@semiont/core 0.5.28 → 0.5.30

package/dist/index.d.ts

@@ -848,275 +848,6 @@ interface paths {
         patch?: never;
         trace?: never;
     };
-    "/api/admin/exchange/backup": {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        get?: never;
-        put?: never;
-        /**
-         * Backup Knowledge Base
-         * @description Create a lossless backup of the knowledge base as a streaming tar.gz archive
-         */
-        post: {
-            parameters: {
-                query?: never;
-                header?: never;
-                path?: never;
-                cookie?: never;
-            };
-            requestBody?: never;
-            responses: {
-                /** @description Streaming backup archive */
-                200: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content: {
-                        "application/gzip": string;
-                    };
-                };
-                /** @description Unauthorized */
-                401: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content: {
-                        "application/json": components["schemas"]["ErrorResponse"];
-                    };
-                };
-                /** @description Forbidden - Admin access required */
-                403: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content: {
-                        "application/json": components["schemas"]["ErrorResponse"];
-                    };
-                };
-            };
-        };
-        delete?: never;
-        options?: never;
-        head?: never;
-        patch?: never;
-        trace?: never;
-    };
-    "/api/admin/exchange/restore": {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        get?: never;
-        put?: never;
-        /**
-         * Restore Knowledge Base
-         * @description Restore knowledge base from a backup archive. Returns SSE progress events.
-         */
-        post: {
-            parameters: {
-                query?: never;
-                header?: never;
-                path?: never;
-                cookie?: never;
-            };
-            requestBody: {
-                content: {
-                    "multipart/form-data": {
-                        /**
-                         * Format: binary
-                         * @description Backup archive (.tar.gz)
-                         */
-                        file: string;
-                    };
-                };
-            };
-            responses: {
-                /** @description SSE stream of restore progress events */
-                200: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content: {
-                        "text/event-stream": string;
-                    };
-                };
-                /** @description Invalid file format */
-                400: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content: {
-                        "application/json": components["schemas"]["ErrorResponse"];
-                    };
-                };
-                /** @description Unauthorized */
-                401: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content: {
-                        "application/json": components["schemas"]["ErrorResponse"];
-                    };
-                };
-                /** @description Forbidden - Admin access required */
-                403: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content: {
-                        "application/json": components["schemas"]["ErrorResponse"];
-                    };
-                };
-            };
-        };
-        delete?: never;
-        options?: never;
-        head?: never;
-        patch?: never;
-        trace?: never;
-    };
-    "/api/moderate/exchange/export": {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        get?: never;
-        put?: never;
-        /**
-         * Export Knowledge Base as JSON-LD
-         * @description Export the knowledge base as a JSON-LD Linked Data tar.gz archive
-         */
-        post: {
-            parameters: {
-                query?: {
-                    /** @description Include archived resources in export */
-                    includeArchived?: boolean;
-                };
-                header?: never;
-                path?: never;
-                cookie?: never;
-            };
-            requestBody?: never;
-            responses: {
-                /** @description Streaming JSON-LD archive */
-                200: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content: {
-                        "application/gzip": string;
-                    };
-                };
-                /** @description Unauthorized */
-                401: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content: {
-                        "application/json": components["schemas"]["ErrorResponse"];
-                    };
-                };
-                /** @description Forbidden - moderator or admin role required */
-                403: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content: {
-                        "application/json": components["schemas"]["ErrorResponse"];
-                    };
-                };
-            };
-        };
-        delete?: never;
-        options?: never;
-        head?: never;
-        patch?: never;
-        trace?: never;
-    };
-    "/api/moderate/exchange/import": {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        get?: never;
-        put?: never;
-        /**
-         * Import Knowledge Base from JSON-LD
-         * @description Import resources from a JSON-LD Linked Data archive. Returns SSE progress events.
-         */
-        post: {
-            parameters: {
-                query?: never;
-                header?: never;
-                path?: never;
-                cookie?: never;
-            };
-            requestBody: {
-                content: {
-                    "multipart/form-data": {
-                        /**
-                         * Format: binary
-                         * @description JSON-LD archive (.tar.gz)
-                         */
-                        file: string;
-                    };
-                };
-            };
-            responses: {
-                /** @description SSE stream of import progress events */
-                200: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content: {
-                        "text/event-stream": string;
-                    };
-                };
-                /** @description Invalid file format */
-                400: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content: {
-                        "application/json": components["schemas"]["ErrorResponse"];
-                    };
-                };
-                /** @description Unauthorized */
-                401: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content: {
-                        "application/json": components["schemas"]["ErrorResponse"];
-                    };
-                };
-                /** @description Forbidden - moderator or admin role required */
-                403: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content: {
-                        "application/json": components["schemas"]["ErrorResponse"];
-                    };
-                };
-            };
-        };
-        delete?: never;
-        options?: never;
-        head?: never;
-        patch?: never;
-        trace?: never;
-    };
     "/api/cookies/consent": {
         parameters: {
             query?: never;
@@ -1399,7 +1130,7 @@ interface paths {
         put?: never;
         /**
          * Create a resource
-         * @description Upload binary content + metadata as multipart/form-data. The backend writes content to disk, then emits yield:create on the bus; Stower persists it and returns a 202 with the new resourceId. Full reconciliation happens via SSE domain events (yield:created).
+         * @description Upload binary content + metadata as multipart/form-data. The gateway writes content to disk, then emits yield:create on the bus; Stower persists it and returns a 202 with the new resourceId. Full reconciliation happens via SSE domain events (yield:created).
          *
          *     Generation workers and the /know/compose page both hit this route — bytes always travel on the HTTP wire, never on the bus.
          */
@@ -1477,196 +1208,7 @@ interface paths {
         patch?: never;
         trace?: never;
     };
-    "/resources/{id}": {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        /**
-         * Get a resource's stored representation (the pipe)
-         * @description Returns the stored representation's bytes, verbatim, with the stored media type in Content-Type (`application/octet-stream` when the stored metadata carries none). The Accept header is never read: there is no content negotiation and no transcoding, so the served bytes always hash to the representation's registered checksum.
-         *
-         *     The resource's JSON-LD description (descriptor + annotations + inbound entity references) lives at GET /resources/{id}/jsonld; every content response advertises it via a `Link: rel="describedby"` header.
-         *
-         *     Content is immutable (checksum-addressed), and this route is bearer-authenticated, so responses carry `Cache-Control: private, max-age=31536000, immutable`.
-         */
-        get: {
-            parameters: {
-                query?: never;
-                header?: never;
-                path: {
-                    id: string;
-                };
-                cookie?: never;
-            };
-            requestBody?: never;
-            responses: {
-                /** @description The stored representation's bytes, verbatim */
-                200: {
-                    headers: {
-                        /** @description `</resources/{id}/jsonld>; rel="describedby"; type="application/ld+json"` — where to dereference the resource's JSON-LD description */
-                        Link?: string;
-                        [name: string]: unknown;
-                    };
-                    content: {
-                        "*/*": string;
-                    };
-                };
-                /** @description Resource or representation not found */
-                404: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content: {
-                        "application/json": components["schemas"]["ErrorResponse"];
-                    };
-                };
-                /** @description Failed to retrieve resource */
-                500: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content: {
-                        "application/json": components["schemas"]["ErrorResponse"];
-                    };
-                };
-            };
-        };
-        put?: never;
-        post?: never;
-        delete?: never;
-        options?: never;
-        head?: never;
-        patch?: never;
-        trace?: never;
-    };
-    "/resources/{id}/anchored-text": {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        /**
-         * Get a resource's anchored text
-         * @description The coordinate map derived from a resource's bytes: its recovered text plus the positioned runs that index it. Assembled via the bus gateway.
-         *
-         *     Whole-resource, not paginated — a producer iterates page by page, but every consumer wants one map: a browser quoting the text under a hand-drawn rectangle, a headless client analysing a document.
-         *
-         *     This endpoint never runs recognition. The Smelter is the sole producer and publishes at ingest; a read that finds nothing waits for that resource's content generation to settle and then answers 204. A 204 is the common case and not an error — a native text layer is read in the browser, and a media type with no extractor never produces a map at all. Callers degrade: for a PDF annotation that means geometry with no quoted text.
-         */
-        get: {
-            parameters: {
-                query?: never;
-                header?: never;
-                path: {
-                    id: string;
-                };
-                cookie?: never;
-            };
-            requestBody?: never;
-            responses: {
-                /** @description The stored extraction outcome: the coordinate map with its provenance (method, PDF class, OCR confidence, unread pages), or a named decline. */
-                200: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content: {
-                        "application/json": components["schemas"]["ExtractionOutcome"];
-                    };
-                };
-                /** @description No map has been derived for this resource. The ordinary answer for a native text layer or a media type with no extractor — not an error, and distinct from 404, which means the resource itself is absent. Carried as an empty body rather than a JSON `null` body so that a generated client's typed 200 field stays absent: unmarshalling `null` into a struct is a no-op in several languages, which would make "no map" indistinguishable from an empty one. */
-                204: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content?: never;
-                };
-                /** @description Resource not found */
-                404: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content: {
-                        "application/json": components["schemas"]["ErrorResponse"];
-                    };
-                };
-                /** @description Request timed out (bus gateway) */
-                504: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content: {
-                        "application/json": components["schemas"]["ErrorResponse"];
-                    };
-                };
-            };
-        };
-        put?: never;
-        post?: never;
-        delete?: never;
-        options?: never;
-        head?: never;
-        patch?: never;
-        trace?: never;
-    };
-    "/anchored-text/keys": {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        /**
-         * List the keys under which anchored text is currently stored
-         * @description The anchored-text store's would-hit keys — the reconcile planner's bulk existence read (PERSIST-ANCHORS P0). The Smelter diffs this against the catalog to find resources whose derived coordinate map was lost (a transient store, a failed publish) and plans re-derivation; one request per reconcile, keys only, because each map is ~32 KB per scanned page and only presence is being asked.
-         *
-         *     Keys are resource ids today; after PERSIST-ANCHORS P1 they are content checksums. Only entries a read would actually serve are listed — stale-stamped or unreadable entries are excluded, exactly as a read would exclude them.
-         *
-         *     Agents only: this is projection-maintenance planning data, same trust boundary as publishing a map.
-         */
-        get: {
-            parameters: {
-                query?: never;
-                header?: never;
-                path?: never;
-                cookie?: never;
-            };
-            requestBody?: never;
-            responses: {
-                /** @description Every key under which anchored text would currently be served. */
-                200: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content: {
-                        "application/json": {
-                            keys: string[];
-                        };
-                    };
-                };
-                /** @description Caller is not an agent */
-                403: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content: {
-                        "application/json": components["schemas"]["ErrorResponse"];
-                    };
-                };
-            };
-        };
-        put?: never;
-        post?: never;
-        delete?: never;
-        options?: never;
-        head?: never;
-        patch?: never;
-        trace?: never;
-    };
-    "/anchored-text/{checksum}": {
+    "/resources/{id}": {
         parameters: {
             query?: never;
             header?: never;
@@ -1674,85 +1216,37 @@ interface paths {
             cookie?: never;
         };
         /**
-         * Read a representation's stored extraction outcome by content checksum
-         * @description The cache-consult read (PERSIST-ANCHORS P2c): the extraction seam asks "has this exact byte content already been extracted?" — and every cache consumer runs out of process (the smelter worker, the detection workers), so the consult must cross the wire or the cache is write-only from exactly the processes it exists to serve.
+         * Get a resource's stored representation (the pipe)
+         * @description Returns the stored representation's bytes, verbatim, with the stored media type in Content-Type (`application/octet-stream` when the stored metadata carries none). The Accept header is never read: there is no content negotiation and no transcoding, so the served bytes always hash to the representation's registered checksum.
          *
-         *     Checksum-addressed and barrier-free, deliberately: presence at this instant is the question, the same semantics as the keys listing. The read-your-writes settle barrier belongs to the resource-addressed reader (GET /resources/{id}/anchored-text), which resolves a mutable resource id through the view index; a caller holding the checksum already holds the content identity and needs no resolution and no wait.
+         *     The resource's JSON-LD description (descriptor + annotations + inbound entity references) lives at GET /resources/{id}/jsonld; every content response advertises it via a `Link: rel="describedby"` header.
          *
-         *     Agents only — projection-maintenance traffic, the same trust boundary as the PUT beside it.
+         *     Content is immutable (checksum-addressed), and this route is bearer-authenticated, so responses carry `Cache-Control: private, max-age=31536000, immutable`.
          */
         get: {
             parameters: {
                 query?: never;
                 header?: never;
                 path: {
-                    /** @description Hex SHA-256 checksum of the representation bytes. */
-                    checksum: string;
+                    id: string;
                 };
                 cookie?: never;
             };
             requestBody?: never;
             responses: {
-                /** @description The stored extraction outcome — a success with provenance, or a cached decline. */
+                /** @description The stored representation's bytes, verbatim */
                 200: {
                     headers: {
+                        /** @description `</resources/{id}/jsonld>; rel="describedby"; type="application/ld+json"` — where to dereference the resource's JSON-LD description */
+                        Link?: string;
                         [name: string]: unknown;
                     };
                     content: {
-                        "application/json": components["schemas"]["ExtractionOutcome"];
-                    };
-                };
-                /** @description No entry under this checksum. The ordinary cache miss — carried as an empty body rather than a JSON null for the same generated-client reason as the resource-addressed GET. */
-                204: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content?: never;
-                };
-                /** @description Caller is not an agent */
-                403: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content: {
-                        "application/json": components["schemas"]["ErrorResponse"];
-                    };
-                };
-            };
-        };
-        /**
-         * Publish anchored text for a representation, keyed by its content checksum
-         * @description Store the coordinate map derived from a representation's bytes, under the SHA-256 checksum of those bytes (PERSIST-ANCHORS decision A: one artifact per representation, and a representation is its bytes). The producer supplies the checksum because it alone knows which bytes it actually read — deriving the key server-side from the resource's current representation would file old geometry under a new checksum when a byte change races the publish, and that entry would read as present to the reconcile planner forever. Reads remain resource-addressed (GET /resources/{id}/anchored-text); the server resolves the resource to its current representation's checksum.
-         *
-         *     The Smelter is the sole producer: it is the only process that reads those bytes at ingest, so it is the only one positioned to derive a map cheaply, and it runs separately from the backend.
-         *
-         *     Agents only. A map is derived data every consumer trusts to place annotation geometry, so a browser session must not be able to write one.
-         */
-        put: {
-            parameters: {
-                query?: never;
-                header?: never;
-                path: {
-                    /** @description Hex SHA-256 checksum of the representation bytes the map was derived from. */
-                    checksum: string;
-                };
-                cookie?: never;
-            };
-            requestBody: {
-                content: {
-                    "application/json": components["schemas"]["ExtractionOutcome"];
-                };
-            };
-            responses: {
-                /** @description Stored */
-                204: {
-                    headers: {
-                        [name: string]: unknown;
+                        "*/*": string;
                     };
-                    content?: never;
                 };
-                /** @description Body is not a valid ExtractionOutcome */
-                400: {
+                /** @description Resource or representation not found */
+                404: {
                     headers: {
                         [name: string]: unknown;
                     };
@@ -1760,8 +1254,8 @@ interface paths {
                         "application/json": components["schemas"]["ErrorResponse"];
                     };
                 };
-                /** @description Caller is not an agent */
-                403: {
+                /** @description Failed to retrieve resource */
+                500: {
                     headers: {
                         [name: string]: unknown;
                     };
@@ -1771,6 +1265,7 @@ interface paths {
                 };
             };
         };
+        put?: never;
         post?: never;
         delete?: never;
         options?: never;
@@ -2093,7 +1588,7 @@ interface components {
                 domain: string;
                 isAdmin: boolean;
             };
-            /** @description Short-lived access token (1 hour). Use as Authorization: Bearer header on API calls. */
+            /** @description Short-lived access token. Use as Authorization: Bearer header on API calls. The TTL is deliberately NOT restated here — docs/system/administration/AUTHENTICATION.md holds the one table of token lifetimes, and a second copy is how this description came to claim an hour for a ten-minute token. A client must refresh from the refresh token rather than assume any particular window. */
             token: string;
             /** @description Long-lived refresh token (30 days). Exchange via POST /api/tokens/refresh for a fresh access token. */
             refreshToken: string;
@@ -2356,6 +1851,11 @@ interface components {
             correlationId: string;
             response: Omit<components["schemas"]["ExtractionOutcome"], "kind"> | null;
         };
+        /** @description Request the stored extraction outcome for a content identity the caller already holds — the detection workers' read-through cache consult (ANCHORED-TEXT-TO-SMELTER P2). A hit — success or decline — is served whole and the caller skips extraction; null is a miss and the caller extracts locally. Read-only: the Smelter is the sole writer and never answers over this channel. */
+        BrowseAnchoredTextByChecksumRequest: {
+            correlationId: string;
+            checksum: string;
+        };
         /** @description Request to browse a single resource */
         BrowseResourceRequest: {
             correlationId: string;
@@ -2407,8 +1907,10 @@ interface components {
             payload: {
                 [key: string]: unknown;
             };
-            /** @description Optional resource scope for broadcast channels (e.g. resourceId). Publishers only — frontends must never set this. */
+            /** @description Optional resource scope for broadcast channels (e.g. resourceId). Publishers only — clients must never set this. */
             scope?: string;
+            /** @description Routing address for this request's reply (CORRELATED-REPLY-ROUTING D1/D2): the emit doubles as a claim on the correlationId, and delivery matches BOTH this and the emitting principal. Top-level, not inside `payload` — a wire concern like `scope`, so it never enters a channel's domain type. Optional in the schema because a plain broadcast needs no return address; the route requires it when the channel is a registered request channel and the payload carries a correlationId. */
+            clientId?: string;
         };
         /** @description Subscription matrix for the bus SSE stream (MULTI-RESOURCE-SCOPE). `global` channels are delivered unscoped; each `scoped` entry subscribes the connection to one resource scope's channels, optionally resuming replay from that scope's last-seen persisted event id. At least one global channel or one scoped entry is required. */
         BusSubscribeRequest: {
@@ -2425,6 +1927,8 @@ interface components {
                 /** @description This scope's last-seen persisted event id (`p-<scope>-<seq>`). The server replays this scope's persisted events after it before joining the live tail, and emits a scoped `bus:resume-gap` when it cannot cover the gap (unparseable or mismatched id, retention exceeded, or query error). */
                 lastEventId?: string;
             }[];
+            /** @description Routing address for correlated replies (CORRELATED-REPLY-ROUTING D1): a UUID minted once per bus-client lifetime — per actor, NOT per connection, so it survives a make-before-break reconnect and both overlap connections share it. Required: a subscriber without one could never receive a correlated frame, and that must fail loudly here rather than silently at delivery. Not authentication — the JWT stays that; this is an unguessable routing address, never echoed into any payload or broadcast frame. */
+            clientId: string;
         };
         CloneResourceWithTokenResponse: {
             /** @description Generated clone token */
@@ -2542,7 +2046,7 @@ interface components {
         DiscoveredKB: {
             /** @description Hostname the KB is reachable on from this machine (today always "localhost" — local stacks bind locally and codespace KBs arrive through a local port forward) */
             host: string;
-            /** @description Local TCP port of the KB's API (the backend port for a local stack; the allocated forward port for a codespace stack) */
+            /** @description Local TCP port of the KB's API (the gateway port for a local stack; the allocated forward port for a codespace stack) */
             port: number;
             /**
              * @description Where the stack actually runs. "local": containers on this machine. "codespace": a GitHub-hosted VM whose KB is port-forwarded here.
@@ -2560,7 +2064,7 @@ interface components {
         };
         /**
          * DiscoveryDocument
-         * @description The launcher's KB discovery document — the schema authority for <stateDir>/discovery/kbs.json, which the semiont launcher (Go, apps/launcher) regenerates on every stack mutation and the frontend container mounts read-only at /discovery. NOT an API endpoint: a static document fetched same-origin by browsers (via the frontend's static server) or read from disk by local Node consumers. An empty kbs list is meaningful ("the launcher manages nothing right now") and distinct from an absent file. Design record: .plans/BROWSER-KB-DISCOVERY.md.
+         * @description The launcher's KB discovery document — the schema authority for <stateDir>/discovery/kbs.json, which the semiont launcher (Go, apps/launcher) regenerates on every stack mutation and the Browser container mounts read-only at /discovery. NOT an API endpoint: a static document fetched same-origin by browsers (via the Browser's static server) or read from disk by local Node consumers. An empty kbs list is meaningful ("the launcher manages nothing right now") and distinct from an absent file. Design record: .plans/BROWSER-KB-DISCOVERY.md.
          */
         DiscoveryDocument: {
             /**
@@ -2739,6 +2243,8 @@ interface components {
         };
         /** @description Progress payload emitted on the gather:annotation-progress SSE channel during LLM context gathering. */
         GatherProgress: {
+            /** @description The request this progress belongs to (CORRELATED-REPLY-ROUTING D3). Required: `CORRELATED_CHANNELS` derives every operation's progress channel into the delivery filter, so a frame without it cannot be matched to a claim and is silently dropped. */
+            correlationId: string;
             message?: string;
             percentage?: number;
         };
@@ -2849,9 +2355,9 @@ interface components {
         };
         /** @description Params bag for `job:create` with `jobType: 'generation'` — exactly the shape yield.fromContext(context, options) takes: options + the gathered context. The job's ids are DERIVED from context.focus at the dispatcher (resource focus → focus.resource; annotation focus → focus.sourceResource, with the worker auto-binding to focus.annotation); a caller-supplied referenceId is rejected. Carried inside JobCreateCommand.params; this schema is the generation shape's contract, including its requiredness. */
         GenerationJobParams: {
-            /** @description Title of the generated resource. */
+            /** @description Title of the generated resource. Non-empty: the dispatcher and worker both reject an empty title via isGenerationJobParams. NOTE minLength is documentation here — JobCreateCommand.params is additionalProperties:true, so /bus/emit's generated validator never sees this field (GENERATION-OUTPUT-FORMAT D9b). */
             title: string;
-            /** @description Storage URI for the generated resource's content. */
+            /** @description Storage URI for the generated resource's content — AUTHORITATIVE: the worker writes exactly here and never derives a location from the title. Non-empty, and there is no fallback; the dispatcher and worker both reject an empty value via isGenerationJobParams. NOTE minLength is documentation here — JobCreateCommand.params is additionalProperties:true, so /bus/emit's generated validator never sees this field (GENERATION-OUTPUT-FORMAT D6/D9). */
             storageUri: string;
             /** @description The gathered context that grounds the generation. Its `focus` names the anchor: the DISPATCHER derives the job's resourceId from it (resource focus → focus.resource; annotation focus → focus.sourceResource, with the worker auto-binding to focus.annotation) and REJECTS a caller-supplied id — the context is authoritative. Under `cite`, the ids its embedding carries are the only valid citation targets. */
             context: components["schemas"]["GatheredContext"];
@@ -2997,12 +2503,29 @@ interface components {
             assessmentsFound: number;
             assessmentsCreated: number;
         };
-        /** @description Request to cancel a job */
+        /** @description Request to cancel a job. Target one running or pending job by `jobId` (JOB-RESTART-SAFETY P4), or a whole category of pending jobs by `jobType`. A `jobId`-targeted request that names a RUNNING job is honoured cooperatively by the owning worker, which stops at its next unit boundary and emits JobCancelCommand — the queue is never made to yank a running job out from under a live worker. */
         JobCancelRequest: {
             /** @description Correlation id for request/reply matching, set by the SDK's busRequest so the confirmed-write ack/failure routes back. Absent for the local cancelRequest UI signal. */
             correlationId?: string;
-            /** @enum {string} */
-            jobType: "annotation" | "generation";
+            /** @description Cancel this one job. A pending job is cancelled immediately by the gateway; a running job is cancelled cooperatively by its worker. Takes precedence over jobType. */
+            jobId?: string;
+            /**
+             * @description Cancel all PENDING jobs in this category — the bulk UI signal. Ignored when jobId is present.
+             * @enum {string}
+             */
+            jobType?: "annotation" | "generation";
+        };
+        /** @description A worker's confirmation that it has cooperatively stopped a running job at a unit boundary (JOB-RESTART-SAFETY P4) — the queue moves the job to cancelled/. Distinct from JobCancelRequest (the client→worker REQUEST to stop): this is the worker announcing it did, so the running job is never yanked to cancelled/ out from under a live worker (the roach-motel race). */
+        JobCancelCommand: {
+            /** @description Authenticated user's DID, injected by the /bus/emit gateway. Clients do not set this. */
+            _userId?: string;
+            resourceId: string;
+            jobId: string;
+            jobType: components["schemas"]["JobType"];
+            /** @description Annotation this job is attached to, when applicable. Lets the UI route cancellation feedback to a specific annotation. */
+            annotationId?: string;
+            /** @description Entity-type units whose annotations were fully emitted before cancellation. Recorded on the cancelled job's metadata so the work already done stays visible. */
+            completedUnits?: string[];
         };
         /** @description Command to claim a pending job (atomic CAS: pending → running) */
         JobClaimCommand: {
@@ -3077,6 +2600,23 @@ interface components {
             /** @description Annotation this job is attached to, when applicable. Lets the UI route failure feedback (error toast, revert state) to a specific annotation. */
             annotationId?: string;
             error: string;
+            /** @description Entity-type units whose annotations were fully emitted before this failure (checkpointed resume). The queue records them on the retried job's metadata; a retried claim skips them so completed work is neither redone nor duplicated. */
+            completedUnits?: string[];
+            /**
+             * @description Worker-side classification of the failure, made where the error is still typed. 'deterministic' — the same request cannot succeed on a second attempt — skips the retry budget; absent or 'transient' retries as before. Only KNOWN-deterministic failures carry the class.
+             * @enum {string}
+             */
+            failureClass?: "transient" | "deterministic";
+            /** @description Whether the queue will re-queue this job for another attempt. Computed by the worker from the SAME predicate the queue applies at failJob (one decision site, `willRetryAfter` in @semiont/jobs) using the retry budget carried on the claimed record. FALSE (or absent) means this failure is TERMINAL: a client's job-watch stream ends here. TRUE means the work continues on a fresh attempt — the failure is an event, not the end, and a stream that terminated on it would report a recovering run as a failed one (JOB-RESTART-SAFETY P5). */
+            willRetry?: boolean;
+        };
+        /** @description Command to persist a running job's completed-unit checkpoint AT unit completion (JOB-RESTART-SAFETY P2). Distinct from JobFailCommand's checkpoint, which lands only on a clean failure: a worker that dies (crash/OOM/kill) never emits job:fail, so this durable, unthrottled write is what lets the janitor's stale-running recovery resume a dead worker's job rather than redo its finished units. */
+        JobCheckpointCommand: {
+            /** @description Authenticated user's DID, injected by the /bus/emit gateway. Clients do not set this. */
+            _userId?: string;
+            jobId: string;
+            /** @description Entity-type units whose annotations have been fully emitted so far. Unioned into the running job's metadata checkpoint; a retry after recovery skips them. */
+            completedUnits: string[];
         };
         /** @description Result of a job that completed without doing its work because the resource could not be read. Distinct from a failure: nothing went wrong, there was simply no text to work with — an encrypted or damaged PDF, a scan whose text could not be recognized, or a document that yielded nothing. The reasons are the extraction vocabulary the Smelter reports on `smelt:settled`, MINUS `no-extractor`: a media type that can never yield text (a zip, an image) is a bad request rather than a decline, so a worker asked to detect over one throws and the job reports `job:fail`. Everything here is a resource-specific outcome — the same media type would have succeeded on a different document. */
         JobDeclinedResult: {
@@ -3091,7 +2631,7 @@ interface components {
              */
             declined: true;
             /**
-             * @description Why the resource could not be read. A CODE, not a sentence: the client owns the wording, so a browser renders it in the user's language and the CLI renders English terminal copy from the same value. The prose `message` this schema used to carry was composed backend-side and was therefore English everywhere (ASSIST-PROGRESS-CONSOLIDATION P5).
+             * @description Why the resource could not be read. A CODE, not a sentence: the client owns the wording, so a browser renders it in the user's language and the CLI renders English terminal copy from the same value. The prose `message` this schema used to carry was composed gateway-side and was therefore English everywhere (ASSIST-PROGRESS-CONSOLIDATION P5).
              * @enum {string}
              */
             reason: "no-text-layer" | "encrypted" | "corrupt" | "too-large" | "empty";
@@ -3161,6 +2701,8 @@ interface components {
                 value: string;
                 /** @description Annotations found for it. */
                 foundCount: number;
+                /** @description Annotations actually persisted for it — post-dedupe and post-durability-acknowledgement, so it counts what the event log holds, not what the model proposed. Beside foundCount this is the per-unit yield the sizing work is judged by. Present on flows whose units persist as they complete (reference-annotation); the tagging flow reports the same fact as byCategory on its result, because its annotations are built after the per-category loop. */
+                persistedCount?: number;
             }[];
             /** @description Echoed job parameters for display in the progress UI. `label` is a CODE, not a sentence — the client owns the wording, same rule as the progress message. `value` is the user's own input (an entity-type list, their instructions) and is deliberately NOT translated: it is their words, not ours. */
             requestParams?: {
@@ -3399,6 +2941,7 @@ interface components {
             /** @description Authenticated user's DID, injected by the /bus/emit gateway. Clients do not set this. */
             _userId?: string;
             resourceId: string;
+            /** @description Optional: where the resource's bytes live, so the archive can act on the file. An instruction to this handler, not a copy of the stored fact (that lives on the primary Representation). Working-tree URI, only file:// is supported. */
             storageUri?: string;
             keepFile?: boolean;
             noGit?: boolean;
@@ -3438,6 +2981,29 @@ interface components {
                 annotationId: string;
             };
         };
+        /** @description Bus command to persist a detection unit's annotations as one acknowledged batch (JOB-RESTART-SAFETY P6). Unlike mark:create, which is fire-and-forget and resolves when the bus accepts it, this command is answered only after every annotation is in the event log — so a worker can gate unit completion on durability rather than on emission. The batch is the unit: a partial commit is reported as a failure, and the worker retries the whole unit, which is safe because annotation ids are deterministic (P3). */
+        MarkCommitCommand: {
+            /** @description Authenticated user's DID, injected by the /bus/emit gateway. Clients do not set this. */
+            _userId?: string;
+            /** @description Correlation id set by busRequest so the mark:commit-ok / mark:commit-failed reply routes back to the awaiting worker. */
+            correlationId: string;
+            /** @description Resource every annotation in this batch targets. */
+            resourceId: string;
+            /** @description The unit's annotations, already built with deterministic ids. Re-committing an identical batch is a no-op rather than a duplicate. */
+            annotations: components["schemas"]["Annotation"][];
+        };
+        /** @description Durability acknowledgement for a mark:commit batch: every annotation named by the command is in the event log at the moment this is emitted. */
+        MarkCommitOk: {
+            /** @description Correlation id echoed from the mark:commit command so busRequest can match the reply. */
+            correlationId: string;
+            /** @description What the commit persisted. */
+            response: {
+                /** @description Annotations this commit appended to the event log. Equals the batch size on success — a retry re-appends what already landed rather than counting it out, because the annotation fold is idempotent by id and the log is append-only. Not a dedupe count. */
+                persisted: number;
+                /** @description Ids the batch covers, whether appended now or already present. */
+                annotationIds: string[];
+            };
+        };
         /** @description Raw annotation creation intent — bus handler assembles the W3C annotation */
         MarkCreateRequest: {
             correlationId: string;
@@ -3487,6 +3053,7 @@ interface components {
             /** @description Authenticated user's DID, injected by the /bus/emit gateway. Clients do not set this. */
             _userId?: string;
             resourceId: string;
+            /** @description Optional: where the resource's bytes are expected to be. When present the handler VERIFIES the file exists and fails loudly if it does not, rather than succeeding as a no-op. An instruction, not a copy of the stored fact (that lives on the primary Representation). Working-tree URI, only file:// is supported. */
             storageUri?: string;
         };
         /** @description Bus command to update an annotation's body with patch operations. */
@@ -3578,7 +3145,7 @@ interface components {
             "@type"?: string | string[];
             /** @description MIME/media type (e.g., text/markdown, image/png). */
             mediaType: string;
-            /** @description Working-tree URI identifying where the bytes live. Only file:// is supported (e.g. file://docs/overview.md). */
+            /** @description Working-tree URI identifying where this rendition's bytes live. Only file:// is supported (e.g. file://docs/overview.md). The single home of the storage location: maintained across moves (yield:moved relocates it), absent when the resource has no stored bytes. */
             storageUri?: string;
             filename?: string;
             /** @description Size of the payload in bytes. */
@@ -3629,6 +3196,8 @@ interface components {
             format: components["schemas"]["ContentFormat"];
             contentChecksum: string;
             contentByteSize?: number;
+            /** @description Where the clone's bytes are, on the resource's primary Representation — the same single home `yield:created` writes to (STORAGE-URI-ONE-HOME). */
+            storageUri?: string;
             parentResourceId: string;
             entityTypes?: string[];
             language?: string;
@@ -3641,7 +3210,7 @@ interface components {
             contentChecksum: string;
             contentByteSize?: number;
             entityTypes?: string[];
-            /** @description Working-tree URI (e.g. file://docs/overview.md) */
+            /** @description The creating instruction's URI, recorded on the event. Append-only, so this value never changes — the LOCATION the projection serves is maintained across moves and lives on the resource's primary Representation, relocated by yield:moved. Optional: a resource may have no bytes. Working-tree URI, only file:// is supported (e.g. file://docs/overview.md). */
             storageUri?: string;
             language?: string;
             isDraft?: boolean;
@@ -3715,10 +3284,6 @@ interface components {
              * @description Original URI from a source knowledge base when this resource was imported
              */
             originatedFrom?: string;
-            /** @description Working-tree URI for this resource (e.g. file://docs/overview.md). Stable across updates and moves. */
-            storageUri?: string;
-            /** @description SHA-256 hex hash of the current content. Updated on resource.created, resource.updated, resource.cloned events. */
-            currentChecksum?: string;
         } & {
             [key: string]: unknown;
         };
@@ -3831,7 +3396,7 @@ interface components {
             projectName?: string;
             /** @description Current git branch of the knowledge base repository */
             gitBranch?: string;
-            /** @description The knowledge base's did:web identity — 'did:web:' + the committed [site] domain, byte-identical to the string the launcher publishes in its discovery document. REQUIRED: a KB that declares no domain does not run (the launcher refuses to start it, and the backend refuses to boot), so a response without this field means the caller reached something that bypassed both. Identifies WHICH knowledge base this is; it does NOT identify which running copy — one KB reachable at two addresses (a local clone and a codespace of one repo) reports the same did at both. Use it to verify what you connected to, not to select among discovered entries. */
+            /** @description The knowledge base's did:web identity — 'did:web:' + the committed [site] domain, byte-identical to the string the launcher publishes in its discovery document. REQUIRED: a KB that declares no domain does not run (the launcher refuses to start it, and the gateway refuses to boot), so a response without this field means the caller reached something that bypassed both. Identifies WHICH knowledge base this is; it does NOT identify which running copy — one KB reachable at two addresses (a local clone and a codespace of one repo) reports the same did at both. Use it to verify what you connected to, not to select among discovered entries. */
             did: string;
         };
         /** @description A persisted domain event with metadata. Flat shape — event fields and metadata are peers. */
@@ -3988,14 +3553,18 @@ interface components {
             /** @description Authenticated user's DID, injected by the /bus/emit gateway. Clients do not set this. */
             _userId?: string;
         };
-        /** @description Bus command to create a cloned resource from a clone token. */
+        /** @description Bus command to create a cloned resource from a clone token. Bytes are stored gateway-side BEFORE this command is emitted (GATEWAY.md D4a: the Archivist serves no bytes) — the command carries the storage coordinates, never content. */
         YieldCloneCreateCommand: {
             correlationId: string;
             /** @description Authenticated user's DID, injected by the /bus/emit gateway. Clients do not set this. */
             _userId?: string;
             token: string;
             name: string;
-            content: string;
+            /** @description Where the caller already wrote the clone's bytes — an instruction, not a copy of the stored fact (that lives on the primary Representation). Bytes are stored through the byte door BEFORE this command is sent, so this names an existing file. Working-tree URI, only file:// is supported. */
+            storageUri: string;
+            contentChecksum: string;
+            byteSize: number;
+            format: components["schemas"]["ContentFormat"];
             archiveOriginal?: boolean;
         };
         /** @description Success response after creating a cloned resource. */
@@ -4022,6 +3591,7 @@ interface components {
             /** @description Authenticated user's DID, injected by the /bus/emit gateway. Clients do not set this. */
             _userId?: string;
             name: string;
+            /** @description The caller's instruction for WHERE the bytes are — not a copy of the stored fact. The stored location lives on the resource's primary Representation (`Representation.storageUri`), which is its single home; this field is the message that puts it there. Working-tree URI, only file:// is supported (e.g. file://docs/overview.md). */
             storageUri: string;
             contentChecksum: string;
             byteSize: number;
@@ -4037,6 +3607,34 @@ interface components {
             generator?: components["schemas"]["Agent"] | components["schemas"]["Agent"][];
             noGit?: boolean;
         };
+        /**
+         * @description Command: stow an already-uploaded clone's bytes and append `yield:cloned`.
+         *
+         *     The INNER half of the clone flow. `yield:clone-create` reaches the CloneTokenManager, which alone can validate the token and read the source's entity types; it then emits this so the Stower — the only appendEvent caller — writes the domain event.
+         *
+         *     Distinct from `yield:create` because a clone is a distinct operation, not a creation with an extra field. It REQUIRES a parent, and that requirement is what a separate command expresses: an optional `parentResourceId` on the create command could not say that a clone without a parent is not a clone. `ResourceClonedPayload` requires it for the same reason.
+         *
+         *     Generated resources are NOT clones: they carry provenance in `generatedFrom` and stay on `yield:create`.
+         */
+        YieldClonePersistCommand: {
+            /** @description Correlation id so busRequest can match the reply. */
+            correlationId: string;
+            /** @description Injected by the gateway from the authenticated principal; never supplied by a wire caller. */
+            _userId?: string;
+            name: string;
+            /** @description The caller's instruction for WHERE the bytes are — the uploader wrote them before emitting this. The stored location lives on the clone's primary Representation (STORAGE-URI-ONE-HOME). */
+            storageUri: string;
+            contentChecksum: string;
+            byteSize: number;
+            format: components["schemas"]["ContentFormat"];
+            language?: string;
+            /** @description Inherited from the source resource by the CloneTokenManager, which is the only party that knows the token is valid. */
+            entityTypes?: string[];
+            /** @description The resource this one is cloned FROM. Required: it is what makes this a clone rather than a creation. */
+            parentResourceId: string;
+            /** @description The bytes were already written by the uploader; the Stower's register does the one `git add` on apply (GATEWAY.md D4b). */
+            noGit?: boolean;
+        };
         /** @description Success reply after creating a yielded resource, matched to the originating command by correlationId. */
         YieldCreateOk: {
             /** @description Correlation id echoed from the yield:create command so busRequest can match the reply. */
@@ -4046,6 +3644,15 @@ interface components {
                 resourceId: string;
             };
         };
+        /** @description Success reply after cloning a resource, matched to the originating command by correlationId. */
+        YieldClonePersistOk: {
+            /** @description Correlation id echoed from the yield:clone-persist command so busRequest can match the reply. */
+            correlationId?: string;
+            /** @description The clone's identity — a new resource, distinct from its parent. */
+            response: {
+                resourceId: string;
+            };
+        };
         /** @description Bus command to move (rename) a yielded resource. */
         YieldMvCommand: {
             /** @description Authenticated user's DID, injected by the /bus/emit gateway. Clients do not set this. */
@@ -4061,6 +3668,7 @@ interface components {
             /** @description Authenticated user's DID, injected by the /bus/emit gateway. Clients do not set this. */
             _userId?: string;
             resourceId: string;
+            /** @description The caller's instruction for WHERE the bytes are — not a copy of the stored fact. The stored location lives on the resource's primary Representation (`Representation.storageUri`), which is its single home; this field is the message that puts it there. Working-tree URI, only file:// is supported (e.g. file://docs/overview.md). */
             storageUri: string;
             contentChecksum: string;
             byteSize: number;
@@ -4408,7 +4016,7 @@ interface AnchorRect {
  *
  * The complete EventMap for the RxJS EventBus. Every channel name and
  * its payload type is defined here — domain events, commands, reads,
- * results, SSE stream payloads, and frontend UI events.
+ * results, SSE stream payloads, and Browser UI events.
  *
  * Identifier discipline: where a payload carries an annotation or
  * resource id, the TypeScript layer narrows the OpenAPI `string` to the
@@ -4454,6 +4062,7 @@ type EventMap = {
     'yield:representation-added': StoredEvent<EventOfType<'yield:representation-added'>>;
     'yield:representation-removed': StoredEvent<EventOfType<'yield:representation-removed'>>;
     'yield:create': components['schemas']['YieldCreateCommand'];
+    'yield:clone-persist': components['schemas']['YieldClonePersistCommand'];
     'yield:update': components['schemas']['YieldUpdateCommand'];
     'yield:mv': components['schemas']['YieldMvCommand'];
     'yield:clone': void;
@@ -4462,6 +4071,10 @@ type EventMap = {
     'yield:clone-create': components['schemas']['YieldCloneCreateCommand'];
     'yield:create-ok': components['schemas']['YieldCreateOk'];
     'yield:create-failed': components['schemas']['CommandError'];
+    'yield:clone-persist-ok': components['schemas']['YieldClonePersistOk'];
+    'yield:clone-persist-failed': {
+        correlationId: string;
+    } & components['schemas']['CommandError'];
     'yield:update-ok': components['schemas']['YieldUpdateOk'];
     'yield:update-failed': components['schemas']['CommandError'];
     'yield:move-failed': {
@@ -4501,6 +4114,16 @@ type EventMap = {
     'mark:update-entity-types': components['schemas']['MarkUpdateEntityTypesCommand'];
     'mark:create-ok': components['schemas']['MarkCreateOk'];
     'mark:create-failed': components['schemas']['CommandError'];
+    /**
+     * Persist a detection unit's annotations as ONE acknowledged batch
+     * (JOB-RESTART-SAFETY P6). Answered only after every annotation is in
+     * the event log, so a worker can gate unit completion on durability
+     * instead of on emission — which is what makes an Archivist outage a
+     * delay rather than silent data loss.
+     */
+    'mark:commit': components['schemas']['MarkCommitCommand'];
+    'mark:commit-ok': components['schemas']['MarkCommitOk'];
+    'mark:commit-failed': components['schemas']['CommandError'];
     'mark:delete-ok': components['schemas']['MarkDeleteOk'];
     'mark:delete-failed': components['schemas']['CommandError'];
     'mark:archive-ok': {
@@ -4601,6 +4224,14 @@ type EventMap = {
     'browse:anchored-text-failed': {
         correlationId: string;
     } & components['schemas']['CommandError'];
+    'browse:anchored-text-by-checksum-requested': components['schemas']['BrowseAnchoredTextByChecksumRequest'];
+    'browse:anchored-text-by-checksum-result': {
+        correlationId: string;
+        response: components['schemas']['ExtractionOutcome'] | null;
+    };
+    'browse:anchored-text-by-checksum-failed': {
+        correlationId: string;
+    } & components['schemas']['CommandError'];
     'browse:resources-requested': components['schemas']['BrowseResourcesRequest'];
     'browse:resources-result': {
         correlationId: string;
@@ -4706,8 +4337,10 @@ type EventMap = {
     'job:report-progress': components['schemas']['JobReportProgressCommand'];
     'job:complete': components['schemas']['JobCompleteCommand'];
     'job:fail': components['schemas']['JobFailCommand'];
+    'job:checkpoint': components['schemas']['JobCheckpointCommand'];
     'job:queued': components['schemas']['JobQueuedEvent'];
     'job:cancel-requested': components['schemas']['JobCancelRequest'];
+    'job:cancel': components['schemas']['JobCancelCommand'];
     'job:status-requested': components['schemas']['JobStatusRequest'];
     'job:create': components['schemas']['JobCreateCommand'];
     'job:claim': components['schemas']['JobClaimCommand'];
@@ -4737,7 +4370,7 @@ type EventMap = {
      * Emitted by the Weaver after applying an event (or a batch's last event)
      * for a resource to the graph. `sequenceNumber` is the resource-stream
      * sequence of the last applied event. Folded by `WeaveProgress`
-     * (make-meaning) into the backend-local applied map that the
+     * (make-meaning) into the gateway-local applied map that the
      * `whenApplied` barrier awaits. In-process signal today; crosses the
      * bus gateway after WEAVER-ISOLATION.
      */
@@ -4867,6 +4500,7 @@ declare const CHANNEL_SCHEMAS: {
     readonly 'yield:representation-added': null;
     readonly 'yield:representation-removed': null;
     readonly 'yield:create': "YieldCreateCommand";
+    readonly 'yield:clone-persist': "YieldClonePersistCommand";
     readonly 'yield:update': "YieldUpdateCommand";
     readonly 'yield:mv': "YieldMvCommand";
     readonly 'yield:clone': null;
@@ -4875,6 +4509,8 @@ declare const CHANNEL_SCHEMAS: {
     readonly 'yield:clone-create': "YieldCloneCreateCommand";
     readonly 'yield:create-ok': "YieldCreateOk";
     readonly 'yield:create-failed': "CommandError";
+    readonly 'yield:clone-persist-ok': "YieldClonePersistOk";
+    readonly 'yield:clone-persist-failed': null;
     readonly 'yield:update-ok': "YieldUpdateOk";
     readonly 'yield:update-failed': null;
     readonly 'yield:move-failed': null;
@@ -4904,6 +4540,9 @@ declare const CHANNEL_SCHEMAS: {
     readonly 'frame:add-tag-schema': "FrameAddTagSchemaCommand";
     readonly 'mark:create-ok': "MarkCreateOk";
     readonly 'mark:create-failed': "CommandError";
+    readonly 'mark:commit': "MarkCommitCommand";
+    readonly 'mark:commit-ok': "MarkCommitOk";
+    readonly 'mark:commit-failed': "CommandError";
     readonly 'mark:delete-ok': "MarkDeleteOk";
     readonly 'mark:delete-failed': "CommandError";
     readonly 'mark:archive-ok': null;
@@ -4953,6 +4592,9 @@ declare const CHANNEL_SCHEMAS: {
     readonly 'browse:anchored-text-requested': "BrowseAnchoredTextRequest";
     readonly 'browse:anchored-text-result': "BrowseAnchoredTextResult";
     readonly 'browse:anchored-text-failed': null;
+    readonly 'browse:anchored-text-by-checksum-requested': "BrowseAnchoredTextByChecksumRequest";
+    readonly 'browse:anchored-text-by-checksum-result': "BrowseAnchoredTextResult";
+    readonly 'browse:anchored-text-by-checksum-failed': null;
     readonly 'browse:resources-requested': "BrowseResourcesRequest";
     readonly 'browse:resources-result': "BrowseResourcesResult";
     readonly 'browse:resources-failed': null;
@@ -5009,8 +4651,10 @@ declare const CHANNEL_SCHEMAS: {
     readonly 'job:report-progress': "JobReportProgressCommand";
     readonly 'job:complete': "JobCompleteCommand";
     readonly 'job:fail': "JobFailCommand";
+    readonly 'job:checkpoint': "JobCheckpointCommand";
     readonly 'job:queued': "JobQueuedEvent";
     readonly 'job:cancel-requested': "JobCancelRequest";
+    readonly 'job:cancel': "JobCancelCommand";
     readonly 'job:status-requested': "JobStatusRequest";
     readonly 'job:create': "JobCreateCommand";
     readonly 'job:claim': "JobClaimCommand";
@@ -5198,6 +4842,13 @@ declare class EventBus {
      * using runtime `PersistedEventType` strings.
      */
     getDomainEvent(eventType: PersistedEventType): Subject<StoredEvent>;
+    /**
+     * Channel names with at least one live observer right now. Introspection
+     * for composition-parity gates: `get()` creates subjects lazily, so mere
+     * access does not count — only real subscriptions do. Scoped channels
+     * appear under their namespaced key (`<scope>:<channel>`).
+     */
+    observedChannels(): string[];
     /**
      * Destroy the event bus and complete all subjects
      *
@@ -5434,7 +5085,7 @@ declare function errField(error: unknown): unknown;
  * Bus logging — runtime-toggleable cross-wire visibility.
  *
  * One line per event that crosses a process boundary, in a grep-able
- * format that's symmetric across frontend and backend:
+ * format that's symmetric across frontend and gateway:
  *
  *   [bus EMIT] <channel> [scope=X] [cid=<first8>] <payload>
  *   [bus RECV] <channel> [scope=X] [cid=<first8>] <payload>
@@ -5924,7 +5575,11 @@ declare function getChecksum(resource: ResourceDescriptor | undefined): string |
  */
 declare function getLanguage(resource: ResourceDescriptor | undefined): string | undefined;
 /**
- * Get storage URI from primary representation
+ * Get the storage URI from the primary representation — the field's ONE home
+ * (STORAGE-URI-ONE-HOME): bytes are a fact about a rendition, so their
+ * location lives on the Representation, never on the descriptor. This is the
+ * accessor every descriptor-holding read goes through; `undefined` means the
+ * resource has no stored bytes.
  *
  * @param resource - ResourceDescriptor
  * @returns Storage URI or undefined
@@ -6014,7 +5669,7 @@ declare function decodeRepresentation(buffer: Buffer, mediaType: string): string
  *  - `not-found`    — resource missing (HTTP 404)
  *  - `conflict`     — concurrent modification, duplicate, etc. (HTTP 409)
  *  - `bad-request`  — request malformed (HTTP 400)
- *  - `unavailable`  — backend unreachable, network error, 5xx
+ *  - `unavailable`  — gateway unreachable, network error, 5xx
  *  - `error`        — unclassified fallback
  */
 type TransportErrorCode = 'unauthorized' | 'forbidden' | 'not-found' | 'conflict' | 'bad-request' | 'unavailable' | 'error';
@@ -6050,11 +5705,11 @@ declare class ConflictError extends SemiontError {
  *
  *   ITransport          — bus primitives + lifecycle. Universal: every
  *                         concrete transport implements this.
- *   IBackendOperations  — auth, admin, exchange, system endpoints.
+ *   IGatewayOperations  — auth, admin, and system endpoints.
  *                         HTTP-shaped today; an in-process transport may
  *                         implement none, some, or a different set.
  *                         Optional on `SemiontClient` — passed only when
- *                         the host has a backend that supports them.
+ *                         the host has a gateway that supports them.
  *   IContentTransport   — binary I/O (putBinary / getBinary). Narrow by
  *                         design because binary has different backpressure
  *                         and streaming characteristics.
@@ -6066,21 +5721,28 @@ declare class ConflictError extends SemiontError {
 type Agent$1 = components['schemas']['Agent'];
 type GetResourceResponse = components['schemas']['GetResourceResponse'];
 /**
- * Six-state lifecycle for a transport's connection. Drives UI affordances
+ * Seven-state lifecycle for a transport's connection. Drives UI affordances
  * (connecting spinners, reconnecting banners, etc.) and is observed via
  * `ITransport.state$`.
  *
- *   initial      ─ pre-`start()`; never enters subscribers' streams
- *                  except as the first replayed value
- *   connecting   ─ in-flight initial open
- *   open         ─ healthy, delivering events
- *   reconnecting ─ open → dropped, retrying; may be transient
- *   degraded     ─ has been reconnecting for > DEGRADED_THRESHOLD_MS;
- *                  UI banner threshold; distinguishes brief mount-
- *                  churn cycles from sustained disconnection
- *   closed       ─ stop()/dispose() called; terminal
- */
-type ConnectionState = 'initial' | 'connecting' | 'open' | 'reconnecting' | 'degraded' | 'closed';
+ *   initial         ─ pre-`start()`; never enters subscribers' streams
+ *                     except as the first replayed value
+ *   connecting      ─ in-flight initial open
+ *   open            ─ healthy, delivering events
+ *   reconnecting    ─ open → dropped, retrying; may be transient
+ *   degraded        ─ has been reconnecting for > DEGRADED_THRESHOLD_MS;
+ *                     UI banner threshold; distinguishes brief mount-
+ *                     churn cycles from sustained disconnection
+ *   unauthenticated ─ not attempting: the credential is absent, or was
+ *                     refused (401) and only a DIFFERENT one is worth
+ *                     trying. No network activity; recovers on its own
+ *                     when a usable credential appears (a re-login, a
+ *                     session refresh). The refusal itself surfaces on
+ *                     the transport's error stream (SSE-AUTH-RESILIENCE
+ *                     D3/D6a — one state for both answers)
+ *   closed          ─ stop()/dispose() called; terminal
+ */
+type ConnectionState = 'initial' | 'connecting' | 'open' | 'reconnecting' | 'degraded' | 'unauthenticated' | 'closed';
 type AuthResponse = components['schemas']['AuthResponse'];
 type TokenRefreshResponse = components['schemas']['TokenRefreshResponse'];
 type AdminUserStatsResponse = components['schemas']['AdminUserStatsResponse'];
@@ -6123,27 +5785,6 @@ type UserResponse = ResponseContent<paths['/api/users/me']['get']>;
 type UpdateUserRequest = RequestContent<paths['/api/admin/users/{id}']['patch']>;
 type UpdateUserResponse = ResponseContent<paths['/api/admin/users/{id}']['patch']>;
 type ListUsersResponse = ResponseContent<paths['/api/admin/users']['get']>;
-type ProgressEvent = {
-    phase: string;
-    message?: string;
-    result?: Record<string, unknown>;
-};
-type ProgressCallback = (event: ProgressEvent) => void;
-/**
- * Stream-shaped return type for backend download operations
- * (`backupKnowledgeBase`, `exportKnowledgeBase`). Transport-neutral —
- * any implementation can produce a `ReadableStream<Uint8Array>` without
- * fabricating a fetch `Response`. HTTP wraps `response.body` and
- * `response.headers`; in-process implementations return their own stream.
- *
- * The same shape `IContentTransport.getBinaryStream` already uses for
- * binary downloads.
- */
-interface BackendDownload {
-    stream: ReadableStream<Uint8Array>;
-    contentType: string;
-    filename?: string;
-}
 interface ITransport {
     /**
      * Base URL the transport speaks to. For HTTP this is `https://host[:port]`;
@@ -6159,7 +5800,7 @@ interface ITransport {
      *
      * Resolves with the number of subscribers the emit reached
      * (`/bus/emit` responds `{subscribers: n}`; GUIDED-TOUR P1), or `-1`
-     * when the count is unknown — an older backend, an unreadable body, or
+     * when the count is unknown — an older gateway, an unreadable body, or
      * an in-process transport where the question does not apply. `-1` is
      * the same sentinel the Go client uses: a parse failure must stay
      * distinguishable from a genuine empty room.
@@ -6228,9 +5869,9 @@ interface ITransport {
     dispose(): void;
 }
 /**
- * Auth, admin, exchange, and system endpoints. HTTP-shaped today —
+ * Auth, admin, and system endpoints. HTTP-shaped today —
  * `HttpTransport` implements both this and `ITransport`; the
- * `SemiontClient` constructor takes a `IBackendOperations` argument
+ * `SemiontClient` constructor takes a `IGatewayOperations` argument
  * separately from the bus transport so non-HTTP transports
  * (`LocalTransport`) can implement just the bus surface and the
  * SemiontClient cleanly omits `client.auth` / `client.admin`.
@@ -6239,7 +5880,7 @@ interface ITransport {
  * `TransportErrorCode` (see `errors.ts`) so the routing layer
  * (`SemiontBrowser`) stays transport-neutral.
  */
-interface IBackendOperations {
+interface IGatewayOperations {
     authenticatePassword(email: Email, password: string): Promise<AuthResponse>;
     authenticateGoogle(credential: GoogleCredential): Promise<AuthResponse>;
     refreshAccessToken(token: RefreshToken): Promise<TokenRefreshResponse>;
@@ -6253,22 +5894,6 @@ interface IBackendOperations {
     getUserStats(): Promise<AdminUserStatsResponse>;
     updateUser(id: UserDID, data: UpdateUserRequest): Promise<UpdateUserResponse>;
     getOAuthConfig(): Promise<OAuthConfigResponse>;
-    backupKnowledgeBase(): Promise<BackendDownload>;
-    /**
-     * Stream of `ProgressEvent`s for a restore/import operation. The
-     * Observable emits each progress event in order and completes when
-     * the operation is done; the final event carries `phase: 'complete'`
-     * (or `'error'` / `'failed'` followed by an Observable error).
-     *
-     * The SDK wraps the contract's `Observable<ProgressEvent>` as a
-     * `StreamObservable<ProgressEvent>` so consumers can `await` for the
-     * final event or `.subscribe(...)` to render every step.
-     */
-    restoreKnowledgeBase(file: File): Observable<ProgressEvent>;
-    exportKnowledgeBase(params?: {
-        includeArchived?: boolean;
-    }): Promise<BackendDownload>;
-    importKnowledgeBase(file: File): Observable<ProgressEvent>;
     healthCheck(): Promise<HealthCheckResponse>;
     getStatus(): Promise<StatusResponse>;
 }
@@ -6284,6 +5909,15 @@ interface PutBinaryRequest {
     generationPrompt?: string;
     generator?: Agent$1 | Agent$1[];
     isDraft?: boolean;
+    /**
+     * Clone provenance (EXTRACT-ARCHIVIST P3): when set, the gateway stores
+     * the bytes and routes creation through `yield:clone-create` — the
+     * CloneTokenManager validates the token and inherits source metadata.
+     * Bytes never ride the bus (D4a).
+     */
+    cloneToken?: string;
+    /** Clone-only: archive the source resource after a successful clone. */
+    archiveOriginal?: boolean;
 }
 /**
  * Optional byte-progress hook for `putBinary`. Receives raw byte counts;
@@ -6339,85 +5973,6 @@ interface IContentTransport {
     getResourceGraph(resourceId: ResourceId, options?: {
         auth?: AccessToken;
     }): Promise<GetResourceResponse>;
-    /**
-     * Store anchored text — the coordinate map a producer derived from a
-     * representation's bytes (OCR, a native text layer, a table or form
-     * reader) — under **the content checksum of those bytes** (PERSIST-ANCHORS
-     * decision A: one artifact per representation, and a representation IS its
-     * bytes).
-     *
-     * The producer supplies the checksum because it alone knows which bytes it
-     * actually read. That is a correctness rule, not a convenience: if the
-     * store derived the key from the resource's CURRENT representation at
-     * write time, a byte change racing the publish would file old geometry
-     * under the new checksum — wrong quotes served, and the reconcile diff
-     * sees "artifact present" so it never heals. Producer-supplied, the same
-     * race files the map under the OLD checksum: an unreachable orphan, and
-     * the new checksum's missing artifact is exactly what the third drift
-     * class re-derives (SMELTER-AXIOMS S15).
-     *
-     * Its own method rather than a `putBinary` of some derived media type: a
-     * coordinate map is not a *representation* of the resource, and dressing it
-     * as one would make a derived artifact indistinguishable from content a user
-     * uploaded.
-     *
-     * Whole-representation, like `getResourceGraph` is whole-resource. The
-     * producer iterates page by page; every consumer wants one map.
-     */
-    putAnchoredText(checksum: string, outcome: ExtractionOutcome, options?: {
-        auth?: AccessToken;
-    }): Promise<void>;
-    /**
-     * The resource's anchored text, or `null` when none has been derived.
-     *
-     * Deliberately resource-addressed while `putAnchoredText` is
-     * checksum-addressed: readers hold a resource id, and the server resolves
-     * it to the current representation's checksum through the view — the
-     * `resourceId → checksum` index of PERSIST-ANCHORS decision A. A reader
-     * therefore can never receive geometry for bytes the resource no longer
-     * has: the pointer moves, the artifacts stay, the index always follows
-     * the pointer.
-     *
-     * `null` is not an error and is the common case: a native text layer is read
-     * in the browser, and a resource whose media type has no extractor never
-     * produces a map at all. Callers degrade — for a PDF annotation that means
-     * geometry with no quoted text, which is the behaviour that shipped before
-     * any of this existed.
-     */
-    getAnchoredText(resourceId: ResourceId, options?: {
-        auth?: AccessToken;
-    }): Promise<ExtractionOutcome | null>;
-    /**
-     * The stored extraction outcome for exactly this byte content, or `null`
-     * for a miss — the cache-consult read (PERSIST-ANCHORS P2c). Every cache
-     * consumer runs out of process (the smelter worker, the detection
-     * workers), so the `extract()` seam's consult crosses the wire through
-     * this method; without it the cache would be write-only from exactly the
-     * processes it exists to serve.
-     *
-     * Checksum-addressed and barrier-free, unlike `getAnchoredText`:
-     * presence at this instant is the question (the keys listing's
-     * semantics), and a caller holding the checksum already holds the
-     * content identity — nothing to resolve, nothing to wait for.
-     */
-    getAnchoredTextByChecksum(checksum: string, options?: {
-        auth?: AccessToken;
-    }): Promise<ExtractionOutcome | null>;
-    /**
-     * Every key under which anchored text would currently be served — the
-     * reconcile planner's bulk existence read (PERSIST-ANCHORS P0). The
-     * Smelter diffs this against the catalog to find resources whose artifact
-     * was lost (a transient store, a failed publish) and plans re-derivation;
-     * one call per reconcile, never a `getAnchoredText` probe per resource,
-     * because each map is ~32 KB per scanned page and only presence is asked.
-     *
-     * Keys are resource ids today; after PERSIST-ANCHORS P1 they are content
-     * checksums. Callers compare against whichever handle the store is keyed
-     * by — the diff moves with the rekey, this contract does not.
-     */
-    listAnchoredTextKeys(options?: {
-        auth?: AccessToken;
-    }): Promise<string[]>;
     dispose(): void;
 }
 
@@ -6461,6 +6016,10 @@ declare const BUS_OPERATIONS: {
         readonly result: "browse:anchored-text-result";
         readonly failure: "browse:anchored-text-failed";
     };
+    readonly 'browse:anchored-text-by-checksum-requested': {
+        readonly result: "browse:anchored-text-by-checksum-result";
+        readonly failure: "browse:anchored-text-by-checksum-failed";
+    };
     readonly 'browse:resources-requested': {
         readonly result: "browse:resources-result";
         readonly failure: "browse:resources-failed";
@@ -6546,6 +6105,10 @@ declare const BUS_OPERATIONS: {
         readonly result: "mark:create-ok";
         readonly failure: "mark:create-failed";
     };
+    readonly 'mark:commit': {
+        readonly result: "mark:commit-ok";
+        readonly failure: "mark:commit-failed";
+    };
     readonly 'mark:delete': {
         readonly result: "mark:delete-ok";
         readonly failure: "mark:delete-failed";
@@ -6578,6 +6141,10 @@ declare const BUS_OPERATIONS: {
         readonly result: "yield:create-ok";
         readonly failure: "yield:create-failed";
     };
+    readonly 'yield:clone-persist': {
+        readonly result: "yield:clone-persist-ok";
+        readonly failure: "yield:clone-persist-failed";
+    };
     readonly 'yield:update': {
         readonly result: "yield:update-ok";
         readonly failure: "yield:update-failed";
@@ -6626,7 +6193,7 @@ type BusOperationKey = keyof typeof BUS_OPERATIONS;
  * and SSE infrastructure. A reply channel must NOT go here — declare its
  * operation in `BUS_OPERATIONS` instead.
  */
-declare const BRIDGED_BROADCASTS: readonly ["job:report-progress", "job:complete", "job:fail", "frame:entity-type-added", "frame:tag-schema-added", "beckon:focus", "beckon:sparkle", "bus:resume-gap", "browse:resource-open", "browse:resource-viewed", "session:joined", "session:left", "browse:click"];
+declare const BRIDGED_BROADCASTS: readonly ["job:report-progress", "job:complete", "job:fail", "frame:entity-type-added", "frame:tag-schema-added", "yield:created", "yield:updated", "yield:cloned", "yield:moved", "beckon:focus", "beckon:sparkle", "bus:resume-gap", "browse:resource-open", "browse:resource-viewed", "session:joined", "session:left", "browse:click"];
 type OpSpecs = (typeof BUS_OPERATIONS)[keyof typeof BUS_OPERATIONS];
 type ProgressChannel<O> = O extends {
     progress: infer P extends EventName;
@@ -6651,11 +6218,24 @@ type BridgedChannel = RegistryReply | (typeof BRIDGED_BROADCASTS)[number];
 type BusReply<Op extends BusOperationKey> = EventMap[(typeof BUS_OPERATIONS)[Op]['result'] & EventName] extends {
     response: infer R;
 } ? R : void;
-type BusRequestErrorCode = 'bus.timeout' | 'bus.rejected' | 'bus.closed' | 'bus.bad-payload' | 'bus.unauthorized' | 'bus.forbidden' | 'bus.not-found';
+type BusRequestErrorCode = 'bus.timeout' | 'bus.rejected' | 'bus.closed' | 'bus.bad-payload' | 'bus.unauthorized' | 'bus.forbidden' | 'bus.not-found' | 'bus.unsubscribed';
 declare class BusRequestError extends SemiontError {
     code: BusRequestErrorCode;
     constructor(message: string, code: BusRequestErrorCode, details?: Record<string, unknown>);
 }
+/**
+ * The reply channels — result, failure, and (for streaming operations)
+ * progress — of every operation in `channels`, deduplicated. Entries that
+ * are not operation request channels (broadcast signals, domain events)
+ * contribute nothing.
+ *
+ * This is THE derivation for a narrowed-subscription transport profile
+ * (`HttpTransportConfig.channels`: subscribe exactly the reply channels of
+ * the operations a process awaits) and for a service's outbound reply pump
+ * (forward exactly the replies of the operations it answers). Restating a
+ * reply channel by hand was the recurring unbridged-reply bug class.
+ */
+declare function replyChannelsFor(channels: readonly string[]): EventName[];
 /**
  * Subset of ITransport that `busRequest` needs: a way to send a command and
  * a way to observe channels. Generic enough that an in-process transport
@@ -6689,6 +6269,16 @@ interface BusRequestPrimitive {
      * lose replies omits the surface and `busRequest` behaves as before.
      */
     trackReply?(correlationId: string): () => void;
+    /**
+     * Whether this transport's receive path delivers `channel` — i.e. a reply
+     * published there can actually reach this process. Wire transports whose
+     * subscription set is configurable (a worker subscribing only the reply
+     * channels it awaits) implement this so `busRequest` on a channel outside
+     * the set fails fast with `bus.unsubscribed` instead of burning its
+     * timeout on a reply that could never arrive. OPTIONAL: an in-process
+     * transport delivers every channel and omits it.
+     */
+    isSubscribed?(channel: string): boolean;
 }
 /**
  * Request/reply over the bus, keyed by the operation's request channel.
@@ -7017,7 +6607,7 @@ declare function reconcileSelector(content: string, llm: LlmSelectorInput): Reco
 /**
  * Text encoding utilities for consistent charset handling
  *
- * Ensures frontend decoding matches backend decoding by respecting
+ * Ensures frontend decoding matches gateway decoding by respecting
  * charset parameters in mediaType (e.g., "text/plain; charset=iso-8859-1")
  */
 /**
@@ -7036,7 +6626,7 @@ declare function extractCharset(mediaType: string): string;
  *
  * Uses TextDecoder with the charset extracted from mediaType parameter.
  * This ensures the same character space is used for both annotation creation
- * (backend) and rendering (frontend).
+ * (gateway) and rendering (frontend).
  *
  * @param buffer - Binary data to decode
  * @param mediaType - Media type with optional charset parameter
@@ -7120,11 +6710,16 @@ declare function isValidEmail(email: string): boolean;
  *                   embedding, never mojibake)
  * - `authorable`  — offered in the compose editor's format dropdown
  * - `uploadable`  — big tent: true for every registry member
+ * - `generatable` — the generation worker can produce it as a yield artifact
  *
  * Capabilities are orthogonal strategies, not a ladder: images render but
  * yield no text; PDFs yield text but aren't authorable. A "tier" is a
  * derived reading, not a stored fact.
  *
+ * Questions ANSWERABLE from those rows get a helper, never a row of their own —
+ * `isAnnotatable` reads `anchoring`, and a second stored field would be a fact
+ * that can contradict the one it was derived from.
+ *
  * Import-leniency invariant: restore/import preserves archive mediaTypes
  * verbatim, so "every stored mediaType is registry-valid" holds only for
  * content that entered through the validated create/yield gate. No code
@@ -7301,6 +6896,15 @@ declare function baseMediaType(format: string): string;
 declare function isSupportedMediaType(format: string): format is SupportedMediaType;
 /** Capabilities for a format (parameters tolerated), or undefined on registry miss. */
 declare function capabilitiesOf(format: string): MediaTypeCapabilities | undefined;
+/**
+ * The clone-format gate (MEDIA-TYPES.md Phase 5, moved here for
+ * EXTRACT-ARCHIVIST's clone wire-shape change): a clone opens in the
+ * compose editor, so authorable sources keep their base media type and
+ * everything else falls back to text/plain. Lives beside the registry it
+ * reads; the SDK applies it when deriving a clone upload's format and the
+ * CloneTokenManager's tests pin it.
+ */
+declare function cloneFormat(sourceMediaType: string | undefined): SupportedMediaType;
 /**
  * Lenient extension lookup for naming foreign/imported content: '.dat' on
  * registry miss. Exporters use this — a vocabulary change must never
@@ -7321,6 +6925,19 @@ declare function mediaTypeForExtension(ext: string): SupportedMediaType | undefi
  * unregistered text subtypes embed too), everything else is 'none'.
  */
 declare function textExtractionOf(format: string): TextExtraction;
+/**
+ * WHETHER a type can carry annotations — `anchoring` remains the authority on
+ * HOW. Derived rather than stored: a parallel `annotatable` row field would be
+ * two facts that can disagree, with nothing to adjudicate
+ * `{ annotatable: true, anchoring: 'none' }`.
+ *
+ * Strict on a registry miss, where `textExtractionOf` above is lenient. The
+ * asymmetry is deliberate. Extracting the wrong bytes costs one bad vector,
+ * and refusing to extract costs a resource nobody can find, so extraction
+ * guesses; an annotation is a durable write against a coordinate model the
+ * system does not have for an unknown type, so it refuses.
+ */
+declare function isAnnotatable(format: string): boolean;
 /** Types offered in the compose editor's format dropdown. */
 declare const AUTHORABLE_MEDIA_TYPES: readonly SupportedMediaType[];
 /** Registry rows whose text the Smelter can extract. Rows only — the
@@ -7462,6 +7079,61 @@ interface StateUnit {
     dispose(): void;
 }
 
+/**
+ * Storage URI Derivation
+ *
+ * Builds the name a resource's content lives under in the working tree, from
+ * its title and validated media type. Extensions come from the media-type
+ * registry; formats are validated upstream at the create/yield boundary, so
+ * the lookup is strict — no fallback.
+ *
+ * Lives in `@semiont/core` rather than `@semiont/content` (moved
+ * 2026-08-24, GENERATION-OUTPUT-FORMAT D10) because the generation form
+ * proposes a default path and react-ui cannot depend on the node-flavoured
+ * content package. This module imports only the registry, so it is
+ * browser-safe.
+ */
+
+/**
+ * The FILENAME a resource's content takes: slug + the registry's extension.
+ *
+ * The name is lowercased, runs of non-alphanumeric characters collapse to
+ * single hyphens, and leading/trailing hyphens are stripped.
+ *
+ * This is the fragment form, for callers composing a path themselves — the
+ * generation form's input sits beside a `file://` prefix chip, so it must not
+ * strip a prefix this helper just added.
+ *
+ * @example
+ * storageFileName("My Document", "text/markdown") // => "my-document.md"
+ */
+declare function storageFileName(name: string, format: SupportedMediaType): string;
+/**
+ * Derive a full `file://` storage URI from a resource name and media type.
+ *
+ * @example
+ * deriveStorageUri("My Document", "text/markdown") // => "file://my-document.md"
+ */
+declare function deriveStorageUri(name: string, format: SupportedMediaType): string;
+/**
+ * The folder a resource lives in, WITHOUT a trailing slash — `''` when it sits
+ * at the tree root. Accepts a `file://` URI or a bare path.
+ */
+declare function folderOf(storageUri: string | undefined): string;
+/**
+ * The Save location a form PROPOSES: beside the source resource, named for the
+ * title, extended for the chosen format (GENERATION-OUTPUT-FORMAT D11).
+ *
+ * Deriving the whole filename — extension included — has a happy consequence:
+ * while untouched, switching format rewrites the extension too, so D7's
+ * mismatch refusal becomes unreachable except on hand-edited paths. It guards
+ * deliberate edits rather than trapping ordinary use.
+ *
+ * Returns `''` for an empty title: a bare extension (".md") reads as a hidden
+ * file and is nobody's intent.
+ */
+declare function proposeStoragePath(folder: string, title: string, format: SupportedMediaType): string;
+
 /**
  * Common type guard utilities
  */
@@ -7761,9 +7433,9 @@ interface BuildRequirements {
 }
 /**
  * This interface was referenced by `HttpsSemiontOrgSchemasConfigJson`'s JSON-Schema
- * via the `definition` "BackendServiceConfig".
+ * via the `definition` "GatewayServiceConfig".
  */
-interface BackendServiceConfig {
+interface GatewayServiceConfig {
     platform: ServicePlatformConfig;
     devMode?: boolean;
     command?: string;
@@ -7812,58 +7484,6 @@ interface BackendServiceConfig {
         [k: string]: string;
     };
 }
-/**
- * This interface was referenced by `HttpsSemiontOrgSchemasConfigJson`'s JSON-Schema
- * via the `definition` "FrontendServiceConfig".
- */
-interface FrontendServiceConfig {
-    platform: ServicePlatformConfig;
-    devMode?: boolean;
-    command?: string;
-    port: number;
-    siteName: string;
-    image?: string;
-    projectRoot?: string;
-    databaseUrl?: string;
-    timeout?: number;
-    wait?: number;
-    logsEndpoint?: string;
-    tag?: string;
-    resources?: ResourceRequirements;
-    security?: SecurityRequirements;
-    build?: boolean | BuildRequirements;
-    dockerfile?: string;
-    buildContext?: string;
-    buildArgs?: {
-        [k: string]: string;
-    };
-    buildTarget?: string;
-    prebuilt?: boolean;
-    noCache?: boolean;
-    secrets?: string[];
-    labels?: {
-        [k: string]: string;
-    };
-    annotations?: {
-        [k: string]: string;
-    };
-    dependencies?: string[];
-    externalDependencies?: (string | {
-        name?: string;
-        url?: string;
-        required?: boolean;
-        healthCheck?: string;
-        [k: string]: unknown;
-    })[];
-    environment?: {
-        [k: string]: string;
-    };
-    env?: {
-        [k: string]: string;
-    };
-    publicURL?: string;
-    allowedOrigins?: string[];
-}
 /**
  * This interface was referenced by `HttpsSemiontOrgSchemasConfigJson`'s JSON-Schema
  * via the `definition` "VectorsServiceConfig".
@@ -8034,13 +7654,26 @@ interface McpServiceConfig {
  * via the `definition` "ServicesConfig".
  */
 interface ServicesConfig {
-    backend?: BackendServiceConfig;
-    frontend?: FrontendServiceConfig;
+    gateway?: GatewayServiceConfig;
     database?: DatabaseServiceConfig;
     graph?: GraphServiceConfig;
     mcp?: McpServiceConfig;
     vectors: VectorsServiceConfig;
     embedding: EmbeddingServiceConfig;
+    archivist?: ArchivistServiceConfig;
+    [k: string]: unknown;
+}
+/**
+ * The Archivist service — the out-of-process keeper of the record (EXTRACT-ARCHIVIST). Internal-only: the gateway dials host:port for the D1 sequence-ranged event read path; nothing public.
+ *
+ * This interface was referenced by `HttpsSemiontOrgSchemasConfigJson`'s JSON-Schema
+ * via the `definition` "ArchivistServiceConfig".
+ */
+interface ArchivistServiceConfig {
+    platform?: ServicePlatformConfig;
+    host?: string;
+    port?: number;
+    image?: string;
     [k: string]: unknown;
 }
 /**
@@ -8055,7 +7688,7 @@ interface SiteConfig {
     /**
      * Primary domain for the site
      */
-    domain: string;
+    domain?: string;
     /**
      * Administrator email address
      */
@@ -8130,6 +7763,17 @@ interface EnvironmentConfig {
      * Environment name
      */
     name?: string;
+    /**
+     * The KB's committed identity, staged by the launcher (SINGLE-KB-MOUNT D4). Top-level in the staged file, out of any environment section's reach; never overridable.
+     */
+    kb?: {
+        name: string;
+        domain?: string;
+        /**
+         * Sign-in policy committed in the KB's .semiont/config, staged alongside the identity because the gateway no longer mounts the tree that holds it.
+         */
+        oauthAllowedDomains?: string[];
+    };
     platform?: {
         default?: PlatformType$1;
         [k: string]: unknown;
@@ -8356,8 +8000,8 @@ declare function deriveViews(graph: KnowledgeGraph, mainResourceId: string, foca
  *
  * Exists for startup-critical network calls in long-running peers (worker,
  * smelter, weaver): each authenticates against the KS the moment its
- * container starts, and the backend may not be reachable for a few seconds
- * (backend restart, container-network warm-up). Orchestration runs these
+ * container starts, and the gateway may not be reachable for a few seconds
+ * (gateway restart, container-network warm-up). Orchestration runs these
  * processes with `--rm` and no restart policy, so a process that dies on
  * the first `TypeError: fetch failed` is dead for good — the retry window
  * here is the only recovery it gets.
@@ -8380,7 +8024,7 @@ interface RetryAttemptInfo {
     error: unknown;
 }
 /**
- * Default policy for startup connections to the backend: 8 attempts with
+ * Default policy for startup connections to the gateway: 8 attempts with
  * delays 1s, 2s, 4s, then capped at 8s — ~39s of patience before giving up.
  */
 declare const STARTUP_FETCH_RETRY: RetryPolicy;
@@ -8388,7 +8032,7 @@ declare const STARTUP_FETCH_RETRY: RetryPolicy;
  * True for the errors `fetch` throws when the connection itself fails —
  * undici's `TypeError: fetch failed` (ECONNREFUSED, ENOTFOUND, reset,
  * timeout — the socket error rides in `cause`). Deliberately false for
- * HTTP-level failures (a 401 means the backend is UP and rejected us;
+ * HTTP-level failures (a 401 means the gateway is UP and rejected us;
  * retrying won't change its mind) and for programming errors.
  */
 declare function isTransientFetchError(error: unknown): boolean;
@@ -8466,5 +8110,5 @@ declare function getShardPath(key: string, numBuckets?: number): [string, string
  */
 declare const DISCOVERY_URL_PATH = "/discovery/kbs.json";
 
-export { AUTHORABLE_MEDIA_TYPES, BRIDGED_CHANNELS, BUS_OPERATIONS, BusRequestError, CHANNEL_SCHEMAS, CONTEXT_FULL_WEIGHT, CONTEXT_PARTIAL_WEIGHT, ConfigurationError, ConflictError, DEFAULT_CHUNKING_CONFIG, DISCOVERY_URL_PATH, EMBEDDABLE_MEDIA_TYPES, EventBus, GENERATABLE_MEDIA_TYPES, JWTTokenSchema, LOCALES, MEDIA_TYPES, NotFoundError, PERSISTED_EVENT_TYPES, POSITION_WEIGHT_MAX, POSITION_WINDOW, RESOURCE_BROADCAST_TYPES, STARTUP_FETCH_RETRY, ScopedEventBus, ScriptError, SemiontError, UnauthorizedError, ValidationError, accessToken, agentToDid, anchorAnnotation, anchorRuns, annotationId, annotationUri, applyBodyOperations, assembleAnnotation, authCode, baseMediaType, baseUrl, buildContentCache, burstBuffer, busLog, busLogEnabled, busRequest, capabilitiesOf, chunkText, cloneToken, createCircleSvg, createFragmentSelector, createPolygonSvg, createRectangleSvg, createTomlConfigLoader, decodeRepresentation, decodeWithCharset, deriveViews, didToAgent, email, entityType, errField, estimateTokens, extensionForMediaType, extractBoundingBox, extractCharset, extractContext, findBestTextMatch, findBodyItem, findClaimSpan, formatLocaleDisplay, generateUuid, getAllLocaleCodes, getAllPlatformTypes, getAnnotationExactText, getAnnotationUriFromEvent, getBodySource, getBodyType, getChecksum, getCommentText, getCreator, getDerivedFrom, getExactText, getFragmentSelector, getLanguage, getLocaleEnglishName, getLocaleInfo, getLocaleNativeName, getNodeEncoding, getPageFromFragment, getPrimaryMediaType, getPrimaryRepresentation, getPrimarySelector, getResourceEntityTypes, getResourceId, getShardPath, getStorageUri, getSvgSelector, getTargetSelector, getTargetSource, getTextPositionSelector, getTextQuoteSelector, googleCredential, hasTargetSelector, isAnnotationId, isArchived, isArray, isAssessment, isBodyResolved, isBoolean, isComment, isDefined, isDraft, isEventRelatedToAnnotation, isFunction, isGatheredContext, isGenerationJobParams, isHighlight, isNull, isNullish, isNumber, isObject, isReference, isResolvedReference, isResourceId, isStoredEvent, isString, isStubReference, isSupportedMediaType, isTag, isTextRun, isTransientFetchError, isUndefined, isValidEmail, isValidPlatformType, jobId, jumpConsistentHash, kbDid, loadTomlConfig, locate, mcpToken, mediaTypeForExtension, normalizeCoordinates, normalizeText, parseEnvironment, parseFragmentSelector, parseSvgSelector, reconcileSelector, refreshToken, resourceAnnotationUri, resourceId, resourceUri, retryWithBackoff, scaleSvgToNative, searchQuery, serializePerKey, setBusLogTraceIdProvider, softwareToAgent, textExtractionOf, textUnder, userDID, userId, userToAgent, userToDid, uuidV4, validateData, validateEnvironment, validateSvgMarkup, verifyPosition };
-export type { AccessToken, AnchorConfidence, AnchorMethod, AnchorRect, AnchorSelectors, AnchorStrategy, AnchoredText, AnchoringModel, Annotation, AnnotationCategory, AnnotationId, AnnotationUri, AnthropicProviderConfig, AppConfig, AssembledAnnotation, AuthCode, BackendDownload, BackendServiceConfig, BaseUrl, BodyItem, BodyItemIdentity, BodyOperation, BoundingBox, Brand, BridgedChannel, BurstBufferOptions, BusOp, BusOperationKey, BusOperationSpec, BusRequestErrorCode, BusRequestPrimitive, ChunkingConfig, CloneToken, CollaboratorEntry, ConnectionState, ContentCache, ContentFormat, CreateAnnotationInternal, DatabaseServiceConfig, DiscoveredKB, DiscoveryDocument, Email, EmbeddingServiceConfig, EmittableChannel, EntityType, EntityTypeStats, Environment, EnvironmentConfig, EventBase, EventInput, EventMap, EventMetadata, EventName, EventOfType, EventQuery, EventSignature, ExtractionOutcome, FragmentSelector, FrontendServiceConfig, GatheredContext, GenerationJobParams, GoogleAuthRequest, GoogleCredential, GraphConnection, GraphDatabaseType, GraphPath, GraphServiceConfig, GraphViews, HealthCheckResponse, IBackendOperations, IContentTransport, ITransport, InferenceProvidersConfig, JobId, JobType, ListUsersResponse, LlmSelectorInput, LocaleInfo, Logger, MCPToken, MatchQuality, McpServiceConfig, MediaTypeCapabilities, Motivation, OllamaProviderConfig, PdfCoordinate, PdfTextItem, PdfTextRun, PersistedEvent, PersistedEventType, PlatformType, Point, ProgressCallback, ProgressEvent, PutBinaryOptions, PutBinaryProgress, PutBinaryRequest, ReconciledSelector, RefreshToken, RenderMode, RenderedAnchor, ResourceAnnotationUri, ResourceAnnotations, ResourceBroadcastType, ResourceDescriptor, ResourceFilter, ResourceId, ResourceUri, RetryAttemptInfo, RetryPolicy, SearchQuery, SelectionData, Selector, SemiontConfig, ServicePlatformConfig, ServicesConfig, SiteConfig, StateUnit, StatusResponse, StoredEvent, StoredEventLike, SupportedMediaType, SvgSelector, TagCategory, TagSchema, TextExtraction, TextPosition, TextPositionSelector, TextQuoteSelector, ActorInferenceConfig as TomlActorInferenceConfig, TomlFileReader, InferenceConfig as TomlInferenceConfig, WorkerInferenceConfig as TomlWorkerInferenceConfig, TransportErrorCode, UpdateResourceInput, UpdateUserRequest, UpdateUserResponse, UserDID, UserId, UserResponse, ValidationFailure, ValidationResult, ValidationSuccess, VectorsServiceConfig, components, operations, paths };
+export { AUTHORABLE_MEDIA_TYPES, BRIDGED_CHANNELS, BUS_OPERATIONS, BusRequestError, CHANNEL_SCHEMAS, CONTEXT_FULL_WEIGHT, CONTEXT_PARTIAL_WEIGHT, ConfigurationError, ConflictError, DEFAULT_CHUNKING_CONFIG, DISCOVERY_URL_PATH, EMBEDDABLE_MEDIA_TYPES, EventBus, GENERATABLE_MEDIA_TYPES, JWTTokenSchema, LOCALES, MEDIA_TYPES, NotFoundError, PERSISTED_EVENT_TYPES, POSITION_WEIGHT_MAX, POSITION_WINDOW, RESOURCE_BROADCAST_TYPES, STARTUP_FETCH_RETRY, ScopedEventBus, ScriptError, SemiontError, UnauthorizedError, ValidationError, accessToken, agentToDid, anchorAnnotation, anchorRuns, annotationId, annotationUri, applyBodyOperations, assembleAnnotation, authCode, baseMediaType, baseUrl, buildContentCache, burstBuffer, busLog, busLogEnabled, busRequest, capabilitiesOf, chunkText, cloneFormat, cloneToken, createCircleSvg, createFragmentSelector, createPolygonSvg, createRectangleSvg, createTomlConfigLoader, decodeRepresentation, decodeWithCharset, deriveStorageUri, deriveViews, didToAgent, email, entityType, errField, estimateTokens, extensionForMediaType, extractBoundingBox, extractCharset, extractContext, findBestTextMatch, findBodyItem, findClaimSpan, folderOf, formatLocaleDisplay, generateUuid, getAllLocaleCodes, getAllPlatformTypes, getAnnotationExactText, getAnnotationUriFromEvent, getBodySource, getBodyType, getChecksum, getCommentText, getCreator, getDerivedFrom, getExactText, getFragmentSelector, getLanguage, getLocaleEnglishName, getLocaleInfo, getLocaleNativeName, getNodeEncoding, getPageFromFragment, getPrimaryMediaType, getPrimaryRepresentation, getPrimarySelector, getResourceEntityTypes, getResourceId, getShardPath, getStorageUri, getSvgSelector, getTargetSelector, getTargetSource, getTextPositionSelector, getTextQuoteSelector, googleCredential, hasTargetSelector, isAnnotatable, isAnnotationId, isArchived, isArray, isAssessment, isBodyResolved, isBoolean, isComment, isDefined, isDraft, isEventRelatedToAnnotation, isFunction, isGatheredContext, isGenerationJobParams, isHighlight, isNull, isNullish, isNumber, isObject, isReference, isResolvedReference, isResourceId, isStoredEvent, isString, isStubReference, isSupportedMediaType, isTag, isTextRun, isTransientFetchError, isUndefined, isValidEmail, isValidPlatformType, jobId, jumpConsistentHash, kbDid, loadTomlConfig, locate, mcpToken, mediaTypeForExtension, normalizeCoordinates, normalizeText, parseEnvironment, parseFragmentSelector, parseSvgSelector, proposeStoragePath, reconcileSelector, refreshToken, replyChannelsFor, resourceAnnotationUri, resourceId, resourceUri, retryWithBackoff, scaleSvgToNative, searchQuery, serializePerKey, setBusLogTraceIdProvider, softwareToAgent, storageFileName, textExtractionOf, textUnder, userDID, userId, userToAgent, userToDid, uuidV4, validateData, validateEnvironment, validateSvgMarkup, verifyPosition };
+export type { AccessToken, AnchorConfidence, AnchorMethod, AnchorRect, AnchorSelectors, AnchorStrategy, AnchoredText, AnchoringModel, Annotation, AnnotationCategory, AnnotationId, AnnotationUri, AnthropicProviderConfig, AppConfig, ArchivistServiceConfig, AssembledAnnotation, AuthCode, BaseUrl, BodyItem, BodyItemIdentity, BodyOperation, BoundingBox, Brand, BridgedChannel, BurstBufferOptions, BusOp, BusOperationKey, BusOperationSpec, BusRequestErrorCode, BusRequestPrimitive, ChunkingConfig, CloneToken, CollaboratorEntry, ConnectionState, ContentCache, ContentFormat, CreateAnnotationInternal, DatabaseServiceConfig, DiscoveredKB, DiscoveryDocument, Email, EmbeddingServiceConfig, EmittableChannel, EntityType, EntityTypeStats, Environment, EnvironmentConfig, EventBase, EventInput, EventMap, EventMetadata, EventName, EventOfType, EventQuery, EventSignature, ExtractionOutcome, FragmentSelector, GatewayServiceConfig, GatheredContext, GenerationJobParams, GoogleAuthRequest, GoogleCredential, GraphConnection, GraphDatabaseType, GraphPath, GraphServiceConfig, GraphViews, HealthCheckResponse, IContentTransport, IGatewayOperations, ITransport, InferenceProvidersConfig, JobId, JobType, ListUsersResponse, LlmSelectorInput, LocaleInfo, Logger, MCPToken, MatchQuality, McpServiceConfig, MediaTypeCapabilities, Motivation, OllamaProviderConfig, PdfCoordinate, PdfTextItem, PdfTextRun, PersistedEvent, PersistedEventType, PlatformType, Point, PutBinaryOptions, PutBinaryProgress, PutBinaryRequest, ReconciledSelector, RefreshToken, RenderMode, RenderedAnchor, ResourceAnnotationUri, ResourceAnnotations, ResourceBroadcastType, ResourceDescriptor, ResourceFilter, ResourceId, ResourceUri, RetryAttemptInfo, RetryPolicy, SearchQuery, SelectionData, Selector, SemiontConfig, ServicePlatformConfig, ServicesConfig, SiteConfig, StateUnit, StatusResponse, StoredEvent, StoredEventLike, SupportedMediaType, SvgSelector, TagCategory, TagSchema, TextExtraction, TextPosition, TextPositionSelector, TextQuoteSelector, ActorInferenceConfig as TomlActorInferenceConfig, TomlFileReader, InferenceConfig as TomlInferenceConfig, WorkerInferenceConfig as TomlWorkerInferenceConfig, TransportErrorCode, UpdateResourceInput, UpdateUserRequest, UpdateUserResponse, UserDID, UserId, UserResponse, ValidationFailure, ValidationResult, ValidationSuccess, VectorsServiceConfig, components, operations, paths };