@plurnk/plurnk-service 3.2.0 → 4.0.0

package/SPEC.md

@@ -40,11 +40,11 @@ Canonical meanings. When a doc, comment, test name, or commit message uses one o
 
 ```mermaid
 flowchart LR
-    W["Workspace<br/>shared world"] --> K["Worker<br/>actor and history"]
+    W["Workspace<br/>shared resources and configuration"] --> K["Worker<br/>actor and history"]
     K --> L["Loop<br/>queued-to-terminal work"]
     L --> T["Turn<br/>one admitted scheduling unit"]
     T --> O["Op<br/>one statement / action row"]
-    H["AG-UI thread<br/>conversation identity"] -. resolves to .-> K
+    H["AG-UI thread<br/>names a worker"] -. resolves to .-> K
     R["AG-UI Run<br/>client stream envelope"] -. binds to .-> L
     R -. or executes .-> A["Management action<br/>no core loop required"]
 ```
@@ -52,7 +52,7 @@ flowchart LR
 | Term              | Layer                 | Meaning |
 |-------------------|-----------------------|---------|
 | **agent**         | PLURNK                | The plurnk runtime. Acts in-workspace as the `_plurnk` worker ({§actor-boundary} self-hosting), never a privileged singleton owning its own entries ({§entry-owner}, {§machine-processes}). |
-| **workspace**     | Core                  | Durable user-named shared world. Persists across workers and process restarts. Identity: `workspaces.id` + unique `workspaces.name`. |
+| **workspace**     | Core                  | Durable shared resources and configuration, with an optional project folder. Identity: `workspaces.id`; mutable label: unique `workspaces.name`. Persists across workers and process restarts. |
 | **worker**        | Core                  | Durable actor and history over one workspace. Owns its loops and log rows, may carry a `parent_worker_id`, and has one process-local cancellation scope while active. |
 | **loop**          | Core                  | Queued-to-terminal unit of model or client work within a worker. Status ∈ {100 pending · 102 running · 200 done · 202 waiting (blocked on a live obligation, {§send}) · 413 input-capacity failure · 429 model-turn ceiling · 499 cancelled · 500 failed · 504 execution timeout ({§operator-config-loop-timeout}) · 508 runaway}. Many loops may belong to one worker. |
 | **turn**          | Core                  | One durable, producer-neutral batch of ordered operations. A turn may be authored by a model, client, or `_plurnk`; only a model turn assembles a packet and owns an emission call. Many turns may belong to one loop. Identity: `(loop_id, sequence)`. |
@@ -62,7 +62,7 @@ flowchart LR
 | **action**        | Core                  | One executed op. Execution normally produces a `log_entries` row at `log:///<L>/<T>/<S>/<op>`; an engine rail may instead record an `op='error'` row ({§operation-results}). A source artifact carries no fabricated operation. |
 | **dispatch**      | Core                  | Routing a statement to its scheme's op handler. |
 | **AG-UI Run**     | AG-UI protocol        | A client request/stream envelope identified by the client's `runId`. A message or resume AG-UI Run binds to one core loop; a management-action AG-UI Run may complete without creating a core loop. |
-| **AG-UI thread**  | AG-UI protocol        | Conversation identity. Within an explicitly selected workspace, `threadId` resolves to one conversation worker. |
+| **AG-UI thread**  | AG-UI protocol        | Message history identity. Within an explicitly selected workspace, `threadId` resolves to one model worker. |
 
 ### Storage terms
 
@@ -202,7 +202,8 @@ early ownership introduces neither traffic nor a close/rebind race.
 §http-host **The daemon opens exactly one transport.** Core binds the HTTP
 listener on `PLURNK_HOST:PLURNK_PORT` and offers it to every exterior adapter as
 `registerHttpRoute(prefix, handler)` and `httpAddress()` on the application port
-({§application-port}). A prefix is an absolute pathname. Each request goes to the
+({§application-port}). The listener is bound before any module sets up, so the setup seam
+offers `httpAddress()` too ({§module-host-capabilities}). A prefix is an absolute pathname. Each request goes to the
 longest mounted prefix; a prefix claims itself and the subtree beneath it, never
 a longer sibling name; `/` is the root and receives whatever nothing more
 specific claimed when a module mounts it. An admitted listener returns an HTTP
@@ -215,6 +216,67 @@ none opens a socket of its own. The standards
 address by URL, never by port (#641): AG-UI mounts only `/agui`, A2A the
 well-known card and its endpoint path, on the same address.
 
+§http-request-origin **What the daemon advertises follows the address a caller used.** A request's
+origin is the address its `Host` names, over http, or the listener's own for a request that names
+none (`requestOrigin`). Every address the daemon advertises to a caller, the authority's issuer
+({§agui-oauth-endpoints}) and the A2A card's endpoint, is its configured public origin or the origin
+of the request that asked, so a daemon bound to every interface answers each caller at the address
+that caller used; a module that asks with no request in hand, as one reading the issuer at its
+start does, is answered with the configured origin or the listener's own. A configured origin is for
+a front the daemon cannot see, such as a TLS proxy. No request is refused for the name it uses.
+
+§credential-authority **The daemon is one credential authority.** Every credential presented
+to its listener, whatever protocol is mounted there, was issued by the daemon's `credentials`
+authority on the application port ({§application-port}): an opaque random token held in memory
+with its kind (`access`, presented as a bearer; `refresh`, exchanged and never presented), its
+subject, its client, its scopes, its family and its expiry. A restart revokes every credential.
+Revocation is by family, so an access token and the refresh token that renews it fall together;
+a refresh token is consumed once, and a second presentation revokes its family and says so. The
+authority has no HTTP face and no policy of its own: the issuing module publishes the one face
+(`publish({ issuer })`, at setup) that names where a request's caller obtains credentials
+({§http-request-origin}) and answers from its publication, so any module may read the issuer from its own `start` on ({§module-phases}), an
+exterior adapter
+verifies through it ({§agui-http-authorization}), and the client protocol issues through it
+({§agui-oauth}). The posture is the shared `PLURNK_AUTH` ({§operator-config-shared-keys}) and is
+never inferred from what else is set. Under `1` the authority holds the operator's client secret,
+`PLURNK_SECRET` when set, else one minted for this boot and written to the file `secret` beside the
+database, 0600 and complete or absent, before any mount is admitted, where a tool running as the
+operator reads it; a configured secret and a daemon that does not authenticate leave no such file. A
+listening daemon under `1` refuses to start until a module publishes the face. Under `0` no
+credential exists, no face is published and every mounted resource admits anonymously. Credentials
+the daemon presents to others follow the remote party's declared scheme and are never minted here.
+
+§credential-module-client **A module of this daemon is a confidential client by registration.** At
+setup a module registers its own client on the authority, `registerClient({ id, redirectPaths, scopes, stylesheetPath })`:
+an id of letters, digits, `.`, `_` or `-` other than `operator`, the absolute pathnames under its own
+mounts it may be answered at, each as a URL carries it, with no query and no fragment, the scopes it
+may ask for and, optionally, the pathname in the same form of a stylesheet under its own mounts,
+which the issuing face links on the documents it serves that client's requests
+({§agui-oauth-documents}). A module states no origin: it serves only on the daemon's one listener
+({§http-host}), so its address is its path on the issuer, and registration needs nothing from the
+listener, the issuer or another module. The issuing face answers the client at exactly the issuer
+followed by a registered path ({§agui-oauth-endpoints}), and the module forms the same address from
+`credentials.face().issuer()`, from its `start` on ({§credential-authority}). The authority mints the client's
+secret for this boot, holds it in memory, answers it to the registrant and to nobody else, and
+checks it in constant time (`authenticateClient`); `client(id)` tells any module the registration
+without the secret. A second registration of one id and a malformed registration are faults and
+register nothing. Nothing is configured, printed or persisted, so installing a module adds no
+operator step. The issuing face authenticates such a client as it does any confidential one
+({§agui-oauth-clients}). A module's own browser session is a credential of this authority too: a
+`session` credential it issues in the family of the authorization grant it stands on, which is the
+family of the browser's sign-in that authorized it ({§agui-oauth-session}), so revoking that family
+from either side ends the module's session, its tokens and the browser's standing at the issuing
+face together.
+
+§credential-sessions **A browser sign-in is a family, and a subject's sign-ins are listed without a
+token.** `sessions(subject)` answers every family of that subject that holds a live `session`
+credential, oldest first: the family, which is the sign-in's handle and is never admitted as a
+credential; the subject; when a credential was first issued into the family; when the last of its
+session credentials expires; and the clients holding credentials in it. A grant with no session
+credential, such as a client's `client_credentials` token or a consented client's code grant, is no
+sign-in and is not listed. Revoking a listed family ({§credential-authority}) is signing that browser
+out. Nothing records last activity or a device, and a restart ends every sign-in.
+
 §startup-admission-order After listener ownership, database admission completes
 before capability initialization can perform external work. Provider construction
 and endpoint verification occur on worker selection or first use, never merely
@@ -262,7 +324,7 @@ not access to workspace resources ({§actor-boundary-no-mutex}).
 | Root creation | Explicit owner, otherwise the runtime `_plurnk`. |
 | WORK, FORK, or a fresh child | Inherit the parent's owner. |
 | SEND, schedule occurrence, or other incoming message | Preserve the recipient's owner. |
-| Explicit client control attachment | Claim a runtime-owned conversation and its runtime-owned descendants; never claim the runtime actor or replace another owner. |
+| Explicit client control attachment | Claim a runtime-owned model worker and its runtime-owned descendants; never claim the runtime actor or replace another owner. |
 | Observation or disconnect | No change. |
 
 An owner declares its capability set: the client tool names it implements, and whether it
@@ -313,12 +375,12 @@ filter over workspace resources.
 **attribution** — the delta's provenance ({§env-delta}) — and is never read to
 filter a row.
 
-§actor-boundary-attached-functionality **Attachment selects a conversation,
+§actor-boundary-attached-functionality **Attachment selects a worker,
 not an environment owner.** Client management commands mutate workspace
 Functionality ({§module-workspace-capabilities}); runtimes, runtime
-schemes, and tools resolve by `workspaceId`. Operations journal in the
-submitting actor's `workerId` ({§connection-lifecycle}), which must belong to
-the workspace. Runtime and policy resolution require no second worker identity.
+schemes, and tools resolve by `workspaceId`. A model's operations journal in its
+worker, and a person's client operations in the workspace's runtime worker
+({§connection-lifecycle}). Runtime and policy resolution require no second worker identity.
 Attachment remains many-to-one and unrelated to parentage. Explicit control
 attachment may claim approval ownership under {§worker-ownership}.
 
@@ -422,7 +484,7 @@ direct-entry-plus-directory count; `-1` enables the ordinary markerless page;
 unset / `0` disables previews. `log://` is absent because the current worker's
 log already renders in present mode.
 
-§worker-initialization-entry **Model-worker initialization is a real `_plurnk` operation turn.** A model worker's first loop begins with one packetless `{ producer="_plurnk", kind="initialization" }` turn submitted through {§turn-ops-admission-path}. Its program — the READ/FIND surveys, led by one NOTE when the surveys run — is recorded as the turn's `ops://` source and executed through {§op-execution-order} exactly as a model's program is; it authors no reasoning and reads none back. The NOTE keeps the example turn within the card's NOTE-per-turn teaching: it carries the aside of the card's first NOTE example, `<!-- summary -->`, and reads, exactly, `Surveyed tooling, documentation, extended context, and project root.` No emission row is fabricated ({§emission-row}): the first request sees the NOTE and the surveys' ordinary results, never an assistant-content copy of the program. The initial message arrives as an inbound SEND in the first model turn ({§message-arrival}); initialization never READs it, and neither initialization nor later turns manufacture a task inventory. Every orienting row is structurally classified `_plurnk` and `init`. The namespace surveys and their asides follow {§actor-boundary-catalog-preview}.
+§worker-initialization-entry **Model-worker initialization is a real `_plurnk` operation turn.** A model worker's first loop begins with one packetless `{ producer="_plurnk", kind="initialization" }` turn submitted through {§turn-ops-admission-path}. Its program — the READ/FIND surveys, opened by one NOTE and closed by another when the surveys run — is recorded as the turn's `ops://` source and executed through {§op-execution-order} exactly as a model's program is; it authors no reasoning and reads none back. The two NOTEs show the card's NOTE practice in the example turn: the opening one carries the aside of the card's first NOTE example, `<!-- plan -->`, and is the worker's plan in numbered steps, each with its purpose: survey what exists, read the Open Message and restate what it asks for and what will show it is done, then do the work recording each finding, decision and next action in a NOTE; the closing one carries the aside of the card's last NOTE example, `<!-- next -->`, and reads `Read and resolve the Open Message.` No emission row is fabricated ({§emission-row}): the first request sees the NOTEs and the surveys' ordinary results, never an assistant-content copy of the program. The initial message arrives as an inbound SEND in the first model turn ({§message-arrival}); initialization never READs it, and neither initialization nor later turns manufacture a task inventory. Every orienting row is structurally classified `_plurnk` and `init`. The namespace surveys and their asides follow {§actor-boundary-catalog-preview}.
 
 Incoming messages publish once as inbound SEND rows in the first model turn
 ({§message-arrival}); initialization neither READs nor archives them. The turn
@@ -481,8 +543,8 @@ for a loop, `(loop, sequence)` for a turn, `(turn, sequence)` for a log row —
 outside the database, every copied row passes the same table triggers the original did, and a fork
 either lands whole or not at all. Nothing else runs: `Fork.fork` is the claim.
 
-§machine-processes-worker-is-its-log **A worker's conversational memory of
-the shared world is its log, with no hidden per-worker snapshot beside it.**
+§machine-processes-worker-is-its-log **A worker's memory of
+the shared workspace is its log, with no hidden per-worker snapshot beside it.**
 A scoped KILL suppresses canonical body intervals on that worker's rows ({§log-kill-scope});
 lineage activity and explicit commons broadcasts arrive as attributed log
 entries ({§env-delta}). Named scratch and evidence follow {§machine-processes-entry-inheritance}. They are not an invisible mirror of shared state. Workspace
@@ -497,9 +559,9 @@ the parent after that boundary is sibling activity, not fork history. Global
 commons broadcasts remain live after the fork because the branch is then an
 existing workspace worker in its own right.
 
-§machine-processes-model-worker-readable **Packet membership is per-worker, not an access policy.** A packet contains its worker's log plus explicitly delivered activity ({§actor-boundary}). `readLog({ workspaceId, workerId })` may inspect any worker belonging to that workspace, and `listWorkers` enumerates them. A client-interface module chooses its conversation binding. Inspection does not inject another log into a model's packet.
+§machine-processes-model-worker-readable **Packet membership is per-worker, not an access policy.** A packet contains its worker's log plus explicitly delivered activity ({§actor-boundary}). `readLog({ workspaceId, workerId })` may inspect any worker belonging to that workspace, and `listWorkers` enumerates them. A client-interface module chooses its worker binding. Inspection does not inject another log into a model's packet.
 
-§machine-processes-worker-origin **A worker carries its actor.** Each worker records its `origin` — `model` (a conversation), `client` (a client-interface actor), or `_plurnk` (the runtime's self-hosting worker) — set once at creation and inherited by WORK/FORK from the parent. A turn's producer is independent: a client-produced program in a model worker still delegates model workers. `listWorkers` returns actor class without interpreting names; a retained worker's name is immutable ({§machine-processes-worker-is-its-log}).
+§machine-processes-worker-origin **A worker carries its actor.** Each worker records its `origin`, set once at creation: `model` (a model's identity) or `_plurnk` (the workspace's runtime worker, where the daemon's own work and a person's client operations journal, {§connection-lifecycle}). Every worker WORK or FORK creates is a model worker: a model's is its child, and a person's operation starts a root worker or branches the worker it acts for ({§actor-boundary-client-operations}). `listWorkers` returns actor class without interpreting names; a retained worker's name is immutable ({§machine-processes-worker-is-its-log}).
 
 §worker-provider-identity **A worker owns a durable provider identity distinct
 from its database id.** Creation mints a globally unique, opaque 128-bit value;
@@ -508,7 +570,7 @@ emission ({§provider-cache-identity}). Database ids remain the internal relatio
 client coordinate. BARE calls use isolated per-call provider identities rather
 than either worker value.
 
-§machine-processes-fork-shares-the-world **A fork copies history and named
+§machine-processes-fork-shares-workspace **A fork copies history and named
 scratch while sharing the workspace.** It is a new worker in the
 same workspace (`workers.parent_worker_id`, {§lifecycle-terms}); project files,
 shared entries, and membership remain live and uncopied.
@@ -523,9 +585,10 @@ or membership overlay requires a new workspace.
 §worker-authority-carving **Authority is a literal namespace, not a principal.** `worker:///notes.md` is shared scratch; `worker://alice/draft.md` is named scratch. Both belong directly to the workspace ({§entry-owner}). Entry addresses require no namesake Worker row and survive its deletion; only pathless worker controls resolve an actor. The caller never alters an address, and `~` has no alias semantics.
 
 §worker-name-minting **URI ingestion is permissive; worker minting is not.**
-Every model/client worker-creation door applies the contracts-owned
+Every model worker-creation door applies the contracts-owned
 `WORKER_NAME` predicate ({§worker-name}) through one core admission path. Generic URL parsing
-continues to decompose other authorities without treating them as mintable.
+continues to decompose other authorities without treating them as mintable, and an exact read by
+name ({§methods-worker-read}) is no creation door: it resolves `_plurnk` like any listed name.
 
 | Candidate                                      | Minting result                                                        |
 | ---------------------------------------------- | --------------------------------------------------------------------- |
@@ -566,7 +629,7 @@ Every admitted authority is a literal `workers.name`; self-addressing uses the c
 | `READ`    | existing literal name       | Collect the named worker's deliverable. |
 | `KILL`    | existing literal name  | Terminate the named worker or caller.   |
 
-- §worker-scheme-spawn **Spawn** — ```` ```WORK (worker://<name>)? ```` with a task body creates a new child worker (empty log) and starts it with that task on its first loop. WORK/FORK are the worker-creation verbs: EDIT is file/entry only, so EDIT on the bare worker entity is a **400** steering to WORK/FORK — the entity is not an entry. Names remain unique within a workspace for the lifetime of retained Worker rows, including after termination. An existing name returns 409 whose receipt names the working forms — `SEND (worker://<name>)` with the task as the body to give the live worker more work, or a name no worker holds for another; concurrent claims cannot redirect a published address or expose a raw uniqueness failure.
+- §worker-scheme-spawn **Spawn** — ```` ```WORK (worker://<name>)? ```` with a task body creates a new child worker (empty log) and starts it with that task on its first loop; a person's operation starts a root worker that person owns instead ({§actor-boundary-client-operations}). WORK/FORK are the worker-creation verbs: EDIT is file/entry only, so EDIT on the bare worker entity is a **400** steering to WORK/FORK — the entity is not an entry. Names remain unique within a workspace for the lifetime of retained Worker rows, including after termination. A WORK whose name a worker already holds is the voice door ({§worker-scheme-irc}): its body is delivered to that worker as a message, nothing is created, the receipt names the worker and `delivered: message`, and an `env` option is refused by name since a message takes none. A FORK whose name a worker holds is `409 worker-name-conflict` whose recovery names the working forms, WORK or `SEND (worker://<name>)` to message the live worker, or a name no worker holds to branch; concurrent claims cannot redirect a published address or expose a raw uniqueness failure.
 - §worker-spawn-prompt-resource **The spawn slot is overloaded by scheme.** A `worker://` path is
   the child's address and keeps the address rules ({§worker-control-addressing}). A path of any
   other scheme is the child's prompt resource: it is read whole (`<1,-1>`) under the caller's read capabilities, composed with
@@ -580,7 +643,8 @@ Every admitted authority is a literal `workers.name`; self-addressing uses the c
 - §worker-scheme-fork **Fork** — ```` ```FORK (worker://<name>)? ```` with a task body branches the
   current worker into a **named** child: its log is deep-copied
   ({§machine-processes-fork-copies-the-log}), which continues with `task`; the
-  world is shared, never copied ({§machine-processes-fork-shares-the-world}).
+  workspace is shared, never copied ({§machine-processes-fork-shares-workspace}). A
+  person's operation branches the worker it acts for ({§actor-boundary-client-operations}).
   WORK and FORK are distinct verbs — WORK spawns a fresh worker, FORK branches
   the log. Both report the resulting `worker://name` address in receipt
   metadata `worker`, whether named explicitly or allocated automatically.
@@ -618,11 +682,11 @@ Every admitted authority is a literal `workers.name`; self-addressing uses the c
   A failure reports its problem even when the loop answered earlier: the failure is the news.
   READs and completion observations use the same resolution, representation and projector.
 - §child-orientation **Child orientation.** Beyond the conclusion delta, every
-  turn the packet's status clump surfaces the live things this worker currently
-  holds under the teaching's own word for handing work out: `## Delegation` is
-  one JSON object, `{"workers": [...], "streams": [...]}`, its unconcluded child
-  workers and its open streams as `{status, path}` pointers (the same shape as
-  the errors section). Body-suppressed child activity is durable
+  turn the packet's status clump surfaces the work this worker currently holds
+  open, beside the messages it owes: `## Open Work` is one JSON object, `{"workers": [...], "streams": [...], "messages": [...]}`, its
+  unconcluded child workers, its open streams and the messages it sent that await
+  completion ({§worker-obligations}) as `{status, path}` pointers (the same shape as
+  the errors section); a message pointer carries the recipient loop's status. Body-suppressed child activity is durable
   history; this section is the current inventory that keeps an active obligation
   visible even when no new activity arrived. Each open stream pointer carries
   elapsed runtime, output inactivity, and its channels' sizes and growth since
@@ -642,22 +706,24 @@ Every admitted authority is a literal `workers.name`; self-addressing uses the c
   Workspace schedules are not held work: an occurrence arrives as a message
   ({§schedule-delivery}).
 - §packet-empty-sections **Emptiness is stated where the model decides on it.**
-  `## Delegation` renders every turn, each of its two lists `[]` when empty: the
+  `## Open Work` renders every turn, each of its lists `[]` when empty: the
   model decides whether to wait or complete on exactly these facts, so their
   emptiness is stated rather than inferred from a missing heading. This is the
   deliberate exception to the wire rule that empty content is absent; errors,
   notices, and the rest keep that rule. The parent is not a section: the
   `## Worker` identity block carries `"parent": "worker://<name>"`, or
   `"parent": null` at a root, so a worker never infers its rank from silence.
-- §packet-current-turn **The packet says who and which turn, below the log.** The
+- §packet-current-turn **The packet says who, which turn and who attends, below the log.** The
   `## Worker` block, in the status clump below the log ({§packet-cache-monotone}), carries
-  `{"path": "worker://<name>", "parent": <address or null>, "loop": L, "turn": T}`: the actor,
-  whose child it is, and the coordinate this packet's response becomes, so `reasoning://<worker>/L/T`
-  and `ops://<worker>/L/T` are the model's own and `log:///L/T/*` its rows; a model never infers the
-  present from the last row's coordinate, which may or may not be its own turn. The block
-  changes every turn, so nothing of it precedes the log, and the packet carries no date, time
-  or zone anywhere. The coordinate only; the source addresses stay
-  documented, not taught.
+  `{"path": "worker://<name>", "parent": <address or null>, "loop": L, "turn": T, "owner":
+  {"address": "<owner>", "interactive": <boolean>}}`: the actor, whose child it is, the coordinate
+  this packet's response becomes, so `reasoning://<worker>/L/T` and `ops://<worker>/L/T` are the
+  model's own and `log:///L/T/*` its rows, and its approval owner ({§worker-ownership}) with whether
+  a person attends that owner; a model never infers the present from the last row's coordinate,
+  which may or may not be its own turn, and never infers from a missing tool alone that nobody can
+  answer. The block changes every turn, so nothing of it precedes the log, and the packet carries no
+  date, time or zone anywhere. The coordinate only; the source addresses stay documented, not
+  taught.
 
 Worker control rides the daemon's inject seam (active→fold, idle→enqueue+drain), so the handler creates/branches the worker and hands off; the daemon owns provider + system prompt. FORK/WORK carry the seed task in the body and are their own ops, dispatched to worker control — never the entry-copy path.
 
@@ -864,7 +930,7 @@ pass.
 
 §membership-git-flags **Permission flags.** Service-wide Git admission comes from {§operator-config-git-ceiling}. `PLURNK_SERVICE_GIT_AUTO=1` includes the repository containing `project_root`; `=0` disables automatic Git membership, leaving member definitions as the only membership source. `ALLOWED` gates `AUTO`.
 
-**Rationale.** Workspace is the right scope unit and the containing Git repository is its ordinary development boundary. Membership curation is tiered: Git bounds it by tracking, the client supersedes by overlay, and the model curates its render by READ/KILL. Supporting several independent repositories as one world would require Plurnk-owned topology, synchronization, and model teaching that Git already solves cleanly by treating them as separate workspaces.
+**Rationale.** Workspace is the right scope unit and the containing Git repository is its ordinary development boundary. Membership curation is tiered: Git bounds it by tracking, the client supersedes by overlay, and the model curates its render by READ/KILL. Supporting several independent repositories as one workspace would require Plurnk-owned topology, synchronization, and model teaching that Git already solves cleanly by treating them as separate workspaces.
 
 **Schema.** The version-1 baseline stores the normalized {§inference-ledger},
 its model-response evidence, emission admission, and cardinal
@@ -1141,7 +1207,7 @@ boundary.
 - §worker-lifecycle-idle-is-concluded **Idle is not completion.** A loop concludes only under {§loop-completion}; an unanswered message remains an obligation even when nothing is running. A concluded worker retains durable history; a later addressed arrival starts a new loop.
 - §worker-lifecycle-no-lost-loop **A loop is never stranded by a drain's exit.** A drain relinquishes its registry slot only after a lock-held re-claim confirms the queue is empty; a loop enqueued during that teardown is either re-claimed by the exiting drain or claimed by a fresh drain that a later inject starts. The relinquish and the start are serialized, so neither the lost-loop hang nor a transient double-drain can occur.
 - §worker-lifecycle-durable-disposition **Durable disposition wins cancellation races.** At a turn boundary, the engine reads the loop's durable status before interpreting a process-local abort. A committed `202` park survives a later daemon-shutdown signal; only a loop still durably running at `102` can be terminalized by that cancellation. Wake selection rechecks shutdown and worker cancellation before requeuing each parked loop.
-- §worker-lifecycle-restart-recovery **Restart is owner-loss reconciliation, not replay.** Before opening client transports, the service holds an exclusive database-adjacent daemon lock; a second live owner fails before touching SQLite, while a dead-PID crash claim is replaced atomically without a timeout lease. Boot preserves accepted `100` loops and restores their drains. A `102` loop belonged to a vanished drain/provider call, so it settles `500` with the interruption on its durable row—never replayed across an unknown effect boundary. Every pending physical provider request first settles as an error with absent usage and explicitly unknown cost; then its logical model call closes. Recovery never fabricates zero evidence. Every durable proposed operation likewise lost its process-local resolution waiter and settles as a visible `500 owner_vanished` occurrence rather than an unresolvable interrupt ({§proposal-list}). A pending client interaction also lost its exact awaiting operation, so boot removes the orphan instead of replaying work or inventing a response ({§client-interactions}). Every durable-open subscription belonged to a vanished callable: active channels become errored and its row closes `500`. A `202` continuation requeues on an unseen completion or when no live obligation remains. Otherwise it stays parked on surviving children; the drain restores inherited stream observation through the same guarded scheduler ({§worker-wait-timing}). Child terminalization wakes its parked parent on every outcome, including provider exceptions, cancellation, and restart interruption, recursively through the durable parent edges. These operations are idempotent, so an interrupted recovery safely repeats.
+- §worker-lifecycle-restart-recovery **Restart is owner-loss reconciliation, not replay.** Before opening client transports, the service holds an exclusive database-adjacent daemon lock; a second live owner fails before touching SQLite, while a dead-PID crash claim is replaced atomically without a timeout lease. Database-only owner-loss settlement commits atomically before drains or process-local observation resume; a failed settlement leaves no partial transitions. Boot preserves accepted `100` loops and restores their drains. A `102` loop belonged to a vanished drain/provider call, so it settles `500` with the interruption on its durable row—never replayed across an unknown effect boundary. Every pending physical provider request first settles as an error with absent usage and explicitly unknown cost; then its logical model call closes. Recovery never fabricates zero evidence. Every durable proposed operation likewise lost its process-local resolution waiter and settles as a visible `500 owner_vanished` occurrence rather than an unresolvable interrupt ({§proposal-list}). A pending client interaction also lost its exact awaiting operation, so boot removes the orphan instead of replaying work or inventing a response ({§client-interactions}). Every durable-open subscription belonged to a vanished callable: active channels become errored and its row closes `500`. A `202` continuation requeues on an unseen completion or when no live obligation remains. Otherwise it stays parked on surviving children or unanswered inter-worker messages; the drain restores inherited stream observation through the same guarded scheduler ({§worker-wait-timing}). Child terminalization wakes its parked parent on every outcome, including provider exceptions, cancellation, and restart interruption, recursively through the durable parent edges. These operations are idempotent, so an interrupted recovery safely repeats.
 
 ---
 
@@ -1238,7 +1304,9 @@ alone are not a cycle: changing inputs or observations distinguish activity.
 A turn that executed nothing has no activity to identify, so an empty turn's
 identity is its **text** ({§empty-turn}) — the same principle, applied to the only
 output it produced. Identifying it by its absent program instead makes every empty
-turn identical, and changing words then read as a repeating one.
+turn identical, and changing words then read as a repeating one. A turn whose final emission the
+output allowance cut has no identity: the engine's ceiling, not the model, ended its output, so it
+is no repetition evidence and closes the window ({§loop-rail-continuity}).
 This is an exact-repetition backstop, not a semantic judgment of task progress;
 new asynchronous invocation identities do not prove repetition of their eventual
 effects. Ordinary contract strikes and operator budgets remain independent.
@@ -1309,12 +1377,13 @@ independent turn ceiling terminates at **429** ({§loop-terminals}). The streak
 and cycle verdict are absent from model packets; only the concrete occurrences
 in the table are shown. The streak never leaves the daemon.
 
-A crossing terminal names the source that struck the crossing turn — `repetition`,
-`no_operation`, then `operation` — in its detail, in that order when a turn matches more
-than one. The three are not interchangeable: a turn that authored no operation did not *fail*
+A crossing terminal names the source that struck the crossing turn — `output_allowance`,
+`repetition`, `no_operation`, then `operation` — in its detail, in that order when a turn matches
+more than one. The three are not interchangeable: a turn that authored no operation did not *fail*
 one, and reporting it as a failed turn misreads a model answering without the fence as a model
 whose operations broke. A cycle of empty turns names repeated responses without operations,
-not repeated operations or results. This is the crossing turn's source, not the streak's composition; the
+not repeated operations or results. A turn whose final emission the output allowance cut names
+the allowance and its grant ({§output-allowance-notice}), whatever else it struck on. This is the crossing turn's source, not the streak's composition; the
 rail rules on the crossing and does not retain the kinds behind it. What the crossing turn
 actually said is cited, not discarded ({§terminal-evidence}). Naming the source is not the
 private accounting {§rail-accounting-private} withholds: the streak, the cycle verdict and
@@ -1330,6 +1399,7 @@ restart; curation of log evidence cannot alter them.
 | Assessed turn with a violation | Increment once. | Include its exact activity. |
 | Clean assessed turn | Reset to zero. | Include its exact activity. |
 | Actual park, including an immediate wake/reclaim in the same drain | Preserve the assessed streak. | Close the window; the next turn starts a new one. |
+| Assessed turn whose final emission the output allowance cut | As any assessed turn. | Exclude it and close the window; the next turn starts a new one. |
 | Recoverable provider outage | No assessment; preserve the streak. | Preserve until an actual park. |
 | New loop | Start at zero. | Start empty. |
 
@@ -1411,7 +1481,9 @@ completion before the model sees them in the next packet.
 WAIT without a live obligation continues to those results.
 This is operation recovery, not provider
 resampling. A malformed statement's Problem records the factual
-`siblingsRetained: true` extension.
+`siblingsRetained: true` extension, and its row's `attrs` record the statement the parser refused,
+its `attempt` ({§parse-attempt}), outside the row's body and weight, so the packet shows the model
+nothing new.
 
 §invalid-emission-attempts Each exhausted emission-attempt budget contributes
 one frame-contract strike to the same streak as other contract violations
@@ -1655,7 +1727,7 @@ Every fact names the canonical key, never the host root or an echo of the
 model's spelling. These classes let a caller distinguish a wrong address, an
 invalid range, read-only authority, and occupied hidden state without guessing.
 
-§membership-read-refusal **A file miss speaks of membership, never of the disk.** A file is read only as a member, so every `file` miss — READ, FIND of an exact path, KILL, a pattern EDIT's source, a COPY or MOVE source — is 404 `entry-not-found`, `No member of this workspace is at '<key>'.`, its target rendered as the reusable member address ({§fs-answer-in-canon}, {§file-url}). Recovery offers listing with FIND, creation with EDIT, and admission with `members (add)` as alternatives and presumes none ({§diagnostic-observation}): `` FIND lists paths. EDIT creates files; `members (add)` admits existing files with a `{"glob": "<path>"}` body. `` The sentence is about the address and is true whether or not a file is there: it neither claims absence nor hints at presence. Beyond the root the engine does not look at the disk at all, so two reads of `../` paths differ only in the name they echo, and their recovery speaks of the address too, true under every members scope: `'<key>' is outside the project root: only a members definition under the operator's namespace scope admits it.` Inside the root occupancy is not secret ({§fs-write-nonmember}), so an exact-path READ of a path that exists on disk but is not a member says so instead — 404 `entry-not-member`, `'<key>' exists on disk but is not a member of this workspace.`, with admission-only recovery; a path the repository ignores, which no model definition admits, carries the members discovery verdict instead: `The repository ignores it: a client or operator members definition can include it, a model definition cannot.` Occupancy may surface there; content never does ({§membership}).
+§membership-read-refusal **A file miss speaks of membership, never of the disk.** A file is read only as a member, so every `file` miss — READ, FIND of an exact path, KILL, a pattern EDIT's source, a COPY or MOVE source — is 404 `entry-not-found`, `No member of this workspace is at '<key>'.`, its target rendered as the reusable member address ({§fs-answer-in-canon}, {§file-url}). Recovery offers listing with FIND, creation with EDIT, and admission with `members (add)` as alternatives and presumes none ({§diagnostic-observation}): `` FIND lists paths. EDIT creates files; `members (add)` admits existing files with a `{"files": ["<path>"]}` body. `` The sentence is about the address and is true whether or not a file is there: it neither claims absence nor hints at presence. Beyond the root the engine does not look at the disk at all, so two reads of `../` paths differ only in the name they echo, and their recovery speaks of the address too, true under every members scope: `'<key>' is outside the project root: only a members definition under the operator's namespace scope admits it.` Inside the root occupancy is not secret ({§fs-write-nonmember}), so an exact-path READ of a path that exists on disk but is not a member says so instead — 404 `entry-not-member`, `'<key>' exists on disk but is not a member of this workspace.`, with admission-only recovery; a path the repository ignores, which no model definition admits, carries the members discovery verdict instead: `The repository ignores it: a client or operator members definition can include it, a model definition cannot.` Occupancy may surface there; content never does ({§membership}).
 
 §file-directory-target **A directory is named as a directory.** Inside the root, a READ (or other exact-path read), KILL or EDIT whose target is a directory on disk — with or without a trailing slash — is refused `path-is-directory`, never as a missing or non-member file: READ and KILL answer 404, EDIT 403. The detail is `'<key>' is a directory, not a file; <OP> reads/removes/writes one file.`; a READ or KILL carries the listing as its recovery, `` `FIND (<key>/)` lists its files. ``, and an EDIT carries none. Beyond the root the disk stays dark and {§membership-read-refusal} holds unchanged.
 
@@ -1680,6 +1752,9 @@ cross-scheme SQL transaction. Core's create-only publication claims the same
 identity atomically: an existing identity returns 409 without changing its
 metadata or channels.
 
+Removing a channel preserves its siblings. Pruning the resulting entry requires
+it to be empty at the deletion boundary, not merely at an earlier observation.
+
 ### Op methods
 
 §op-methods-op-dispatch Engine operation ownership follows the public scheme contract:
@@ -1697,7 +1772,7 @@ Registration precedes loop affinity:
 | Registered but inactive under flag | The flag gate returns `403 scheme-unavailable`.                         |
 | Registered and active              | Dispatch continues to the operation owner.                              |
 
-- §op-execution-order **An admitted turn is an ordered program.** Model, client, and harness operations execute in authored order. WAIT is deferred until all other admitted operations settle or establish their explicitly asynchronous work ({§disposition-anywhere}). The complete program then settles under {§wait-obligation-matrix}, whether or not it contains a lifecycle request; no completion operation or inventory is invented. Existing cycle, no-operation, and resource rails remain effective. An observation records the resource state at its execution point; the model sees that receipt in the next packet. Exact submitted source and actual operation outcomes remain durable. Earlier successful effects survive a later operation failure; a producer requesting fail-on-error stops before subsequent operations.
+- §op-execution-order **An admitted turn is an ordered program.** Model, client, and harness operations execute in authored order. WAIT is deferred until all other admitted operations settle or establish their explicitly asynchronous work ({§disposition-anywhere}). The complete program then settles under {§wait-obligation-matrix}, whether or not it contains a lifecycle request; no completion operation or inventory is invented. Existing cycle, no-operation, and resource rails remain effective. An observation records the resource state at its execution point; the model sees that receipt in the next packet. Exact submitted source and actual operation outcomes remain durable. Earlier successful effects survive a later operation failure; a producer requesting fail-on-error stops before subsequent operations. Cancellation stops before the next resolved operation, including remaining glob targets, while preserving already-settled effects, receipts, source, and provider accounting.
 
 §bare-inference **BARE is isolated, synchronous retrieval over the durable child-provider policy.**
 
@@ -1711,7 +1786,7 @@ Registration precedes loop affinity:
 | Failure | A source/admission/provider failure affects its own operation, not successful siblings. Accounting or persistence failure is internal and fails hard. |
 | Observation | Responses are unseen retrieval work; completion follows {§send-premature-terminate}. |
 
-- §op-synchronous **Decisive operations settle before the next operation.** The dispatcher awaits each operation and its proposal resolution. Work remains in flight only when the operation's contract deliberately creates concurrency: FORK, WORK, a stream-producing execution, and streaming READ after acquisition. Such a READ first establishes its durable subscription and returns `102`; a later operation may address that live owner. Dispatching an execution before KILL does not wait for the process to finish using a resource. KILL of a worker synchronously ends its live loops before disposition checks the pending set; physical scope cleanup remains asynchronous.
+- §op-synchronous **Decisive operations settle before the next operation.** The dispatcher awaits each operation and its proposal resolution, including subsystem commands ({§functionality-model-mutation}). Work remains in flight only when the operation's contract deliberately creates concurrency: FORK, WORK, external execution, and streaming READ after acquisition. Such a READ first establishes its durable subscription and returns `102`; a later operation may address that live owner. Dispatching an external execution before KILL does not wait for the process to finish using a resource. KILL of a worker synchronously ends its live loops before disposition checks the pending set; physical scope cleanup remains asynchronous.
 - §edit-execution **One resolved EDIT target is one mutation.** Each EDIT resolves against current resource state when dispatch reaches it, owns its proposal when gated, and records its own resulting revision. No later EDIT is prepared or applied in advance. Numeric scopes address current coordinates; an earlier EDIT may change what those numbers select. Rejection applies only to that operation, not its successful siblings.
 - §edit-anchor-continuity **Own EDITs preserve untouched hash targets within one program.** Core carries an anchor through exact, successfully applied EDIT splices when its line survives unchanged, even if its ordinal or neighborhood changes. Scoped entry KILL uses the same deletion path. Target-line replacement or deletion invalidates that binding. Continuity is private to the admitted program and canonical resource/channel; it is not a new published anchor format. The complete normalized line content must match the expected result of the preceding recorded EDIT, otherwise retained bindings are discarded and ordinary current-state validation applies. Reviewer replacement and results without an applied EDIT receipt do not carry bindings forward. A retained binding resolves alone: a twin neighbourhood this program's own splice created elsewhere does not make the carried anchor ambiguous, and an anchor the program never bound resolves against current state. Normalization is the same line-content representation used by READ and line hashing; file-write revision checks remain independent. No approximate text matching is used. Lowered coordinates retain a current-anchor precondition at the mutation owner; ambiguous matches and concurrent changes remain collisions.
 - §anchor-offset **An anchor offset is tolerated, never taught (#749).** A line mark may carry an offset from its anchor (`@abcde+1`, `@abcde-2`), and a bare `+N` after an anchor counts from that anchor (`<@abcde,+1>`). The anchor resolves as usual and the offset is added; a result before line 1 is an invalid mark, and past the end is the ordinary range refusal. Continuity and current-anchor preconditions check the anchor's own line. `plurnk.md` keeps its two anchor forms. Numeric relative endpoints normalize under {§scope-range-recovery}; a reversed range produced by anchor resolution is never reinterpreted as a count.
@@ -2111,7 +2186,7 @@ source line therefore retains the same prefix across projections of one revision
 An explicit default-channel fragment and its fragmentless spelling share that
 identity; a selected non-default channel retains its canonical `#channel`.
 
-For READ/LOOK and COPY/MOVE source or destination selection, core resolves every
+For READ and COPY/MOVE source or destination selection, core resolves every
 anchor against the addressed current complete content before applying the
 ordinary numeric text-coordinate contract. Exactly one current match lowers to
 its numeric line; zero or multiple matches return 409 `line-anchor-collision`,
@@ -2388,6 +2463,32 @@ The `## Log` section is a sequence of ordinary Markdown records separated by one
 
 An emission row's body is not in its record ({§emission-row}); its eligible program follows it as a separate assistant message ({§emission-history}). Patterns retain their literal spelling; a pattern containing a line break is JSON-quoted to keep the H3 on one physical line. Receipts are descriptive records, not reconstructed operation headings. Absent fields are not invented. Every physical body line retains its canonical numeric `N:` or anchored `@hash N:` coordinate, so source text cannot create a record boundary. The section contains records only, with no leading prose or enclosing fence.
 
+§log-mutation-patch **A settled file mutation's row keeps what it did.** When an accepted EDIT,
+COPY, MOVE or KILL writes or removes a text member, the file scheme appends the unified diff of
+that write, `current` to `proposed`, to the operation row it is settling (`log_entries.patch`); a
+row that settles several writes keeps them in application order. The row serves it as its `patch`
+channel, `log:///<loop>/<turn>/<item>/<OP>#patch`, `text/x-diff`, for the life of the row: a fork
+copies it with the row, and it never enters a receipt or a packet unasked. Nothing is kept for a
+byte write, a member past the materialization bound, or a row settled before this version, and
+nothing is reconstructed for them: such a row has no `patch` channel, and whatever reads one, a
+rollback included, fails by name rather than inventing one.
+
+§rollback **Rollback reverses a worker's settled file mutations, latest first, through ordinary
+operations.** `rollback({ workspaceId, workerId, actor, to })` (`workspace.rollback { to,
+workerId? }` for a client) names a log coordinate of `workerId`, `<loop>/<turn>/<item>`; the state
+after that item is what remains. Every settled EDIT, COPY, MOVE or KILL row after it, latest first,
+has its patch ({§log-mutation-patch}) reversed against the file as it is now and written back within
+one client operation of `actor` ({§connection-lifecycle}), that person's decision already: a rewrite
+as `EDIT <1,-1>`, a removed file as a creating `EDIT`, a created file as `KILL`. Each reversal is a
+row and a patch of its own, so a rollback is inspectable afterwards and reversible by the same
+means. The report (`RollbackReport`) lists what was restored, the rows skipped because they
+kept no patch or were reversed already (the file is in the state before that mutation, as an earlier
+rollback left it), and where it stopped: `drift`, the file no longer holds what that mutation wrote,
+leaves that file and everything earlier untouched; `refused` carries the reversing operation's
+Problem. A coordinate that is not one of the worker's rows is `404 coordinate-not-found`, a
+malformed one `400 coordinate-invalid`, and a workspace without a project root `400
+project-root-required`. Nothing is reconstructed for a patchless row, and the log is never rewritten.
+
 §log-address-metadata **Addresses name their relationship, not the row's producer.**
 
 | Spelling | Meaning | Where |
@@ -2438,9 +2539,9 @@ complete non-retrieval body retains `lines` where no other field supplies its
 navigable extent. None of these spellings changes acquisition, delivery,
 curation, admission, or immutable evidence.
 
-Field absence carries defaults: `origin` is omitted for the owning model, `source` for the owning worker, and `status` for a routine 200. An emission row renders its author, the turn's producer, as its `origin` ({§emission-row}). Dispositions always carry their lifecycle status, SEND its delivery status, KILL keeps an explicit 200, and every non-200 stays explicit. A present authored aside appears as `aside`. Every row's accounting follows {§packet-token-accounting}.
+Field absence carries defaults: `origin` is omitted for the owning model, `source` for the owning worker, and `status` for a routine 200, regardless of operation. Every non-200 stays explicit. This presentation rule does not alter message completion, durable results or protocol responses. An emission row renders its author, the turn's producer, as its `origin` ({§emission-row}). A present authored aside appears as `aside`. Every row's accounting follows {§packet-token-accounting}.
 
-Authored `metadata` retains its opaque ordered block strings under {§scheme-metadata-modifier}; COPY/MOVE pair them as `{from,to}`. Packet rendering does not interpret scheme options or discard malformed input from a failed operation.
+Authored `metadata` retains its opaque ordered block strings under {§scheme-metadata-modifier}, as stored under {§log-sensitive-request-evidence}; COPY/MOVE pair them as `{from,to}`. Packet rendering does not interpret scheme options or discard malformed input from a failed operation.
 
 - §operation-resource-receipt A result's nonempty `resource` address remains visible in receipt metadata when distinct from its `path` and `stream`. It identifies returned material without replacing the addressed operand or injecting that material into context; ordinary READ acquires it.
 - §packet-attachment-parts A successful READ of an attachable resource carries projection facts with its
@@ -2979,10 +3080,27 @@ When all messages are resolved but new results require another packet, the engin
 reports only: `All Open Messages resolved. Review new results; emit no OPs if finished.`
 The notice creates no state and does not demand another final reply.
 
-§worker-obligations A worker holds its unresolved children and open non-detached
-streams (`worker_obligations`); `loop_obligations` names them per loop. The
-packet's Delegation list, WAIT, completion and drain wake settlement use that
-same durable liveness.
+§worker-obligations A worker holds its unresolved children, its open non-detached
+streams, and the messages it sent to other workers that await completion while the
+recipient's loop is live (`worker_obligations`); `loop_obligations` names them per
+loop. Each obligation records the operation that opened it, by identity: a stream its
+execution ({§subscriptions-causal-resource}), a message the SEND, WORK or FORK that sent it,
+by the row that operation writes; a child's loop is opened by its first message's. The
+opening row names what it opened: an execution's `attrs.stream`, a message's `attrs.message`
+(its durable address). A message holds, and its reply reaches, the worker whose own operation
+sent it; a message a person, a client or the daemon sends opens no worker's obligation. The packet's Open Work list, WAIT, completion and drain wake settlement use
+that same durable liveness: a worker that messaged another worker parks on an
+authored WAIT until the completion arrives ({§message-completion}), and with no WAIT
+joins that work with the bounded park rather than concluding idle.
+
+§message-abandonment **An ended loop answers what it left open.** When a loop ends,
+every message another worker sent it that has no completion is completed `499` by the
+daemon: one `_plurnk` SEND to the message's address in a maintenance turn of the
+recipient, "Loop *N* ended with status *S*; this message was not answered.",
+delivered to the sender like any reply ({§message-reply-delivery}). A message the
+ending loop had not yet published is re-homed first ({§message-loop-containment}) and
+is not abandoned. The sender's hold ends with the recipient's loop either way; the
+completion is what wakes it and tells it.
 
 §wait-obligation-matrix **End-of-program resolution.** Execute all admitted operations and settle optimistic work before applying this table. WAIT is an optional yield, not an end-of-program delimiter.
 
@@ -3078,7 +3196,7 @@ accounting and model-visible failure evidence remain separately owned by
   The strike sends no notice of its own: the turn records one `_plurnk`
   error row, `422` `The turn performed no operation.`, which rides the next packet's errors like
   any failure ({§operation-result-uniform-error-channel}); the threshold terminal still says why ({§engine-rails}).
-  An empty turn uses its exact text as the cycle fingerprint ({§engine-cycle-evidence});
+  An empty turn the output allowance did not cut uses its exact text as the cycle fingerprint ({§engine-cycle-evidence});
   different empty programs are not a repeated cycle merely because neither contained
   operations. Lost-boundary handling remains {§unparsed-tail-boundary}; no confirmation
   token or private retry is invented here.
@@ -3144,7 +3262,9 @@ of which Worker launched it ({§execution-output-identity}).
 | --- | --- |
 | Admission | Require SEND control and the original invocation's runtime/tool capabilities. Preserve its classified effect: host input proposes; pure/read input uses the same effect policy as launch. |
 | Acceptance | Recheck both capabilities, workspace, and the exact live subscription. Stale approval cannot reach a replacement invocation. |
-| Queued or starting without a receiver | `409 input-unavailable`, immediately; never wait for an execution slot while blocking another input-dependent execution. |
+| Launched without input | The invocation's preparation declared no receiver ({§executor-live-input}): `409 input-unavailable`, immediately, naming the launch form that opens input. |
+| Queued for a slot | `409 input-unavailable`, immediately and `retryable`; never wait for an execution slot while blocking another input-dependent execution. |
+| Admitted, receiver declared, not yet open | Delivery waits for the receiver to register, within the backpressure bound; the execution settling first returns `410 input-closed`. A receiver registered without the declaration is the executor's defect and fails its run. |
 | Unknown address | `404 stream-not-found`. A terminal execution or retired input returns `410 input-closed`. |
 | Delivery | Serialize accepted inputs per invocation. Preserve authored body and receiver-owned metadata. Receiver success means delivery only, not completion. |
 | Backpressure | `PLURNK_SERVICE_EXEC_INPUT_TIMEOUT_MS` bounds each accepted delivery, including its queue residence. Expiry returns `504 input-timeout`; cancellation returns `499 input-cancelled`. Once delivery has begun, retire and abort input on either; delivery may be partial and is never replayed. The execution itself is not implicitly killed. |
@@ -3282,8 +3402,12 @@ unchanged for proposal policy, application, stream registration, and
 effect-qualified hold policy. The post-acceptance materialization path never
 triggers reclassification.
 
-§exec-registry-resolves The runtime slot (`signal`) selects an executor from
-the workspace snapshot. Installed siblings form the immutable base:
+§exec-registry-resolves The execution's `runtime` selects an executor from
+the workspace snapshot at its dispatch point. Explicit invocations parse without requiring
+registration ({§executor-heading}); a preceding accepted subsystem command may publish the
+name they invoke in that same program ({§functionality-model-mutation}). A failed or rejected
+command grants nothing; subsequent invocations resolve the unchanged snapshot, unless the
+producer requested fail-on-error and stopped the program. Installed siblings form the immutable base:
 they are discovered and probed at startup, and availability is cached.
 Workspace Functionality providers may atomically overlay additional names under
 {§module-workspace-capabilities}; a name has one owner within a workspace, while
@@ -3319,7 +3443,7 @@ execution is refused `scope-unsupported` (400).
 | `lifetime`   | The spawn |
 | ------------ | --------- |
 | a duration   | Aborted at the deadline — a bounded reap, polite signal then SIGKILL after `PLURNK_SERVICE_EXEC_KILL_GRACE_MS` — and the stream is stamped **504** `execution-timeout`, distinct from a deliberate kill (499) or a clean exit (200): `` Execution of '*runtime*' outlived its *lifetime* lifetime. `` |
-| `loop` (absent) | Loop-life bounded: reaped on every loop terminal except 202, the background-stream behavior. |
+| `loop` (absent) | Loop-life bounded: reaped on every loop terminal except 202, the background-stream behavior. A person's client operation answers once its command starts, so its execution belongs to the operation instead: it outlives the operation loop's 200 and is reaped when that operation is cancelled or the daemon stops ({§connection-lifecycle}). |
 | `turn`       | Reaped at the worker's next pre-turn via the registry abort, before the turn's own spawns, so it never survives into the subsequent turn; its terminal output surfaces born visible like any close ({§exec-stream}). |
 | `detached`   | Outlives its loop's terminal, 200 included. It never binds to the loop's teardown and is nobody's obligation — completion is not gated by it, WAIT does not park on it, optimistic settlement looks past it — and it ends only by KILL, the worker's total reap, or daemon shutdown; its late conclusion surfaces without opening a loop. |
 
@@ -3365,18 +3489,53 @@ lifecycle teardown still reaps its work. No new delegation semantics follow.
 
 §worker-auto-name **Automatic names are eight random lowercase hexadecimal
 characters**, e.g. `worker://ab3d5678`; a colliding draw is retried. All unnamed
-workers use this allocator, including WORK, FORK, clients, and conversations.
+workers use this allocator, including WORK, FORK, clients, and model workers.
 Names encode neither machine identity nor topology or role; those remain
 separate durable fields.
 Automatic names never reuse an existing literal. Name selection and worker
 creation share one atomic claim: concurrent allocations receive distinct
-addresses, while concurrent default-conversation ensures converge on one root
-worker. Generated addresses appear in ordinary operation receipts and child
+addresses. Generated addresses appear in ordinary operation receipts and child
 inventory; allocation never rewrites the submitted operation's target.
 
-§workspace-auto-name **Workspace auto-names are five anchor-alphabet characters.** A `workspace.create` without a name draws five characters from the {§line-anchors} alphabet `0-9A-Za-z` (uniformly, from a cryptographic source), redrawing on the astronomically rare collision. No prefix, timestamp, or origin marker: a name never encodes where a workspace came from, so nothing can grow load-bearing on it.
-
-§exec-readpure-ungated A `read` runtime (observes external state, e.g. search) or `pure` runtime (no observable effect, e.g. `:memory:` sqlite) is side-effect-free → **auto-run**: no proposal, no human gate, no notification. Core persists the prepared operation before applying it; that write-ahead staging has no resolution waiter and therefore cannot enter proposal discovery ({§proposal-list}). It skips the gate a host command faces, but it does NOT resolve in-band — like every exec it backgrounds and streams, its output reaching the model through the environment-observation injector (a foisted READ of newly publishable stream content each turn, {§exec-stream}), never a same-turn receipt.
+§workspace-name **A workspace's name is an opaque handle; its identity is its id; its folder is a
+separate fact.** A name is a unique non-empty string compared by exact bytes, the same comparison for
+creation, rename and lookup; nothing in it is normalized or decoded, and it authorizes
+nothing: only `projectRoot` selects a folder, and a workspace may have none. Admission, at creation
+and rename, refuses these spellings as `name-invalid` (400):
+
+- ASCII decimal digits alone (`[0-9]+`, including zero and leading zeroes): reserved for workspace IDs.
+- Text that is not well-formed Unicode: an unpaired surrogate has no encoding.
+- A slash-delimited segment exactly `.` or `..`: a URL parser resolves it away, encoded or not.
+
+None is repaired or resolved. Every other spelling
+is admitted as written: spaces, Unicode, `~`, `@`, `%` and a literal `%2E%2E`, query and fragment
+punctuation, and a dot within a segment (`.config`, `file.txt`, `...`). A refused rename changes
+nothing. Admission governs new names only: a workspace already carrying a refused spelling keeps it,
+its id, its folder and its workers, stays listed and attachable, and is renamed like any other. Rename
+({§methods-workspace-rename}) changes the name alone; {§methods-workspace-attach} selects an existing workspace. With a project
+root and no name, `workspace.create` names the workspace after the root, the root's path with the daemon's
+home abbreviated to `~` (`~` for the home itself, the absolute path outside it), and selects the
+workspace of that name when one exists instead of creating a second, so two default launches on the
+same project and daemon share one workspace and a concurrent pair resolves to one. The root is resolved
+before it is named, so a root spelled with `.` or `..` components derives the name of the folder it
+reaches and no default is ever refused; a root that is not well-formed Unicode is
+`project-root-invalid` (400), since it names no folder. The default is a
+convention, not a mapping: a renamed workspace is not re-selected by its old default, and a workspace may
+carry any name over any folder. An explicit name that exists is `409 name-conflict`, never a
+selection.
+
+§workspace-label **A folder's display spelling is the daemon's.** Wherever the application port
+returns a workspace's folder it returns its label beside it: `projectLabel` on a client envelope and
+the `workspace/created` notice, `project_label` on a `listWorkspaces` row. The label is the folder as
+a default name spells it: the daemon's home is `~`, a path beneath it `~/<rest>`, and any other path,
+one that merely shares the home's prefix included, its absolute spelling. A workspace without a
+folder has a null label. It is derived from the folder on every read and never stored, and it never
+rewrites a name, so a client compares a workspace's name with its label by equality and derives
+neither from its own home.
+
+§workspace-auto-name **A workspace with neither name nor project root gets five alphanumeric characters, at least one a letter.** Such a `workspace.create` draws uniformly from the {§line-anchors} alphabet `0-9A-Za-z` using a cryptographic source, redrawing digit-only names and collisions. No prefix, timestamp, or origin marker: a name never encodes where a workspace came from.
+
+§exec-readpure-ungated A `read` runtime (observes external state, e.g. search) or `pure` runtime (no observable effect, e.g. `:memory:` sqlite) is side-effect-free → **auto-run**: no proposal, no human gate, no notification. Core persists the prepared operation before applying it; that write-ahead staging has no resolution waiter and therefore cannot enter proposal discovery ({§proposal-list}). Admission does not determine settlement: external executions background and stream, while subsystem commands settle under {§functionality-model-mutation}. Both expose output through ordinary environment observation ({§exec-stream}), not a second inline body path.
 
 §effect-policy-tunable **Effect admission is one knob per effect.**
 `PLURNK_SERVICE_EFFECT_HOST`, `PLURNK_SERVICE_EFFECT_READ` and
@@ -3392,7 +3551,7 @@ two states and no others:
 
 | state | what the model receives |
 |---|---|
-| active | nothing in the Log. The `## Delegation` stream pointer reports timing and channel activity ({§child-orientation}); the model READs any range it wants, and every READ of a stream channel carries `terminal: false` while it runs and `terminal: true` once it has concluded, so an empty page is never mistaken for a finished command that printed nothing. |
+| active | nothing in the Log. The `## Open Work` stream pointer reports timing and channel activity ({§child-orientation}); the model READs any range it wants, and every READ of a stream channel carries `terminal: false` while it runs and `terminal: true` once it has concluded, so an empty page is never mistaken for a finished command that printed nothing. |
 | terminal | ONE `origin=_plurnk` READ at the execution's channel address, born visible, that is exactly a markerless READ of the channel — its bounded first page ({§read-selection-projection}, the whole channel when it fits, the channel's own mimetype), the `range` or `region`, terminal status and Problem, `terminal: true`, and any producer-supplied integer `exitCode`. The packet writes the read resource as its operand, exactly as an explicit READ does ({§log-address-metadata}). |
 
 §stream-observation-result **One liveness fact.** The durable READ result owns
@@ -3407,7 +3566,7 @@ publishes only once subscription settlement has installed its terminal result;
 until then the stream is still in flight and publishes on the turn after it settles.
 
 §exec-concurrency **Bounded admission per workspace (#389).** At most
-`PLURNK_SERVICE_EXEC_CONCURRENCY` executions run at once in one workspace (`-1`
+`PLURNK_SERVICE_EXEC_CONCURRENCY` external executions run at once in one workspace (`-1`
 unbounded); the scope is the workspace, so neither delegation nor later turns
 bypass it and no other workspace can starve it. Every admitted execution still creates its
 entry, channels, and open subscription before its receipt returns, so queued work is
@@ -3419,7 +3578,8 @@ it: an immediate slot is `200 { outcome: "started" }`; delayed work is
 current truth. Admission is FIFO within the workspace; queue residence does not consume
 the execution timeout; a KILL while queued never invokes the executor and concludes the
 stream as any KILL does ({§stream-control}). The scheduler is the exec scheme's; the knob is the
-service's ({§operator-config}), fail-hard on any other value.
+service's ({§operator-config}), fail-hard on any other value. Ordered subsystem
+commands use {§functionality-model-mutation}, not this background-work queue.
 
 §exec-stream-page **An unrequested delivery never exceeds the retrieval page.** The
 terminal observation is the same page a markerless READ returns, whatever the
@@ -3434,7 +3594,7 @@ records stop at the last complete line that fits, or at an exact Unicode region
 when even the first line exceeds the character bound. Explicit READ scopes stay exact.
 
 The durable per-subscription, per-channel cursor records the size last reported
-to the model — by the Delegation stream pointer while active, by the terminal
+to the model — by the Open Work stream pointer while active, by the terminal
 observation at close — so the pointer can state growth and no partial document
 or record ever reaches the model. The terminal observation and its cursor
 transition commit atomically. A concluded stream lands one conclusion row per
@@ -3578,6 +3738,9 @@ Core derives the contracts-owned `ProposalProjection` from the durable proposed
 | Projection field      | Durable authority                                                                                                  |
 | --------------------- | ------------------------------------------------------------------------------------------------------------------ |
 | identity              | proposed log row `id`, `worker_id`, `loop_id`, `turn_id`, and validated `op`                                       |
+| `worker`              | the worker's name ({§worker-name})                                                                                 |
+| `coordinate`          | the row's log coordinate `L/T/S` ({§methods-log-coordinate})                                                       |
+| `expiresAt`           | when the operator's decision deadline cancels the proposal ({§proposal-timeout-cancels}); absent for an untimed wait |
 | `target`              | canonical `{ scheme, authority, pathname }` from `attrs.proposalTarget` for staged COPY/MOVE, otherwise the log row target |
 | `body`                | proposed operation result `rx.body`; absent means the empty review body                                            |
 | `attrs`               | proposed log row `attrs` object                                                                                    |
@@ -3631,6 +3794,7 @@ operation, message sender, or attrs.
 | Runtime bookkeeping | reject, `runtime_bookkeeping` |
 | Server `accept` | accept |
 | Server `reject` | reject, `policy_veto` |
+| Server `review`, a person's client operation ({§connection-lifecycle}) | accept, `client_operation` |
 | Server `review`, owner implements `request_approval` | review |
 | Server `review`, owner has no reviewer | reject, `no_review_channel` |
 
@@ -3638,8 +3802,9 @@ Core selects the disposition once for the pending gate. Its live event and
 reconnect projection use that same decision. Automatic settlement precedes
 observational notification; an observer failure cannot change authority or orphan
 a waiter. Invalid configuration is diagnosed at the proposal boundary without
-substituting authority ({§configuration-repair-path}). Client-authored
-administrative operations retain their client's owner.
+substituting authority ({§configuration-repair-path}). A person's client operation is
+already that person's decision, so review never routes it; the server's `accept` and
+`reject` still apply.
 
 §runtime-bookkeeping-policy Runtime bookkeeping cannot acquire new authority.
 Generated reference publication and audit narration have no reviewer and do not
@@ -4083,6 +4248,13 @@ systemd user unit. Installation and enablement are explicit operator actions;
 package installation performs neither. The template documents executable-path
 and environment adjustments instead of introducing a service-management command.
 
+§nginx-example The service package ships `plurnk.nginx.conf`, an example nginx front, beside
+the unit and under the same terms. Hardening belongs there, not in the daemon: TLS, security
+headers, sign-in throttling by real client address and an optional network allow-list. The
+daemon answers every caller at the address it used ({§http-request-origin}); behind TLS it is
+told the public origin (`PLURNK_AGUI_ISSUER`, and `PLURNK_A2A_ENDPOINT_URL` when it exposes A2A),
+which it cannot see.
+
 Model selection uses one selector vocabulary in `ProviderRegistry` ({§provider-instantiation}). `PLURNK_MODEL_<alias>=<provider>/<model-id>` optionally declares a friendly route and tuning scope; `PLURNK_MODEL=<selector>` selects either that alias or an exact provider/model route. `PLURNK_MODEL_CHILD=<selector>` uses the same vocabulary for the default child provider; unset means inherit the spawning loop's provider. Operator selections and alias declarations live in `.env`, not `.env.defaults`.
 
 Each knob's value lives on its panel and nowhere else (`plurnk-service config defaults` prints them all); this table says what the service's knobs mean.
@@ -4092,7 +4264,7 @@ Each knob's value lives on its panel and nowhere else (`plurnk-service config de
 | `PLURNK_SERVICE_DB_PATH` | SQLite file path; an explicit non-empty value overrides the derived default. |
 | `PLURNK_SERVICE_SQLITE_SYNCHRONOUS` | Connection-time WAL durability: `OFF`, `NORMAL`, `FULL` or `EXTRA` ({§db-durability}). |
 | `PLURNK_SERVICE_SHARE_FOLDER` | Parent of the shares written when no folder is named ({§share-folder}); empty is `$XDG_STATE_HOME/plurnk/shares`. |
-| §operator-config-shared-keys `PLURNK_HOST`, `PLURNK_PORT` | The daemon-owned listener's bind address and TCP port; modules mount their paths on that one listener ({§http-host}). **A key the daemon and its clients both read has a shared owner**: `@plurnk/plurnk-contracts` declares these two and the optional `PLURNK_AGUI_URL` on its own panel, the one package every side depends on. The daemon folds it like any installed member's, a client folds it beneath its own, and so neither holds the other's default. The service's `--host` and `--port` flags are generated from that panel. |
+| §operator-config-shared-keys `PLURNK_HOST`, `PLURNK_PORT`, `PLURNK_AUTH`, `PLURNK_SECRET`, `PLURNK_PASS` | The daemon-owned listener's bind address and TCP port; modules mount their paths on that one listener ({§http-host}). The daemon's authentication posture, the operator's client secret and the operator's browser sign-in ({§credential-authority}, {§agui-oauth}). **A key the daemon and its clients both read has a shared owner**: `@plurnk/plurnk-contracts` declares these, and the optional `PLURNK_AGUI_URL`, on its own panel, the one package every side depends on. The daemon folds it like any installed member's, a client folds it beneath its own, and so neither holds the other's default. The service's `--host`, `--port`, `--auth`, `--user` and `--pass` flags are generated from that panel. |
 | §operator-config-git-ceiling `PLURNK_SERVICE_GIT_ALLOWED` | Hard service ceiling: only `1` admits Git membership and status; every other value denies them. |
 | §operator-config-file-create-scope `PLURNK_SERVICE_FILE_CREATE_SCOPE` | Hard file-creation ceiling: `none < root < namespace`. `none` denies new filesystem files, `root` admits only paths inside `project_root`, and `namespace` also admits canonical outside-root paths. Existing-member writes are unaffected. |
 | `PLURNK_SERVICE_FILE_MATERIALIZE_MAX_BYTES` | Byte ceiling in `1..104857600` for one workspace-file snapshot ({§membership-materialization-limit}). |
@@ -4103,7 +4275,7 @@ Each knob's value lives on its panel and nowhere else (`plurnk-service config de
 | `PLURNK_SERVICE_PROVIDER_RECOVERY_BACKOFF` | First recovery delay (ms); doubles per failure up to `PLURNK_SERVICE_PROVIDER_RECOVERY_BACKOFF_MAX` ({§provider-recovery}). |
 | `PLURNK_SERVICE_MAX_STRIKES` | Consecutive turn-contract strike threshold ({§engine-rails}). |
 | `PLURNK_SERVICE_EMISSION_ATTEMPTS` | Completed provider responses allowed beneath one engine turn before frame admission is exhausted. Bounded interior operation errors are admitted without spending this budget. Exhaustion contributes one frame-contract strike under {§invalid-emission-attempts}. |
-| `PLURNK_SERVICE_BUDGET_PRESSURE` | Budget percentage above which the gauge names its largest rows ({§context-gauge}) and a packet within its budget carries the `budget_pressure` notice ({§context-pressure-notice}); measured before adding either. |
+| `PLURNK_SERVICE_BUDGET_PRESSURE` | Budget percentage above which the gauge names its largest rows ({§context-gauge}); measured before adding the inventory. |
 | `PLURNK_SERVICE_BUDGET_LARGEST_ITEMS` | How many of the heaviest retained log rows the pressured gauge names ({§context-gauge}). |
 | `PLURNK_SERVICE_LINE_ANCHOR_CONTEXT_LINES` | Minimum neighboring lines hashed on each side; repeated handles expand their context ({§line-anchor-disambiguation}). |
 | `PLURNK_SERVICE_EDIT_RECEIPT_CONTEXT_LINES` | Surrounding and landed lines shown at each EDIT result boundary ({§edit-result-receipt-projection}). |
@@ -4279,7 +4451,7 @@ flowchart LR
     release --> warm["Bounded warm grace / idle LRU"]
     warm -->|new demand| lease
     warm -->|idle bound| cool["Deactivate providers;<br/>withdraw runtime projections"]
-    interface -->|worldless call| calls
+    interface -->|daemon call| calls
     calls --> core["Core state and orchestration"]
     core --> events["subscribeToEvents<br/>(workspaceId, event, payload)"]
     events --> interface
@@ -4293,7 +4465,8 @@ modules in registration order. The daemon's listener is bound before durable adm
 ({§module-http-mounts}). Persisted workspaces with
 no durable work stay passive until first demand; activation publishes their
 complete capabilities and documentation before the demanding operation
-proceeds. `setup` is the readiness boundary for every capability registered
+proceeds. An owner's arrival is such a demand ({§methods-workspace-activate}), so a first prompt
+waits only for what remains of it. `setup` is the readiness boundary for every capability registered
 with Core: recovery may demand a workspace provider before `start`. Requests on
 the listener remain unavailable until it is admitted; a module opens any other exterior
 ingress only after recovery. No
@@ -4334,11 +4507,12 @@ An invalid module object, factory result or lifecycle member is an implementatio
 not configuration, and fails loudly. What a module contributes registers through its owning public
 interfaces and is released during {§module-lifecycle} resource teardown.
 
-§module-shutdown-order `Daemon.stop()` first rejects new capability demand and
+§module-shutdown-order `Daemon.stop()` first rejects new capability demand, cancels preparation
+under {§functionality-preparation-cancellation}, and
 aborts proposals, branches, derivations, and worker scopes. It begins module
 `stop()` calls in reverse registration order without serially awaiting them,
 so every producer is asked to stop even if another stalls. Core settles drains,
-capability publications, module producers, streaming producers, derivations,
+whole workspace activation and cooling transitions, capability publications, module producers, streaming producers, derivations,
 mimetypes, schemes, and the final worker-settlement barrier while observers
 remain subscribed. Only then does it begin and join module `close()` calls in
 reverse order. Failures do not skip later phases and join one shutdown aggregate.
@@ -4349,6 +4523,9 @@ After asynchronous selection, the supervisor rechecks shutdown before creating
 a drain or installing a timer; parked-loop wake mutations also recheck worker
 cancellation under {§worker-lifecycle-durable-disposition}.
 The database remains available through observer closure and final maintenance.
+Residency transitions are retained from stop admission through settlement, including failed
+transitions; one failure does not stop the join of other workspaces. Expected preparation
+cancellation is not a shutdown failure; genuine preparation and cleanup failures are.
 The shared deadline bounds every phase, including observer delivery; forced
 shutdown may therefore lose notifications and reports the unfinished phase.
 
@@ -4369,7 +4546,8 @@ flowchart LR
     stop[Begin stop] --> abort[Abort core producers]
     stop --> moduleStop[Begin reverse module stop]
     abort --> drains[Settle worker drains]
-    drains --> joined[Settle module producers]
+    drains --> residency[Join workspace transitions<br/>and capability publications]
+    residency --> joined[Settle module producers]
     moduleStop --> joined
     joined --> producers[Settle streaming producers]
     producers --> resources[Dispose derivations,<br/>mimetypes, and schemes]
@@ -4386,6 +4564,8 @@ published module contract.
 
 | Setup function | Contract |
 |---|---|
+| `credentials` | The {§credential-authority} on the setup seam: the issuing module publishes its face (`publish({ issuer })`) before any module starts, and every module may `verify` through it. |
+| `httpAddress()` | The address of the listener the host bound before any module set up ({§http-host}), as on the application port: the issuing module derives its issuer from it at setup, so the face it publishes answers from publication. |
 | `registerRuntimes([{ decl, executor, availability, scheme? }, ...])` | Validates the complete canonical tag set under {§executor-runtime-declaration}, then publishes every process-wide executor and optional claimed scheme facet atomically. |
 | §module-workspace-provider `registerWorkspaceCapabilityProvider(namespaceOwner, provider)` | Registers one extension-unique Functionality provider. `activate({ workspaceId, retain })` reconstructs the workspace snapshot; idempotent `deactivate({ workspaceId })` releases process resources. Core coalesces demand and supplies residency leases for work that outlives its caller. |
 | §module-workspace-state `readWorkspaceModuleState(workspaceId, namespaceOwner)` | Reads one nullable JSON state value per workspace and provider. Core owns storage and lifecycle; the provider owns its schema. Store symbolic credential references, not copied secrets. A worker-scoped family's coordinator reads and replaces the same shape per worker in `worker_module_state` ({§functionality-scope}). |
@@ -4428,7 +4608,10 @@ Settling the coordinator includes accepted refreshes waiting for that gate,
 not only work already inside a family lane.
 Explicit client mutations use `try` and fail 409 before effects while the workspace is held.
 Refused mutations reserve no queue position; a client retry is a new admission.
-An accepted model mutation uses `wait`, proceeding after its originating turn. Activation and turn-admission refresh use `none` inside
+An accepted operation mutation uses `wait`: its turn yields the shared lease
+at that operation, awaits exclusive publication, and reacquires its lease before
+dispatching the next operation. Concurrent publishers yield independently; no
+publisher waits while retaining the shared lease it needs released. Activation and turn-admission refresh use `none` inside
 their already-held demand boundary. Providers reject replacement while active
 requests, input exchanges, or Tasks depend on the old snapshot; infrastructure
 watches may be replaced. These are concurrency constraints, not creator privileges.
@@ -4450,8 +4633,11 @@ bound. Concurrent demand coalesces; cooling never closes a leased connection.
 
 Cooling withdraws live capability and releases process resources at the
 workspace boundary. Durable configuration, history, and saved entries remain.
-New demand reconstructs the one shared snapshot. Shutdown cancels warm timers
-and closes module resources through their owning provider.
+New demand reconstructs the one shared snapshot. Shutdown cancels warm timers and preparation,
+refuses new leases before database access, and joins whole activation and cooling transitions
+before releasing resources. An interrupted acquisition rejects with `AbortError`, never a usable
+lease. Cooling and activation cleanup remain joined, not cancelled.
+Cooling failures are reported; demand awaiting that transition receives its failure, not a lease.
 
 §module-workspace-residency-facet **Residency is the workspace's; processes are
 one family's facet.** The workspace is the lease unit, and every family's
@@ -4503,6 +4689,20 @@ It neither removes the old definition first nor merges omitted fields.
 | Authorization required | Publish the existing authorization-required handoff; this is not a failed preparation. |
 | Identical definition | Retain enabledness and normal attachment reuse; this is not an explicit enable/restart. |
 
+§functionality-addressing **A family may name definitions by their content.** An adapter that
+declares `addressing` supplies the input of `add` and the input of `enable`, `disable` and `remove`,
+and reads from a select input the alias it names; its alias grammar ({§functionality-adapter}) is
+the identity's own, and the generated teaching's `add` example is that input. Every other rule of
+the coordinator — ownership, enabledness, `alias-exists`, `alias-unknown`, publication, documents —
+reads the alias as that identity. The members family names its definitions by their glob
+({§members-functionality}).
+
+| Verb | Addressing family |
+|---|---|
+| `add` | Admits every definition the body names, or none: one refusal refuses the whole body. Reapplying a definition the scope holds is idempotent; a different definition under the same name is `alias-exists` (409), whose recovery is remove and add. The receipt lists the admitted definitions in body order (`definitions`) and names no one `alias`. Preparation receives them all as its admissions. |
+| `replace` | Not served: when the name is the definition there is nothing to reassign, so neither projection offers it ({§functionality-discover-advertisement}). |
+| `enable`, `disable`, `remove` | Take the family's select input; the receipt names the one alias it concerned. |
+
 §functionality-mutation-status **Mutation status describes the committed resource
 outcome, not the management invocation's stream lifetime.** Apply these rows in
 order; refusals retain their own Problems and do not commit a replacement.
@@ -4510,10 +4710,10 @@ order; refusals retain their own Problems and do not commit a replacement.
 | Outcome | Status |
 |---|---:|
 | The resulting definition requires authorization | 202 |
-| `add` or `replace` creates a local definition, including an override of an inherited definition | 201 |
-| `add` reapplies the identical local definition; `replace` assigns an existing local definition; `enable`, `disable`, or `remove` settles | 200 |
+| `add` or `replace` creates a local definition, including an override of an inherited definition; an `add` naming several ({§functionality-addressing}) creates any of them | 201 |
+| `add` reapplies the identical local definition, every one it names; `replace` assigns an existing local definition; `enable`, `disable`, or `remove` settles | 200 |
 
-`add` of a different local definition remains `alias-exists` (409); `replace` is explicit.
+`add` of a different local definition remains `alias-exists` (409); `replace` is explicit where a family serves it.
 Model invocation settlement follows {§functionality-model-mutation} independently.
 
 §functionality-discover-advertisement **A family's `discover` advertises exactly the inputs it
@@ -4616,7 +4816,7 @@ state without demand; `workspace/preparation` broadcasts
 | Boundary | Visible state |
 |---|---|
 | Preparation begins | Family, `phase: preparing`, `alias: null`, UTC `since` |
-| Adapter calls `progress(alias)` | Enabled alias being prepared; a fresh `since` |
+| Adapter reports the aliases it is preparing | One activity per alias, each keeping the `since` it began; an alias leaves when a later report omits it, so aliases prepared at once are listed together |
 | Prepared candidate enters publication | `phase: publishing`, `alias: null` |
 | Commit, rejection, or rollback settles | Family removed; empty array means no preparation |
 
@@ -4727,7 +4927,8 @@ reserved or masked name is no resource. The family's manager exposes it as the f
 the value its commands receive now, FIND lists the names in effect and a pattern on it matches
 values, COPY carries a value out. The manager's own output streams, eight hexadecimal characters
 ({§execution-output-identity}), stay the executor's. A write is the Worker's own layer, never the
-workspace's or the operator's: EDIT sets the whole value through the family's `replace` for the
+workspace's or the operator's (the runtime worker keeps none, so a person's write is the workspace's,
+{§actor-boundary-client-operations}): EDIT sets the whole value through the family's `replace` for the
 Worker, and KILL retires the name from the Worker's commands — `remove` for an entry the Worker
 owns, which restores an inherited value, `disable` for an inherited one, which keeps its
 definition. Admission is the family's ({§env-functionality}) and its refusal is the operation's
@@ -4739,7 +4940,9 @@ effect is `entry-not-found` (404) on READ and KILL alike.
 §functionality-scope **A family declares its supported scopes.** Skills, MCP, members
 and outbound A2A describe what exists in a **workspace**: a capability, resident or installable,
 that every Worker there shares. Environment describes how one **Worker** works — context rather
-than capability — with worker overrides above workspace defaults. The adapter declares
+than capability — with worker overrides above workspace defaults. A context family's definitions are read where they
+are used, so a change at either scope holds nothing resident and takes no workspace exclusivity: it serializes on
+the family's lane. The adapter declares
 `scopes` (absent means `["workspace"]`; the first is the model default), and the
 coordinator keys durable state and the locally-owned `origin`
 by it: a workspace-scoped family's own entries carry origin `workspace`, a worker-scoped
@@ -4826,20 +5029,27 @@ A family that ships no file has a header-only document. Registration also
 validates the adapter's taught `add` example against the `add` input schema it
 teaches, so a wrong example fails boot rather than the model.
 
-§functionality-model-mutation **An accepted mutation completes through its ordinary
-execution stream.** Preparation and publication share the family's serialized
-lane. Publication acquires workspace exclusivity after current turns release
-their leases; the invoking stream remains pending until publication completes.
+§functionality-model-mutation **Subsystem commands settle in authored order.**
+Every manager verb, including inspection, completes before dispatch proceeds;
+later operations observe earlier successful configuration changes. These
+core-owned commands use ordinary proposals and durable execution outputs, but
+not the background-execution slot pool. Preparation and publication share the
+family's serialized lane. Resident publication uses the lease handoff in
+{§module-workspace-quiescence}; context-only families retain their existing
+scope-local serialization. The invoking operation and its output remain pending
+until settlement; they never acknowledge merely starting a future commit.
 It then reports `active`, `unavailable`, or `authorization-required`, or the exact
 publication failure. Resource readiness is not execution liveness: a mutation's
 `202 authorization-required` body remains exact, while the finished manager
 execution closes with `200`. It does not wait for sign-in. A preparation failure may publish enabled-but-unavailable
-state for other mutations, but `replace` rejects it ({§functionality-replacement}); a publication failure never reports a successful mutation. Stream polling,
-waiting, and result observation use the ordinary execution lifecycle, without a
+state for other mutations, but `replace` rejects it ({§functionality-replacement}); a publication failure never reports a successful mutation. Result observation uses the ordinary execution lifecycle, without a
 separate deferred-commit queue. An explicit client action publishes now, rejects
 a failed preparation, and fails 409 while the workspace is held
 ({§module-workspace-quiescence}). Rejecting a proposal prepares, persists, and
-publishes nothing.
+publishes nothing. Cancellation removes queued publication and aborts preparation
+before publication; an already-started atomic publication is joined, never
+abandoned partway through. Shell commands, remote tools, WORK/FORK and streaming
+READ retain their deliberately asynchronous contracts ({§op-synchronous}).
 
 ## §methods Application interface
 
@@ -4851,34 +5061,36 @@ Core's behavior behind them.
 | Area                                              | Function | Core contract |
 |---------------------------------------------------|----------|---------------|
 | §methods-event-subscribe Events                   | `subscribeToEvents(handler) -> unsubscribe` | Subscribes to the raw event source in {§notifications}. A subscriber failure is logged and cannot re-enter engine control flow. |
+| §methods-credentials Credentials                  | `credentials` | The {§credential-authority}: `issue`, `verify`, `consume`, `revokeFamily`, `onRevoked` and the sign-ins of a subject by `sessions` ({§credential-sessions}), and a module's own client by `registerClient`, `client` and `authenticateClient` ({§credential-module-client}); one in-memory authority per daemon, offered to every module on the seam. |
 | §proposal-list Proposals                          | `pendingProposals(workspaceId)` | Intersects durable proposed rows with the lifecycle owner's live resolution waiters, then returns their validated {§proposal-projection}; persistence alone cannot advertise an unresolvable client interrupt. |
 | §methods-proposal-resolve Proposals               | `resolveProposal(logEntryId, resolution, owner)` | Validates the workspace-scoped owner before delivering one accept, reject, or cancel decision. Unknown, mismatched, and already-resolved identities fail without consuming the gate; the adapter authenticates its owner identity. |
 | §client-interaction-list Client interactions      | `pendingClientInteractions(workspaceId)` | Intersects durable interaction rows with their live operation waiters and returns the contracts-owned projection; a row alone is not a resumable interaction. |
 | §methods-client-interaction-resolve Client interactions | `resolveClientInteraction(interactionId, resolution, respondent, message?)` | Validates the recorded recipient before delivering one resolved payload or cancellation. Unknown, mismatched, and already-resolved identities fail before affecting an operation. |
 | §methods-loop-run Loops                           | `runLoop({ workspaceId, workerId, loopId?, prompt, source?, maxTurns?, openPaths?, selector?, childSelector? })` | Validates a model worker and persists the request with the effective turn ceiling, then returns an immediate status-100 acknowledgement with `loopId` and `action`. An explicit Loop recipient follows {§loop-addressed-admission}. A trusted adapter may identify the prompt's causal actor with one canonical `source`; ordinary clients cannot author it through their protocol surface. Messages carry no approval authority. The exact terminal result arrives only through `loop/terminated`; parking and resuming do not replace the loop. |
-| §methods-loop-cancel Loops                        | `cancelDrain(workerId, reason?)`; `cancelWorker({ workspaceId, workerId, reason? })` | `cancelDrain` begins durable structured cancellation and reports whether process-local work existed when called; queued or parked durable work is still terminalized when it is `false`. The ownership-bounded `cancelWorker` awaits that same tree cancellation and stream reap, so an exterior protocol can project the settled durable result without polling or fabricating state. |
-| §methods-op-mirror Client dispatch                | `dispatchClientAction({ workspaceId, workerId, statements })` | Dispatches already-parsed grammar statements as one client action in one administrative loop in the client worker, executing in the workspace's Functionality ({§actor-boundary-attached-functionality}). Every statement is an ordered client/operation turn, and every committed `log/entry` is emitted before the action promise resolves; a proposal may keep its turn, loop, and action promise open until resolution. Core exposes no per-op method family. |
-| Client observation                                | `look({ workspaceId, workerId, statement, perspectiveWorkerId? })` | Runs an already-parsed READ through the full resolver in the workspace's Functionality without a log row. A non-READ statement is rejected ({§op-look}). |
-| §methods-log-read Reads                           | `readLog({ workspaceId, workerId, ...coordinate })` | Ownership-checks the worker, then reads by ids, recency, or the complete `loopSeq`/`turnSeq`/`sequence` display coordinate. An omitted `limit` is `PLURNK_SERVICE_LOG_READ_PAGE`, and any `limit` is capped at `PLURNK_SERVICE_LOG_READ_MAX`. |
+| §message-idempotency Message admission           | `messageAdmission({ workspaceId, address, body })` | A client message's address is its idempotency key ({§message-source-scheme}): `new` when nothing is accepted there, `accepted` when the same body is, so a repeat attaches to what the message started instead of admitting it twice; another body under an accepted address is refused, 422 `message-address-reused`, creating nothing. `runLoop` refuses every repeat it is handed: other words 422 `message-address-reused`, the same words 409 `message-already-accepted`, a duplicate racing the original. |
+| §methods-loop-cancel Loops                        | `cancelDrain(workerId, reason?)`; `cancelWorker({ workspaceId, workerId, reason? })`; `cancelLoop({ workspaceId, loopId, reason? })` | `cancelDrain` begins durable structured cancellation and reports whether process-local work existed when called; queued or parked durable work is still terminalized when it is `false`. The ownership-bounded `cancelWorker` awaits that same tree cancellation and stream reap, so an exterior protocol can project the settled durable result without polling or fabricating state. `cancelLoop` cancels exactly one client operation ({§connection-lifecycle}): its dispatch while that runs, and every attached execution its rows started that still runs, then reports whether any of it was running; nothing else in the runtime worker shares its scope. |
+| §methods-op-mirror Client dispatch                | `dispatchClientAction({ workspaceId, actor, contextWorkerId?, statements, onLoop? })` | Dispatches already-parsed grammar statements as one client operation of `actor` ({§connection-lifecycle}), in the workspace's Functionality ({§actor-boundary-attached-functionality}), reading `log:///` in `contextWorkerId`'s log ({§actor-boundary-client-operations}). `onLoop` hears the operation's loop before any statement runs. Every statement is an ordered client/operation turn, and every committed `log/entry` is emitted before the promise resolves. Core exposes no per-op method family. |
+| §methods-log-read Reads                           | `readLog({ workspaceId, workerId, ...coordinate })` | Ownership-checks the worker, then reads by ids, recency, or the complete `loopSeq`/`turnSeq`/`sequence` display coordinate, newest first. `sinceId` keeps rows after an id and `beforeId` rows before one, so a reader pages back through the whole log one page at a time. An omitted `limit` is `PLURNK_SERVICE_LOG_READ_PAGE`, and any `limit` is capped at `PLURNK_SERVICE_LOG_READ_MAX`. |
 | §methods-entry-read Reads                         | `readEntry({ workspaceId, workerId, target, channel?, offset? })` | Resolves the selector from that worker's perspective and returns {§entry-read-result}, either complete or as one channel suffix, without creating action evidence. |
 | Providers                                         | `listProviders()` | Lists configured aliases with provider/model identity, active state, and the effective provider-derived `inputCapacity` when known. |
 | Model catalog                                     | `listModels(query)` | Returns one validated bounded {§model-catalog-wire} page under {§model-catalog}; performs no provider request or selection. |
 | Client capabilities                               | `listClientDisplayCapabilities()` | Composes sorted scheme declarations ({§manifest-client-display}) followed by sorted MIME declarations ({§mimetype-client-display}) into the validated shared wire ({§client-display-capabilities}). The internal `exec` operation handler is excluded; its addressable runtime-tag scheme faces remain included. |
-| §methods-workspace-create Workspace lifecycle     | `createWorkspace({ name?, projectRoot?, settings? })` | Validates `settings` through {§operator-config-workspace-settings}, creates the world and its client envelope, and emits global `workspace/created`. Creation and attachment are passive: neither starts derivation nor activates workspace Functionality. `projectRoot` is established here or the workspace remains headless. |
-| §methods-workspace-attach Workspace lifecycle     | `attachWorkspace({ workspaceId, workerId?, workerName? })` | Validates ownership and returns a client envelope for an existing world. It does not retain caller or transport binding state in core. |
-| §methods-model-worker Workspace lifecycle         | `ensureModelWorker(workspaceId)` | Returns the workspace's stable default model worker, creating it on first use. A durable default-conversation role identifies it independently of worker name and root creation order. Repeated and concurrent calls return the same root; fresh conversations and forks do not replace it. |
-| §methods-conversation-worker Workspace lifecycle  | `createConversationWorker({ workspaceId, name?, parentWorkerId?, owner? })` | Creates a distinct model-origin worker with empty history. A root may name a registered owner; a child names its parent and inherits ownership. Supplying both parent and owner is invalid ({§worker-owner-creation}). |
+| §methods-workspace-create Workspace lifecycle     | `createWorkspace({ name?, projectRoot?, settings? })` | Validates `settings` through {§operator-config-workspace-settings}, creates the workspace and returns its client envelope, minting no worker, and emits global `workspace/created`; with a project root and no name it names and selects the workspace under {§workspace-name}, emitting `workspace/created` only for a workspace it created. Creation and attachment are passive: neither starts derivation nor activates workspace Functionality. `projectRoot` is established here or the workspace remains headless. |
+| §methods-workspace-attach Workspace lifecycle     | `attachWorkspace({ workspaceId } \| { name } \| { projectRoot })` | Exactly one selector returns an existing workspace's client envelope, minting and activating nothing. Names are literal lookups, including previously admitted names. An absolute project root selects its folder-derived default name ({§workspace-name}), not a workspace by its stored folder. An absent target is `404 workspace-not-found`; ambiguous or absent selectors are `400 identity-invalid`. It retains no caller or transport binding state. |
+| §methods-workspace-activate Workspace lifecycle   | `activateWorkspace({ workspaceId })` | Makes the demand a turn makes, without a turn: a cold workspace activates and publishes its complete capabilities; a concurrent demand shares that one activation; it resolves once the workspace is active and leaves it warm under `PLURNK_SERVICE_WORKSPACE_WARM_MS`. Creation and attachment stay passive; an owner's arrival calls it ({§agui-owner-activation}). |
+| §methods-worker-create Workspace lifecycle  | `createWorker({ workspaceId, name?, parentWorkerId?, owner? })` | Creates a distinct model-origin worker with empty history. A root may name a registered owner; a child names its parent and inherits ownership. Supplying both parent and owner is invalid ({§worker-owner-creation}). |
 | Worker ownership | `registerWorkerOwner(workspaceId, { address, tools, interactive })` | Declares or replaces an owner's supported client-tool names and whether a person attends it, in that workspace; `_plurnk` is reserved. |
 | Worker ownership | `claimWorkerOwner({ workspaceId, workerId, owner })` | Claims only runtime-owned work under {§worker-ownership}, returning its effective owner. The owner must already be registered. |
 | Runtime actor | `ensureRuntimeWorker(workspaceId)` | Returns the workspace's `_plurnk` actor, creating it if absent; it always retains runtime ownership. |
-| Workspace lifecycle                               | `forkWorker({ workspaceId, workerId, name? })` | Creates a child worker that branches the source worker's history while sharing workspace state. |
-| §methods-workspace-rename Workspace metadata      | `renameWorkspace(workspaceId, name)` | Changes only the world's unique mutable name; workers, log, and membership remain intact. |
-| §methods-workspace-prompts Workspace metadata     | `listPrompts(workspaceId, limit?, workerId?)` | Returns nonempty loop-seed prompts a client addressed to the workspace's model workers, newest-first; `workerId` narrows to one worker. Authorship is the seed message's address ({§message-arrival}): a worker-issued seed (WORK, FORK, SEND to a worker) has none and is never history, whichever worker it seeded; a client prompt at a forked conversation worker is. An omitted limit is `PLURNK_SERVICE_PROMPTS_PAGE`. |
-| Workspace metadata                                | `listWorkspaces()`, `workspaceDerivationStatus(...)` | Reads current workspace identity and derivation progress. |
-| §methods-worker-read Worker topology              | `readWorker({ workspaceId, identity })` | Ownership-bounds an exact id-or-name lookup and returns one durable Worker projection or `null` under {§application-worker-observation}. Supplying both identities or neither is invalid. |
-| §methods-worker-list Worker topology              | `listWorkers(workspaceId, query?)` | Returns the workspace's durable Worker projections under {§application-worker-observation}. The origin filter is exact; an explicitly present `parentWorkerId` filters roots (`null`) or one immediate parent (id), while omission returns every lineage position. Each projection carries `kind` (`conversation`, `fork` for a child with a fork boundary, `work` for any other child) and `lifecycle`, the representative work loop's status through {§loop-lifecycle-vocabulary} (`idle` with no work loop), so a directory row shows the same lifecycle glyph the bound worker's own status gauge shows; clients infer neither (#523). |
-| §methods-worker-loops Loop lifecycle              | `listWorkerLoops({ workspaceId, workerId })` | Ownership-checks the Worker and returns its Loops in sequence order under {§application-loop-observation}, including the validated exact terminal result when one exists. It performs no scheduling or event replay. |
-| §methods-worker-descendants Descendant spend       | `descendantAccounting({ workspaceId, workerId, loopId })` | Ownership-checks the Worker and returns the {§provider-accounting} projection of every settled request on a loop that a descendant of the Worker (`parent_worker_id`, to any depth) ran after `loopId` — this delegation's spend, the same tree the turn cap counts ({§turn-cap-counts-the-tree}). The Worker's own loop is never included: its accounting stays {§notifications-loop-terminated}'s. `loopId: null` is the empty projection, explicit zero. Derived from the request ledger on every read ({§tokenomics-provider-usage}); no rollup, no second store. |
+| Workspace lifecycle                               | `forkWorker({ workspaceId, workerId, name? })` | Creates a child worker that branches the source worker's history while sharing workspace state. The source is a model worker, else `409 model-worker-required` ({§machine-processes-worker-origin}). |
+| §methods-workspace-rename Workspace metadata      | `renameWorkspace(workspaceId, name)` | Changes only the workspace's unique mutable name, under the admission of {§workspace-name}; workers, log, and membership remain intact, and a refused name changes nothing. |
+| §methods-workspace-rollback Workspace files      | `rollback({ workspaceId, workerId, actor, to })` | Reverses `workerId`'s settled file mutations after its coordinate `to` as one client operation of `actor` ({§rollback}, {§connection-lifecycle}); answers a `RollbackReport`. |
+| §methods-workspace-prompts Workspace metadata     | `listPrompts(workspaceId, limit?, workerId?)` | Returns nonempty loop-seed prompts a client addressed to the workspace's model workers, newest-first; `workerId` narrows to one worker. Authorship is the seed message's address ({§message-arrival}): a worker-issued seed (WORK, FORK, SEND to a worker) has none and is never history, whichever worker it seeded; a client prompt at a forked model worker is. An omitted limit is `PLURNK_SERVICE_PROMPTS_PAGE`. |
+| Workspace metadata                                | `listWorkspaces()`, `workspaceDerivationStatus(...)` | Reads current workspace identity, with each folder and its label ({§workspace-label}), and derivation progress. |
+| §methods-worker-read Worker topology              | `readWorker({ workspaceId, identity })` | Ownership-bounds an exact id-or-name lookup and returns one durable Worker projection or `null` under {§application-worker-observation}. Supplying both identities or neither is invalid. Any non-empty name is looked up, the runtime worker's `_plurnk` included: the lookup is no minting door ({§worker-name-minting}). |
+| §methods-worker-list Worker topology              | `listWorkers(workspaceId, query?)` | Returns the workspace's durable Worker projections under {§application-worker-observation}. The origin filter is exact; an explicitly present `parentWorkerId` filters roots (`null`) or one immediate parent (id), while omission returns every lineage position. Each projection carries `kind` (`root` for a worker with no parent, `fork` for a child with a fork boundary, `work` for any other child) and `lifecycle`, the representative work loop's status through {§loop-lifecycle-vocabulary} (`idle` with no work loop), so a directory row shows the same lifecycle glyph the bound worker's own status gauge shows; clients infer neither (#523). |
+| §methods-worker-loops Loop lifecycle              | `listWorkerLoops({ workspaceId, workerId })` | Ownership-checks the Worker and returns its Loops in sequence order under {§application-loop-observation}, including the validated exact terminal result when one exists, and each Loop's `invocation`: `{ workerId, address }`, the Worker and the log address ({§methods-invocation}) of the operation that sent the Loop's first message ({§worker-obligations}), or null when a person, a client, a peer or the daemon sent it. It performs no scheduling or event replay. |
+| §methods-worker-accounting Worker spend       | `workerAccounting({ workspaceId, workerId })` | Ownership-checks the Worker and returns the {§provider-accounting} projection of every settled request on any loop the Worker or a descendant of it (`parent_worker_id`, to any depth) ran, since the Worker began: its own spend and its delegations', the same tree the turn cap counts ({§turn-cap-counts-the-tree}). Nothing spent is explicit zero. One loop's own accounting stays {§notifications-loop-terminated}'s. Derived from the request ledger on every read ({§tokenomics-provider-usage}); no rollup, no second store. |
 | Extension actions | `listModuleActions()`, `invokeModuleAction(name, params, context)` | Lists setup-registered `{ name, scope, inputSchema, outputSchema }` descriptors in sorted order. Invocation requires a context matching the registered scope; missing names, forged scope, and missing workspace identity fail before the owner runs. Handler values remain opaque to core. |
 
 §methods-loop-run-fold-consistency **A folded prompt cannot silently reconfigure
@@ -4914,19 +5126,17 @@ If an unpublished message is promoted into subsequent work under
 {§message-loop-containment}, its selected paths travel with it.
 
 §methods-rebind **Binding belongs to the client-interface module.** Core's
-workspace lifecycle calls return exactly the workspace and selected client actor
-(`workspaceId`, `workspaceName`, `projectRoot`, `workerId`, `workerName`); they
-carry no conversation-worker or action-loop binding. Core retains no connection,
-thread, or current-workspace mapping. A module may replace its own binding with a
-later create or attach result without requiring a new transport; it resolves the
-conversation worker separately, while each client action allocates its own
-administrative loop under {§connection-lifecycle}.
-
-§methods-worker-name-admission **Client worker-name admission.** Attach,
-fresh-conversation, and fork apply {§worker-name-minting} before lookup or
-creation. A client therefore cannot forge or resume the runtime actor (its
-name lies outside `WORKER_NAME`), insert a non-mintable spelling, or make the
-client registry diverge from model worker control.
+workspace lifecycle calls return exactly the workspace (`workspaceId`,
+`workspaceName`, `projectRoot`, `projectLabel`); they carry no worker, bound-worker
+or operation-loop binding. Core retains no connection, thread, or current-workspace
+mapping. A module may replace its own binding with a later create or attach result
+without requiring a new transport; it resolves the bound worker separately, while
+each client operation allocates its own administrative loop under {§connection-lifecycle}.
+
+§methods-worker-name-admission **Worker-name admission.** Worker
+creation and fork apply {§worker-name-minting} before lookup or creation. A client therefore cannot forge or resume the runtime actor (its
+name lies outside `WORKER_NAME`) or create a worker under a spelling model worker control
+could not mint.
 
 §capability-admission **One admission path owns external authority.** Core
 derives one or more `CapabilityDescriptor` demands from each routed statement,
@@ -4963,7 +5173,7 @@ resolver.** Workspace capability actions return the contracts-owned
 their normalized effective intersection. The same resolver governs dispatch
 and packet shaping. Replacement preserves unrelated workspace settings. Before their next operation
 or observation, existing workers reconcile generated references against it. It requires no selected
-conversation worker and returns the complete fresh projection.
+bound worker and returns the complete fresh projection.
 
 §question-tool **The native request-user-input tool.** Core registers one
 in-process `question` runtime at boot and offers it only to a worker whose owner
@@ -5026,7 +5236,7 @@ packets or state snapshots.
 owns one durable model, persisted as a nullable `model_routes` foreign key.
 Concurrent first selections of the same resolved tuple share one identity;
 an insertion conflict returns the existing route without changing its fields.
-The root conversation worker is seeded once — from an explicit selection, else
+A root model worker is seeded once — from an explicit selection, else
 the daemon default — and never re-seeded from a later default change. A
 deliberately modelless daemon leaves the worker unset and rejects model work
 until an explicit selection. Starting a loop snapshots the worker's resolved
@@ -5035,7 +5245,7 @@ continue from the loop snapshot and never re-resolve through the alias
 cascade. A WORK/FORK child copies the spawning loop's effective spawn model
 (spawn override ?? model) onto the new worker by value at creation; it retains
 no live link and begins with no override, so a later parent change affects
-only that worker's future loops and descendants. Client operation actors and
+only that worker's future loops and descendants. The runtime worker and other
 Plurnk-owned bookkeeping workers run no model loops and own no model
 selection; the model, spawn-override, and effort controls refuse them with
 `409 model-worker-required` before any policy row is initialized or written. An explicit model, spawn-override, or effort change while
@@ -5117,26 +5327,40 @@ beside database ids, so a client can render and resolve the logical `L/T/S`
 coordinate without fetching all rows and matching locally.
 
 §methods-log-entry-wire **Log entry wire fidelity.** `readLog` and `log/entry`
-preserve causal `source` and parse the row's JSON `attrs` into structured data.
+preserve causal `source` and the row's lifecycle `state` (`proposed` while a proposal awaits its
+decision, then `resolved`, `failed` or `cancelled`), and parse the row's JSON `attrs` into structured data.
 Client interfaces do not reconstruct these fields from operation or origin.
 
 §methods-readable-reasoning **Readable provider reasoning remains derived
-provider evidence.** On model SEND and disposition rows, `readLog` and `log/entry`
-project a nonempty admitted `packet.assistant.reasoning` as the optional
-`reasoning` field. The durable packet remains the sole stored representation;
+provider evidence.** On a turn's first model operation row, `readLog` and `log/entry`
+project the turn's nonempty admitted `packet.assistant.reasoning` as the optional
+`reasoning` field, from the row's first announcement; no other row repeats it. Beside it,
+`reasoning_model_call_id` and `reasoning_request_sequence` name the request that streamed it (the
+turn's accepted model call and that call's response request), so a client can match the reasoning it
+watched stream; history a FORK inherited was streamed by no request of this worker and names none. The durable packet remains the sole stored representation;
 core does not copy readable reasoning into log attributes or bodies. A turn
 without readable reasoning omits the field.
 
-§op-look **LOOK ownership.** A client-interface module owns the public LOOK
-spelling and grammar parsing. It rewrites a valid LOOK statement to READ and
-hands the AST to core's `look`; core owns the full resolver and the no-log
-invariant. The internal closed, rowless observation segment supplies an honest
-numeric loop coordinate for relative `log:///` addressing without leaving
-active lifecycle behind. The segment belongs to the acting worker (`workerId`);
-the READ resolves `log:///` as `perspectiveWorkerId` when one is given; explicit source
-authorities retain their identity under {§turn-source-resources}. A client can look at a conversation without
-adding a loop to it. LOOK text anchors resolve through the same
-{§line-anchors} path as READ.
+§methods-invocation **A row that discharges an obligation names the operation that opened it.** `readLog`
+and `log/entry` project `invocation`, the log address of that operation ({§worker-obligations}), on every
+row that discharges one, so a client pairs the answer with its call without matching addresses:
+
+| Discharging row | Its invocation |
+|---|---|
+| A stream observation ({§exec-stream}) | The execution, as its subscription recorded it ({§subscriptions-causal-resource}) |
+| A child's conclusion ({§env-delta-child-termination}) | The operation that sent the first message of the concluded loop |
+| A completion reply delivered to the sender ({§message-reply-delivery}), including {§message-abandonment} | The operation that sent the message it completed |
+
+Each is derived from what the row records: the publication it advanced, or the occurrence it materialized.
+A message names an invocation only to the worker whose operation sent it; history a FORK inherited names the
+same invocation as its original, at the same coordinate. The row's own `source` keeps its attribution meaning
+({§env-delta-attribution}). An obligation whose opener was not recorded, and every other row, omits the field.
+
+§methods-answering **A reply names the operation that sent the message it answers.** `readLog` and `log/entry`
+project `answering` on a reply delivered to the worker whose operation sent the message ({§message-reply-delivery}):
+that operation's log address, whether the reply completes the message or reports progress. A completion reply
+names the same address as its `invocation`. A reply to a message this worker did not send, such as another actor
+answering a message in this worker's inbox, omits the field, as does every other row.
 
 ### §notifications Core events
 
@@ -5144,13 +5368,13 @@ adding a loop to it. LOOK text anchors resolve through the same
 |--------------------------------------------------------------|---------|------------|
 | §notifications-operation-event `operation/event` | `ApplicationOperationEvent`: `{ workerId, loopId, turnId, sequence, origin, projectRoot, statement, phase, result? }` | One admitted dispatch starts before capability/proposal admission and settles after its durable receipt(s). Only the settled phase has `result`, the exact returned operation result. Resource fan-out is one dispatch ({§bulk-resource-targeting}); BARE starts before prompt preparation and settles after ordered receipt persistence. Automatic stream observations and log writes are not dispatches. An asynchronous executor's successful dispatch does not assert process exit. An internal exception that prevents settlement has no invented result event. |
 | §notifications-log-entry-notify `log/entry`                  | `{ entry: LogEntry }` | A non-proposed `log_entries` row is committed, or a proposed row reaches terminal settlement under {§proposal-proposed-hidden}. Delivery completes before a later event may terminate the owning Loop. |
-| §notifications-loop-terminated `loop/terminated`             | `{ workerId, loopId, result, hitMaxTurns, turnIds, usage: { accounting, curationWeight, curationBudget, contextTokens, contextCapacity, meta }, attributions }` | One loop reaches a terminal state. `result` is the exact universal operation result, including its RFC 9457 Problem Details on failure. `accounting` is the loop's contracts-owned {§provider-accounting}; the two curation facts and two physical-context facts follow {§tokenomics-client-gauge}; `meta` is that turn's opaque provider bag. `attributions` is the sorted union of exact provider-request evidence ({§attribution}), separate from accounting. Worker and loop are an inseparable owning coordinate. |
+| §notifications-loop-terminated `loop/terminated`             | `{ workerId, loopId, result, hitMaxTurns, turnIds, usage: { accounting, curationWeight, curationBudget, contextTokens, contextCapacity, meta }, attributions, terminatedAt }` | One loop reaches a terminal state. `terminatedAt` is the loop's own stamp in Unix milliseconds, the one a projection reads ({§application-loop-observation}). `result` is the exact universal operation result, including its RFC 9457 Problem Details on failure. `accounting` is the loop's contracts-owned {§provider-accounting}; the two curation facts and two physical-context facts follow {§tokenomics-client-gauge}; `meta` is that turn's opaque provider bag. `attributions` is the sorted union of exact provider-request evidence ({§attribution}), separate from accounting. Worker and loop are an inseparable owning coordinate. |
 | §notifications-loop-packet `loop/packet`                     | `{ workerId, loopId, packetCount }` | One provider packet becomes durable. `packetCount` is the exact count of packet-bearing turns in that Loop; packetless producer turns and physical provider retries never contribute. |
 | §notifications-loop-proposal `loop/proposal`                 | contracts-owned `ProposalProjection` | Dispatch pauses on a durable 202 proposal. `disposition` is the sole authority for whether a client presents review UI; live and reconnect share {§proposal-projection}. |
 | §notifications-loop-interaction `loop/interaction`           | contracts-owned `ClientInteractionProjection` | An operation is paused on client input. Live delivery and reconnect discovery share {§client-interactions}; workspace scope remains the event envelope. |
 | §notifications-workspace-created `workspace/created`         | `{ id, name, projectRoot }` | A workspace is created. This is the only current global event. |
 | `workspace/preparation` | `{ workspaceId, preparation: FunctionalityPreparationActivity[] }` | Workspace capability preparation changes; snapshot and clearing semantics follow {§functionality-preparation-visibility}. |
-| §notifications-stream-event-on-channel-change `stream/event` | `{ entryId, workerId, target, channel, state, contentLength, mimetype?, loop_seq?, turn_seq?, sequence? }` | Channel content grows or channel state transitions. `workerId` is the initiating actor used for conversation routing, never entry ownership or access control. `target` is the canonical resource URI. Optional numeric coordinates identify the causal log item, independently of that URI. Core-managed channel writes include the current stored `mimetype`, which may change per call ({§channel-mimetype}); the generic extension notification capability does not require it. It carries metadata, not content; consumers read bytes by canonical workspace address. |
+| §notifications-stream-event-on-channel-change `stream/event` | `{ entryId, workerId, target, channel, state, contentLength, mimetype?, loop_seq?, turn_seq?, sequence? }` | Channel content grows or channel state transitions. `workerId` is the initiating actor used for routing to the bound worker, never entry ownership or access control. `target` is the canonical resource URI. Optional numeric coordinates identify the causal log item, independently of that URI. Core-managed channel writes include the current stored `mimetype`, which may change per call ({§channel-mimetype}); the generic extension notification capability does not require it. It carries metadata, not content; consumers read bytes by canonical workspace address. |
 | §notifications-stream-concluded `stream/concluded`           | `{ entryId, workerId, target, subscriptionId, scheme, result, summary, wakeAction, loop_seq?, turn_seq?, sequence? }` | A subscription closes. `workerId` identifies the initiating actor; `target` is the canonical resource URI. Optional numeric fields identify the causal log item, never parsed from `target`. Exact result truth is preserved. `wakeAction` reports `wake-pending` before settlement, `no-op-active-loop` when work is already executing, `no-loop`, or `skipped-aborted`/`skipped-cancelled` for an aborted worker scope. A pending wake predicts neither execution nor recipient count; subsequent ordinary loop events report actual progress and completion. |
 | §notifications-notice-event `notice/event`                   | `{ workerId, loopId, notice: Notice }` | A transient observation or progress notice occurs. `workerId` owns loop activity; only workspace derivation progress uses `null` with `loopId=0`. It cannot alter durable history, scheduling, recovery, or model-visible failure truth. |
 | §notifications-outside-event `outside/event`                 | `{ workerId, loopId, turnId, coordinate, text, tokens }` | An admitted emission carried text outside every operation ({§outside-text}): once per admitted emission, the exact stored text, its packet weight, and the turn's `<worker>-<loop>-<turn>` coordinate. It is transient presentation evidence; the turn's `outside` source remains the durable authority. |
@@ -5173,21 +5397,66 @@ the authoritative scope and is `null` only for a global event. Core does not
 mutate each payload to repeat it. A transport module stamps that scope onto any
 outward envelope that requires it and owns workspace fan-out.
 
-### §connection-lifecycle Client action evidence
+### §worker-external-reference External worker references
+
+An adapter's `(namespace, reference)` identifies one durable model worker. Both strings are opaque
+to core; protocol syntax belongs to the adapter. `readWorkerReference` returns its workspace and
+worker IDs or null, without creating anything. `ensureWorkerReference` returns the same identity,
+atomically creating an ordinary folderless workspace and root model worker if absent. Names follow
+{§workspace-auto-name} and {§worker-auto-name}; no owner is claimed and no work starts.
 
-A module client is an actor ({§machine-processes}). Its dispatched side effects
-write to its own client worker with `origin="client"` and execute in the
-workspace's Functionality
-({§actor-boundary-attached-functionality}); one client action owns
-one administrative loop, and its statements become ordered operation turns
-inside that loop. A proposal may hold its turn and loop across an external
-interrupt/resume, but those records preserve durable evidence rather than
-defining the public client lifecycle. Multiple client actors have distinct workers.
+The association is immutable while its worker exists. Concurrent allocation creates exactly one
+workspace, worker and association; failure leaves none. Renaming a workspace, changing approval
+ownership, reconnecting or restarting does not change the association. Worker deletion removes it
+through its foreign key. Namespaces isolate adapter identities, not authorization: the daemon
+remains one trust domain. `listWorkerReferences` inspects one namespace's references to a worker,
+bounded by its workspace. New workspace creation emits the ordinary `workspace/created` event.
 
-`runLoop` targets a separate model worker holding the conversation with
-`origin="model"`. Both workers share workspace state, while a packet renders
-only the model worker's private log; client action rows are structurally absent
-without an origin filter ({§actor-boundary-isolation}).
+### §connection-lifecycle Client operations
+
+A worker is a model's identity. A person's client operations (an execution, typed
+statements, a rollback's compensations) are the workspace's, so each journals in the
+workspace's runtime worker `_plurnk`, created when absent, and executes in the workspace's
+Functionality ({§actor-boundary-attached-functionality}). Binding a workspace mints nothing.
+
+| | A model worker | A client operation in `_plurnk` |
+|---|---|---|
+| Who acted | the worker | the person its loop names ({§actor-boundary-client-operations}) |
+| Who answers its proposals | the worker's owner reviews them | nobody: it is that person's decision already ({§proposal-disposition}) |
+| Who answers its clarifications | its owner, while it can ({§client-interaction-routing}) | nobody: the runtime's owner receives no client tool, so an interaction the operation needs fails at once as unsupported |
+| What is cancelled and observed together | the worker's loops | the operation's own administrative loop |
+| What its `env:///` means | its own layer, above the workspace's | the workspace's layer; `_plurnk` keeps none ({§env-scheme}) |
+| Whose voice its messages carry | its own | the person's, as a thread message's is |
+| Whose log its log addresses and FORK mean | its own | the worker the person acts for: read and branched, never curated |
+| What its WORK starts | its own child | a root worker the person owns |
+
+One client operation owns one administrative loop, and its statements become ordered
+`client` operation turns inside it. The loop carries its own cancellation scope, and
+nothing else in `_plurnk` (another person's operation, the daemon's narration, a hosted A2A
+task) shares it. `cancelLoop` cancels that operation alone: a dispatch still running
+ends `operation-cancelled`, as does its loop, and every attached execution its rows started
+that still runs is reaped ({§worker-lifecycle-total-reap}), its stream concluding aborted even
+after the loop settled. A detached execution is nobody's obligation, and `cancelLoop` leaves it
+running. Shutdown cancels every operation the same way.
+
+`runLoop` targets a model worker with `origin="model"`. A packet renders only that
+worker's private log, so a client operation's rows are structurally absent from every
+model's packet ({§actor-boundary-isolation}); a person reaches a model through a message.
+
+§actor-boundary-client-operations **A client operation acts on workspace resources, attributes messages
+to its person, and reads a log in the context of one worker.** Its loop's `promptSource`
+({§methods-worker-loops}) is the acting person's canonical address, the form arrivals use
+({§message-causal-source}); the daemon's own loops in `_plurnk` have none. Its rows are acts, not arrivals:
+they keep writer `origin: "client"`, so a person never writes as the runtime
+({§scheme-surface-writableby-403}), and `source` null, so a person's SEND replies and completes as any
+author's does. Acting for no worker, an operation names no log: `log:///` is 404 `log-unaddressed` and
+FORK is 404 `fork-unaddressed`.
+
+| Frame | Covers | So |
+|---|---|---|
+| Workspace resources | files, executions, Functionality, `env:///` | `_plurnk` keeps no layer of its own, so a person's `env:///` reads and writes the workspace's ({§env-scheme}) |
+| The person's voice | messages and delegated prompts | a message the operation delivers (SEND, or WORK to a worker that exists) arrives from the person, as a thread message does; WORK to a new worker starts a root model worker the person owns, its first prompt from them |
+| The worker it acts for | `log:///`, and the log FORK branches | READ and FIND answer from that worker's log as it reads it; FORK branches it as `forkWorker` does, its task from the person; curating the log is a client write it refuses ({§scheme-surface-writableby-403}) |
 
 ---
 
@@ -5261,7 +5530,7 @@ Conditional absence never reorders the surviving default sections.
 |     6 | user   | `git`                 | Per-turn workspace status; empty content is omitted. |
 |     7 | user   | `budget`              | `Context Curation`; omitted when capacity is unknown. |
 |     8 | user   | `worker`              | `Worker`: `{"path": "worker://alice", "parent": <address or null>, "loop": L, "turn": T}`, the actor and the coordinate this packet's response becomes ({§packet-current-turn}). |
-|     9 | user   | `delegation`          | `Delegation`: per-turn `{workers, streams}` pointers; always present, each list `[]` when empty ({§packet-empty-sections}). |
+|     9 | user   | `work`                | `Open Work`: per-turn `{workers, streams, messages}` pointers; always present, each list `[]` when empty ({§packet-empty-sections}). |
 |    10 | user   | `messages`            | `Open Messages`: immutable message addresses and causal sources ({§message-arrival}). |
 |    11 | user   | `notices`             | Per-turn observations; empty content is omitted. |
 |    12 | user   | `errors`              | Per-turn failure pointers; empty content is omitted. |
@@ -5271,7 +5540,7 @@ The order favors prefix-cache locality where semantics permit: the definition
 and privileged policy lead operator notes, while the append-mostly
 log and interpolated programs lead the volatile user-status clump. That clump is never cached
 across turns, since the next turn's log grows into its place, so its order serves attention alone:
-it runs from ambient state (Git Status, Context, Worker, Delegation) to what the turn owes (Open
+it runs from ambient state (Git Status, Context, Worker, Open Work) to what the turn owes (Open
 Messages) to feedback on the last turn (Notices, then Errors), and closes with the Recap. The nearer
 the end, the more a section asks of this turn. With `all`, appending new
 observations and programs preserves the existing history's roles and text prefix; no old program
@@ -5332,8 +5601,7 @@ flowchart TD
 ```
 
 - §context-budget **One room.** The budget is the provider's input capacity through the loop's calibration, `floor(inputCapacity / factor)` ({§tokenomics-calibrated-readout}), and it bounds the whole packet — teaching, catalog, log and gauge together. Nothing on the service panel sizes a part of it: no projection share or preview page. When the loop's first response fixes its factor, the budget follows it either way; a room that shrinks under the model is announced by the over-budget row ({§context-over-budget-row}), never hidden by keeping a larger figure.
-- §context-gauge **One gauge.** Every packet carries one `## Context` section holding one JSON object: `tokens`, the packet's weight as rendered, and `budget`, the known room. Only when the packet without an inventory strictly exceeds `PLURNK_SERVICE_BUDGET_PRESSURE` of its budget does `largest` name the `PLURNK_SERVICE_BUDGET_LARGEST_ITEMS` heaviest retained log rows as `{path, tokens}`, ranked by weight then path. Unknown budget omits both `budget` and `largest`. The final `tokens` includes the inventory; over budget, its full configured count remains available for curation ({§context-over-budget-row}). Each log row heading carries its own `tokens`. The gauge is state: it never presents `budget − tokens` as response allowance and carries no mandate.
-- §context-pressure-notice **Pressure is one notice.** When the gauge names its inventory ({§context-gauge}) and the packet, with the notice in it, stays within its budget, the packet's notices section carries one `engine:context` notice `budget_pressure`, `level: warn`, whose directive is "YOU MUST NOT exceed budget." and whose message is "Context is at *N*% of budget." *N* is `floor(100 × tokens / budget)` over the gauge's final figures, so the share never disagrees with the gauge, and the notice carries no count of its own. It is decided and rendered with the packet it describes, recurs on every such packet, and is never buffered or sent to clients, which read their own pair ({§tokenomics-client-gauge}). An over-budget packet carries the row instead ({§context-over-budget-row}).
+- §context-gauge **One gauge.** Every packet carries one `## Context` section holding one JSON object: `tokens`, the packet's weight as rendered, `budget`, the known room, and `percent`, `floor(100 × tokens / budget)` over the gauge's own final figures, so the share never disagrees with the counts beside it; a zero budget states no share. Only when the packet without an inventory strictly exceeds `PLURNK_SERVICE_BUDGET_PRESSURE` of its budget does `largest` name the `PLURNK_SERVICE_BUDGET_LARGEST_ITEMS` heaviest retained log rows as `{path, tokens}`, ranked by weight then path. Unknown budget omits `budget`, `percent` and `largest`. The final `tokens` includes the inventory; over budget, its full configured count remains available for curation ({§context-over-budget-row}). Each log row heading carries its own `tokens`. The gauge is state: it never presents `budget − tokens` as response allowance and carries no mandate.
 - §context-fit **One rule: whole if it fits, otherwise as much as fits, then its size and address.** A result the model asked for — a READ without a scope, a FIND, an exec result delivered on close — arrives complete when its weight fits within `budget − tokens` as of that turn, less the room the turn still owes — one receipt's measured weight for each result still to land in it and the emission record that answers it, so that the receipts of a batch and the answer always fit. Otherwise the complete result stays where it was read from and the row is a `413` receipt naming the result's size, its weight, the remaining budget, and the two verbs: `READ` a range, or `KILL` first. A READ of lines carries, above its receipt, the longest prefix of those lines whose row fits that room — the lines with their anchors, the returned range closed on the last line delivered, and the receipt naming the lines delivered; a result whose first line does not fit, a FIND, a stream page and a byte view are bodiless receipts. An arrival the model did not ask for — an inbound `SEND`, a child's conclusion — takes the same bodiless receipt as a fact, not an error: its size and its address. Explicit scopes (`<a,b>`, a pattern, `<1,-1>`) are exact and take the same test. Result cuts are named where they happen: the first page of what came back unasked in size ({§markerless-first-page}) and the cut at the room in the receipt. The optional emission history is whole or absent ({§emission-history}), never a cut.
 - §context-verbs **The verbs are the curation.** `READ` with a range takes a piece of what did not fit ({§read-selection-projection}); `NOTE` keeps what the model learned; `KILL` retires rows, ranges and bodies ({§log-kill-scope}) and may carry what it keeps of them as its own NOTE ({§log-kill-distillation}). The daemon adds no other mechanism.
 - §context-over-budget-row **Over budget is a row and a request, not an ending.** A packet whose weight exceeds `budget` is still submitted when it fits the window ({§context-wall}), and it carries one `_plurnk` error row at the head of its turn, `engine/context/packet-exceeds-budget` 413: "Context exceeds budget. YOU MUST ONLY KILL, MOVE or NOTE this turn." The row is the mandate and carries no figure: the gauge is the one home for `tokens` and `budget` ({§context-gauge}), and it shows the packet over with the row in it. The row is shown once, in the packet it describes, then retired from the projection as a no-match KILL receipt is ({§log-kill-meta-operation}): it stays durable and readable at its coordinate, and a later packet that is over carries its own row. Nothing is hidden to make the packet smaller; the response grant is the window's remainder above the provider's output floor ({§provider-output-floor}). The limit protects a loop; it never ends one.
@@ -5397,7 +5665,7 @@ flowchart LR
     log --> packet["Packet lists coordinate;<br/>READ recalls exact body"]
 ```
 
-§env-delta-log-pull **Pull the event record, never a world snapshot.** At
+§env-delta-log-pull **Pull the event record, never a workspace snapshot.** At
 pre-turn, a worker materializes only occurrences whose structural audience
 includes that worker. The set is exhaustive, unranked, and exactly once; the
 engine makes no relevance decision. Each copied event retains the operation,
@@ -5591,9 +5859,9 @@ another admission is a 409 conflict, not a second message or an implicit content
 
 | Audience | Delivery | Effect |
 |---|---|---|
-| Assigned worker | Its conversation, even when another actor answered | Visible reply; wakes eligible parked work without a new Open Message or loop. |
+| Assigned worker | Its own log, even when another actor answered | Visible reply; wakes eligible parked work without a new Open Message or loop. |
 | Original native sender | That worker, if distinct from the assigned worker; original delegated-task answers use {§worker-scheme-collect} instead | Other replies use the same wake and observation path. |
-| Exterior sender | The assigned conversation's protocol adapter | The adapter delivers the answer through its standard message channel. |
+| Exterior sender | The assigned worker's protocol adapter | The adapter delivers the answer through its standard message channel. |
 | Replying actor | Its own executed SEND | No duplicate ambient occurrence. |
 
 The successful SEND and its addressed occurrences commit together. Reply occurrences use
@@ -5624,7 +5892,9 @@ published, oldest first, and stamps each with the row it became. Ordinal 1 is th
 own assignment and shares the loop's fate: a loop that fails before its first turn does
 not replay it. Every other still-unpublished message at conclusion moves into one
 source-keyed recovery loop, renumbered from its first, whose headline it becomes; that loop's first turn publishes the complete
-ordered set exactly once. Recovery retries complete the same queued loop and never
+ordered set exactly once. The recovery loop retains the source loop's model routes,
+effort, and call ceiling; message bodies and attribution are preserved directly from
+their durable rows. Recovery retries complete the same queued loop and never
 mint duplicate work. Output withholding preserves readable arrival rows; explicit
 KILL follows the ordinary log contract.
 
@@ -5690,10 +5960,9 @@ retain distinct contracts and lifetimes.
 | `parse_advisory` | grammar parser — recoverable near-miss which did not invalidate the parsed statements | YOU SHOULD write the canonical form. | content-offset into the model's emission |
 | `search_progress` | repository materialization/indexing lifecycle ({§persistent-search-index}); structured phase, count, and percent; `level: info`, `warn` when a completed pass carries failed members ({§derivation-member-failure}), `error` on terminal failure | none | none |
 | `git_inspection_refused` | engine membership — automatic Git inspection refused a supplied repository whose config declares a `filter.*` program ({§membership-git-hermetic}); names the key; `level: warn`, once per workspace until the key changes or clears | none | none |
-| `continued_without_note` | engine turn — a continuing or parked model turn that admitted no NOTE ({§continued-without-note}); `level: warn` | YOU MUST record at least one NOTE along with other operations. | none |
-| `budget_pressure` | engine context — a packet within its budget whose gauge is under pressure ({§context-pressure-notice}); `level: warn`; rendered with that packet, never buffered | YOU MUST NOT exceed budget. | none |
+| `continued_without_note` | engine turn — a continuing or parked model turn that admitted no NOTE ({§continued-without-note}); `level: warn` | YOU MUST emit at least one NOTE in every turn. | none |
 | `outside_text` | engine turn — text the emission carried outside its operations, discarded ({§outside-text}); `level: warn` | YOU MUST NOT emit anything except whitespace between fenced operations. | none |
-| `invalid_emission` | engine grammar — a response rejected before dispatch; `level: error` | YOU MUST ONLY emit fenced operations; with the parameters, pattern, and terse aside on the fenced Operation line. | content-offset of the parser diagnostic, when it has one |
+| `invalid_emission` | engine grammar — a response rejected before dispatch; `level: error` | YOU MUST ONLY emit fenced operations; with the parameters, pattern, and terse aside on the fenced operation line. | content-offset of the parser diagnostic, when it has one |
 | `output_truncated` | engine capacity or turn — an emission cut at the output allowance ({§output-allowance-notice}); `level: error` when the cut response was rejected, otherwise `warn` | YOU SHOULD emit fewer or shorter operations per turn. | none |
 | `provider_warning` | a provider warning: an SDK compatibility note, or native tool calls in a response that declared none; `level: warn` | YOU MUST NOT emit native tool calls. on the native tool calls; none on a compatibility note | none |
 | `provider_retry` | a provider stream that failed after output began and was answered by a complete retry; `level: warn` | none | none |
@@ -5705,13 +5974,13 @@ retain distinct contracts and lifetimes.
 | `scope_normalized` | engine slicer — a scope normalized to its canonical form; `level: warn` | YOU SHOULD write the normalized scope. | none |
 | `edit_merged` | engine slicer — an EDIT resolution rule applied to a batch ({§edit-batch-merges}); `level: warn` | YOU SHOULD verify the merged EDIT before building on it. | none |
 
-§continued-without-note **A continuing turn that lapsed from the per-turn rule is told so.** The card's rule is one line, `YOU MUST record at least one NOTE along with other operations.`, and the daemon's directive quotes it. When a model turn settles at 102 or 202, so the loop continues past it or parks on it, and it admitted no NOTE in its program or from its reasoning ({§reasoning-operations}), the next packet carries one `engine:turn` notice, `continued_without_note`, `level: warn`, with that directive and the message `The turn continued without a NOTE.`; when its program was NOTEs and nothing else, the next packet carries `noted_without_operation`, the same directive and the message `The turn carried NOTEs and no other operation.` Each is a notice, never a failure: it mints no row, never counts toward the strike rail, and never ends or alters a loop. A turn that concludes its loop, an empty turn, which carries its own no-operation row, and every non-model turn take none.
+§continued-without-note **A continuing turn that carried no NOTE is told so.** The card teaches NOTE as the register of every plan, finding, decision and next action; the notice's directive is the command `YOU MUST emit at least one NOTE in every turn.` When a model turn settles at 102 or 202, so the loop continues past it or parks on it, and it admitted no NOTE in its program or from its reasoning ({§reasoning-operations}), the next packet carries one `engine:turn` notice, `continued_without_note`, `level: warn`, with that directive and the message `The turn continued without a NOTE.` It is a notice, never a failure: it mints no row, never counts toward the strike rail, and never ends or alters a loop. A turn that concludes its loop, an empty turn, which carries its own no-operation row, and every non-model turn take none.
 
 §notice-callout **A notice speaks in the card's callout form.** Each renders as one alert callout, its level choosing the callout: `> [!CAUTION]` for `error`, `> [!WARNING]` for `warn`, and `> [!NOTE]` for `info`, which no model packet carries. Inside it stand the directive ({§notice-directive}), then the message, any typed position as `@ line:column`, and the kind in brackets; a blank line separates consecutive callouts:
 
 ```text
 > [!WARNING]
-> YOU MUST record at least one NOTE along with other operations. The turn continued without a NOTE. [continued_without_note]
+> YOU SHOULD write the normalized scope. Scope <0,120> was normalized to <1,120>. [scope_normalized]
 ```
 
 §notice-level **Severity on the wire (`level`, required).** Every `Notice` carries `level: "error" | "warn" | "info"`, set by the **producer** at the emit site. The level is client presentation, not operation status: even an `error` notice cannot terminalize work or substitute for a durable Problem. A forwarded `output_unaccounted` is `warn`; ordinary lifecycle and progress notices are `info`. Clients color straight off `level` without interpreting the open `kind` vocabulary.
@@ -5721,7 +5990,10 @@ retain distinct contracts and lifetimes.
 §notice-event-notify **Client surface.** Engine Notices broadcast live via the `notice/event` notification — `{ workerId, loopId, notice: { source, kind, level, message?, position?, …kind-specific } }` per the grammar's `Notice` schema — the moment they land. A loop Notice names its owning Worker; workspace derivation progress alone carries `workerId=null, loopId=0`. AG-UI projects the same observation as the custom `plurnk.notice` event. Failures do not broadcast on this surface: they are log rows, and the client reads them through `log.read` / the `log/entry` notification, the durable log.
 
 §loop-status-notice **The drain publishes lifecycle and its observation deadline together.**
-`notice/event` carries `{ workerId, loopId, notice: { source: "engine:lifecycle", kind: "loop_status", level: "info", status, waitUntil } }`.
+`notice/event` carries `{ workerId, loopId, notice: { source: "engine:lifecycle", kind: "loop_status", level: "info", status, waitUntil, packetCount, claimedAt } }`:
+with its status, every beat carries its loop's packet count and claim stamp (Unix milliseconds, `null`
+before the first claim), the ones a projection reads ({§application-loop-observation}), so a client
+updates the loop's identity, count and stamp together.
 
 | Edge | `status` | `waitUntil` |
 |---|---|---|
@@ -5743,7 +6015,7 @@ the same deadline through {§application-loop-observation}, not a restarted cloc
 
 §candidate-pinned-runtime **Candidate runtime stays pinned.** At launch, after its optional build, the candidate copies every workspace's package projection (`files`) into `<state>/runtime`, links third-party dependencies, and resolves `@plurnk/*` to those copies. Its daemon and its digest export both run from that copy, never the shared checkout, so neither source edits nor a concurrent candidate's or developer's rebuild after launch changes the code a run finishes on. The copy is removed once the digest is written.
 
-§output-allowance-notice **The output allowance is not disclosed; a ceiling cut names its cause.** The packet's budget section carries the curation state and no response allowance: a model does not plan in tokens and no harness tells it its output ceiling, so the number is a fact without a use (#826). Overflow tolerance (#482) is likewise never advertised; a cut's notice names the true per-call grant from the response's own capacity record. When a provider finish is `length`, the engine emits an `output_truncated` notice (source `engine:capacity`) naming the allowance — the fact alone, never advice on what to do about it — on every path — railed or not — and the rails verdict never blames the model's grammar for a cut the engine's own ceiling made. The same precedence governs a cut so deep no operation parses: the rejection notice names the truncation as the cause, not the parser's symptom, overriding {§invalid-emission-attempts}'s parser diagnostic for `length` finishes.
+§output-allowance-notice **The output allowance is not disclosed; a ceiling cut names its cause.** The packet's budget section carries the curation state and no response allowance: a model does not plan in tokens and no harness tells it its output ceiling, so the number is a fact without a use (#826). Overflow tolerance (#482) is likewise never advertised; a cut's notice names the true per-call grant from the response's own capacity record. When a provider finish is `length`, the engine emits an `output_truncated` notice (source `engine:capacity`) naming the allowance — the fact alone, never advice on what to do about it — on every path — railed or not — and the rails verdict never blames the model for a cut the engine's own ceiling made: a cut turn is no repetition evidence ({§engine-cycle-evidence}), and a strike threshold crossed on one names the allowance ({§engine-rails}). The same precedence governs a cut so deep no operation parses: the rejection notice names the truncation as the cause, not the parser's symptom, overriding {§invalid-emission-attempts}'s parser diagnostic for `length` finishes.
 
 §turn-lifecycle **Turn-lifecycle liveness.** Provider generation is the long, opaque window in a turn — one or more same-packet emission attempts may occur before the first committed op. A static client screen there is indistinguishable from a hang. The engine brackets the complete attempt window with two `notice/event` notices (`source: "engine:turn"`, `level: "info"`): `turn_awaiting_model` before the first call and `turn_generated` when an emission is accepted or the attempt budget is exhausted. The completion beat carries the spend ({§turn-accounting-notice}). Rejected content never rides the notice channel. Both are suppressed on an aborted loop and broadcast to the workspace like any notice ({§notice-event-notify}).
 
@@ -5831,15 +6103,18 @@ remain one compact orientation line, not an expansion of every tool's signature.
 
 §members-functionality **File membership is one workspace Functionality family.**
 Core registers the `members` family with the coordinator ({§functionality-coordinator}):
-the model, the client, and the operator learn one surface — `list | discover | add | replace |
+the model, the client, and the operator learn one surface — `list | discover | add |
 enable | disable | remove`, `workspace.members.<verb>` for the client,
 ```` ```members (<verb>) ```` for the model — for what the model may see, exactly as they do for skills and
-MCP servers. A definition is one shell-path glob ({§path-glob-matching}), `{ glob }`, relative to the project
-root; a leading `!` excludes matching members, and an exclusion wins over every inclusion.
-Admission provenance (`service-configuration`, `client-action`, `model-proposal`)
-rides the definition to enforce {§members-model-scope}; configuration-source
-provenance belongs to the shared inspection projection ({§configuration-provenance}).
-The alias is a short name, suggested from the glob. `list` shows each
+MCP servers. A definition is one shell-path glob ({§path-glob-matching}) relative to the project
+root; a leading `!` excludes matching members, and an exclusion wins over every inclusion. The glob
+is the definition's identity ({§functionality-addressing}): `add` takes `{"files": ["<glob>", …]}`
+and admits each glob, trimmed, as one definition, a glob named twice being one; `enable`, `disable`
+and `remove` take `{"file": "<glob>"}`, the glob as `list` shows it. A bare `!` is 400
+`definition-invalid`. Admission provenance (`service-configuration`, `client-action`,
+`model-proposal`) rides the persisted definition, `{ glob, provenance }`, to enforce
+{§members-model-scope}; configuration-source provenance belongs to the shared inspection projection
+({§configuration-provenance}). `list` shows each
 definition with what it resolved to — `include` or `exclude`, the pattern, the members it
 admits or removes (count and a bounded sample), and for a model's inclusion the matches the
 repository's ignore rules refused — so the model sees what its glob did and adapts.
@@ -5850,7 +6125,9 @@ or exclude. A query that names neither, blank or a bare `!`, is 400 `query-inval
 never content; nothing is added.
 
 §members-configuration *Available definitions.* `PLURNK_MEMBERS_<alias>=<glob>`
-declares one service-origin rule (`!glob` excludes). The shared naming and
+declares one service-origin rule (`!glob` excludes), named by its glob like every definition; the
+key is its configuration provenance, which `list` shows, and two keys declaring one glob fail by
+name. The shared naming and
 enabledness dialect is {§resource-environment}; `PLURNK_MEMBERS_ENABLED` supplies
 the panel default and `PLURNK_MEMBERS_<alias>_ENABLED` overrides one rule.
 An empty glob or a bare `!` fails validation. Controls may precede their rule;
@@ -5877,7 +6154,8 @@ the repository ignores ({§membership-model-universe}). The engine's creation re
 overwrites or retires them. Projection happens at the family's publication commit and
 re-resolves membership; workspace cooling changes nothing, because desired state is
 durable. Each enabled definition is one generated document at
-`worker:///_plurnk/members/<alias>.md` ({§functionality-documents}) — its glob, origin,
+`worker:///_plurnk/members/<glob>.md` ({§functionality-documents}), the glob percent-encoded as
+one path segment (RFC 3986 unreserved characters and parentheses stay literal) — its glob, origin,
 provenance, and what it resolved to — surveyed at turn 0 like every family's enabled
 definitions ({§actor-boundary-catalog-preview}), so the model sees why a file is or is
 not a member before it asks. There is no other membership path: the client's `/members`
@@ -6309,7 +6587,25 @@ lane's run directory and the lane's reclaim takes all of it; an unnamed run is C
 that passes is reclaimed when it exits; a failed suite's evidence is never touched and stays exactly where the run reported it. A cross-package test may reuse Core's migration fixture only by passing a path inside the
 caller's own run directory.
 
-§fs-world-state **The world-state harness — coverage that closes the class.** Op-outcome tests check what an op returned; the harness checks the resulting world. `WorldState.check(db)` asserts, pure-db and read-only: identity uniqueness in practice (no tuple holds two rows), the canonical fixpoint on every file-class key, channel orphan-freedom, the closed admission set (every file row's origin is Git or constraint), and sig-coherence. Generated-pick incorporation and lifecycle require filesystem/Git evidence and are covered by the composed creation matrix rather than a false pure-database proxy. The harness runs as a lifecycle-test epilogue and at every soak turn boundary, where the delta half applies: an idle turn grows the entries table by ZERO. A violation names its law and its row.
+§tier-census **A real-model tier run is one directory with its census.** The live and demo drivers
+stamp `PLURNK_TIER_RUN` as `<kind>-<UTC stamp>`; every worker the run claims lands inside
+`PLURNK_BENCHMARKS/tier-<kind>-<stamp>/`, each in its own `<label>-XXXXXX/` with its database, its own
+host, its digest and a `census.json` naming the specimen that drove it, its loops, turns, requests,
+tokens and cost. The run's `census.md` and `census.json`, written by the tier's node:test reporter
+when the run ends, carry one row per specimen: verdict, skip reason or first failure line, the
+workers it claimed, turns, requests and cost; a run never deletes or moves any of it. A specimen
+declares what it requires of the route and the host (`input:<image|pdf|audio|video>`, `reasoning`,
+`output-budget`, `env:<NAME>`, `url:<http(s) URL>`, `bin:<name>` on PATH, `checkout:<client|a2a-tck>`
+at `PLURNK_CLIENT_CHECKOUT` or `PLURNK_A2A_TCK_CHECKOUT`, else beside the repository); an unmet
+requirement is a skip, before anything boots or is spent, whose reason names the requirement and what
+was observed, and the census answers each unmet route-bound requirement with the declared aliases
+whose catalog entry satisfies it. A route the harness cannot resolve is a failure, never a skip. No
+test surface is an opt-in flag or a script of its own: the third-party MCP composition, the
+llama-server rails, the upstream A2A TCK and the client's real-model TUI tier are live specimens that
+run wherever their requirements hold. `tier:history` ledgers every census under the home: per
+specimen, its verdicts over runs and its last reason.
+
+§fs-resource-state **The resource-state harness — coverage that closes the class.** Op-outcome tests check what an op returned; the harness checks the resulting resource state. `ResourceState.check(db)` asserts, pure-db and read-only: identity uniqueness in practice (no tuple holds two rows), the canonical fixpoint on every file-class key, channel orphan-freedom, the closed admission set (every file row's origin is Git or constraint), and sig-coherence. Generated-pick incorporation and lifecycle require filesystem/Git evidence and are covered by the composed creation matrix rather than a false pure-database proxy. The harness runs as a lifecycle-test epilogue and at every soak turn boundary, where the delta half applies: an idle turn grows the entries table by ZERO. A violation names its law and its row.
 
 ## Problem codes and pinned wording
 
@@ -6341,11 +6637,15 @@ Every Problem code core mints is named here under its family ({§problem-error-c
 | `kill-target-scheme-required` | 400 | KILL target requires a scheme. |
 | `worker-not-found` | 404 | Worker '*name*' does not exist in this workspace. |
 | `entry-operation-unsupported` | 400 | KILL requires an entry-bearing target; '*scheme*' does not provide one. |
+| `coordinate-invalid` | 400 | '*to*' is not a log coordinate ({§rollback}). Recovery: Name the coordinate as `<loop>/<turn>/<item>`, as the log shows it. |
+| `coordinate-not-found` | 404 | No log entry exists at log:///*coordinate* ({§rollback}). |
+| `project-root-required` | 400 | Rollback restores files, and this workspace has no project root ({§rollback}). |
 | `resource-scheme-required` | 400 | Resource selection requires an address. |
 | `channel-required` | 400 | The '*scheme*' scheme has no default channel. Recovery: Address a named channel with a URI fragment. |
 | `binary-source-unsupported` | 415 | Channel #*name* is binary and its scheme keeps no bytes to transfer. |
-| `metadata-unsupported` | 400 | *OP* takes only the env option; '*key*' is not one. |
-| `worker-name-conflict` | 409 | Worker '*name*' already exists in this workspace. |
+| `metadata-unsupported` | 400 | *OP* takes only the env option; '*key*' is not one. A WORK to a held name with env: WORK to the existing worker '*name*' carries env; a message takes none. |
+| `fork-unaddressed` | 404 | This client operation acts for no worker, so FORK has no log to branch ({§actor-boundary-client-operations}). |
+| `worker-name-conflict` | 409 | Worker '*name*' already exists in this workspace. Recovery: WORK or SEND (worker://*name*) delivers a message to the live worker; FORK with a name no worker holds. ({§worker-scheme-spawn}) |
 | `no-operation` | 422 | The turn performed no operation ({§empty-turn}). |
 | `send-target-not-a-recipient` | 400 | The addressed scheme is not a SEND recipient. Recovery: Name a message address or a recipient that implements SEND. |
 | `invalid-operation-syntax` | 400 | The parser's diagnostic for an invalid operation in an admitted turn. |
@@ -6408,7 +6708,7 @@ lists the schemes the workspace registers, and rebuilds the address into nothing
 | `file-create-excluded` | 403 | A members exclusion (`!_glob_`) covers '*path*'. Recovery: Remove or disable the excluding members definition, or choose another path. |
 | `file-create-gitignored` | 403 | Active Git policy ignores '*path*', and no members definition includes it. Recovery: Choose a Git-admitted path or add a members definition that includes it. |
 | `file-materialization-limit` | 413 | The file exceeds the materialization byte limit and is not read into the workspace. |
-| `entry-not-found` | 404 | No member of this workspace is at '*path*'. Recovery: FIND lists paths. EDIT creates files; `members (add)` admits existing files with a `{"glob": "<path>"}` body. A path beyond the root recovers instead to: '*path*' is outside the project root: only a members definition under the operator's namespace scope admits it. |
+| `entry-not-found` | 404 | No member of this workspace is at '*path*'. Recovery: FIND lists paths. EDIT creates files; `members (add)` admits existing files with a `{"files": ["<path>"]}` body. A path beyond the root recovers instead to: '*path*' is outside the project root: only a members definition under the operator's namespace scope admits it. |
 | `body-channel-required` | 400 | A file write requires a body channel. |
 | `write-failed` | 500 | Publication or its settlement failed; the result distinguishes an unpublished write from an already-published one. |
 | `creation-rollback-failed` | 500 | Incorporating a newly created file failed, and rollback was incomplete. |
@@ -6421,7 +6721,7 @@ lists the schemes the workspace registers, and rebuilds the address into nothing
 | code | status | contract |
 |---|---:|---|
 | `invalid-input-target` | 400 | SEND input addresses an execution, without a channel or scope. |
-| `input-unavailable` | 409 | This execution's input receiver is no longer enabled. |
+| `input-unavailable` | 409 | This execution was launched without input. Recovery: Launch it with `[{"stdin": "open"}]` when its runtime takes input, then SEND to that execution. — This execution is queued for an execution slot; its input opens when it starts. Recovery: SEND again once the execution has started. — This execution's input receiver is no longer enabled. |
 | `stream-not-found` | 404 | No execution exists at the requested address. Recovery, when the id holds an execution under another runtime ({§exec-near-miss}): The execution at /*id* is `*runtime*:///*id*`. |
 | `input-closed` | 410 | Execution input is closed. |
 | `executor-not-registered` | 400 | No executor or MCP service named '*runtime*' is registered for this worker. |
@@ -6444,6 +6744,7 @@ lists the schemes the workspace registers, and rebuilds the address into nothing
 |---|---:|---|
 | `read-target-required` | 400 | READ requires a log coordinate. Recovery: Provide one exact log coordinate. |
 | `coordinate-malformed` | 400 | The log coordinate '*path*' is malformed. Recovery: Use one exact loop/turn/sequence coordinate. |
+| `log-unaddressed` | 404 | This client operation acts for no worker, so `log:///` names no log ({§actor-boundary-client-operations}). |
 | `kill-failed` | 400 | The log target '*path*' is malformed. (A glob the matcher cannot read: The log glob '*glob*' is malformed.) Recovery: the {§log-target-shape} sentence. |
 | `curation-failed` | 400 | A scoped KILL's selection could not be read: the same sentences and recovery as `kill-failed`. |
 | `worker-target-required` | 400 | EDIT requires a worker:// target. Recovery: Provide the worker target. |
@@ -6464,14 +6765,16 @@ lists the schemes the workspace registers, and rebuilds the address into nothing
 | code | status | condition |
 |---|---:|---|
 | `interaction-not-pending` | 409 | The requested client interaction is not pending. |
-| `interaction-unsupported` | 501 | No recipient implements the requested tool for this conversation. |
+| `interaction-unsupported` | 501 | No recipient implements the requested tool for this worker. |
 | `recipient-mismatch` | 403 | Only the interaction's recipient may answer it. |
 | `interaction-response-invalid` | 400 | The response does not satisfy the pending interaction's schema. |
 | `invalid-body` | 400 | A question body is not JSON, or lacks its nonempty message or requested schema. |
 | `offset-invalid` | 400 | An entry offset is not a nonnegative safe integer. |
 | `userinfo-not-allowed` | 400 | An entry target URL contains userinfo. |
 | `action-threw` | 500 | The client action failed outside its operation result contract. |
+| `operation-cancelled` | 499 | The client operation was cancelled: *reason*. Its loop settles with this result ({§connection-lifecycle}). |
 | `message-already-accepted` | 409 | The message address was already accepted in this workspace. |
+| `message-address-reused` | 422 | The message address was already accepted in this workspace with other words. |
 | `source-not-running` | 409 | The originating task is not running; no message was admitted. |
 | `loop-not-open` | 409 | The named loop is not an unfinished recipient of the worker; no message was admitted. |
 
@@ -6518,18 +6821,18 @@ lists the schemes the workspace registers, and rebuilds the address into nothing
 | Nothing is in flight. Continuing. | a WAIT (or a premature terminal) with no live work ({§wait-obligation-matrix}) |
 | All Open Messages resolved. Review new results; emit no OPs if finished. | resolved messages with unobserved results ({§loop-completion}) |
 | Context exceeds budget. YOU MUST ONLY KILL, MOVE or NOTE this turn. | the over-budget row ({§context-over-budget-row}) |
-| YOU MUST NOT exceed budget. Context is at *N*% of budget. | a packet within its budget under pressure ({§context-pressure-notice}) |
-| YOU MUST record at least one NOTE along with other operations. The turn continued without a NOTE. | a continuing or parked model turn without a NOTE ({§continued-without-note}) |
+| YOU MUST emit at least one NOTE in every turn. The turn continued without a NOTE. | a continuing or parked model turn without a NOTE ({§continued-without-note}) |
 | Each directive in the notice table | a notice of the model's own output ({§notice-directive}) |
 | Context window overflow: the packet cannot fit the model's window even as receipts. | the wall ({§context-wall}) |
 | No recipient implements the requested interaction. | The worker's owner is not interactive or does not declare the required client tool ({§client-interaction-routing}). |
 | Nobody is present to answer. Decide from what you already have, or conclude stating what you could not resolve. | dispatch of an interaction tool the worker's owner would not receive ({§owner-interaction-ring}) |
 | Worker name '*name*' must match `[A-Za-z0-9][A-Za-z0-9_-]{0,62}`. Recovery: Use 1–63 ASCII letters, digits, '_' or '-', starting with a letter or digit. | an invalid worker name |
 | Provide the client identifier. / Provide an absolute project path. / Use a positive integer limit. / prompt is not a non-empty string. | client input validation on the daemon's methods |
+| name '*name*' has the path segment '*segment*'. Recovery: Provide a name with no '.' or '..' between its slashes; a dot within a segment is ordinary. / name is not well-formed Unicode: it holds an unpaired surrogate. | a workspace name refused at creation or rename ({§workspace-name}) |
 | The stream was cancelled by KILL. | a stream terminal after KILL |
 | '*runtime*' exited with code 127; `*program*` is a registered tool of `*owner*`. | a tool run as a shell command ({§exec-tool-fall-through}) |
 | '*path*' is a directory, not a file; READ reads one file. Recovery: `FIND (_path_/)` lists its files. | READ of a directory |
 | The execution at ops://*worker*/*loop* has not concluded. | a bare READ of a running worker's result (425) |
 | The child provider failed. | a child's provider failure read back by its parent |
-| '*path*' exists on disk but is not a member of this workspace. Recovery: Admit it with `members (add)` and a `{"glob": "<path>"}` body. | a non-member on disk at the addressed path |
+| '*path*' exists on disk but is not a member of this workspace. Recovery: Admit it with `members (add)` and a `{"files": ["<path>"]}` body. | a non-member on disk at the addressed path |
 | '*path*' exists on disk but is not a member of this workspace. Recovery: The repository ignores it: a client or operator members definition can include it, a model definition cannot. | a non-member the repository ignores ({§membership-read-refusal}) |