@synapsor/runner 1.6.1 → 1.6.3

package/docs/limitations.md

@@ -5,7 +5,10 @@ whole-application boundary drafting and a local authoring-only Explore ->
 Protect path on top of guarded writes. Version 1.6.1 also adds opt-in
 proposal/evidence freshness for exact same-source direct-SQL proposals. It does
 not turn Runner into a generic database query tool, claim Synapsor Cloud scale,
-or claim an enterprise SLA.
+or claim an enterprise SLA. Version 1.6.3 adds guided onboarding, verified
+approval-role evidence, default-off exact-digest supervised execution for a
+narrow write subset, and quiet human-attention delivery without changing
+existing manual behavior.
 
 ## Supported
 
@@ -15,8 +18,9 @@ or claim an enterprise SLA.
 - Optional shared Postgres proposal/evidence/replay runtime store for MCP serving.
 - Asymmetric claim-bound Streamable HTTP sessions and explicit readiness.
 - Native Postgres/MySQL source pools and operational/fleet-wide rate limits.
-- Verified operator approval through CLI, optional distinct-reviewer quorum,
-  and shared local review UI reads.
+- Verified operator approval through CLI or the secured local Workbench,
+  optional distinct-reviewer quorum, separate apply authority, and
+  proposal-centered lifecycle inspection.
 - Optional live target and explicitly declared supporting-row freshness checks
   before every approval, with immutable proof binding and final transactional
   revalidation for PostgreSQL/MySQL direct SQL writeback.
@@ -75,6 +79,13 @@ or claim an enterprise SLA.
   and scoped tamper-evident JSON/Markdown/PDF ledger reports.
 - Off-by-default graduated-trust recommendations that require verified operator
   review and explicit artifact export without activation.
+- Default-off operator-supervised apply for eligible exact-row direct
+  `INSERT`/`UPDATE`, requiring both public contract permission and an
+  independent deployment allowlist for the exact active digest. It reuses
+  guarded apply and preserves legacy `AUTO APPROVE` as manual-apply.
+- Durable redacted human-attention events, a coalesced Workbench inbox,
+  no-ID CLI inspection, optional JSONL output, and signed generic HTTPS
+  webhooks with quiet routing, budgets, digests, and safe delivery replay.
 
 ## Runtime Contract
 
@@ -105,11 +116,16 @@ truth for the model-facing tools.
 - Inferred compensation for app-owned handlers or external effects.
 - General restoration of hard-deleted rows, cascades, or trigger side effects.
 - Model-callable approval or commit tools.
+- Model-callable worker, notification-routing, acknowledgement, recovery, or
+  reconciliation controls.
 - Generic MCP firewall behavior.
 - Prompt-injection prevention.
 - Unbounded/high-throughput or multi-region ledger scale.
 - Managed fleet, SLA, compliance certification, or production support guarantee.
 - Production, shared HTTP, remote, or non-loopback Scoped Explore.
+- Automatic supervised execution for hard DELETE, reversible changes, bounded
+  sets, app-owned/external effects, or writes without deterministic conflict,
+  deduplication, freshness, and receipt authority.
 - Arbitrary aggregate expressions, dynamic identifiers, unrestricted joins,
   many-to-many joins, formulas, window functions, subqueries, `HAVING`,
   user-defined functions, or a statistical privacy guarantee. Version 1.6

package/docs/local-mode.md

@@ -158,6 +158,12 @@ npx -y -p @synapsor/runner synapsor-runner proposals approve wrp_123 \
   --yes
 ```
 
+The `--actor` example is the unverified local-development path. Shared and
+production operation should require `signed_key` or `jwt_oidc`, resolve the
+contract's exact role from verified identity, and authorize apply separately.
+See [Approval Roles And Verified Operator
+Identity](approval-roles-and-operator-identity.md).
+
 Before approval, the CLI prints the reviewer-critical proposal details: trusted principal, tenant, target row, primary key, required role, proposal hash/version, allowed columns, conflict guard, evidence bundle/query fingerprint, writeback boundary, source mutation state, and exact before/after diff. Interactive approval still requires typing `yes`; noninteractive scripts must pass `--yes`.
 
 When `proposal_freshness` is configured for that capability, approval also
@@ -301,6 +307,8 @@ or prune it without touching your source Postgres/MySQL database:
 ```bash
 synapsor-runner store stats --store ./.synapsor/local.db
 synapsor-runner events tail --store ./.synapsor/local.db
+synapsor-runner attention show --store ./.synapsor/local.db
+synapsor-runner notifications status --store ./.synapsor/local.db
 synapsor-runner events webhook --url http://127.0.0.1:8788/synapsor/events --kind proposal_created --store ./.synapsor/local.db
 synapsor-runner store vacuum --store ./.synapsor/local.db
 synapsor-runner store prune --store ./.synapsor/local.db --older-than 30d --dry-run
@@ -316,8 +324,14 @@ running local store.
 
 `events webhook` pushes the same local lifecycle events to a local/dev/staging
 HTTP endpoint, one event envelope per POST. Use it for a review UI, Slack bridge,
-or app-local notification path when polling is awkward. It is not a hosted
-central ledger and does not expose database credentials.
+or app-local compatibility path when polling is awkward. It is not the
+production human-attention dispatcher.
+
+For durable coalesced incidents, quiet defaults, budgets/digests, signed HTTPS
+delivery, replay protection, sink health, and the no-ID Workbench inbox, use
+`attention` and `notifications`. See [Human Attention And
+Notifications](human-attention-notifications.md). Neither notification path
+becomes approval or apply authority.
 
 `store prune` defaults to dry-run. `store reset` requires `--yes` and removes
 only the local SQLite ledger files. MCP server modes write a small active-store

package/docs/migrating-to-synapsor-spec.md

@@ -148,6 +148,44 @@ The equivalent DSL is `REQUIRE 2 APPROVALS` after `APPROVAL ROLE
 billing_lead`. Runner 1.0 does not understand this new optional semantic field;
 use Runner/spec/DSL 1.1 together. Omitted fields preserve 1.0 behavior.
 
+## 1.6 Generated Authority And Supervised Execution
+
+Runner 1.6.3, Spec 1.6.0, and DSL 1.6.0 are additive. Existing hand-authored
+DSL/JSON/config projects do not need Auto Boundary, Workbench, a generation
+lock, schema rescanning, or supervised execution. Contracts that omit the new
+fields retain their previous canonical normalization and digest.
+
+Auto Boundary writes a generation lock only for authority it generated.
+Drift enforcement applies only when `synapsor.runner.json` explicitly
+references that lock under `generated_authority`; manually authored projects
+continue to start without metadata inspection.
+
+The optional proposal permission:
+
+```json
+{
+  "execution": {
+    "supervised_worker": "allowed"
+  }
+}
+```
+
+compiles from:
+
+```sql
+ALLOW SUPERVISED WORKER APPLY
+```
+
+It applies nothing by itself. Automatic execution also requires a separate
+deployment policy for the exact capability and active digest. Existing
+`AUTO APPROVE` contracts continue to wait for manual apply, and no worker
+starts because Runner was upgraded. See
+[Operator-Supervised Automatic Apply](supervised-automatic-apply.md).
+
+Human-attention events and external notification sinks require no contract
+migration. Notifications are absent/disabled by default and emit no outbound
+traffic until an operator configures and explicitly runs the dispatcher.
+
 ## Validate
 
 ```bash

package/docs/production.md

@@ -400,6 +400,45 @@ every skipped item includes a safe reason. Re-running is idempotent through
 durable receipts. Do not schedule batch apply for a policy that has no reviewed
 aggregate limits.
 
+For continuous execution, use the stricter default-off supervised mode rather
+than scheduling broad batch apply. `AUTO APPROVE` by itself remains
+manual-apply. A worker may consume approved work only when the active contract
+contains `execution.supervised_worker = "allowed"` and
+`supervised_worker.capabilities` independently names the exact same capability
+and digest. Production additionally requires verified operator controls and a
+live least-privilege writer-posture fingerprint.
+
+```bash
+synapsor-runner worker run --supervised --yes \
+  --worker-id billing_worker \
+  --config ./synapsor.runner.json
+```
+
+The worker accepts only eligible single-row direct INSERT/UPDATE shapes and
+reuses the manual guarded-apply implementation. Before execution it repeats
+approval, policy, limit, expiry, digest/lock, tenant/principal, target and
+supporting-evidence freshness, conflict/deduplication, receipt, writer-posture,
+and lease checks. Source or evidence drift produces zero mutation. DELETE,
+reversible changes, set writes, and app-owned/external effects are not eligible
+for this first automatic path. See [Operator-Supervised Automatic
+Apply](supervised-automatic-apply.md).
+
+Production operators can inspect the same queue and Human Attention Inbox in
+the secured Workbench or CLI:
+
+```bash
+synapsor-runner worker status --config ./synapsor.runner.json
+synapsor-runner attention show --config ./synapsor.runner.json
+```
+
+External delivery is disabled and quiet by default. When explicitly enabled,
+one signed generic webhook can route timely review, UNKNOWN, reconciliation,
+dead-letter, sustained-health, drift, posture, and critical-limit incidents.
+Successful applies remain in the ledger/Workbench unless a sink opts into an
+all-events route or digest. A webhook informs and cannot approve or mutate
+Runner state. See [Human Attention And
+Notifications](human-attention-notifications.md).
+
 Runner writes newline-delimited JSON events to stderr for model-facing tool
 rejections, operator decisions, and terminal writeback outcomes. These events
 contain safe codes and identifiers, never tool arguments, row values, database

package/docs/release-notes.md

@@ -10,7 +10,89 @@ npx -y -p @synapsor/runner synapsor-runner demo --quick
 The OSS runner command is `synapsor-runner`. The `synapsor` command is reserved
 for the Synapsor Cloud CLI.
 
-## 1.6.1 (prepared, not published)
+## 1.6.3 (prepared, not published)
+
+### Guided adoption without weaker authority
+
+- A fresh interactive
+  `npx -y @synapsor/runner@latest start --from-env DATABASE_URL` now drives one
+  resumable metadata-inspection, review-by-exception, exact-digest activation,
+  first safe read, and MCP setup journey. It requires no account, model key,
+  Cloud control plane, global install, or manual project files.
+- Workbench explains the boundary before exposing advanced details, highlights
+  only unresolved security decisions, and keeps one primary next action visible.
+  Generated read, aggregate, protected, and write authorities remain disabled
+  until the human activates the exact reviewed digest.
+- Project-aware `try call`, `try explore`, `try protect`, and guided action
+  paths remove repeated config/store flags and copied handles while preserving
+  the canonical DSL/Spec/runtime boundary and existing manual/headless paths.
+- The packaged FitFlow journey proves a real named read, privacy-suppressed
+  PM-style aggregate, Protect This Query, proposal-only model call, bounded
+  approval policy, guarded source write, receipt/replay, compensation, and
+  equivalent authority across Workbench, CLI, Cursor, Claude, Codex, and
+  generic stdio setup.
+- The packaged approval-role guide and simulated external OIDC/JWKS flow show
+  how `APPROVAL ROLE` maps to verified IdP claims and immutable decisions.
+  Reviewer and applier authority remain separate; invalid signatures, token
+  time/issuer/audience failures, missing or similar roles, key rotation errors,
+  proof tampering, and proof replay fail closed.
+- Operator-supervised automatic apply is a new default-off execution axis.
+  Contract permission and an independent deployment allowlist must match one
+  exact active digest. Existing `AUTO APPROVE` behavior remains manual-apply;
+  eligible single-row INSERT/UPDATE work uses the same guarded apply after
+  current policy, limit, scope, target/supporting-evidence freshness,
+  writer-posture, receipt, and fenced-lease revalidation.
+- The ledger and Workbench now project durable redacted human-attention events
+  for proposal, worker, boundary, schema, credential, policy, and sensitive
+  override states. External delivery is disabled and quiet by default. A
+  separate dispatcher supports coalescing, budgets, digests, JSONL development
+  output, and signed generic HTTPS webhooks that inform but never authorize.
+- Replaying a failed notification requires a fresh verified signed-key or OIDC
+  operator decision bound to the exact delivery revision and a recorded
+  reason. It requeues only the redacted event. Packed tests prove competing
+  dispatcher deduplication, zero immediate success noise under the default
+  preset, metadata-endpoint SSRF refusal, and an unchanged source database
+  across notification replay.
+- Workbench and CLI expose queue status, pause/drain, exact-digest
+  enable/disable/revoke, cancellation, dead-letter, UNKNOWN/reconciliation,
+  notification status/replay, and no-ID attention inspection outside MCP.
+- Supported JSON failure paths emit one parseable result with a stable error
+  code, preserved-state and source-change status, one recovery action, and
+  redacted diagnostics on stderr.
+- An explicit empty `capabilities` array is now valid zero-authority review
+  state. The optional canonical `execution.supervised_worker` permission and
+  public `ALLOW SUPERVISED WORKER APPLY` clause are additive. Spec and DSL
+  advance to `1.6.0` while preserving old contract normalization, digests, and
+  generated-lock support.
+
+Prepared package versions: `@synapsor/runner@1.6.3`,
+`@synapsor/spec@1.6.0`, and `@synapsor/dsl@1.6.0`.
+No package is published by this change.
+
+The pre-release clean-install gate uses the locally packed public Spec until
+Spec 1.6.0 is on npm. After publishing Spec first, force the registry-only
+Runner dependency check with
+`VERIFY_PACKED_RUNNER_USE_LOCAL_SPEC=0 ./scripts/verify-packed-runner.sh`.
+
+## 1.6.2 (published 2026-07-23)
+
+### Registry-installable packaging hotfix
+
+- Runner remains linked to the local Spec workspace during development, while
+  pnpm must transform that link to the public `@synapsor/spec@^1.5.0` range in
+  the release tarball.
+- A publish lifecycle guard rejects `npm publish`, requires
+  `corepack pnpm publish`, and rejects unexpected local dependency protocols or
+  incorrect Spec ranges.
+- The release gate inspects pnpm's transformed tarball manifest and installs
+  the Runner tarball alone in a clean project before invoking its CLI. The test
+  therefore exercises the dependency-resolution path used by public `npx`.
+- Runtime behavior is unchanged from the proposal/evidence freshness release.
+
+Published package version: `@synapsor/runner@1.6.2`.
+`@synapsor/spec@1.5.0` and `@synapsor/dsl@1.5.0` remain unchanged.
+
+## 1.6.1 (published 2026-07-23; install-broken)
 
 ### Fail-closed proposal and evidence freshness
 
@@ -33,9 +115,10 @@ for the Synapsor Cloud CLI.
 - Existing contracts, exact digests, DSL, model-facing tool lists, and
   non-freshness deployments keep their prior behavior.
 
-Prepared package version: `@synapsor/runner@1.6.1`.
-`@synapsor/spec@1.5.0` and `@synapsor/dsl@1.5.0` are unchanged. Nothing has
-been published by this repository change.
+The `1.6.1` registry manifest accidentally retained
+`@synapsor/spec: "workspace:^"`. Clean npm and npx installs reject that local
+workspace protocol with `EUNSUPPORTEDPROTOCOL`. The version should remain
+deprecated and is superseded by `1.6.2`. Spec and DSL were unaffected.
 
 ## 1.6.0 (published 2026-07-23)
 

package/docs/runner-config-reference.md

@@ -40,6 +40,9 @@ Unknown keys fail when `strict` is true (the default).
 | `rate_limits` | No | Operational fixed-window limits; fleet-wide only with shared `runtime_store`. |
 | `metrics` | No | Separately authorized scrapeable HTTP metrics. Disabled by default. |
 | `graduated_trust` | No | Off-by-default, operator-only policy recommendation criteria and kill switch. |
+| `generated_authority` | Generated projects | Generation-lock path and required drift enforcement for generated authority only. |
+| `supervised_worker` | No | Default-off exact-digest allowlist for trusted automatic execution of approved proposals. |
+| `notifications` | No | Default-off quiet attention routing to JSONL or signed HTTPS webhooks. |
 | `executors` | No | App-owned writeback wiring. |
 | `cloud` | Cloud mode | Scoped Cloud adapter configuration. |
 
@@ -499,6 +502,129 @@ synapsor-runner doctor --check-writeback --config ./synapsor.runner.json
 The complete validation, privilege, lifecycle, and error-code contract is in
 [Proposal And Evidence Freshness](proposal-evidence-freshness.md).
 
+## Supervised worker
+
+`supervised_worker` is a separate deployment opt-in for automatic execution of
+already-approved proposals. It does not change `AUTO APPROVE`; old and new
+auto-approved proposals still wait for manual apply unless both the contract
+and this exact-digest allowlist permit worker execution.
+
+```json
+{
+  "supervised_worker": {
+    "enabled": true,
+    "profile": "production",
+    "capabilities": [
+      {
+        "capability": "billing.propose_small_credit",
+        "contract_digest": "sha256:EXACT_ACTIVE_DIGEST",
+        "mode": "supervised_worker",
+        "concurrency": 1,
+        "queue_limit": 100,
+        "lease_seconds": 60,
+        "max_attempts": 5,
+        "proposal_ttl_seconds": 3600,
+        "rate_limit": {
+          "executions": 20,
+          "window_seconds": 60
+        },
+        "write_url_env": "BILLING_POSTGRES_WRITE_URL",
+        "worker_identity": "billing_worker",
+        "control_role": "runner_operator",
+        "require_least_privilege_writer": true,
+        "writer_posture_fingerprint": "sha256:REVIEWED_POSTURE_DIGEST",
+        "required_attention_sinks": ["operations"]
+      }
+    ]
+  }
+}
+```
+
+`profile` is `development`, `staging`, or `production`. Production requires
+verified operator identity and hardened writer posture. Every entry binds
+capability name, active contract digest, worker mode, queue/concurrency/rate
+bounds, proposal TTL, writer credential reference, and optional fixed worker
+identity/control role.
+
+`required_attention_sinks` is optional and default-off. When present, an
+otherwise eligible job remains queued until every named enabled notification
+sink has a healthy delivery record. Sink health never grants approval or
+execution authority.
+
+The active capability must itself contain
+`execution.supervised_worker = "allowed"`, compile from `ALLOW SUPERVISED
+WORKER APPLY`, use direct single-row guarded INSERT/UPDATE, and satisfy the
+receipt, trusted-scope, conflict/deduplication, and eligibility checks. See
+[Operator-Supervised Automatic Apply](supervised-automatic-apply.md).
+
+## Notifications
+
+`notifications` routes immutable redacted attention events. It is absent or
+`enabled: false` by default and starts no background dispatcher.
+
+```json
+{
+  "notifications": {
+    "enabled": true,
+    "workbench_url_env": "SYNAPSOR_WORKBENCH_URL",
+    "sinks": [
+      {
+        "id": "operations",
+        "type": "webhook",
+        "url_env": "SYNAPSOR_NOTIFY_WEBHOOK_URL",
+        "signing_secret_env": "SYNAPSOR_NOTIFY_SIGNING_SECRET",
+        "minimum_severity": "warning",
+        "events": [
+          "proposal.review_required",
+          "worker.dead_lettered",
+          "worker.unknown_outcome"
+        ],
+        "environments": ["production"],
+        "delivery": "immediate",
+        "max_attempts": 5,
+        "timeout_ms": 3000,
+        "max_response_bytes": 1024,
+        "replay_window_seconds": 300,
+        "allow_private_destinations": false,
+        "recovery_notifications": false,
+        "budgets": {
+          "per_minute": 10,
+          "per_hour": 100,
+          "cooldown_seconds": 600,
+          "retry_attempt_threshold": 3,
+          "degraded_duration_seconds": 120,
+          "queue_depth_threshold": 100,
+          "queue_age_seconds": 300
+        },
+        "quiet_hours": {
+          "start_utc_hour": 22,
+          "end_utc_hour": 7
+        }
+      }
+    ]
+  }
+}
+```
+
+Sink `type` is `webhook` or `jsonl`. JSONL requires
+`destination: "stdout"` and accepts no URL/signing fields. Webhook URLs and
+32-byte-or-longer signing secrets come only from the named environment
+variables.
+
+`delivery` is `immediate`, `digest`, or `all`. Each sink can filter fixed event
+names, qualified capability names, environments, and minimum severity.
+Per-minute/hour budgets, informational budgets, aggregation windows, cooldown,
+unresolved reminders, digest cadence, escalation delay, retry/degraded
+thresholds, queue thresholds, UTC quiet hours, and opt-in recovery messages
+control interruption volume. Critical events bypass ordinary quiet hours and
+budgets but still coalesce.
+
+Private webhook destinations require both
+`allow_private_destinations: true` and an exact
+`private_host_allowlist`. See [Human Attention And
+Notifications](human-attention-notifications.md) for event classes, commands,
+signature verification, SSRF protections, and quiet-default behavior.
+
 ## Rate limits
 
 ```json
@@ -554,6 +680,12 @@ it. See [Graduated Trust Recommendations](graduated-trust.md).
 
 ## Operator identity
 
+For the complete lifecycle from public DSL `APPROVAL ROLE`, through IdP group
+mapping and JWT verification, to the immutable approval record and independent
+apply decision, use [Approval Roles And Verified Operator
+Identity](approval-roles-and-operator-identity.md). The examples below are the
+configuration summary; that guide contains the tested local OIDC/JWKS flow.
+
 Local development compatibility uses an explicitly unverified environment
 identity:
 

package/docs/running-a-runner-fleet.md

@@ -287,9 +287,17 @@ Use the shared queue explicitly:
 synapsor-runner proposals list --config ./synapsor.runner.json
 synapsor-runner proposals show latest --config ./synapsor.runner.json
 synapsor-runner ui --config ./synapsor.runner.json
-synapsor-runner worker run --yes --config ./synapsor.runner.json
+synapsor-runner worker run --supervised --yes \
+  --worker-id billing_worker --config ./synapsor.runner.json
 ```
 
+The supervised path is disabled by default and requires contract permission
+plus a deployment allowlist for the exact digest. Existing `AUTO APPROVE`
+contracts remain manual-apply after upgrade. Worker leases, policy reservations,
+writer posture, source/evidence freshness, idempotency receipts, and UNKNOWN
+outcome recovery are covered in [Operator-Supervised Automatic
+Apply](supervised-automatic-apply.md).
+
 Dead-letter operations require verified operator identity:
 
 ```bash
@@ -305,6 +313,13 @@ Requeue preserves history and refuses if a durable applied/already-applied
 receipt already proves the effect. Discard closes the queue item without
 deleting proposals, receipts, or events.
 
+Use `attention show` and the Workbench Human Attention Inbox to inspect
+review-required, stale, limit, dead-letter, UNKNOWN, and reconciliation states
+without copying proposal IDs. Optional external notifications are disabled and
+quiet by default. A signed generic webhook can route selected coalesced
+incidents; it cannot approve or mutate state. See [Human Attention And
+Notifications](human-attention-notifications.md).
+
 ## Backup, Restore, And Retention
 
 ```bash

package/docs/security-boundary.md

@@ -169,6 +169,20 @@ outside the model-facing MCP server and verifies:
 
 If any authority check cannot be verified, the write fails closed.
 
+Manual apply remains the default, including after policy auto-approval. An
+eligible single-row direct INSERT or UPDATE may instead use operator-supervised
+automatic apply, but only when the activated contract explicitly permits the
+trusted worker and the deployment independently allowlists the exact
+capability/digest. The model controls neither opt-in. The separately operated
+worker leases approved work and invokes the same guarded-apply implementation
+as manual apply; it repeats current approval, policy, limit, scope, freshness,
+generation-lock, writer-posture, idempotency, and receipt checks immediately
+before execution. Source or supporting-evidence drift causes zero mutation.
+Ambiguous transaction outcomes require reconciliation and are never blindly
+retried. Hard DELETE, reversible changes, set writes, and app-owned/external
+effects are excluded from this first automatic path. See
+[Operator-Supervised Automatic Apply](supervised-automatic-apply.md).
+
 Strict freshness is intentionally limited to same-database direct SQL
 writeback. Runner rejects app-owned or cross-source strict freshness because it
 cannot claim one atomic transaction around those effects. Cloud can govern an
@@ -218,6 +232,16 @@ controls are not MCP tools. The UI does not expose raw SQL, database URLs, or
 write credentials, and it does not let a model widen reviewed tables, columns,
 scope, policy, or executor authority.
 
+The authoritative store also records redacted human-attention events and
+projects related events into a secured Workbench inbox. External delivery is
+disabled and quiet by default. When an operator enables it, a separate
+dispatcher can route selected coalesced incidents to a JSONL development sink
+or signed HTTPS webhook. Delivery is at least once, redacted, budgeted, and
+observable. A notification, webhook response, inbox acknowledgement, delivery
+replay, or MCP update hint never activates, approves, applies, cancels,
+recovers, or mutates anything. The ledger and Workbench remain the source of
+truth. See [Human Attention And Notifications](human-attention-notifications.md).
+
 Contract lint and tests are review aids rather than a proof of complete
 security. Capability breadth can still drift as narrow tools accumulate;
 surface-fitness lint makes high-signal generic, dense, poorly named, and

package/docs/store-lifecycle.md

@@ -1,7 +1,8 @@
 # Store Lifecycle
 
 Synapsor Runner keeps local evidence, query audit, proposals, receipts, replay,
-and lifecycle events in a SQLite store.
+worker state, human-attention events, notification delivery state, and
+lifecycle events in a SQLite store.
 
 Default path:
 
@@ -143,6 +144,24 @@ event. The `lifecycle` command never does that; it only reports the most recent
 stored proof and approval linkage. See
 [Proposal And Evidence Freshness](proposal-evidence-freshness.md).
 
+## Human Attention And Delivery State
+
+The store records immutable attention events, coalesced incident projections,
+and sink-specific delivery attempts. Inspect them without copying an ID:
+
+```bash
+synapsor-runner attention show --store ./.synapsor/local.db
+synapsor-runner notifications status --store ./.synapsor/local.db --json
+```
+
+Acknowledgement changes only the attention projection. Notification replay
+requires a fresh verified signed-key or OIDC operator decision plus an explicit
+reason. That decision is bound to the exact delivery revision, requeues only
+the original redacted event, and appends an immutable
+`notification.replayed` audit event. Neither command approves, applies,
+reconciles, or repeats a source mutation. See
+[Human Attention And Notifications](human-attention-notifications.md).
+
 ## Server leases
 
 MCP server modes write a small lease file next to the store: