Unrelated paths remain concurrent. No reservation survives a commit, and no lock is held awaiting model inference, approval, or MIME projection. Membership acquires and projects outside this boundary, then revalidates its source inside it before publishing; an older projection cannot overwrite a newer daemon write.
+
+§file-publication A native file write stages complete bytes beside the target, then publishes them atomically; failures before publication leave the original intact. Creation never replaces an occupied name. Existing-file replacement preserves permission bits and ownership, but replaces the inode: other hard-link names and already-open descriptors retain their previous file. Inode-specific extended attributes are not a promised projection. The file/directory operations and SQLite commit are not one transaction or a filesystem power-loss durability guarantee. If publication succeeds but incorporation/projection fails, the result identifies that partial effect; it never claims nothing happened.
+
+§file-delete-revision KILL and MOVE source removal validate the captured source revision immediately before unlinking or editing. Whole-file KILL of an input-limited member acquires a streaming digest before proposal without materializing its body. Deferred MOVE retains its original source selection through destination approval. A changed source is preserved; a destination already written remains reported under {§move-cross-scheme-move}. Creation rollback may remove only the unchanged file that creation published; a changed or replaced path is retained and reported as incomplete rollback.
+
+§file-external-race The file boundary is optimistic with respect to external programs, executors and other daemons. Portable filesystem APIs provide no atomic expected-content-and-replace/unlink primitive. Plurnk detects drift through its final validation, but cannot exclude a writer racing after that check. It neither advertises such exclusion nor silently merges changed files. Physical-path revalidation prevents a changed symlink from redirecting an approved operation to a different target, subject to the same external race limit.
+
+| Commit boundary | Filesystem effect | Result and settlement |
+| --- | --- | --- |
+| Unknown baseline or observed drift | No mutation | 409; refresh and prepare again ({§membership-edit-write-revision}). |
+| Staging or prepublication I/O failure | Original target remains intact | Failure; retain cleanup failures too ({§file-publication}). |
+| Existing file published; projection fails | Complete replacement remains | Failure identifies the update; ordinary reconciliation reads disk truth ({§file-publication}). |
+| New file published; incorporation fails | Remove only the unchanged creation | Report rollback, or partial failure if another writer changed it or cleanup fails ({§file-delete-revision}). |
+| MOVE destination published; source changed | Keep destination and changed source | Conflict identifies the completed destination effect ({§move-cross-scheme-move}). |
 
 §membership-git-flags **Permission flags.** Service-wide Git admission comes from {§operator-config-git-ceiling}. `PLURNK_SERVICE_GIT_AUTO=1` includes the repository containing `project_root`; `=0` disables automatic Git membership, leaving member definitions as the only membership source. `ALLOWED` gates `AUTO`.
 
@@ -1555,16 +1574,30 @@ historical execution. No address grants ownership or access restrictions.
 | `src/x.md`, `./src/x.md`, `/work/project/src/x.md` | `src/x.md` |
 | `/src/x.md` | `../../src/x.md` |
 | `../policy.md`, `/work/policy.md` | `../policy.md` |
+| `~/x.md` (daemon home `/home/user`) | `../../home/user/x.md` |
+| `./~/x.md` | Key `~/x.md`, addressed as `./~/x.md` |
 | `.`, `/work/project/` | The project collection, not a file entry |
 | `/` | `../../`, the operating-system root collection |
 
-At `project_root=/`, `/src/x.md` and `src/x.md` resolve to the same key. Without a project root, absolute paths cannot be translated; no process CWD or home directory is substituted.
+At `project_root=/`, `/src/x.md` and `src/x.md` resolve to the same key. Without a project root, absolute and home-relative spellings cannot be translated; no implicit filesystem base is supplied.
+
+§fs-home **Home expansion belongs to authored file spellings, not resource identities.** A leading `~` or `~/` resolves from the daemon user's home (`os.homedir()`) before project-relative translation. Bare `~` names that directory. Other tilde-prefixed names, `./~` and embedded tilde segments are literal. This applies to file operations and client attachments regardless of producer; pattern-slot `~` remains full-text search. Bound entry addresses, Git paths, stored keys and membership patterns remain literal. Expansion grants neither membership nor write authority. A literal key `~` or `~/…` is rendered with a leading `./`, so resolving the displayed address recovers the same key without expanding it again. Existing identities and historical evidence are unchanged.
 
-Folders and globs select members in those same filesystem coordinates. Parent-directory selectors may include in-root and outside-root members; they never scan or admit unrelated disk contents. Catalog paths and grouped subtree selectors remain project-relative.
+§file-url **Explicit file URLs have native URL meaning; stored keys stay literal.** Reads, mutations, client attachments and rendered addresses share this boundary:
 
-§file-path-normalization An authored model file operation using an absolute path receives a `scheme:file/path_normalized` warning Notice naming its project-relative address. COPY/MOVE cover each absolute operand. The Notice neither changes the operation result nor causes a strike, and does not repeat for automatic observations or already-relative paths. Root-mounted workspaces need no such notice. It never suggests that an unadmitted path has become a member.
+| Surface | Contract |
+|---|---|
+| `file://` input | Native `fileURLToPath` interpretation, once, before {§fs-namei}; `%2528` names literal `%28`, not `(`. Query does not change the native filename; fragment selects a channel, while `%23` names a literal `#`. |
+| Invalid URL | Invalid encoding, host-unsupported authorities or encoded separators, and NUL refuse the operation with 400. |
+| Bare input / bound key | Bare spelling retains {§path-parentheses}, not general URI decoding. Bound keys are never decoded or home-expanded again. |
+| Resource rendering | Ordinary names stay project-relative. Names that bare target syntax would reinterpret use absolute native file URLs from `project_root`; no identity or membership changes. |
+| Selectors | Encoded metacharacters are filename data, separate from authored glob syntax ({§path-glob-matching}). URL selector receipts preserve that distinction; generated folder links quote the literal folder before appending `/**`. Literal backslashes remain within their filename segment, including beside glob syntax. |
+
+Folders and globs select members in those same filesystem coordinates. Parent-directory selectors may include in-root and outside-root members; they never scan or admit unrelated disk contents. Catalog paths and grouped subtree selectors use the reusable spelling in {§file-url}.
 
-§fs-canonical-name **One canonical name, storage ≡ wire: the git pathspec.** Member keys follow gitformat-index(5) verbatim (reference edition: git 2.47.3): relative to the workspace `project_root`, without leading slash, `/`-separated, no trailing slash or NUL. Directories are never entries and the root needs no name. When `project_root` is below the containing repository's top level, Git members above it naturally use the same `../`-prefixed CWD-relative names that `git ls-files` emits without `--full-name`; these are not outside-repository mounts. The database stores that root-relative key directly because workspace identity is rooted at the access point. Every model spelling canonicalizes before storage or comparison.
+§file-path-normalization An authored model file operation using an absolute or home-relative path receives a `scheme:file/path_normalized` warning Notice naming its project-relative address. COPY/MOVE cover each such operand. The Notice neither changes the operation result nor causes a strike, and does not repeat for automatic observations or already-relative paths. Root-mounted workspaces and spellings that must remain file URLs ({§file-url}) need no such notice. It never suggests that an unadmitted path has become a member.
+
+§fs-canonical-name **One canonical identity: the literal Git-relative key.** Member keys follow gitformat-index(5) verbatim (reference edition: git 2.47.3): relative to the workspace `project_root`, without leading slash, `/`-separated, no trailing slash or NUL. Directories are never entries and the root needs no name. When `project_root` is below the containing repository's top level, Git members above it naturally use the same `../`-prefixed CWD-relative names that `git ls-files` emits without `--full-name`; these are not outside-repository mounts. The database stores that root-relative key directly because workspace identity is rooted at the access point. Authored spellings resolve before storage or comparison; stored keys are lexical fixpoints, never reinterpreted as authored input. Rendering quotes target-slot syntax ({§path-parentheses}) and home-like literal names ({§fs-home}), using a file URL where necessary ({§file-url}); resolving the rendered spelling returns the same key.
 
 §fs-visibility-grantors **File visibility has two represented grantors; Plurnk never invents a private third one.** A file member is admitted by the active Git substrate or by an ordinary `include` row of the overlay. An `include` is either a projected `members` definition ({§members-projection}) or the exact, inspectable record of an accepted creation ({§fs-create-record}); both resolve to `constraint` membership. AGENTS.md remains auto-pulled as POLICY ({§policy-sections}), deliberately not a file member. A physically existing path that neither Git nor an `include` admits does not exist for the model and cannot be overwritten.
 
@@ -1605,12 +1638,12 @@ where the invariant closes an architectural failure mode:
 - §file-create-scope The effective creation scope is the minimum of the service ceiling and workspace setting; no call site or producer may widen it.
 - §file-create-producer-neutral The file contract depends on the operation and target, never the producer identity.
 - §file-create-single-owner File membership owns prospective admission, incorporation choice, and creation-record lifecycle; file operations consume that decision rather than re-deriving Git and constraint policy.
-- §file-create-transaction Success requires both exclusive disk creation and durable incorporation. Approval re-resolves physical containment and policy, so a proposal-time parent cannot be swapped for an outside-pointing symlink. Incorporation failure removes the created entry and file; incomplete rollback is an explicit partial-failure Problem.
+- §file-create-transaction Success requires both exclusive disk creation and durable incorporation. Approval re-resolves physical containment and policy. Incorporation failure rolls back only the unchanged creation ({§file-delete-revision}); incomplete rollback is an explicit partial-failure Problem. Publication and its filesystem limits are defined by {§file-publication} and {§file-external-race}.
 
 Refusing an occupied non-member follows the POSIX exclusive-create precedent:
 namespace occupancy is not secret, but content remains dark.
 
-§fs-answer-in-canon **The engine answers in canon.** Every engine-authored address — log-row pathname columns, rx spans and error facts, FIND results, the catalog, the foists — renders the one canonical form: exactly what `git ls-files --full-name` prints, byte-for-byte on the git-membership subset. A miss names the RESOLVED form, never an echo of the model's spelling. The single verbatim survivor is the model's own emission text — history is never rewritten. There is no shadow universe of model-preferred addressing.
+§fs-answer-in-canon **The engine answers with the resolved identity.** Log-row pathname columns retain literal canonical keys. Model-facing addresses in receipts, FIND results, the catalog and recovery use their round-trippable spelling ({§fs-canonical-name}); filename facts and native diffs may name the literal key. A miss names the resolved identity, never an echo of the model's spelling. The model's own emission text remains verbatim — history is never rewritten. Rendering does not create another resource identity.
 
 §fs-errno **errno discipline — one error, one meaning, each with its fact.** Error facts speak wire canon and state the occurrence, never a tutorial.
 
@@ -1625,7 +1658,7 @@ Every fact names the canonical key, never the host root or an echo of the
 model's spelling. These classes let a caller distinguish a wrong address, an
 invalid range, read-only authority, and occupied hidden state without guessing.
 
-§membership-read-refusal **A file miss speaks of membership, never of the disk.** A file is read only as a member, so every `file` miss — READ, FIND of an exact path, KILL, a pattern EDIT's source, a COPY or MOVE source — is 404 `entry-not-found`, `No member of this workspace is at '<key>'.`, its target rendered as the member key, never a `file://` URI. Recovery offers listing with FIND, creation with EDIT, and admission with `members (add)` as alternatives and presumes none ({§diagnostic-observation}): `` FIND lists paths. EDIT creates files; `members (add)` admits existing files with a `{"glob": "<path>"}` body. `` Admission takes a `{"glob": "<path>"}` body. The sentence is about the address and is true whether or not a file is there: it neither claims absence nor hints at presence. Beyond the root the engine does not look at the disk at all, so two reads of `../` paths differ only in the name they echo, and their recovery speaks of the address too, true under every members scope: `'<key>' is outside the project root: only a members definition under the operator's namespace scope admits it.` Inside the root occupancy is not secret ({§fs-write-nonmember}), so an exact-path READ of a path that exists on disk but is not a member says so instead — 404 `entry-not-member`, `'<key>' exists on disk but is not a member of this workspace.`, with admission-only recovery; a path the repository ignores, which no model definition admits, carries the members discovery verdict instead: `The repository ignores it: a client or operator members definition can include it, a model definition cannot.` Occupancy may surface there; content never does ({§membership}).
+§membership-read-refusal **A file miss speaks of membership, never of the disk.** A file is read only as a member, so every `file` miss — READ, FIND of an exact path, KILL, a pattern EDIT's source, a COPY or MOVE source — is 404 `entry-not-found`, `No member of this workspace is at '<key>'.`, its target rendered as the reusable member address ({§fs-answer-in-canon}, {§file-url}). Recovery offers listing with FIND, creation with EDIT, and admission with `members (add)` as alternatives and presumes none ({§diagnostic-observation}): `` FIND lists paths. EDIT creates files; `members (add)` admits existing files with a `{"alias": "<name>", "definition": {"glob": "<path>"}}` body. `` The sentence is about the address and is true whether or not a file is there: it neither claims absence nor hints at presence. Beyond the root the engine does not look at the disk at all, so two reads of `../` paths differ only in the name they echo, and their recovery speaks of the address too, true under every members scope: `'<key>' is outside the project root: only a members definition under the operator's namespace scope admits it.` Inside the root occupancy is not secret ({§fs-write-nonmember}), so an exact-path READ of a path that exists on disk but is not a member says so instead — 404 `entry-not-member`, `'<key>' exists on disk but is not a member of this workspace.`, with admission-only recovery; a path the repository ignores, which no model definition admits, carries the members discovery verdict instead: `The repository ignores it: a client or operator members definition can include it, a model definition cannot.` Occupancy may surface there; content never does ({§membership}).
 
 §file-directory-target **A directory is named as a directory.** Inside the root, a READ (or other exact-path read), KILL or EDIT whose target is a directory on disk — with or without a trailing slash — is refused `path-is-directory`, never as a missing or non-member file: READ and KILL answer 404, EDIT 403. The detail is `'<key>' is a directory, not a file; <OP> reads/removes/writes one file.`; a READ or KILL carries the listing as its recovery, `` `FIND (<key>/)` lists its files. ``, and an EDIT carries none. Beyond the root the disk stays dark and {§membership-read-refusal} holds unchanged.
 
@@ -1654,7 +1687,7 @@ metadata or channels.
 
 §op-methods-op-dispatch Engine operation ownership follows the public scheme contract:
 
-- Each authored EDIT dispatches through `editBatch` with one resolved statement.
+- Each resolved EDIT target dispatches through `editBatch` with one statement.
 - A log KILL dispatches only to the core-owned log curation handler ({§log-kill-scope}); an entry scheme's `kill` method never sees a `log:///` target.
 - Other delegated operations use the corresponding lowercase `SchemeHandler` method, with standard FIND supplied for a data scheme that omits a custom implementation.
 - COPY and MOVE are engine-owned compositions over CRUD primitives ({§copy}/{§move}).
@@ -1682,10 +1715,10 @@ Registration precedes loop affinity:
 | Observation | Responses are unseen retrieval work; completion follows {§send-premature-terminate}. |
 
 - §op-synchronous **Decisive operations settle before the next operation.** The dispatcher awaits each operation and its proposal resolution. Work remains in flight only when the operation's contract deliberately creates concurrency: FORK, WORK, a stream-producing execution, and streaming READ after acquisition. Such a READ first establishes its durable subscription and returns `102`; a later operation may address that live owner. Dispatching an execution before KILL does not wait for the process to finish using a resource. KILL of a worker synchronously ends its live loops before disposition checks the pending set; physical scope cleanup remains asynchronous.
-- §edit-execution **One authored EDIT is one mutation.** Each EDIT resolves against current resource state when dispatch reaches it, owns its proposal when gated, and records its own resulting revision. No later EDIT is prepared or applied in advance. Numeric scopes address current coordinates; an earlier EDIT may change what those numbers select. Rejection applies only to that operation, not its successful siblings.
+- §edit-execution **One resolved EDIT target is one mutation.** Each EDIT resolves against current resource state when dispatch reaches it, owns its proposal when gated, and records its own resulting revision. No later EDIT is prepared or applied in advance. Numeric scopes address current coordinates; an earlier EDIT may change what those numbers select. Rejection applies only to that operation, not its successful siblings.
 - §edit-anchor-continuity **Own EDITs preserve untouched hash targets within one program.** Core carries an anchor through exact, successfully applied EDIT splices when its line survives unchanged, even if its ordinal or neighborhood changes. Scoped entry KILL uses the same deletion path. Target-line replacement or deletion invalidates that binding. Continuity is private to the admitted program and canonical resource/channel; it is not a new published anchor format. The complete normalized line content must match the expected result of the preceding recorded EDIT, otherwise retained bindings are discarded and ordinary current-state validation applies. Reviewer replacement and results without an applied EDIT receipt do not carry bindings forward. A retained binding resolves alone: a twin neighbourhood this program's own splice created elsewhere does not make the carried anchor ambiguous, and an anchor the program never bound resolves against current state. Normalization is the same line-content representation used by READ and line hashing; file-write revision checks remain independent. No approximate text matching is used. Lowered coordinates retain a current-anchor precondition at the mutation owner; ambiguous matches and concurrent changes remain collisions.
 - §anchor-offset **An anchor offset is tolerated, never taught (#749).** A line mark may carry an offset from its anchor (`@abcde+1`, `@abcde-2`), and a bare `+N` after an anchor counts from that anchor (`<@abcde,+1>`). The anchor resolves as usual and the offset is added; a result before line 1 is an invalid mark, and past the end is the ordinary range refusal. Continuity and current-anchor preconditions check the anchor's own line. `plurnk.md` keeps its two anchor forms. Numeric relative endpoints normalize under {§scope-range-recovery}; a reversed range produced by anchor resolution is never reinterpreted as a count.
-- §edit-batch **One compound operation may require atomic splices.** The scheme's `editBatch` primitive validates all supplied numeric edits against one snapshot and commits one revision or none. Core supplies one statement for an authored EDIT; same-resource MOVE can supply multiple splices as one operation. This primitive does not group separate authored operations. Its replacement, insertion, conflict, and receipt rules remain owned by the shared Slicer.
+- §edit-batch **One compound operation may require atomic splices.** The scheme's `editBatch` primitive validates all supplied numeric edits against one snapshot and commits one revision or none. Core supplies one statement per resolved EDIT target; same-resource MOVE can supply multiple splices as one operation. This primitive does not group separate targets or authored operations. Its replacement, insertion, conflict, and receipt rules remain owned by the shared Slicer.
 - §edit-batch-receipt **A refusal describes its own unapplied work.** An anchor collision lists every distinct unresolved anchor in that EDIT, including both range endpoints, in `unresolvedAnchors` (`anchor`, `kind: missing | ambiguous`, and matching `lines` when ambiguous). Missing is not proof of earlier validity or subsequent change. It carries `editCount: 1`, `applied: 0`, and recovery directing a READ for current coordinates; it makes no claim about other operations. A refused compound splice batch lists all conflicting pairs in `conflicts`, non-conflicting regions in `cleanRegions`, its first pair in `conflictingRegions`, and its own `editCount` and `applied: 0`.
 - §edit-batch-merges **Normalizations require evidence and a receipt.** An EDIT body carrying only this resource's published `L<@xxxxx>` prefixes (the number right-aligned) is stripped when those prefixes verify against current anchors or this worker's preserved READ receipts (`rendered-prefix-stripped`); otherwise it remains literal content (`rendered-prefix-unverified`). Within a single atomic splice batch, the Slicer can deduplicate identical regions/bodies, concatenate same-boundary insertions, assign a shared endpoint to the sole body reproducing that line, or relocate an inner change when its original content occurs exactly once in the outer body. An already-applied inner body can be dropped. Unevidenced overlap remains a collision. These batch resolutions never reinterpret separate authored EDITs. Applied normalizations carry their exact merge facts and a notice; receipts describe only the applied effects.
 
@@ -1697,6 +1730,34 @@ a resource, channel, and optional text scope ({§transfer-resource-selections}).
 Source acquisition follows {§universal-read-composition}; landed mutation
 effects follow {§edit-result-copy-move-effects}.
 
+§bulk-resource-targeting **Path selectors resolve before resource operations.** Core
+uses ordinary FIND selection, without a FIND receipt, to resolve glob/extglob
+operands ({§path-glob-matching}). Resolution occurs when dispatch reaches the
+operation, not when the turn is parsed. Each selected address retains the
+authored channel; scopes and content matchers belong to the selected resource.
+
+| Operation | Selection and execution |
+|---|---|
+| READ | The ordinary FIND resource page, optionally filtered by the content matcher; each target receives an exact READ ({§read-fan-out}). |
+| EDIT, resource KILL | The complete matching path set, not the FIND preview page. Content matchers do not filter this set: each target independently validates and applies its scope, matcher and body through the ordinary mutation owner. No paths means one 204 receipt and no mutation. |
+| COPY, MOVE | Each glob operand must resolve to exactly one resource. Zero or multiple matches refuse the pair with `target-cardinality` before either side changes. Exact destinations retain ordinary creation semantics. Explicit pairs express bulk transfers; no implicit concatenation, folder mapping or positional pairing. |
+| Log KILL | The existing curation selector owns the complete operation ({§log-kill-scope}), including its snapshot and distillation. |
+
+Fan-out resolves the address set once and executes in FIND order. Each target
+has its own admission, current-state validation, proposal and durable receipt;
+successful siblings survive a later refusal. Fail-on-error stops before the
+next target ({§op-execution-order}). No cross-resource transaction is implied.
+Per-target rows carry `attrs.fanout` (`target`, the authored selector; `matched`,
+the selected resource count; zero-based `index`; `count`, the admitted target
+count). One authored operation still produces one lifecycle notification pair.
+The configured command ceiling counts each admitted concrete operation; WAIT
+remains exempt ({§operator-config-workspace-max-commands}). It never counts an
+internal survey or a distillation as another command. An entirely omitted
+statement is not surveyed just to count its possible targets.
+Dispatch returns core-owned `commandsExecuted` and `commandsOmitted` totals to
+the turn executor outside operation results, receipts and lifecycle events;
+scheme result extensions cannot supply these counts.
+
 ### SEND dispatch (a message to a recipient)
 
 Targetless and exact-message SENDs follow the reply accounting at
@@ -1913,7 +1974,7 @@ Every entry is uniformly listed in the catalog (```` ```FIND (scheme:///**) ````
 
 Mimetype is declared by scheme manifest ({§scheme-manifest}) or supplied per-call for dynamic schemes. Writing a channel without a declared mimetype throws. No default mimetype anywhere.
 
-- §channel-mimetype-cross-mimetype-415 COPY/MOVE compatibility follows {§mimetype-verbatim-transfer}; incompatible pairs return 415. Transfers preserve content verbatim and retain the destination's declared type, resolving it through {§ext-mimetype} only for an absent channel ({§copy}).
+- §channel-mimetype-cross-mimetype-415 COPY/MOVE compatibility follows {§mimetype-verbatim-transfer}; incompatible pairs return 415. Transfers preserve content verbatim and retain the destination's declared type, resolving an absent channel under {§copy-destination-mimetype}.
 
 ### §channel-selection Channel selection in the DSL
 
@@ -2126,14 +2187,14 @@ AST: `{ op: "EDIT", target, body: string | null, signal: tags | null, lineMarker
   ({§edit-anchor-continuity}) does not carry through a pattern batch; the next
   anchored EDIT validates against current state.
 
-A `file:///` member EDIT diverges from this immediate-write contract: it diffs against the entry snapshot (the body channel, never a fresh disk read) and **proposes** (202) a disk write that lands via a compare-and-swap on accept. See {§membership-edit-write-cas} and the proposal lifecycle {§proposal}. The marker-required rule above applies identically here — an existing file is never markerlessly replaced.
+A `file:///` member EDIT computes against its materialized body and **proposes** (202) conditional file publication under {§membership-edit-write-revision}, {§file-external-race}, and {§proposal}. The marker-required rule applies identically: an existing file is never markerlessly replaced.
 
 ### §read READ
 
 AST: `{ op: "READ", target, body: null, signal: tags | null, lineMarker? }`.
 
 A READ is never rewritten into a FIND ({§read-find-normalization}); a path-glob
-READ is the one fan-out core performs ({§read-fan-out}).
+READ uses the common resource selector ({§bulk-resource-targeting}, {§read-fan-out}).
 
 - §read-read-content Returns channel content and mimetype.
 - §read-read-404 Returns 404 when the channel is absent.
@@ -2175,16 +2236,16 @@ READ is the one fan-out core performs ({§read-fan-out}).
   scope, matcher and aside ({§read-selection-projection}, {§read-pattern}), one
   receipt row per path in the FIND's order, so every rendered line keeps its path,
   physical ordinal and anchor and remains a coordinate source for EDIT and KILL.
-  Each such row carries `attrs.fanout` (`target`, the authored glob; `matched`, the
-  survey's matching path count; `index`; `count`), so a client presents the authored
-  statement once and folds the paths beneath it without inferring the group.
+  Rows use the shared `attrs.fanout` identity ({§bulk-resource-targeting}), so a
+  client can group the exact receipts under the authored statement.
   Without a scope each path uses {§markerless-first-page}; with a pattern
   only the matching lines, `grep -n` style. The authored statement contributes
   `rowsWritten`, the receipt count, to its turn's sequence. No path is one 204
   receipt on the authored glob (`matched: 0` when a pattern selected nothing); a
   FIND failure is that failure on the authored glob. The FIND's resource page bounds
-  the fan-out: when more paths matched than were read, one `read_fanout_bounded`
-  notice names both counts. Every dialect follows this same READ fan-out;
+  the fan-out: when more paths matched than its page selected, one
+  `read_fanout_bounded` notice names both counts. A separate command ceiling may
+  further limit dispatch ({§bulk-resource-targeting}). Every dialect follows this same READ fan-out;
   none substitutes a FIND receipt for the requested content.
 
 §read-pattern-evidence **Match regions survive line-oriented presentation.** A patterned
@@ -2278,6 +2339,10 @@ AST: `{ op: "KILL", target, matcher: MatcherBody | null, lineMarker: TextLineMar
 
 KILL deletes context from the **log** (`log:///`, {§packet}). Without a scope it retires the selected rows from the active projection ({§log-history-projection}). With a one-line or inclusive two-line scope it removes only that body's intersecting body-relative physical lines from the readable projection, and the row stays active. An anchor may be one published on that body or one returned by READing its `log:///` coordinate ({§line-anchors}); an anchor absent from the current body selects no line, as with an out-of-bounds numeric line. Scoped KILL is one-way: intervals accumulate, the durable body is untouched, and subsequent access follows {§log-readable-projection}. A scoped KILL on a bodyless row is a friendly 200 no-op with `matched` reported. An emission row is curated whole ({§emission-row}): the unscoped KILL retires it; a line scope on its exact coordinate addresses its legend and retires the NOTEs on the lines it selects, the row staying; on a row with no legend lines the scope is 422 `emission-curated-whole`, whose recovery names the unscoped KILL; a sweep leaves it intact. A KILL that addresses no row is 404 on an exact coordinate and 204 on a sweep ({§log-curation-folder-idiom}). Selection composes target/glob with an optional heading pattern ({§log-curation-set-selection}).
 
+§log-target-tolerances **The log target reader accepts four near-misses of the taught form and reads each as the one target it can only have meant.** The card teaches `KILL (log:///1/[1-7]/*/{READ,emission})`; none of the following is taught, and no diagnostic text accompanies any of them. A `|` between complete KILL targets, each a coordinate, prefix or glob ({§log-coordinate-hierarchy}) written bare or as a full `log:///` address, is their union: `log:///1/25/2/EDIT|log:///1/24/3/EDIT` retires both rows; a piece that is none of those refuses the whole target, 400 `kill-failed`, naming the piece; a list that selects nothing is the sweep's 204 unless every piece is an exact coordinate, when it is the exact miss's 404. `|` is not a character of a coordinate, and file paths, where it is one, are untouched. For KILL and FIND alike: a bracketed comma list in a numeric slot is a set, `log:///1/[19,24]/**/sh` reading as `log:///1/{19,24}/**/sh`, since a character class can never match a turn number; a non-numeric literal in a numeric slot, after at least one numeric slot, is the leaf with the missing slots `*`, `log:///1/*/READ` reading as `log:///1/*/*/READ`; and `*` segments between the sequence and the leaf are dropped, `log:///1/3/3/*/READ` reading as `log:///1/3/3/READ`, since no coordinate holds a segment there.
+
+§log-target-shape **The refusal of a log target nothing can read shows the working form.** A malformed KILL or FIND target, 400, carries as its recovery the one sentence `` A log target is `log:///<loop>/<turn>/<sequence>` with an optional `/<op>` leaf; a shorter path is a prefix, and `*`, `**`, `[1-7]` or `{a,b}` may stand in any segment. `` It names the shape and presumes nothing about what the author meant ({§diagnostic-observation}). A sweep that matches nothing stays the bare 204 of {§log-curation-folder-idiom} and an exact miss beside rows that exist names them ({§log-near-miss}); neither carries the sentence, so no text rides the packet for the ordinary case.
+
 §log-scope-recovery A log-body scope follows the file slicer's range rule ({§range-starts-at-one} in the schemes SPEC): a range starting at 0 — `<0,-1>` included — is refused 416 `range-not-satisfiable` on every body, empty ones too, and never clamped; its detail is the slicer's own sentence, `Range <0,-1> starts at 0, which is not a line; lines are numbered from 1.`, and its recovery names the forms a log body takes — `Trim one line with <L> or lines L through M with <L,M>; KILL (log:///1/9/2/READ) with no scope retires the whole row.` — never the insert and append positions a body cannot take. Every other scope that names no line is 400 `curation-scope-invalid` with the same recovery: the forms that work on that row, never a rebuild of the written scope ({§diagnostic-observation}).
 
 A READ carrying active native media is atomic: any KILL scope is ignored and the entire observation is retired, including its native context contribution ({§packet-attachment-parts}). For a model turn, native activity is the attachment selection in its actual input packet; without a model packet, a native observation is atomic by default. Text-only observations in the same selection retain ordinary scoped behavior. Neither form deletes source data or forensic evidence.
@@ -2326,6 +2391,32 @@ The `## Log` section is a sequence of ordinary Markdown records separated by one
 
 An emission row's body is not in its record ({§emission-row}); its eligible program follows it as a separate assistant message ({§emission-history}). Patterns retain their literal spelling; a pattern containing a line break is JSON-quoted to keep the H3 on one physical line. Receipts are descriptive records, not reconstructed operation headings. Absent fields are not invented. Every physical body line retains its canonical numeric `N:` or anchored `@hash N:` coordinate, so source text cannot create a record boundary. The section contains records only, with no leading prose or enclosing fence.
 
+§log-mutation-patch **A settled file mutation's row keeps what it did.** When an accepted EDIT,
+COPY, MOVE or KILL writes or removes a text member, the file scheme appends the unified diff of
+that write, `current` to `proposed`, to the operation row it is settling (`log_entries.patch`); a
+row that settles several writes keeps them in application order. The row serves it as its `patch`
+channel, `log:///<loop>/<turn>/<item>/<OP>#patch`, `text/x-diff`, for the life of the row: a fork
+copies it with the row, and it never enters a receipt or a packet unasked. Nothing is kept for a
+byte write, a member past the materialization bound, or a row settled before this version, and
+nothing is reconstructed for them: such a row has no `patch` channel, and whatever reads one, a
+rollback included, fails by name rather than inventing one.
+
+§rollback **Rollback reverses a worker's settled file mutations, latest first, through ordinary
+operations.** `rollback({ workspaceId, workerId, clientWorkerId, to })` (`workspace.rollback { to,
+workerId? }` for a client) names a log coordinate of `workerId`, `<loop>/<turn>/<item>`; the state
+after that item is what remains. Every settled EDIT, COPY, MOVE or KILL row after it, latest first,
+has its patch ({§log-mutation-patch}) reversed against the file as it is now and written back as an
+operation of the acting client in `clientWorkerId`, settled under that worker's owner: a rewrite as
+`EDIT <1,-1>`, a removed file as a creating `EDIT`, a created file as `KILL`. Each reversal is a
+proposal, a row and a patch of its own, so a rollback is reviewable afterwards and reversible by the
+same means. The report (`RollbackReport`) lists what was restored, the rows skipped because they
+kept no patch or were reversed already (the file is in the state before that mutation, as an earlier
+rollback left it), and where it stopped: `drift`, the file no longer holds what that mutation wrote,
+leaves that file and everything earlier untouched; `refused` carries the reversing operation's
+Problem. A coordinate that is not one of the worker's rows is `404 coordinate-not-found`, a
+malformed one `400 coordinate-invalid`, and a workspace without a project root `400
+project-root-required`. Nothing is reconstructed for a patchless row, and the log is never rewritten.
+
 §log-address-metadata **Addresses name their relationship, not the row's producer.**
 
 | Spelling | Meaning | Where |
@@ -2524,6 +2615,7 @@ reads what the model thought and where its content program can be found
 | A curation that matched nothing (204) | Shown once, in the packet of the very next turn, then retired like any other row. A success and a mismatch are not both silent: the model cannot otherwise tell that its earlier KILL is what emptied the selection (#779). |
 | Failed log curation | Visible with its ordinary Problem. |
 | Non-log target: file, worker, stream, or other resource | Ordinary scheme-owned receipt. |
+| The over-budget mandate row ({§context-over-budget-row}) | The same once-shown lifetime: the packet it describes, then retired from the projection, durable and readable at its coordinate. |
 
 This packet filter does not retire the receipt: the operation, result, authored
 `turnOps`, and each target's curation effects remain durable under
@@ -2694,6 +2786,23 @@ Operand syntax: {§transfer-resource-selections}. Result projection: {§copy-mov
 202 when the owning scheme requires proposal review. Same- and cross-scheme
 COPY use this one orchestrator.
 
+§copy-destination-mimetype **A transfer carries a type into an untyped destination.**
+Resolve the destination channel's type in this order, then apply
+{§mimetype-verbatim-transfer}; a refusal leaves both operands unchanged.
+
+| Destination evidence | Type |
+| --- | --- |
+| Existing channel | Its stored source type, not a derived readable projection. |
+| Absent channel with a recognized pathname extension | The extension's type under {§ext-mimetype}. |
+| Absent channel without a recognized extension, with a declared manifest type | The declared channel type, including explicit `text/plain`. |
+| Absent channel without either declaration | The source's declared type, with automatic `text/plain` normalization under {§markdown-primitive}. |
+
+The admitted type accompanies the content through proposal review and publication.
+This rule applies to whole and scoped transfers across entry-bearing schemes;
+the scheme's text-creation fallback does not override a transfer's supplied type.
+Filesystem reconciliation retains that type while the verified source revision is
+unchanged, including readable reprojection; a changed disk source is detected afresh.
+
 ### §move MOVE (engine-orchestrated)
 
 - §move-relocation-deletes-source MOVE first performs the destination mutation under {§copy}, then removes only
@@ -2721,7 +2830,10 @@ COPY use this one orchestrator.
 - A cross-resource destination failure leaves the source untouched. A source
   failure after destination success is an explicit partial failure with
   `destinationWritten: true` and the destination's identity. Proposal
-  acceptance/rejection follows the same ordered rule.
+  acceptance/rejection follows the same ordered rule. Each approval uses the
+  operand whose effect is pending: its target, metadata, authority and manifest.
+  Source removal retains this binding whether the destination wrote immediately
+  or required its own approval.
 - §move-cross-scheme-move Same- and cross-scheme resources use the same
   contract; there is no global cross-scheme transaction.
 - §move-missing-source-404 A missing source is 404.
@@ -2737,7 +2849,7 @@ Log history preserved — `log_entries` stores path tuple as text, not FK to `en
 - §find-line-anchors **A FIND regex anchors each line**, as READ, EDIT and KILL do ({§read-pattern}, {§edit-pattern}): `^` and `$` are a line's ends in every FIND content match — over entries, log rows, turn sources and a binary channel's bytes — so ```` ```FIND (django/urls/resolvers.py) /^from|^import/ ```` locates the same import lines a READ with that pattern shows, never a false 204.
 - §find-candidate-containment **One candidate's crash is that candidate's problem** — arbitrary member content can crash a mimetype handler mid-match (an unbalanced template partial crashed Readability and killed a 1,916-file FIND as a blank 500, #449). `Matcher.matchCandidates` contains a per-candidate handler throw: the candidate drops out exactly like unsupported content, the cause goes to daemon stderr, and only a FIND whose every candidate crashed reports a 415 whose Problem names the first crashing member and handler. The operation's other candidates always answer.
 
-- §find-scope-prefix-filter Filters entries within scope. A **bare** path is the exact entry unless the file scheme resolves a directory under {§file-find-directory}; an explicit **shell glob**, classified once by {§path-glob}, expands to a scope. Path globs use segment semantics: `*` and `?` never cross `/`; `**` does — in every spelling: a `**` glued to a name (`**.go`, `src/**.ts`) is matched as `**/*.go` / `src/**/*.ts`, never demoted to a one-level `*` the way a native matcher reads it. Terminal `*` and `**` are structural catalog selectors and include dot-prefixed entries, so a complete map does not hide `.env.defaults` or `.github`; richer patterns retain native shell behavior. SQLite prefix queries may reduce the candidate set but never decide the match. A trailing slash is a recursive FIND scope only for a scheme whose manifest declares `folderScopes: true`; otherwise it is ordinary resource syntax. This is an explicit extension contract, never inferred from URL punctuation.
+- §find-scope-prefix-filter Filters entries within scope. A **bare** path is the exact entry unless the file scheme resolves a directory under {§file-find-directory}; an explicit **shell glob**, classified once by {§path-glob}, expands to a scope. Path globs use segment semantics: `*` and `?` never cross `/`; `**` does — in every spelling: a `**` glued to a name (`**.go`, `src/**.ts`) is matched as `**/*.go` / `src/**/*.ts`, never demoted to a one-level `*` the way a standard matcher reads it. Terminal `*` and `**` are structural catalog selectors and include dot-prefixed entries, so a complete map does not hide `.env.defaults` or `.github`; richer patterns use {§path-glob-matching}. SQLite prefix queries may reduce the candidate set but never decide the match. A trailing slash is a recursive FIND scope only for a scheme whose manifest declares `folderScopes: true`; otherwise it is ordinary resource syntax. This is an explicit extension contract, never inferred from URL punctuation.
 
   Resource-authority globs select authorities independently of the path scope.
   Matching resources retain their full addresses through pattern matching,
@@ -2824,6 +2936,23 @@ Log history preserved — `log_entries` stores path tuple as text, not FK to `en
   hidden complete row or location collection is retained behind the public
   projection.
 
+§path-glob-matching Core's `PathGlob` owns shell-path matching and targeted disk
+traversal through the public `minimatch` and `glob` packages. Resource selection,
+membership scans, inspection and the membership SQL predicate share this dialect.
+
+| Input | Meaning |
+| --- | --- |
+| `/` | Segment separator; `*` and `?` do not cross it. |
+| `\*`, `\?`, `\[`, `\\` | Literal wildcard, bracket or backslash, after target-slot decoding ({§path-parentheses}). A backslash is never a pattern's directory separator. |
+| Braces, character classes, extglobs, `**` | Standard matcher semantics; operation catalogs additionally apply {§find-scope-prefix-filter}. |
+| Leading `#` or `!` | Filename syntax, not matcher-level comment or negation. The members family owns its leading `!` exclusion marker. |
+| Dot-prefixed entries | Require an explicit dot except in the complete structural catalogs above. |
+| Filesystem base | Literal, outside the pattern; its metacharacters and backslashes never become selector syntax. |
+
+Matching retains the host's conventional case behavior (case-insensitive on
+Windows/macOS, case-sensitive otherwise). Membership traversal remains
+pattern-bounded and admits files only; it does not become an unrestricted walk.
+
 ### §send Messaging and turn disposition
 
 SEND AST: `{ op: "SEND", target: ParsedPath | null, body: SendBody | null, metadata, lineMarker }`.
@@ -2879,10 +3008,22 @@ When all messages are resolved but new results require another packet, the engin
 reports only: `All Open Messages resolved. Review new results; emit no OPs if finished.`
 The notice creates no state and does not demand another final reply.
 
-§worker-obligations A worker holds its unresolved children and open non-detached
-streams (`worker_obligations`); `loop_obligations` names them per loop. The
-packet's Delegation list, WAIT, completion and drain wake settlement use that
-same durable liveness.
+§worker-obligations A worker holds its unresolved children, its open non-detached
+streams, and the messages it sent to other workers that await completion while the
+recipient's loop is live (`worker_obligations`); `loop_obligations` names them per
+loop. The packet's Delegation list, WAIT, completion and drain wake settlement use
+that same durable liveness: a worker that messaged another worker parks on an
+authored WAIT until the completion arrives ({§message-completion}), and with no WAIT
+joins that work with the bounded park rather than concluding idle.
+
+§message-abandonment **An ended loop answers what it left open.** When a loop ends,
+every message another worker sent it that has no completion is completed `499` by the
+daemon: one `_plurnk` SEND to the message's address in a maintenance turn of the
+recipient, "Loop *N* ended with status *S*; this message was not answered.",
+delivered to the sender like any reply ({§message-reply-delivery}). A message the
+ending loop had not yet published is re-homed first ({§message-loop-containment}) and
+is not abandoned. The sender's hold ends with the recipient's loop either way; the
+completion is what wakes it and tells it.
 
 §wait-obligation-matrix **End-of-program resolution.** Execute all admitted operations and settle optimistic work before applying this table. WAIT is an optional yield, not an end-of-program delimiter.
 
@@ -3044,7 +3185,9 @@ of which Worker launched it ({§execution-output-identity}).
 | --- | --- |
 | Admission | Require SEND control and the original invocation's runtime/tool capabilities. Preserve its classified effect: host input proposes; pure/read input uses the same effect policy as launch. |
 | Acceptance | Recheck both capabilities, workspace, and the exact live subscription. Stale approval cannot reach a replacement invocation. |
-| Queued or starting without a receiver | `409 input-unavailable`, immediately; never wait for an execution slot while blocking another input-dependent execution. |
+| Launched without input | The invocation's preparation declared no receiver ({§executor-live-input}): `409 input-unavailable`, immediately, naming the launch form that opens input. |
+| Queued for a slot | `409 input-unavailable`, immediately and `retryable`; never wait for an execution slot while blocking another input-dependent execution. |
+| Admitted, receiver declared, not yet open | Delivery waits for the receiver to register, within the backpressure bound; the execution settling first returns `410 input-closed`. A receiver registered without the declaration is the executor's defect and fails its run. |
 | Unknown address | `404 stream-not-found`. A terminal execution or retired input returns `410 input-closed`. |
 | Delivery | Serialize accepted inputs per invocation. Preserve authored body and receiver-owned metadata. Receiver success means delivery only, not completion. |
 | Backpressure | `PLURNK_SERVICE_EXEC_INPUT_TIMEOUT_MS` bounds each accepted delivery, including its queue residence. Expiry returns `504 input-timeout`; cancellation returns `499 input-cancelled`. Once delivery has begun, retire and abort input on either; delivery may be partial and is never replayed. The execution itself is not implicitly killed. |
@@ -3363,7 +3506,7 @@ The runtime scheme participates in the durable lookup; a completed `sh:///`
 stream cannot fall through an internal `exec`-only query. {§stream-control}
 
 §workspace-env **Workspace environment.** The `env` family has workspace defaults and
-worker overrides. Its six verbs accept `scope: "workspace" | "worker"`; model calls
+worker overrides. Its management verbs accept `scope: "workspace" | "worker"`; model calls
 default to `worker`. Client actions bind the scope in `workspace.env.*` or
 `worker.env.*`. An explicit scope must agree with that action's context.
 
@@ -3381,35 +3524,26 @@ lower entry and its enabledness ({§configuration-definition-resolution}). Forki
 affect subsequent launches, not existing processes or other workspaces. A shared
 capability never acquires an invoking worker's overrides or ownership.
 
-§exec-env-scoped **Scoped environment.** An execution subprocess receives a composed
-environment, never the host's. Two mechanisms apply in order, and they are different kinds
-of thing. First the **ambient policy**, a ceiling: `PLURNK_SERVICE_EXEC_ENV_INHERIT` names
-what the host's environment may contribute at all and `_EXCLUDE` narrows that, both taking
-exact names or one trailing-`*` prefix glob, both ordinary operator knobs under
-{§operator-config-env-defaults}. A worker document or a heading modifier narrows the ceiling
-further; nothing downstream widens ambient admission. Explicit entries may supply their
-own non-reserved values. Workspace defaults precede the Worker's `env` state
-({§env-functionality}), read at the spawn: an enabled worker entry sets its own value, a disabled
-entry of either origin withholds the name, and what `list` projects is what the command
-receives. Then the **invariant**, which is not a knob:
-`PLURNK_*` config and every provider credential name are stripped last and unconditionally,
-so no policy, document or modifier can readmit plurnk's own secrets. The service composes;
-the executor spawns with the environment it is handed. Each spawn records the environment it
-received on the output it produces — every name with its provenance: the host through the
-ceiling, this Worker, an ancestor by name, or masked — and the digest renders it beside the
-operation, which closes the host-versus-container confound where it starts.
-
-The ceiling exists because the invariant protects the wrong secrets. It knows plurnk's
-credentials and nothing about the operator's, so a denylist alone hands `SSH_AUTH_SOCK` and
-`NPM_TOKEN` to every command a model writes. Membership is an allowlist: the shipped
-`INHERIT` is what a shell, git, node and python need to run, and an operator who wants a
-tool's credential reachable by model-written commands adds it by name. An empty policy admits
-nothing ambient — the allowlist is declared in `.env.defaults`, so an empty one is a cleared
-policy rather than an unconfigured install.
-
-The full composition for one spawn, nearest setter winning for defaults and ceilings immune,
-is package floors → operator cascade → ambient policy → workspace entries → worker entries → the op's modifier →
-body prefixes.
+§exec-env-scoped **Command environment admission.** Core composes an ordinary executor's
+environment; the executor spawns with the environment it is handed ({§workspace-env}).
+
+| Input | Admission |
+|---|---|
+| Ambient host values | `PLURNK_SERVICE_EXEC_ENV_INHERIT` admits exact names or one trailing-`*` prefix glob; `_EXCLUDE` removes names with the same syntax. An empty inherit list admits nothing. |
+| Reserved names | `PLURNK_*` and provider credential names from the model catalog or `PLURNK_PROVIDERS_PROVIDER_<ID>_API_KEY_ENV` are excluded from the ambient base regardless of those selectors. |
+| Workspace and worker entries | Explicit non-reserved values and masks compose at spawn under {§env-functionality}. Reserved names are refused at admission. |
+| Invocation `env` | Explicit non-reserved values override the composed environment under {§env-option}; the same reserved-name refusal applies. |
+
+Explicit values do not widen ambient inheritance. The allowlist is declared under
+{§operator-config-env-defaults}; it limits other host credentials too, not only provider keys.
+Each spawn records admitted values and their provenance (host, workspace, worker, inherited
+worker, modifier, or masked); the digest renders that record beside the operation.
+
+This is environment admission, not process containment or a prohibition on an approved
+program setting its own variables. Module-owned launches use the owning module's contract:
+the host supplies a filtered ambient base through {§module-seam-slices}, while explicit
+MCP bindings resolve under {§mcp-launch-environment}. The env family's reservation does not
+filter those explicit bindings or create a second approval path.
 
 - §env-option **The op's environment.** `env` is the service's key in the heading's `[metadata]`
   ({§scheme-metadata-modifier}): `[{"env": {"NAME": "value"}}]`, an object of string values.
@@ -3419,7 +3553,8 @@ body prefixes.
   retain explicit launch overrides when adding a process-backed definition; it never
   persists the composed ambient environment. On
   WORK and FORK it is the child's starting environment: after the copy the child inherits
-  ({§functionality-scope}), each name lands as the child's own entry through the family's `add`,
+  ({§functionality-scope}), each supplied name replaces its copied definition as an enabled child-owned entry
+  through the family's `replace` and `enable`,
   so a parent hands down its registry and overrides specific names for one child in one heading.
   Names follow the family's admission — a name a shell can export, never plurnk's own — and a
   refusal names the key and the reason at the operation, before anything runs or is created; a
@@ -3451,7 +3586,21 @@ body prefixes.
 - **Loop disposition** ({§proposal-disposition}) — core applies the exact automatic accept/reject before observational subscribers run; automatic policy is not an event listener or client fallback.
 - §proposal-timeout-cancels **Timeout is OPT-IN; an empty deadline WAITS** - an empty `PLURNK_SERVICE_PROPOSAL_TIMEOUT_MS` means a pending proposal - a file edit awaiting review - waits indefinitely for its human: absence is not an answer, so the service does not synthesize a cancellation. A finite positive millisecond value establishes the bound; then elapsing synthesizes `cancel` (outcome `timeout`), server-side, needing no client. Every other explicit value fails at the proposal lifecycle owner and terminalizes an already-written proposal rather than silently choosing an indefinite wait. Indefinite is with respect to the clock alone: the wait ends with its loop. A loop whose signal aborts — its own timeout, `loop.cancel`, worker `KILL` — settles every proposal it is holding through {§proposal-cancel-aborts}, carrying the abort's reason as the outcome, because a cancelled loop is not a loop awaiting a decision.
 
-**The decision drives a one-way state transition** on `log_entries.state` (resolution is idempotent — `WHERE state='proposed'`, so a second resolution 404s):
+§proposal-decision-evidence Each proposal has at most one immutable decision record,
+committed before application. It contains the original accept/reject/cancel,
+resolver identity, decision time, and any submitted body override and outcome.
+Client decisions name the authenticated worker owner; automatic policy, timeout,
+abort, and shutdown decisions name `_plurnk`. This records the resolving authority,
+not an assertion that a human reviewed the operation. A failed decision write
+prevents application and surfaces its cause. The applied result is separate:
+acceptance followed by failure remains acceptance. Restart preserves recorded
+decisions, marks interrupted application uncertain, and never replays it
+({§worker-lifecycle-restart-recovery}). Decision evidence follows its operation's
+history lifetime, survives log curation, and appears in forensic output, not in
+the model packet. Historical rows receive no invented decisions.
+
+**The decision drives a one-way state transition** on `log_entries.state`.
+A second resolution is refused with `409 proposal-not-pending`:
 
 | decision                        | state | `status_rx` | default outcome | effect |
 |---------------------------------|---|---|---|---|
@@ -3624,6 +3773,26 @@ The model is NOT a stream/event consumer — turn-based only; sees whatever's in
 
 SQLite (`node:sqlite`) with WAL mode and STRICT tables. Hand-written DDL; CI-aligned against grammar schemas.
 
+### §db-durability Connection durability
+
+The service launcher applies `PLURNK_SERVICE_SQLITE_SYNCHRONOUS` through SqlRite's
+connection options before migrations or `INIT` write anything. The same policy
+reaches the writer and read pool on every open, including `migrate` and reopening
+an existing database. Its default lives in `.env.defaults`; an invalid value is
+diagnosed by `config check` and refuses database admission, never silently choosing
+a weaker mode. Configuration inspection and editing remain available.
+
+| Mode | WAL guarantee |
+| --- | --- |
+| `FULL` | Each committed transaction is synchronized to storage, surviving application/OS crashes and power loss when the filesystem and device honor synchronization. |
+| `EXTRA` | Same guarantee as `FULL` in WAL mode. |
+| `NORMAL` | Consistent after a crash, but recent commits may be lost after an OS crash or power loss. |
+| `OFF` | Unsynchronized writes; a crash may corrupt the database. |
+
+These are [SQLite's guarantees](https://www.sqlite.org/pragma.html#pragma_synchronous),
+not filesystem-write atomicity, external-effect rollback, a backup, or protection
+against storage hardware that fails to honor synchronization.
+
 ### DDL strategy
 
 No generator. SQLite-optimal: STRICT (3.37+), `INTEGER PRIMARY KEY` aliasing, explicit `NOT NULL`, indexed query paths, deliberate FK `ON DELETE`/`ON UPDATE`, `WITHOUT ROWID` where access pattern warrants, generated columns, FTS5.
@@ -3640,7 +3809,19 @@ No generator. SQLite-optimal: STRICT (3.37+), `INTEGER PRIMARY KEY` aliasing, ex
 | §db-maintenance-optimize Statistics at shutdown | The daemon's last database step before the caller closes SQLite is `PRAGMA optimize` on the writer (`maintenance_optimize`), so `sqlite_stat1` reflects tables the connection planned against, bounded by SQLite's own analysis limit; a failure there is a reported shutdown error, never silent. Retention runs before it under the operator's policy ({§retention-policy}) and ends with a WAL truncation ({§db-space-reclamation}); no periodic `ANALYZE` runs. |
 | §db-space-reclamation The daemon keeps its own file healthy | `PLURNK_SERVICE_AUTO_VACUUM` (`incremental` or `none`) names the mode the daemon keeps its file in. At start, before any drain, a database in another mode is converted (set the mode, one `VACUUM`, which rewrites the file and needs free disk about its size) and the journal says so with page counts before and after. Under `incremental`, every retention pass ends by stepping `PRAGMA incremental_vacuum` to completion once free pages reach `PLURNK_SERVICE_RECLAIM_MIN_FREE_BYTES` (0 = every pass), and reports `reclaimedPages`; below the floor, free pages stay for SQLite to reuse. Under `none` the file never shrinks and freed pages are reused. No operator step is involved beyond the knobs. The WAL stays bounded by SQLite's automatic checkpoint (#764). |
 | §content-store Every body is stored once | `contents` holds each settled body once, addressed by its SHA-256, however many channels, workspaces, forks or derivations carry it; rows are immutable. `entry_channel_rows` points a settled channel at its body and keeps an active stream's body as a private buffer until it settles, when it is interned. Every reader and writer uses the `entry_channels` view, whose `INSTEAD OF` triggers intern bodies, refuse a bound `content_hash` that is not the content's, and write each column group only when it changed, so a search attachment is never a representation write. SQLite counts no changes for a view, so a write that must know whether its channel exists returns the channel's name; an outer join cannot flatten the view, so the two statements that need one read `entry_channel_rows` and `contents` directly. `derivation_fts` is an external-content index over `derivation_texts` (a derivation joined to its body); `derivations.content_id` names the indexed text, and the triggers in `_entry-fts.sql` move the index with it and forget it on delete. A body no channel holds and no derivation indexes is collected by retention under `PLURNK_SERVICE_COLLECT_CONTENTS`. Witnesses: `test/intg/retention.test.ts`, `test/intg/entries.test.ts`, `test/intg/fulltext-index.test.ts`. |
-| §retention-policy Retention is the operator's policy; information is kept by default | `Retention` (`src/server/Retention.ts`, statements in `Retention.sql`) reads ten knobs from `.env.defaults` once at daemon start (the two storage knobs are {§db-space-reclamation}) and runs four set statements in dependency order — on `PLURNK_SERVICE_RETENTION_INTERVAL_MS` cadence while the daemon runs (0 = shutdown only) and once more at shutdown before `PRAGMA optimize`. `PLURNK_SERVICE_RETAIN_PACKET_TURNS` (-1 = every packet) and `PLURNK_SERVICE_RETAIN_PACKET_MS` (-1 = no age limit) retire a completed turn's packet composition (`turn_sections`, {§packet-items}) once it is beyond the newest N packet-bearing turns of its loop or older than the age; the turn, its bag, its log rows and its accounting stay, and an open turn is never retired. `PLURNK_SERVICE_COLLECT_PACKET_ITEMS` collects items no composition references. `PLURNK_SERVICE_COLLECT_CONTENTS` collects stored bodies nothing holds ({§content-store}), after the collectors that release them. `PLURNK_SERVICE_COLLECT_DERIVATIONS` collects derivations no channel, turn source, or log row cites — superseded editions — with their symbols (cascade) and their full-text shadow (`derivations_delete_fts`, a process trigger beside the FTS statements, on every delete path). `PLURNK_SERVICE_RETAIN_RESPONSE_TURNS` and `PLURNK_SERVICE_RETAIN_RESPONSE_MS` retire a settled call's response body (`model_call_responses`) once it is beyond the newest N body-bearing calls of its loop or its turn is older than the age; the call's identity, failure, capacity, admission and accounting stay, and the digest renders such a call request-only. The durable record is kept; packets and response bodies — transient evidence — age out, so a daemon left running for months stops growing (#788). An invalid policy withholds retention, including storage conversion and shutdown collection, and reports its configuration diagnostic without blocking the client ({§configuration-repair-path}). Storage I/O failures remain ordinary startup or shutdown failures. Witness: `test/intg/retention.test.ts`. |
+| §retention-policy Retention separates evidence classes | `Retention` reads the owning `.env.defaults` policy at daemon start and runs on its configured cadence and at shutdown. Packet count/age controls retire completed turns' `turn_sections`. Response controls atomically retire a logical call's normalized response and every physical-request payload, including failed retries; its immutable retirement timestamp remains. Count means the newest payload-bearing logical calls per loop, not individual retries, and retired calls retain their chronological place. Either bound can expire an item; `-1` disables only that bound. Open turns, calls and requests are excluded. Messages, log rows, turn sources, approval decisions, request identities, status, admission, failure, capacity and accounting follow their containing history's lifetime. Collectors remove unreferenced packet items, derivations, text and native contents ({§native-content-lifetime}); derivation deletion removes its search projections. These controls are not a whole-database size bound or content-erasure policy: canonical history can retain text also captured in a retired payload. Invalid policy withholds retention and storage conversion, reports a configuration diagnostic and leaves the repair environment available ({§configuration-repair-path}); storage I/O failures remain failures. Reclamation follows {§db-space-reclamation}. |
+
+§native-content-lifetime Native snapshots remain while any retained READ result,
+message attachment (inbound or outbound), or stored packet references their hash.
+Log curation, reply completion, source replacement and source deletion do not
+release those historical references. `COLLECT_CONTENTS` removes only unreferenced
+native bytes, alongside unreferenced text. Resource operations and message
+admission share the in-flight content-use boundary with derivation work
+({§derivation-in-flight}): collection skips a busy boundary, new producers wait
+for an active collection, and success or failure releases the use. Operations
+remain concurrent; this boundary grants neither file ownership nor reservation.
+Interrupted, unpublished snapshots become collectible after restart. Containing
+history deletion releases its references normally.
 
 - DDL = storage truth; JSON Schemas = wire truth. They are allowed to differ where ergonomics demand.
 - §entry-identity-no-null **Identity components are never NULL.** `(workspace_id, scheme, authority, pathname)` is a unique key. `workspace_id` references the workspace directly with cascading deletion. Namespace schemes use empty authority; resource schemes retain their canonical authority. File members use nonempty `scheme="file"` and render as bare paths. Registration refuses `storedScheme: null`.
@@ -3952,19 +4133,20 @@ Each knob's value lives on its panel and nowhere else (`plurnk-service config de
 | Var | Purpose |
 |---|---|
 | `PLURNK_SERVICE_DB_PATH` | SQLite file path; an explicit non-empty value overrides the derived default. |
+| `PLURNK_SERVICE_SQLITE_SYNCHRONOUS` | Connection-time WAL durability: `OFF`, `NORMAL`, `FULL` or `EXTRA` ({§db-durability}). |
 | `PLURNK_SERVICE_SHARE_FOLDER` | Parent of the shares written when no folder is named ({§share-folder}); empty is `$XDG_STATE_HOME/plurnk/shares`. |
 | §operator-config-shared-keys `PLURNK_HOST`, `PLURNK_PORT` | The daemon-owned listener's bind address and TCP port; modules mount their paths on that one listener ({§http-host}). **A key the daemon and its clients both read has a shared owner**: `@plurnk/plurnk-contracts` declares these two and the optional `PLURNK_AGUI_URL` on its own panel, the one package every side depends on. The daemon folds it like any installed member's, a client folds it beneath its own, and so neither holds the other's default. The service's `--host` and `--port` flags are generated from that panel. |
 | §operator-config-git-ceiling `PLURNK_SERVICE_GIT_ALLOWED` | Hard service ceiling: only `1` admits Git membership and status; every other value denies them. |
 | §operator-config-file-create-scope `PLURNK_SERVICE_FILE_CREATE_SCOPE` | Hard file-creation ceiling: `none < root < namespace`. `none` denies new filesystem files, `root` admits only paths inside `project_root`, and `namespace` also admits canonical outside-root paths. Existing-member writes are unaffected. |
 | `PLURNK_SERVICE_FILE_MATERIALIZE_MAX_BYTES` | Byte ceiling in `1..104857600` for one workspace-file snapshot ({§membership-materialization-limit}). |
 | `PLURNK_SERVICE_MAX_TURNS` | Operator model-call **ceiling** — `-1` = no cap; a positive value clamps `runLoop({maxTurns})`. The durable worker-tree budget includes descendant calls, BARE, and park/resume under {§turn-cap-counts-the-tree}; non-model chronology consumes none. |
-| `PLURNK_SERVICE_MAX_COMMANDS` | Per-emission action ceiling; `-1` = no cap — every compiled op dispatches. Each resolved target statement counts once, whether authored separately or in a group ({§target-group}). Overflow ops drop with one durable `max-commands-exceeded` error row on the next packet. Lifecycle operations remain exempt ({§operator-config-workspace-max-commands-floor}). Tightened per workspace via `settings.maxCommands` (min wins). |
+| `PLURNK_SERVICE_MAX_COMMANDS` | Per-emission action ceiling; `-1` = no cap — every resolved op dispatches. Each concrete operation counts once, whether authored separately, in a group ({§target-group}), or selected by a glob ({§bulk-resource-targeting}). Overflow ops drop with one durable `max-commands-exceeded` error row on the next packet. Lifecycle operations remain exempt ({§operator-config-workspace-max-commands-floor}). Tightened per workspace via `settings.maxCommands` (min wins). |
 | §operator-config-loop-timeout `PLURNK_SERVICE_LOOP_TIMEOUT` | Positive ms of cumulative active execution per loop ({§loop-execution-allowance}); excludes parked/queued time. Snapshotted on first execution, retained across wakes. Exhaustion aborts in-flight work and terminates `504 loop_timeout`, including a stuck provider call. |
 | `PLURNK_SERVICE_PROVIDER_RECOVERY` | ms of recovery after the first recoverable provider failure; `0` disables reissue. Expiry parks workers with a reviewer, otherwise concludes their loop, or returns BARE's failure under {§provider-recovery}. |
 | `PLURNK_SERVICE_PROVIDER_RECOVERY_BACKOFF` | First recovery delay (ms); doubles per failure up to `PLURNK_SERVICE_PROVIDER_RECOVERY_BACKOFF_MAX` ({§provider-recovery}). |
 | `PLURNK_SERVICE_MAX_STRIKES` | Consecutive turn-contract strike threshold ({§engine-rails}). |
 | `PLURNK_SERVICE_EMISSION_ATTEMPTS` | Completed provider responses allowed beneath one engine turn before frame admission is exhausted. Bounded interior operation errors are admitted without spending this budget. Exhaustion contributes one frame-contract strike under {§invalid-emission-attempts}. |
-| `PLURNK_SERVICE_BUDGET_PRESSURE` | Budget percentage above which the gauge names its largest rows ({§context-gauge}) and a packet within its budget carries the `budget_pressure` notice ({§context-pressure-notice}); measured before adding either. |
+| `PLURNK_SERVICE_BUDGET_PRESSURE` | Budget percentage above which the gauge names its largest rows ({§context-gauge}); measured before adding the inventory. |
 | `PLURNK_SERVICE_BUDGET_LARGEST_ITEMS` | How many of the heaviest retained log rows the pressured gauge names ({§context-gauge}). |
 | `PLURNK_SERVICE_LINE_ANCHOR_CONTEXT_LINES` | Minimum neighboring lines hashed on each side; repeated handles expand their context ({§line-anchor-disambiguation}). |
 | `PLURNK_SERVICE_EDIT_RECEIPT_CONTEXT_LINES` | Surrounding and landed lines shown at each EDIT result boundary ({§edit-result-receipt-projection}). |
@@ -4332,7 +4514,7 @@ registry. Deleting the workspace cascades its state; worker lifecycle does not.
 
 §functionality-coordinator **One coordinator owns the common lifecycle.**
 Functionality families are adapters beneath
-`list | discover | add | enable | disable | remove`. State and mutations
+`list | discover | add | replace | enable | disable | remove`. State and mutations
 serialize per workspace and family. Scope-bound client actions
 `workspace.<family>.<verb>` / `worker.<family>.<verb>` and model manager executors invoke the same
 coordinator. Families do not invent another management grammar, proposal
@@ -4345,10 +4527,52 @@ Retryability describes the actual failed condition, not its numeric status.
 | `list` | Project definitions, ownership (`origin`), winning configuration source (`provenance`), enabledness, and published preparation outcome: disabled, dormant, active, unavailable with its Problem, or authorization-required. No credential values. |
 | `discover` | Return inert candidates for the inputs the family serves ({§functionality-discover-advertisement}). Never install, persist, enable, or execute them. |
 | `add` | Admit and persist a local definition, prepare it, and enable it atomically. It may override an inherited definition. Reapplying the same local definition enables it idempotently (200); a different local definition for that alias fails 409 without replacing it. |
+| `replace` | Assign a complete definition to an explicit alias through {§functionality-replacement}. Preserve existing enabledness; a new alias is enabled. |
 | `enable` | Publish an available definition; retry preparation if unavailable. |
 | `disable` | Withdraw live capability; retain its definition and saved results. |
 | `remove` | Forget the locally owned definition and its enabledness override. Restore any inherited definition with its inherited enabledness. Inherited definitions cannot be removed at this scope. Saved results remain. |
 
+§functionality-replacement **Replacement is a named whole-definition assignment.**
+The shared coordinator admits it through the family's existing schema and adapter,
+then uses the same serialized preparation and publication path as other mutations.
+It neither removes the old definition first nor merges omitted fields.
+
+| Boundary | Outcome |
+|---|---|
+| Existing local or inherited alias | Persist the complete admitted definition in the selected scope, retaining the alias's effective enabledness. A local override replaces inherited interpretation context and provenance. |
+| Absent alias | Create the named local definition, enabled. The alias is required; replacement never derives one. |
+| Disabled candidate | Persist without preparing that alias. Editing a definition does not enable it. |
+| Admission, preparation, or publication refuses | Keep the preceding definition, enabledness, attachment and documents. Return the exact failure to either client or model caller. External effects of preparation retain the limits of {§functionality-publication}. |
+| Authorization required | Publish the existing authorization-required handoff; this is not a failed preparation. |
+| Identical definition | Retain enabledness and normal attachment reuse; this is not an explicit enable/restart. |
+
+§functionality-addressing **A family may name definitions by their content.** An adapter that
+declares `addressing` supplies the input of `add` and the input of `enable`, `disable` and `remove`,
+and reads from a select input the alias it names; its alias grammar ({§functionality-adapter}) is
+the identity's own, and the generated teaching's `add` example is that input. Every other rule of
+the coordinator — ownership, enabledness, `alias-exists`, `alias-unknown`, publication, documents —
+reads the alias as that identity. The members family names its definitions by their glob
+({§members-functionality}).
+
+| Verb | Addressing family |
+|---|---|
+| `add` | Admits every definition the body names, or none: one refusal refuses the whole body. Reapplying a definition the scope holds is idempotent; a different definition under the same name is `alias-exists` (409), whose recovery is remove and add. The receipt lists the admitted definitions in body order (`definitions`) and names no one `alias`. Preparation receives them all as its admissions. |
+| `replace` | Not served: when the name is the definition there is nothing to reassign, so neither projection offers it ({§functionality-discover-advertisement}). |
+| `enable`, `disable`, `remove` | Take the family's select input; the receipt names the one alias it concerned. |
+
+§functionality-mutation-status **Mutation status describes the committed resource
+outcome, not the management invocation's stream lifetime.** Apply these rows in
+order; refusals retain their own Problems and do not commit a replacement.
+
+| Outcome | Status |
+|---|---:|
+| The resulting definition requires authorization | 202 |
+| `add` or `replace` creates a local definition, including an override of an inherited definition; an `add` naming several ({§functionality-addressing}) creates any of them | 201 |
+| `add` reapplies the identical local definition, every one it names; `replace` assigns an existing local definition; `enable`, `disable`, or `remove` settles | 200 |
+
+`add` of a different local definition remains `alias-exists` (409); `replace` is explicit where a family serves it.
+Model invocation settlement follows {§functionality-model-mutation} independently.
+
 §functionality-discover-advertisement **A family's `discover` advertises exactly the inputs it
 serves.** The coordinator builds the family's discover input schema from its declared discovery
 ({§functionality-discovery-inputs}): the declared inputs with their shared
@@ -4542,8 +4766,11 @@ set any name it lists or none of them — it answers which names have a **consum
 a Worker learns the name of a value only the operator can supply. The catalog projects
 declarations, never the host environment, so a credential the operator has filled in appears by
 name with its documentation and an empty value ({§exec-env-scoped}: referred to by name, never
-read). `source` selects one declaring package, and a request naming neither input is the whole
-catalog. A client's own environment is no input: contributing candidates, it would be a second
+read). `source` selects one declaring package; an unknown source is `source-unknown`
+(400), not an empty catalog. A known source with no matching settable declarations
+returns an empty candidate list. A request naming neither input is the whole
+catalog. Files are read with READ; variables are set with `add` or `EDIT (env:///NAME)`.
+A client's own environment is no input: contributing candidates, it would be a second
 door past the ceiling.
 
 The family publishes no process runtimes. Its values are read at the spawn that uses them,
@@ -4557,7 +4784,7 @@ reserved or masked name is no resource. The family's manager exposes it as the f
 the value its commands receive now, FIND lists the names in effect and a pattern on it matches
 values, COPY carries a value out. The manager's own output streams, eight hexadecimal characters
 ({§execution-output-identity}), stay the executor's. A write is the Worker's own layer, never the
-workspace's or the operator's: EDIT sets the whole value through the family's `add` for the
+workspace's or the operator's: EDIT sets the whole value through the family's `replace` for the
 Worker, and KILL retires the name from the Worker's commands — `remove` for an entry the Worker
 owns, which restores an inherited value, `disable` for an inherited one, which keeps its
 definition. Admission is the family's ({§env-functionality}) and its refusal is the operation's
@@ -4594,7 +4821,7 @@ reach the other, and depth is transitive with no further rule. Each copied entry
 `inherited`, the Worker that set it, preserved across generations until the child changes that
 entry, so `list` never claims the child set what it inherited; a parent's masking of an
 ambient name travels the same way. WORK and FORK may hand the child more: the heading's `env`
-option lands as the child's own entries through `add`, after the copy ({§env-option}).
+option replaces and enables the child's own entries after the copy ({§env-option}).
 
 §functionality-state **One durable value per workspace and family.**
 `{ version: 1, definitions: { [alias]: { origin, enabled, definition? } } }`
@@ -4664,7 +4891,7 @@ It then reports `active`, `unavailable`, or `authorization-required`, or the exa
 publication failure. Resource readiness is not execution liveness: a mutation's
 `202 authorization-required` body remains exact, while the finished manager
 execution closes with `200`. It does not wait for sign-in. A preparation failure may publish enabled-but-unavailable
-state; a publication failure never reports a successful mutation. Stream polling,
+state for other mutations, but `replace` rejects it ({§functionality-replacement}); a publication failure never reports a successful mutation. Stream polling,
 waiting, and result observation use the ordinary execution lifecycle, without a
 separate deferred-commit queue. An explicit client action publishes now, rejects
 a failed preparation, and fails 409 while the workspace is held
@@ -4703,6 +4930,7 @@ Core's behavior behind them.
 | Runtime actor | `ensureRuntimeWorker(workspaceId)` | Returns the workspace's `_plurnk` actor, creating it if absent; it always retains runtime ownership. |
 | Workspace lifecycle                               | `forkWorker({ workspaceId, workerId, name? })` | Creates a child worker that branches the source worker's history while sharing workspace state. |
 | §methods-workspace-rename Workspace metadata      | `renameWorkspace(workspaceId, name)` | Changes only the world's unique mutable name; workers, log, and membership remain intact. |
+| §methods-workspace-rollback Workspace files      | `rollback({ workspaceId, workerId, clientWorkerId, to })` | Reverses `workerId`'s settled file mutations after its coordinate `to` as the client's own operations in `clientWorkerId` ({§rollback}); answers a `RollbackReport`. |
 | §methods-workspace-prompts Workspace metadata     | `listPrompts(workspaceId, limit?, workerId?)` | Returns nonempty loop-seed prompts a client addressed to the workspace's model workers, newest-first; `workerId` narrows to one worker. Authorship is the seed message's address ({§message-arrival}): a worker-issued seed (WORK, FORK, SEND to a worker) has none and is never history, whichever worker it seeded; a client prompt at a forked conversation worker is. An omitted limit is `PLURNK_SERVICE_PROMPTS_PAGE`. |
 | Workspace metadata                                | `listWorkspaces()`, `workspaceDerivationStatus(...)` | Reads current workspace identity and derivation progress. |
 | §methods-worker-read Worker topology              | `readWorker({ workspaceId, identity })` | Ownership-bounds an exact id-or-name lookup and returns one durable Worker projection or `null` under {§application-worker-observation}. Supplying both identities or neither is invalid. |
@@ -4972,7 +5200,7 @@ adding a loop to it. LOOK text anchors resolve through the same
 
 | Event                                                        | Payload | When fired |
 |--------------------------------------------------------------|---------|------------|
-| §notifications-operation-event `operation/event` | `ApplicationOperationEvent`: `{ workerId, loopId, turnId, sequence, origin, projectRoot, statement, phase, result? }` | One admitted dispatch starts before capability/proposal admission and settles after its durable receipt(s). Only the settled phase has `result`, the exact returned operation result. READ fan-out is one dispatch; BARE starts before prompt preparation and settles after ordered receipt persistence. Automatic stream observations and log writes are not dispatches. An asynchronous executor's successful dispatch does not assert process exit. An internal exception that prevents settlement has no invented result event. |
+| §notifications-operation-event `operation/event` | `ApplicationOperationEvent`: `{ workerId, loopId, turnId, sequence, origin, projectRoot, statement, phase, result? }` | One admitted dispatch starts before capability/proposal admission and settles after its durable receipt(s). Only the settled phase has `result`, the exact returned operation result. Resource fan-out is one dispatch ({§bulk-resource-targeting}); BARE starts before prompt preparation and settles after ordered receipt persistence. Automatic stream observations and log writes are not dispatches. An asynchronous executor's successful dispatch does not assert process exit. An internal exception that prevents settlement has no invented result event. |
 | §notifications-log-entry-notify `log/entry`                  | `{ entry: LogEntry }` | A non-proposed `log_entries` row is committed, or a proposed row reaches terminal settlement under {§proposal-proposed-hidden}. Delivery completes before a later event may terminate the owning Loop. |
 | §notifications-loop-terminated `loop/terminated`             | `{ workerId, loopId, result, hitMaxTurns, turnIds, usage: { accounting, curationWeight, curationBudget, contextTokens, contextCapacity, meta }, attributions }` | One loop reaches a terminal state. `result` is the exact universal operation result, including its RFC 9457 Problem Details on failure. `accounting` is the loop's contracts-owned {§provider-accounting}; the two curation facts and two physical-context facts follow {§tokenomics-client-gauge}; `meta` is that turn's opaque provider bag. `attributions` is the sorted union of exact provider-request evidence ({§attribution}), separate from accounting. Worker and loop are an inseparable owning coordinate. |
 | §notifications-loop-packet `loop/packet`                     | `{ workerId, loopId, packetCount }` | One provider packet becomes durable. `packetCount` is the exact count of packet-bearing turns in that Loop; packetless producer turns and physical provider retries never contribute. |
@@ -5162,11 +5390,10 @@ flowchart TD
 ```
 
 - §context-budget **One room.** The budget is the provider's input capacity through the loop's calibration, `floor(inputCapacity / factor)` ({§tokenomics-calibrated-readout}), and it bounds the whole packet — teaching, catalog, log and gauge together. Nothing on the service panel sizes a part of it: no projection share or preview page. When the loop's first response fixes its factor, the budget follows it either way; a room that shrinks under the model is announced by the over-budget row ({§context-over-budget-row}), never hidden by keeping a larger figure.
-- §context-gauge **One gauge.** Every packet carries one `## Context` section holding one JSON object: `tokens`, the packet's weight as rendered, and `budget`, the known room. Only when the packet without an inventory strictly exceeds `PLURNK_SERVICE_BUDGET_PRESSURE` of its budget does `largest` name the `PLURNK_SERVICE_BUDGET_LARGEST_ITEMS` heaviest retained log rows as `{path, tokens}`, ranked by weight then path. Unknown budget omits both `budget` and `largest`. The final `tokens` includes the inventory; over budget, its full configured count remains available for curation ({§context-over-budget-row}). Each log row heading carries its own `tokens`. The gauge is state: it never presents `budget − tokens` as response allowance and carries no mandate.
-- §context-pressure-notice **Pressure is one notice.** When the gauge names its inventory ({§context-gauge}) and the packet, with the notice in it, stays within its budget, the packet's notices section carries one `engine:context` notice `budget_pressure`, `level: warn`, whose directive is "YOU MUST NOT exceed budget." and whose message is "Context is at *N*% of budget." *N* is `floor(100 × tokens / budget)` over the gauge's final figures, so the share never disagrees with the gauge, and the notice carries no count of its own. It is decided and rendered with the packet it describes, recurs on every such packet, and is never buffered or sent to clients, which read their own pair ({§tokenomics-client-gauge}). An over-budget packet carries the row instead ({§context-over-budget-row}).
+- §context-gauge **One gauge.** Every packet carries one `## Context` section holding one JSON object: `tokens`, the packet's weight as rendered, `budget`, the known room, and `percent`, `floor(100 × tokens / budget)` over the gauge's own final figures, so the share never disagrees with the counts beside it; a zero budget states no share. Only when the packet without an inventory strictly exceeds `PLURNK_SERVICE_BUDGET_PRESSURE` of its budget does `largest` name the `PLURNK_SERVICE_BUDGET_LARGEST_ITEMS` heaviest retained log rows as `{path, tokens}`, ranked by weight then path. Unknown budget omits `budget`, `percent` and `largest`. The final `tokens` includes the inventory; over budget, its full configured count remains available for curation ({§context-over-budget-row}). Each log row heading carries its own `tokens`. The gauge is state: it never presents `budget − tokens` as response allowance and carries no mandate.
 - §context-fit **One rule: whole if it fits, otherwise as much as fits, then its size and address.** A result the model asked for — a READ without a scope, a FIND, an exec result delivered on close — arrives complete when its weight fits within `budget − tokens` as of that turn, less the room the turn still owes — one receipt's measured weight for each result still to land in it and the emission record that answers it, so that the receipts of a batch and the answer always fit. Otherwise the complete result stays where it was read from and the row is a `413` receipt naming the result's size, its weight, the remaining budget, and the two verbs: `READ` a range, or `KILL` first. A READ of lines carries, above its receipt, the longest prefix of those lines whose row fits that room — the lines with their anchors, the returned range closed on the last line delivered, and the receipt naming the lines delivered; a result whose first line does not fit, a FIND, a stream page and a byte view are bodiless receipts. An arrival the model did not ask for — an inbound `SEND`, a child's conclusion — takes the same bodiless receipt as a fact, not an error: its size and its address. Explicit scopes (`<a,b>`, a pattern, `<1,-1>`) are exact and take the same test. Result cuts are named where they happen: the first page of what came back unasked in size ({§markerless-first-page}) and the cut at the room in the receipt. The optional emission history is whole or absent ({§emission-history}), never a cut.
 - §context-verbs **The verbs are the curation.** `READ` with a range takes a piece of what did not fit ({§read-selection-projection}); `NOTE` keeps what the model learned; `KILL` retires rows, ranges and bodies ({§log-kill-scope}) and may carry what it keeps of them as its own NOTE ({§log-kill-distillation}). The daemon adds no other mechanism.
-- §context-over-budget-row **Over budget is a row and a request, not an ending.** A packet whose weight exceeds `budget` is still submitted when it fits the window ({§context-wall}), and it carries one `_plurnk` error row at the head of its turn, `engine/context/packet-exceeds-budget` 413: "Context exceeds budget. YOU MUST ONLY KILL, MOVE or NOTE this turn." The row is the mandate and carries no figure: the gauge is the one home for `tokens` and `budget` ({§context-gauge}), and it shows the packet over with the row in it. The row recurs on every packet that is over, and nothing is hidden to make the packet smaller; the response grant is the window's remainder above the provider's output floor ({§provider-output-floor}). The limit protects a loop; it never ends one.
+- §context-over-budget-row **Over budget is a row and a request, not an ending.** A packet whose weight exceeds `budget` is still submitted when it fits the window ({§context-wall}), and it carries one `_plurnk` error row at the head of its turn, `engine/context/packet-exceeds-budget` 413: "Context exceeds budget. YOU MUST ONLY KILL, MOVE or NOTE this turn." The row is the mandate and carries no figure: the gauge is the one home for `tokens` and `budget` ({§context-gauge}), and it shows the packet over with the row in it. The row is shown once, in the packet it describes, then retired from the projection as a no-match KILL receipt is ({§log-kill-meta-operation}): it stays durable and readable at its coordinate, and a later packet that is over carries its own row. Nothing is hidden to make the packet smaller; the response grant is the window's remainder above the provider's output floor ({§provider-output-floor}). The limit protects a loop; it never ends one.
 - §context-wall **Only the window ends a loop.** The wall is the provider's physical input limit: `maxInputTokens`, and the context window less the output floor ({§provider-output-floor}). A request over the wall sheds ({§context-own-rows-fit}) and is measured again ({§context-wall-measure}); a packet that cannot fit even as receipts ends its loop with the exact `engine/context/window-overflow` 413 Problem, and no inference request is made. An unknown window has no wall ({§tokenomics-window-unpollable-deliberate}).
 - §context-wall-measure **The wall measures the request that will be sent.** The estimate is the packet's weight through its calibration factor ({§tokenomics-calibrated-readout}) and is never assumed to overestimate. A packet that fits by the estimate is assessed by the provider as the exact wire request ({§provider-capacity-admission}): an admission sends it; an exact refusal is the wall's verdict, and the request sheds by the refusal's excess and is assessed again. A provider that can only estimate defers, and the upstream provider is then the capacity oracle: its refusal ends the loop with the provider's own 413.
 - §context-own-rows-fit **The model's own rows take the same receipt.** When a request is over the wall by either measure ({§context-wall-measure}), its newest rows that still carry a body or a native part — NOTEs, receipts, delivered results, pictures — render bodiless in the fit rule's receipt shape, newest first and only as many as it takes for the request to fit: the heading, the facts, and `size`, the lines and tokens of what the row stood for. The optional emission history has already been omitted whole ({§emission-history}); an emission record has no body to take. A row whose receipt would weigh no less than its body stays whole. Every body stays stored and readable at its address, the verbs restore the room ({§context-verbs}), and each packet decides afresh from its own newest rows. The daemon chooses nothing to summarize and hides nothing silently.
@@ -5520,8 +5747,7 @@ retain distinct contracts and lifetimes.
 | `parse_advisory` | grammar parser — recoverable near-miss which did not invalidate the parsed statements | YOU SHOULD write the canonical form. | content-offset into the model's emission |
 | `search_progress` | repository materialization/indexing lifecycle ({§persistent-search-index}); structured phase, count, and percent; `level: info`, `warn` when a completed pass carries failed members ({§derivation-member-failure}), `error` on terminal failure | none | none |
 | `git_inspection_refused` | engine membership — automatic Git inspection refused a supplied repository whose config declares a `filter.*` program ({§membership-git-hermetic}); names the key; `level: warn`, once per workspace until the key changes or clears | none | none |
-| `continued_without_note` | engine turn — a continuing or parked model turn that admitted no NOTE ({§continued-without-note}); `level: warn` | YOU MUST use at least one NOTE per continuing turn. | none |
-| `budget_pressure` | engine context — a packet within its budget whose gauge is under pressure ({§context-pressure-notice}); `level: warn`; rendered with that packet, never buffered | YOU MUST NOT exceed budget. | none |
+| `continued_without_note` | engine turn — a continuing or parked model turn that admitted no NOTE ({§continued-without-note}); `level: warn` | YOU MUST record at least one NOTE along with other operations. | none |
 | `outside_text` | engine turn — text the emission carried outside its operations, discarded ({§outside-text}); `level: warn` | YOU MUST NOT emit anything except whitespace between fenced operations. | none |
 | `invalid_emission` | engine grammar — a response rejected before dispatch; `level: error` | YOU MUST ONLY emit fenced operations; with the parameters, pattern, and terse aside on the fenced Operation line. | content-offset of the parser diagnostic, when it has one |
 | `output_truncated` | engine capacity or turn — an emission cut at the output allowance ({§output-allowance-notice}); `level: error` when the cut response was rejected, otherwise `warn` | YOU SHOULD emit fewer or shorter operations per turn. | none |
@@ -5529,19 +5755,19 @@ retain distinct contracts and lifetimes.
 | `provider_retry` | a provider stream that failed after output began and was answered by a complete retry; `level: warn` | none | none |
 | `provider_unavailable` | engine provider — a provider failure retried within its recovery budget | none | none |
 | `path_normalized` | file scheme — a path resolved to its canonical spelling; `level: warn` | YOU SHOULD address the resolved path. | none |
-| `read_fanout_bounded` | engine dispatcher — a READ whose glob matched more paths than it read; `level: warn` | YOU SHOULD narrow the glob, or FIND first. | none |
+| `read_fanout_bounded` | engine dispatcher — a READ whose glob matched more paths than its resource page selected; `level: warn` | YOU SHOULD narrow the glob, or FIND first. | none |
 | `parse_issues_unavailable` | engine mimetype — parser recovery evidence unavailable for a mimetype; `level: warn` | none | none |
 | `metadata_ignored` | engine dispatcher — `[metadata]` on an operation whose scheme takes none, run without it; `level: warn` | YOU SHOULD NOT write [metadata] on an operation that takes none. | none |
 | `scope_normalized` | engine slicer — a scope normalized to its canonical form; `level: warn` | YOU SHOULD write the normalized scope. | none |
 | `edit_merged` | engine slicer — an EDIT resolution rule applied to a batch ({§edit-batch-merges}); `level: warn` | YOU SHOULD verify the merged EDIT before building on it. | none |
 
-§continued-without-note **A continuing turn that lapsed from the per-turn rule is told so.** The card's rule is one line, `YOU MUST emit at least one NOTE operation with a complete status summary and at least one other operation per turn.`, and the daemon's directive quotes it. When a model turn settles at 102 or 202, so the loop continues past it or parks on it, and it admitted no NOTE in its program or from its reasoning ({§reasoning-operations}), the next packet carries one `engine:turn` notice, `continued_without_note`, `level: warn`, with that directive and the message `The turn continued without a NOTE.`; when its program was NOTEs and nothing else, the next packet carries `noted_without_operation`, the same directive and the message `The turn carried NOTEs and no other operation.` Each is a notice, never a failure: it mints no row, never counts toward the strike rail, and never ends or alters a loop. A turn that concludes its loop, an empty turn, which carries its own no-operation row, and every non-model turn take none.
+§continued-without-note **A continuing turn that lapsed from the per-turn rule is told so.** The card's rule is one line, `YOU MUST record at least one NOTE along with other operations.`, and the daemon's directive quotes it. When a model turn settles at 102 or 202, so the loop continues past it or parks on it, and it admitted no NOTE in its program or from its reasoning ({§reasoning-operations}), the next packet carries one `engine:turn` notice, `continued_without_note`, `level: warn`, with that directive and the message `The turn continued without a NOTE.`; when its program was NOTEs and nothing else, the next packet carries `noted_without_operation`, the same directive and the message `The turn carried NOTEs and no other operation.` Each is a notice, never a failure: it mints no row, never counts toward the strike rail, and never ends or alters a loop. A turn that concludes its loop, an empty turn, which carries its own no-operation row, and every non-model turn take none.
 
 §notice-callout **A notice speaks in the card's callout form.** Each renders as one alert callout, its level choosing the callout: `> [!CAUTION]` for `error`, `> [!WARNING]` for `warn`, and `> [!NOTE]` for `info`, which no model packet carries. Inside it stand the directive ({§notice-directive}), then the message, any typed position as `@ line:column`, and the kind in brackets; a blank line separates consecutive callouts:
 
 ```text
 > [!WARNING]
-> YOU MUST use at least one NOTE per continuing turn. The turn continued without a NOTE. [continued_without_note]
+> YOU MUST record at least one NOTE along with other operations. The turn continued without a NOTE. [continued_without_note]
 ```
 
 §notice-level **Severity on the wire (`level`, required).** Every `Notice` carries `level: "error" | "warn" | "info"`, set by the **producer** at the emit site. The level is client presentation, not operation status: even an `error` notice cannot terminalize work or substitute for a durable Problem. A forwarded `output_unaccounted` is `warn`; ordinary lifecycle and progress notices are `info`. Clients color straight off `level` without interpreting the open `kind` vocabulary.
@@ -5664,12 +5890,15 @@ Core registers the `members` family with the coordinator ({§functionality-coord
 the model, the client, and the operator learn one surface — `list | discover | add |
 enable | disable | remove`, `workspace.members.<verb>` for the client,
 ```` ```members (<verb>) ```` for the model — for what the model may see, exactly as they do for skills and
-MCP servers. A definition is one gitignore-style glob, `{ glob }`, relative to the project
-root; a leading `!` excludes matching members, and an exclusion wins over every inclusion.
-Admission provenance (`service-configuration`, `client-action`, `model-proposal`)
-rides the definition to enforce {§members-model-scope}; configuration-source
-provenance belongs to the shared inspection projection ({§configuration-provenance}).
-The alias is a short name, suggested from the glob. `list` shows each
+MCP servers. A definition is one shell-path glob ({§path-glob-matching}) relative to the project
+root; a leading `!` excludes matching members, and an exclusion wins over every inclusion. The glob
+is the definition's identity ({§functionality-addressing}): `add` takes `{"files": ["<glob>", …]}`
+and admits each glob, trimmed, as one definition, a glob named twice being one; `enable`, `disable`
+and `remove` take `{"file": "<glob>"}`, the glob as `list` shows it. A bare `!` is 400
+`definition-invalid`. Admission provenance (`service-configuration`, `client-action`,
+`model-proposal`) rides the persisted definition, `{ glob, provenance }`, to enforce
+{§members-model-scope}; configuration-source provenance belongs to the shared inspection projection
+({§configuration-provenance}). `list` shows each
 definition with what it resolved to — `include` or `exclude`, the pattern, the members it
 admits or removes (count and a bounded sample), and for a model's inclusion the matches the
 repository's ignore rules refused — so the model sees what its glob did and adapts.
@@ -5680,7 +5909,9 @@ or exclude. A query that names neither, blank or a bare `!`, is 400 `query-inval
 never content; nothing is added.
 
 §members-configuration *Available definitions.* `PLURNK_MEMBERS_<alias>=<glob>`
-declares one service-origin rule (`!glob` excludes). The shared naming and
+declares one service-origin rule (`!glob` excludes), named by its glob like every definition; the
+key is its configuration provenance, which `list` shows, and two keys declaring one glob fail by
+name. The shared naming and
 enabledness dialect is {§resource-environment}; `PLURNK_MEMBERS_ENABLED` supplies
 the panel default and `PLURNK_MEMBERS_<alias>_ENABLED` overrides one rule.
 An empty glob or a bare `!` fails validation. Controls may precede their rule;
@@ -5707,7 +5938,8 @@ the repository ignores ({§membership-model-universe}). The engine's creation re
 overwrites or retires them. Projection happens at the family's publication commit and
 re-resolves membership; workspace cooling changes nothing, because desired state is
 durable. Each enabled definition is one generated document at
-`worker:///_plurnk/members/<alias>.md` ({§functionality-documents}) — its glob, origin,
+`worker:///_plurnk/members/<glob>.md` ({§functionality-documents}), the glob percent-encoded as
+one path segment (RFC 3986 unreserved characters and parentheses stay literal) — its glob, origin,
 provenance, and what it resolved to — surveyed at turn 0 like every family's enabled
 definitions ({§actor-boundary-catalog-preview}), so the model sees why a file is or is
 not a member before it asks. There is no other membership path: the client's `/members`
@@ -5998,12 +6230,12 @@ repair neighboring punctuation. Readable projections have their own coordinates.
 
 ### §ext-mimetype Path-extension declares mimetype
 
-`resolveEntryMimetype` (exported from `@plurnk/plurnk-schemes`): pathname extension → `Mimetypes.detect({ ext })` (with `text/plain` normalized to `text/markdown` per the text-primitive rule {§markdown-primitive}); falls back to scheme manifest channel default when no extension.
+`PathMimetype.resolve` (exported from `@plurnk/plurnk-schemes`): pathname extension → `Mimetypes.detect({ ext })` (with `text/plain` normalized to `text/markdown` per {§markdown-primitive}); an unrecognized or absent extension uses the caller's supplied type. Text EDIT creation supplies the scheme's declared channel type or the Markdown primitive for a dynamically typed channel. Transfers follow {§copy-destination-mimetype}.
 
 - `worker:///users.json` → `application/json` (extension wins)
 - `worker:///notes.md` → `text/markdown` (extension; matches default)
 - `worker:///config.yaml` → `application/yaml`
-- `worker:///users` (no suffix) → `text/markdown` (worker manifest default)
+- Text EDIT of `worker:///users` (no suffix) → `text/markdown` (text primitive)
 
 §ext-mimetype-extension-mimetype The same rule applies to every entry-bearing scheme when
 creating a channel without a per-call type declaration. EDIT and COPY/MOVE into
@@ -6139,6 +6371,24 @@ lane's run directory and the lane's reclaim takes all of it; an unnamed run is C
 that passes is reclaimed when it exits; a failed suite's evidence is never touched and stays exactly where the run reported it. A cross-package test may reuse Core's migration fixture only by passing a path inside the
 caller's own run directory.
 
+§tier-census **A real-model tier run is one directory with its census.** The live and demo drivers
+stamp `PLURNK_TIER_RUN` as `<kind>-<UTC stamp>`; every worker the run claims lands inside
+`PLURNK_BENCHMARKS/tier-<kind>-<stamp>/`, each in its own `<label>-XXXXXX/` with its database, its own
+host, its digest and a `census.json` naming the specimen that drove it, its loops, turns, requests,
+tokens and cost. The run's `census.md` and `census.json`, written by the tier's node:test reporter
+when the run ends, carry one row per specimen: verdict, skip reason or first failure line, the
+workers it claimed, turns, requests and cost; a run never deletes or moves any of it. A specimen
+declares what it requires of the route and the host (`input:<image|pdf|audio|video>`, `reasoning`,
+`output-budget`, `env:<NAME>`, `url:<http(s) URL>`, `bin:<name>` on PATH, `checkout:<client|a2a-tck>`
+at `PLURNK_CLIENT_CHECKOUT` or `PLURNK_A2A_TCK_CHECKOUT`, else beside the repository); an unmet
+requirement is a skip, before anything boots or is spent, whose reason names the requirement and what
+was observed, and the census answers each unmet route-bound requirement with the declared aliases
+whose catalog entry satisfies it. A route the harness cannot resolve is a failure, never a skip. No
+test surface is an opt-in flag or a script of its own: the third-party MCP composition, the
+llama-server rails, the upstream A2A TCK and the client's real-model TUI tier are live specimens that
+run wherever their requirements hold. `tier:history` ledgers every census under the home: per
+specimen, its verdicts over runs and its last reason.
+
 §fs-world-state **The world-state harness — coverage that closes the class.** Op-outcome tests check what an op returned; the harness checks the resulting world. `WorldState.check(db)` asserts, pure-db and read-only: identity uniqueness in practice (no tuple holds two rows), the canonical fixpoint on every file-class key, channel orphan-freedom, the closed admission set (every file row's origin is Git or constraint), and sig-coherence. Generated-pick incorporation and lifecycle require filesystem/Git evidence and are covered by the composed creation matrix rather than a false pure-database proxy. The harness runs as a lifecycle-test epilogue and at every soak turn boundary, where the delta half applies: an idle turn grows the entries table by ZERO. A violation names its law and its row.
 
 ## Problem codes and pinned wording
@@ -6150,6 +6400,7 @@ Every Problem code core mints is named here under its family ({§problem-error-c
 | code | status | contract |
 |---|---:|---|
 | `target-required` | 400 | *OP* requires a target path. Recovery: Write the target in parentheses on the opening fence line: `OP (path)`. |
+| `target-cardinality` | 400 | *OP* *operand* matched *n* resources; expected one. Recovery: Name one source and one destination per pair. |
 | `scheme-not-found` | 501 | Scheme '*name*' is not registered. Recovery: ({§unregistered-scheme-recovery}) `Registered schemes: *names*.` |
 | `scheme-metadata-unsupported` | 400 | *OP* on '*scheme*' does not accept the [metadata] modifier. |
 | `operation-not-implemented` | 501 | Scheme '*name*' does not implement *OP* (or exec). |
@@ -6170,13 +6421,36 @@ Every Problem code core mints is named here under its family ({§problem-error-c
 | `kill-target-scheme-required` | 400 | KILL target requires a scheme. |
 | `worker-not-found` | 404 | Worker '*name*' does not exist in this workspace. |
 | `entry-operation-unsupported` | 400 | KILL requires an entry-bearing target; '*scheme*' does not provide one. |
+| `coordinate-invalid` | 400 | '*to*' is not a log coordinate ({§rollback}). Recovery: Name the coordinate as `<loop>/<turn>/<item>`, as the log shows it. |
+| `coordinate-not-found` | 404 | No log entry exists at log:///*coordinate* ({§rollback}). |
+| `project-root-required` | 400 | Rollback restores files, and this workspace has no project root ({§rollback}). |
 | `resource-scheme-required` | 400 | Resource selection requires an address. |
 | `channel-required` | 400 | The '*scheme*' scheme has no default channel. Recovery: Address a named channel with a URI fragment. |
 | `binary-source-unsupported` | 415 | Channel #*name* is binary and its scheme keeps no bytes to transfer. |
-| `metadata-unsupported` | 400 | *OP* takes only the env option; '*key*' is not one. |
-| `worker-name-conflict` | 409 | Worker '*name*' already exists in this workspace. |
+| `metadata-unsupported` | 400 | *OP* takes only the env option; '*key*' is not one. A WORK to a held name with env: WORK to the existing worker '*name*' carries env; a message takes none. |
+| `worker-name-conflict` | 409 | Worker '*name*' already exists in this workspace. Recovery: WORK or SEND (worker://*name*) delivers a message to the live worker; FORK with a name no worker holds. ({§worker-scheme-spawn}) |
 | `no-operation` | 422 | The turn performed no operation ({§empty-turn}). |
 | `send-target-not-a-recipient` | 400 | The addressed scheme is not a SEND recipient. Recovery: Name a message address or a recipient that implements SEND. |
+| `invalid-operation-syntax` | 400 | The parser's diagnostic for an invalid operation in an admitted turn. |
+| `unreadable-pattern` | 400 | The pattern reader's diagnostic for an unreadable matcher. |
+| `completion-invalid` | 400 | A reply accepts one completion code: 200 or 499. |
+| `attachment-address-invalid` | 400 | An attachment selects one exact resource address. |
+
+§problems-loop **Loop and context Problems.** These codes identify the failed boundary; lifecycle and recovery remain governed by their owning contracts.
+
+| code | status | condition |
+|---|---:|---|
+| `result-exceeds-budget` | 413 | A result exceeds the remaining log budget; detail names its size, delivered portion, and a smaller selection or curation ({§context-fit}). |
+| `window-overflow` | 413 | The packet cannot fit the model's window even as receipts ({§context-wall}). |
+| `packet-exceeds-budget` | 413 | Context exceeds budget; the curation mandate is the pinned sentence below ({§context-over-budget-row}). |
+| `loop-timeout` | 504 | The loop exhausted its active execution allowance. |
+| `strike-threshold` | 508 / 500 | Repetition crossed the strike threshold (508), or another strike source crossed it (500), under {§engine-rails}. |
+| `loop-running` | 425 | The addressed execution has not concluded. |
+| `loop-cancelled` | 499 | The loop was cancelled; detail preserves the cancellation reason. |
+| `loop-threw` | 500 | The loop failed outside its operation result contract. |
+| `narration-failed` | 500 | Filesystem divergence narration failed before its operation turn settled. |
+| `provider-contract-violation` | 502 | The provider failed without returning its required Problem Details. |
+| `active-worker-limit-reached` | 508 | The workspace's active workers reach its configured limit. |
 
 §unregistered-scheme-recovery **An unregistered scheme's refusal names what does exist.** Its recovery
 lists the schemes the workspace registers, and rebuilds the address into nothing else
@@ -6203,6 +6477,7 @@ lists the schemes the workspace registers, and rebuilds the address into nothing
 
 | code | status | contract |
 |---|---:|---|
+| `invalid-file-url` | 400 | The native file-URL diagnostic, or `File URL path must not include NUL characters.` ({§file-url}). |
 | `edit-empty` | 400 | EDIT requires at least one statement. Recovery: Provide an EDIT statement. |
 | `edit-batch-mismatch` | 400 | The EDIT batch spans multiple resources. Recovery: Submit a separate EDIT batch for each resource. |
 | `line-marker-required` | 400 | EDIT of an existing file requires a line marker ({§edit-marker-required-on-existing}). Recovery: Name the lines to replace with `<@hash>` or `<@start,@end>` from a READ of the file; `<L,1,L,1>` inserts before line L, and `<1,-1>` replaces the whole file. |
@@ -6216,16 +6491,35 @@ lists the schemes the workspace registers, and rebuilds the address into nothing
 | `file-create-excluded` | 403 | A members exclusion (`!_glob_`) covers '*path*'. Recovery: Remove or disable the excluding members definition, or choose another path. |
 | `file-create-gitignored` | 403 | Active Git policy ignores '*path*', and no members definition includes it. Recovery: Choose a Git-admitted path or add a members definition that includes it. |
 | `file-materialization-limit` | 413 | The file exceeds the materialization byte limit and is not read into the workspace. |
-| `entry-not-found` | 404 | No member of this workspace is at '*path*'. Recovery: FIND lists paths. EDIT creates files; `members (add)` admits existing files with a `{"glob": "<path>"}` body. A path beyond the root recovers instead to: '*path*' is outside the project root: only a members definition under the operator's namespace scope admits it. |
+| `entry-not-found` | 404 | No member of this workspace is at '*path*'. Recovery: FIND lists paths. EDIT creates files; `members (add)` admits existing files with a `{"alias": "<name>", "definition": {"glob": "<path>"}}` body. A path beyond the root recovers instead to: '*path*' is outside the project root: only a members definition under the operator's namespace scope admits it. |
+| `body-channel-required` | 400 | A file write requires a body channel. |
+| `write-failed` | 500 | Publication or its settlement failed; the result distinguishes an unpublished write from an already-published one. |
+| `creation-rollback-failed` | 500 | Incorporating a newly created file failed, and rollback was incomplete. |
+| `creation-incorporation-failed` | 500 | Incorporating a newly created file failed; its exclusive creation was rolled back. |
+| `materialization-failed` | 500 | The file was written to disk but could not be registered. |
+| `delete-failed` | 500 | Deletion or projection settlement failed; the result distinguishes an undeleted file from an already-deleted one. |
 
 §problems-exec **Execution Problems.** Every code minted here, its status, and the sentence that is its contract (placeholders in *italics* are filled at emission; a fixed recovery follows its detail).
 
 | code | status | contract |
 |---|---:|---|
 | `invalid-input-target` | 400 | SEND input addresses an execution, without a channel or scope. |
-| `input-unavailable` | 409 | This execution's input receiver is no longer enabled. |
+| `input-unavailable` | 409 | This execution was launched without input. Recovery: Launch it with `[{"stdin": "open"}]` when its runtime takes input, then SEND to that execution. — This execution is queued for an execution slot; its input opens when it starts. Recovery: SEND again once the execution has started. — This execution's input receiver is no longer enabled. |
 | `stream-not-found` | 404 | No execution exists at the requested address. Recovery, when the id holds an execution under another runtime ({§exec-near-miss}): The execution at /*id* is `*runtime*:///*id*`. |
 | `input-closed` | 410 | Execution input is closed. |
+| `executor-not-registered` | 400 | No executor or MCP service named '*runtime*' is registered for this worker. |
+| `runtime-unavailable` | 501 | Executable tool '*runtime*' is unavailable; detail includes the availability diagnostic. |
+| `lifetime-invalid` | 400 | The execution lifetime directive is invalid; detail identifies the invalid form. |
+| `target-classification-failed` | 500 | The execution target could not be inspected; detail includes a bounded cause. |
+| `source-content-unavailable` | 422 | The source scheme did not supply execution content. |
+| `stream-entry-write-failed` | 500 | The execution's stream entry could not be created. |
+| `program-is-a-tool` | 404 | The command exited 127 and names a registered tool of another runtime ({§exec-tool-fall-through}). |
+| `executor-did-not-conclude` | 500 | The executor did not produce a terminal result. |
+| `execution-cancelled` | 499 | Execution was cancelled by the service. |
+| `executor-invalid-result` | 500 | The executor returned an invalid operation result. |
+| `executor-threw` | 500 | The executor failed outside its operation result contract. |
+| `entry-narration-failed` | 500 | An executor entry could not be materialized or narrated. |
+| `input-receiver-failed` | 500 | The input receiver failed outside its result contract; delivery may be partial. |
 
 §problems-entries **Entry scheme Problems (log, worker, entries).** Every code minted here, its status, and the sentence that is its contract (placeholders in *italics* are filled at emission; a fixed recovery follows its detail).
 
@@ -6233,12 +6527,36 @@ lists the schemes the workspace registers, and rebuilds the address into nothing
 |---|---:|---|
 | `read-target-required` | 400 | READ requires a log coordinate. Recovery: Provide one exact log coordinate. |
 | `coordinate-malformed` | 400 | The log coordinate '*path*' is malformed. Recovery: Use one exact loop/turn/sequence coordinate. |
+| `kill-failed` | 400 | The log target '*path*' is malformed. (A glob the matcher cannot read: The log glob '*glob*' is malformed.) Recovery: the {§log-target-shape} sentence. |
+| `curation-failed` | 400 | A scoped KILL's selection could not be read: the same sentences and recovery as `kill-failed`. |
 | `worker-target-required` | 400 | EDIT requires a worker:// target. Recovery: Provide the worker target. |
 | `binary-edit-unsupported` | 415 | The #*channel* channel is binary and cannot be edited. |
 | `message-not-implemented` | 501 | SEND does not deliver messages to *scheme* entries. Recovery: To reply, SEND to an Open Message address or omit the target. `SEND (worker://<name>)` sends a new message. |
 | `worker-entity-not-editable` | 400 | A worker entity is not an editable entry. Recovery: EDIT requires an entry path, such as worker:///example.md. |
 | `message-empty` | 400 | SEND has no message text or attachments. |
 | `scope-unsupported` | 400 | A worker SEND takes no scope. |
+| `control-address-invalid` | 400 | The operation requires an authority-only worker control address. |
+| `named-worker-required` | 400 | A worker deliverable READ requires a named worker. |
+| `emission-curated-whole` | 422 | An emission has no legend lines, so a line scope selects nothing on it. |
+| `entry-exists` | 409 | An entry already exists at the addressed resource. |
+| `invalid-expression` | 400 | The full-text or graph matcher expression is invalid. |
+| `delete-target-required` | 400 | KILL requires a target path. |
+
+§problems-client **Client interactions and message admission Problems.** Refused admission creates no replacement message or interaction.
+
+| code | status | condition |
+|---|---:|---|
+| `interaction-not-pending` | 409 | The requested client interaction is not pending. |
+| `interaction-unsupported` | 501 | No recipient implements the requested tool for this conversation. |
+| `recipient-mismatch` | 403 | Only the interaction's recipient may answer it. |
+| `interaction-response-invalid` | 400 | The response does not satisfy the pending interaction's schema. |
+| `invalid-body` | 400 | A question body is not JSON, or lacks its nonempty message or requested schema. |
+| `offset-invalid` | 400 | An entry offset is not a nonnegative safe integer. |
+| `userinfo-not-allowed` | 400 | An entry target URL contains userinfo. |
+| `action-threw` | 500 | The client action failed outside its operation result contract. |
+| `message-already-accepted` | 409 | The message address was already accepted in this workspace. |
+| `source-not-running` | 409 | The originating task is not running; no message was admitted. |
+| `loop-not-open` | 409 | The named loop is not an unfinished recipient of the worker; no message was admitted. |
 
 §problems-functionality **Server and Functionality Problems.** Every code minted here, its status, and the sentence that is its contract (placeholders in *italics* are filled at emission; a fixed recovery follows its detail).
 
@@ -6247,12 +6565,13 @@ lists the schemes the workspace registers, and rebuilds the address into nothing
 | `service-starting` | 503 | The PLURNK service owns this listener but has not admitted its client interface yet. |
 | `route-not-found` | 404 | The requested HTTP route does not exist. |
 | `configuration-invalid` | 503 | The owning configuration reader's diagnostic, naming the invalid key. Recovery: Correct the named configuration input. Other capabilities remain available. |
-| `name-reserved` | 400 | '*alias*' is plurnk's own: PLURNK_* configuration and provider credential names never reach a subprocess. |
+| `name-reserved` | 400 | '*alias*' is reserved in env entries and invocation overrides. Recovery: READ worker:///_plurnk/plurnk/env.md for supported configuration paths. |
 | `value-invalid` | 400 | '*alias*' needs a string value. |
 | `env-invalid` | 400 | `env` must be an object of string values; '*name*' is not a name a shell can export. |
+| `source-unknown` | 400 | '*source*' is not a package in the configuration catalog. Recovery: Omit source to list the catalog. READ files; set variables with add or EDIT (env:///NAME). |
 | `query-invalid` | 400 | '*query*' names no path or pattern. Recovery: Supply a path such as `docs/guide.md` or a pattern such as `docs/**`. |
 | `headless` | 409 | The workspace has no project root, so there are no file members. Recovery: Open the workspace on a project root. |
-| `definition-invalid` | 400 | A members definition is { glob }: a gitignore-style pattern, `!glob` to exclude. |
+| `definition-invalid` | 400 | A members definition is { glob }: a shell-path pattern, `!glob` to exclude. |
 | `model-scope` | 403 | The model may not change membership here: the members scope is none. Recovery: `git add` the file so git tracks it, or ask the operator to add it (/members add) or raise PLURNK_SERVICE_MEMBERS_MODEL_SCOPE. |
 | `workspace-not-found` | 404 | Workspace *id* does not exist. |
 | `state-not-json` | 400 | Worker module state is not JSON-serializable. |
@@ -6263,8 +6582,17 @@ lists the schemes the workspace registers, and rebuilds the address into nothing
 | `offset-channel-required` | 400 | Recovery: Select the channel to read from the offset. |
 | `target-invalid` | 400 | Recovery: Use a scheme://path target. |
 | `proposal-not-pending` | 409 | Recovery: Refresh pending proposals before resolving one. |
+| `proposal-decision-unrecorded` | 500 | The approval decision could not be saved; the operation was not applied. |
 | `scope-cancelled` | 499 | The worker scope was cancelled: *reason*. |
 | `range-not-satisfiable` | 416 | `Range <0,-1>` starts at 0, which is not a line; lines are numbered from 1. Recovery: Trim one line with `<L>` or lines L through M with `<L,M>`; `KILL (log:///…/READ)` with no scope retires the whole row. |
+| `runtime-owner-reserved` | 409 | The runtime owner cannot be registered by a client. |
+| `owner-not-found` | 404 | The owner address is not registered in the workspace. |
+| `proposal-policy-failed` | 500 | Core could not establish the proposal's settlement policy. |
+| `handler-unavailable` | 410 | The proposed scheme handler is no longer available. |
+| `proposal-apply-threw` | 500 | The scheme failed outside its proposal application contract. |
+| `verb-unknown` | 400 | The requested verb is not a lifecycle verb of the addressed family. |
+| `arguments-not-json` | 400 | The lifecycle verb's body must be a JSON object. |
+| `dispatch-threw` | 500 | The Plurnk actor failed outside its operation result contract. |
 
 §pinned-wording-core **Pinned wording.** Verbatim sentences tests pin: each is contract, and a change here is a change of contract.
 
@@ -6273,8 +6601,7 @@ lists the schemes the workspace registers, and rebuilds the address into nothing
 | Nothing is in flight. Continuing. | a WAIT (or a premature terminal) with no live work ({§wait-obligation-matrix}) |
 | All Open Messages resolved. Review new results; emit no OPs if finished. | resolved messages with unobserved results ({§loop-completion}) |
 | Context exceeds budget. YOU MUST ONLY KILL, MOVE or NOTE this turn. | the over-budget row ({§context-over-budget-row}) |
-| YOU MUST NOT exceed budget. Context is at *N*% of budget. | a packet within its budget under pressure ({§context-pressure-notice}) |
-| YOU MUST use at least one NOTE per continuing turn. The turn continued without a NOTE. | a continuing or parked model turn without a NOTE ({§continued-without-note}) |
+| YOU MUST record at least one NOTE along with other operations. The turn continued without a NOTE. | a continuing or parked model turn without a NOTE ({§continued-without-note}) |
 | Each directive in the notice table | a notice of the model's own output ({§notice-directive}) |
 | Context window overflow: the packet cannot fit the model's window even as receipts. | the wall ({§context-wall}) |
 | No recipient implements the requested interaction. | The worker's owner is not interactive or does not declare the required client tool ({§client-interaction-routing}). |
@@ -6286,5 +6613,5 @@ lists the schemes the workspace registers, and rebuilds the address into nothing
 | '*path*' is a directory, not a file; READ reads one file. Recovery: `FIND (_path_/)` lists its files. | READ of a directory |
 | The execution at ops://*worker*/*loop* has not concluded. | a bare READ of a running worker's result (425) |
 | The child provider failed. | a child's provider failure read back by its parent |
-| '*path*' exists on disk but is not a member of this workspace. Recovery: Admit it with `members (add)` and a `{"glob": "<path>"}` body. | a non-member on disk at the addressed path |
+| '*path*' exists on disk but is not a member of this workspace. Recovery: Admit it with `members (add)` and a `{"alias": "<name>", "definition": {"glob": "<path>"}}` body. | a non-member on disk at the addressed path |
 | '*path*' exists on disk but is not a member of this workspace. Recovery: The repository ignores it: a client or operator members definition can include it, a model definition cannot. | a non-member the repository ignores ({§membership-read-refusal}) |