@zackbart/connecta 0.35.0 → 0.36.1

package/documentation/architecture.md

@@ -426,7 +426,7 @@ client. A raw Worker stream established the runtime behavior; a custom auth
 provider returning a synthetic streaming 401 exercised Connecta's real admission
 wrapper. Each case had its own Connecta instance with one request permit and no
 queue. Health checks and subsequent MCP requests confirmed the same isolate ID.
-The [recorded observations](https://github.com/zackbart/connecta/blob/a0ac904513fac735582b4bc9c817a48300134328/scripts/probes/worker-disconnect-2026-09-25.json)
+The [recorded observations](https://github.com/zackbart/connecta/blob/1ab92695f2636f904274d900ce209553358ff1f3/scripts/probes/worker-disconnect-2026-09-25.json)
 contain all twelve cases, including served flags and client-end timing.
 
 | Response and flag                                     | Raw stream abort / cancel | Connecta source abort / cancel | Admission after response; next request |
@@ -486,23 +486,23 @@ MCP requests still rejected a competing request with 503 before the deadline;
 the first MCP request after the deadline returned all eight tools with 200 in
 the original isolate. Admission then reported zero active requests. Without the
 flag, the source still recorded no abort or cancellation, so recovery did not
-rely on runtime cleanup. The [recovery observations](https://github.com/zackbart/connecta/blob/32d8e94/scripts/probes/worker-disconnect-recovered-2026-09-25.json)
+rely on runtime cleanup. The [recovery observations](https://github.com/zackbart/connecta/blob/1ab92695f2636f904274d900ce209553358ff1f3/scripts/probes/worker-disconnect-recovered-2026-09-25.json)
 also retain two inconclusive queue-handoff cases: concurrent client connections
 reached different isolates and could not establish an abandoned queued waiter.
-A [second trial using HTTP/2](https://github.com/zackbart/connecta/blob/b174812/scripts/probes/worker-disconnect-h2-2026-09-25.json)
+A [second trial using HTTP/2](https://github.com/zackbart/connecta/blob/1ab92695f2636f904274d900ce209553358ff1f3/scripts/probes/worker-disconnect-h2-2026-09-25.json)
 repeated the twelve passing core cases and verified queued cancellation with
 request signals enabled. Even on one HTTP/2 connection, the no-signal queue case
 crossed isolates and remained inconclusive. The Node and workerd regression
 suites cover expired waiters, orphaned handoffs, and identity-safe late release
 deterministically.
 
-To repeat from a repository checkout, run
-`node scripts/probes/worker-disconnect.mjs` with an authenticated Wrangler.
-The script is not in the npm package. It deploys a disposable Worker containing
-only synthetic data, verifies the served configuration, saves observations under `eval/results/`,
-and deletes the Worker in `finally`. It uses no `waitUntil`, which would change
-the lifetime being measured. The production runtime build number was not
-exposed by the deployment; these findings are tied to the date and flags above.
+The [historical probe source](https://github.com/zackbart/connecta/blob/1ab92695f2636f904274d900ce209553358ff1f3/scripts/probes/worker-disconnect.mjs)
+and observations are retained in Git history, outside the current checkout and
+npm package. The probe deployed a disposable Worker containing only synthetic
+data, verified the served configuration, saved observations, and deleted the
+Worker in `finally`. It used no `waitUntil`, which would change the lifetime
+being measured. The production runtime build number was not exposed by the
+deployment; these findings are tied to the date and flags above.
 
 ### Production Access bypass for agent endpoints
 
@@ -763,9 +763,9 @@ adoption, OAuth handoff ownership, single-use connect links, every downstream
 OAuth grant write and consent claim, the result stash, and initialization of the cursor signing key.
 
 Every key is built in `src/storage/keys.ts`, which lists each family with its
-scope, version, codec, and TTL policy; `test/storage-keys.node.test.ts` fails when
-two families overlap, another source file spells a prefix (constant concatenation
-folded), or a storage call passes a key holding literal text. Core hands
+scope, version, codec, and TTL policy. Deployed-consumer persistence journeys
+check actual owner isolation in the physical database; key probes retain NUL
+refusal. Core hands
 subsystems namespaced views: `conn:<id>:` per connector, `principal:<key>:` per
 personal registry, `results:` and `subject:<key>:` for result paging.
 
@@ -1266,20 +1266,16 @@ removed. Legacy hosted selectors fail at construction with the generic migration
 path. GitHub retains its scope-enforced App identity and exposes a bounded repository-read and release-write hatch plus local scope discovery, scoped data search and guarded merge.
 
 [Decision 0011](https://github.com/zackbart/connecta/blob/main/decisions/0011-provider-standard.md)
-records the provider standard now implemented by all 15 maintained providers. It fixes
+records the provider standard implemented by every maintained provider. It fixes
 one folder layout per kind and fixed evidence names. `drift.json` gets a
 generated block and the guide a generated Conventions section, and every
-`api()` surface gets one agent-facing shape. Providers completed two migration
-steps: onto the kit with unchanged output, then onto the standard surface.
-Both `PENDING.step1` and `PENDING.step2` in `test/provider-standard.ts` are empty;
-every maintained provider now meets the standard without a migration exemption.
-`test/provider-standard.node.test.ts` holds every maintained provider folder to the
-standard, and `test/provider-conventions.test.ts` checks the surface rules on
-Node. `providers:generate` writes the standard's derived parts and
-refuses a provider past step 1 that breaks the `drift.json` rules, or one past
-step 2 that breaks the guide rules: `drift.json` version 2's `generated` block
-(operations from the kit's `ProviderKitFacts` and evidence digests), and a guide's `## Conventions`, rendered
-from the definition's declarations into `skill.generated.ts`.
+`api()` surface gets one agent-facing shape. Every maintained provider meets the
+standard without a migration exemption. `test/provider-standard.node.test.ts`
+holds every provider folder to it, and `test/provider-conventions.test.ts`
+checks the surface rules on Node. `providers:generate` refuses drift (D) and
+guide (G) violations before writing. It derives `drift.json` version 2's
+`generated` block from kit operations and evidence digests, and the guide's
+`## Conventions` from definition declarations into `skill.generated.ts`.
 The generator requires `fixtures.ts` to export `createAuthored()` with a
 nonempty offline `staticTools` catalog. Its input/output schemas derive one
 paging convention, including `get_*`, hatch search and details, excluding
@@ -1291,8 +1287,9 @@ reports a nonzero explicit refusal count with singular/plural wording and
 points to the actual prefixed details tool with method/path lookup; it never
 embeds the refusal table. Unreviewed operations remain refused.
 `ProviderContext.usageGuide` selects a guide's `<!-- when: <key> -->` blocks
-with the definition's `blocks`. `providers:check` reads both record versions,
-reports a manifest operation no endpoint row records at the provider's level,
+with the definition's `blocks`. Maintained drift records use version 2;
+`providers:check` retains version-1 endpoint/manual record parsing for historical
+reports, while OpenAPI generation and checks use `evidence/openapi.json`. It reports a manifest operation no endpoint row records at the provider's level,
 and lists manual checks last verified more than 180 days ago. Its offline
 record validator, `scripts/drift-validate.mjs`, also gates `providers:generate`
 and the standard suite, so a record they accept is one `providers:check` reads.
@@ -1324,14 +1321,15 @@ A composition moves only by explicit review of its source pins/documents;
 `--record` and `--file` cannot replace it. `providers:check` compares the actual
 public documents independently; it never fetches a synthetic combined URL.
 
-The generic REST connector (`src/providers/_shared/rest/`) serves
+The indexed hatch (`src/http/hatch.ts`) serves
 `<vendor>_api_search`, `_api_details`, `_api_read`, and `_api_write` over an
 `OperationIndex` that `pnpm run providers:spec` compiles offline from the
-provider's pin (`evidence/openapi.json`; `openapi.source.json` until its step 1)
-into `openapi.generated.ts`. A `vendored: true` pin compiles the reviewed
-conversion in `evidence/openapi.document.json` instead of fetching, and the
-generated header records that document's digest beside the pin's, so the
-offline freshness check sees a changed conversion.
+provider's pin (`evidence/openapi.json`)
+into `openapi.generated.ts`. A `vendored: true` pin compiles offline from
+the reviewed conversion in `evidence/openapi.document.json`, or derives a
+deterministic Discovery conversion from its pinned original as described below.
+The generated header records the converted document's digest beside the pin's,
+so offline freshness sees a changed conversion.
 Each call is matched to an operation and checked against its parameters before
 transport. Resolved path parameters are validated before authentication or dispatch,
 including pinned enums and numeric bounds. Number path values must decode to canonical finite ASCII decimals without
@@ -1340,16 +1338,26 @@ canonical ASCII decimal safe integers: `0`, positive decimals without leading
 zeros, or negative decimals without leading zeros. `-0`, leading `+`, whitespace,
 exponents, decimal points and non-ASCII digits are refused. Negative integers
 remain valid when the pin has no minimum excluding them. String-valued ids keep
-their declared string contract; `_api_read` admits GET and the vendor's reviewed read-only POSTs in
-its handler, since classification is per tool name. Vendors configure only a
-transport, failure mapper, scope, framing, cursor extraction, a reviewed
-value-safety table (required; see below), argument-dependent refusals, and an
-idempotency header, plus optional hooks: `path` (fill default ids before
-matching), `admit` (an awaited check in `callRest` every tool passes, such as
-Cloudflare's account and zone pin), `result` (unwrap a vendor envelope;
-redaction runs after it and before cursors and `select`), a reviewed
-request-header allowlist, text bodies, and index `slashParams` that admit an
-encoded `/` in a final key segment (`test/rest-connector.test.ts`).
+their declared string contract. `_api_read` admits only operations with explicit
+reviewed read verdicts, including GET/HEAD and read-only POSTs where declared;
+classification is per tool name. Providers declare a confined kit connection,
+a value-safety table (required;
+see below), and any framing, scope, paging or refusal hooks through the hatch
+binding. The connection owns authentication, transport, failure mapping and
+result safety. An index's `slashParams` can admit an encoded `/` in a reviewed
+final key segment. Current hatch admission, paging, privacy and one-send
+outcomes are exercised by the required `eval:outcomes` tasks against stateful
+vendors and HTTP MCP deployments. `test/provider-hostile-response.node.test.ts`
+commits real HTTP writes before returning HTML, malformed JSON or an oversized
+acknowledgement, then reconciles vendor state with exactly one physical send.
+`test/provider-privacy-journey.node.test.ts` checks credential echoes over HTTP.
+Focused provider suites retain MIME/draft restrictions, revision conflicts,
+CCB routing, Planning Center product exclusions and deployment pins. Native
+HTTP framing, cursor and request-lifetime fault probes remain in the HTTP suites.
+The catalog-wide status sweep and its argument roster, catalog/ranking copies
+and unused paging strategy tests are retired under #1072. Provider workflows
+belong in the existing shared outcomes; a new tool requires no failure-matrix row.
+No legacy REST tool adapter remains.
 Large documents opt into generator options that drop restated operation ids
 and plain path parameters and cap one operation's details (`opBudget`).
 `numericBounds: true` preserves documented numeric minimum/maximum constraints
@@ -1364,11 +1372,10 @@ levels, 256 paths or 200 characters per path; overflow or an unresolved
 reference omits that operation's whole response-field contract. Explicitly open
 roots (including root-array items) also leave fields absent. Empty,
 schemaless and non-JSON responses declare no fields. Request shrinking and
-endpoint contract digests do not depend on this metadata. Legacy REST tools
-retain their catalog and discovery behavior until each provider's step 2.
+endpoint contract digests do not depend on this metadata.
 Fields remain optional additive metadata, so a previously compiled
 index without the source bytes remains usable without inventing a response
-contract. Vercel's step-2 pin review restores response metadata from the reviewed public
+contract. Vercel's pin includes response metadata from the reviewed public
 document; operations without declared response properties still refuse fields. Breeze's pin declares no response
 properties. GitHub's immutable official OpenAPI pin supplies its complete index and response fields; a reviewed repository allowlist controls dispatch. Natural queries with reviewed matches scope discovery to those matches and named-only operations; explicit paths and unmatched queries retain full-pin refusal discovery.
 `check:providers-generated` checks each index header against its source record
@@ -1406,7 +1413,7 @@ UTF-16 code units; full reconstruction must match its recorded exact length.
 These physical decode checks do not change request validation, schema traversal,
 search, refusal, result or discovery budgets. Generation and offline roundtrip
 tests must preserve every pinned logical contract; storage changes never accept
-new upstream evidence or golden bytes. The compaction suites cover exact strings,
+new upstream evidence. The compaction suites cover exact strings,
 native Web Crypto identity, malformed references, lazy decoding, mutation
 semantics and every maintained provider.
 
@@ -1427,14 +1434,12 @@ every vendor ships one reviewed table through one mechanism
    signing, webhooks, drains, transfer, claim, and invite codes). It is the
    union of the detectors Cloudflare and Vercel shipped first, and
    deliberately over-inclusive. `providers:spec` writes
-   `evidence/value-safety.json` (`value-safety.candidates.json` until the
-   provider's step 1) when the source record sets
+   `evidence/value-safety.json` when the source record sets
    `options.valueSafety` (vendor `operationWords`; Stripe's `expansions: false`
    skips id-or-object expansions, which are their own operations' candidates),
    stamped with the pinned digest, the detector format, and its options. The
    file is test evidence and never ships.
-2. **One reviewed verdict per candidate**, in the vendor's `safety.ts`
-   (`value-safety.ts` until its step 1):
+2. **One reviewed verdict per candidate**, in the vendor's `safety.ts`:
    `refuse` (the generic tools refuse it before transport, naming the
    operation and the reason), `redact` (reviewed field paths), or `safe`, each
    with a reason. Paths are dot paths into the data a tool returns: a list on
@@ -1455,8 +1460,8 @@ every vendor ships one reviewed table through one mechanism
    otherwise. `providers:spec` derives the binding fields from the pinned
    schema, and the harness fails until the condition lists each one. Argument-dependent refusals (Stripe expansions,
    Vercel `decrypt`) stay in the vendor's `refuse` hook.
-3. **Redaction on every success body**, in `callRest` after `result` and
-   before cursors and `select`, so named tools, HEAD data, and uploads pass
+3. **Redaction on every success body**, in the kit connection after `result`
+   and before cursors and `fields`, so named tools, HEAD data, and uploads pass
    through it too: the operation's reviewed paths, then the key-name
    heuristic as defense in depth. The heuristic is the union of the former
    vendor engines: a credential word anywhere in a non-metadata name removes
@@ -1619,14 +1624,13 @@ response schema can return (through `options.valueSafety.dataRoot` for an
 envelope such as Cloudflare's `result`), and every resource rule path
 something the resource's schema can return. It stamps the paths that resolve
 into the candidates file and fails on the rest, unless the table's `absent`
-field (`value-safety.absent.json` until the provider's step 1) acknowledges
+field acknowledges
 them with a reason (shared verdicts applied to operations whose schema lacks a
 path, or fields a schema leaves undeclared; such paths still apply at
 runtime).
 
 `test/fixtures/value-safety.ts` is the shared harness each vendor's
-`value-safety.node.test.ts` (`provider.safety.node.test.ts` after its step 1)
-runs; `reviewProblems` is pure, and
+`provider.safety.node.test.ts` runs; `reviewProblems` is pure, and
 `test/value-safety-harness.node.test.ts` proves wrong paths fail it. It fails
 on candidates from another pin, format, or option set; an unreviewed
 candidate; a verdict for an operation the index lacks; a table path the stamp
@@ -1653,232 +1657,116 @@ There are no hosted review maps, pins, drift comparisons or review UI fields.
 Catalog refresh activity still compares successive accepted catalog fingerprints
 and reports only added, removed and changed counts in the caller's partition.
 
-#### Characterization goldens
-
-Every maintained provider with an `api()` surface has goldens under
-`test/goldens/<provider>/`: the oracle a provider migration must match byte
-for byte. `catalog.json` holds the connector metadata, the rendered guide,
-and each tool's name, description, schemas, and annotations. `calls.json`
-holds at least one fixture call per tool, then an echo call: the exact
-requests sent (method, URL, sorted headers, body), grouped into causal
-steps, and the agent-visible outcome. `failures.json` drives one read and
-one write through 400, 401, 403, 404, 409, 422, 429 (with `retry-after`)
-and 500 responses, a 401 whose message echoes every sent secret, a refused
-connection, and a transport timeout (a `TimeoutError` after the request
-left). `setup.json`, for a provider whose spec completes an OAuth consent,
-holds the consent's steps. Calls run through `Registry` and
-`InvocationService` with a real credential vault, so the outcome is what
-`call_tool` returns before MCP rendering.
-
-`test/goldens/<provider>/spec.ts` says only how to build the provider and
-which calls to make, including an `echo` call whose vendor reply carries the
-text the harness passes. `test/goldens/harness.ts` owns everything else:
-
-- The fake network records each request as `new Request(input, init)`
-  builds it, so `init.headers` replaces a Request's headers as Fetch does,
-  and a body gets its implied `content-type`. Form bodies are recorded as
-  fields when they re-encode to the exact bytes sent; FormData as its parts,
-  with the runtime's boundary as `<boundary>`. A JSON body is recorded as
-  `json` alone only when it is exactly that value's compact serialization;
-  any other spacing, key order, or escape also keeps the exact `text`.
-- A step loop drives each scenario under fake timers. It drains microtasks,
-  fires timers due now synchronously, and waits for request construction and
-  counted real work to finish. Newly waiting requests form one step, sorted
-  by method, URL, headers, and exact body. The loop releases **one answer at
-  a time**, running to quiescence after each. Previously recorded requests
-  keep release priority over new requests. Fixture updates capture canonical
-  cohort release order and reverse cohort release order, each with its own
-  fresh module graph, clock, network and cache namespace. Queue replies are
-  assigned in canonical request order in both runs; only answer delivery
-  changes. Steps remain readable admission cohorts, not simultaneous answers.
-  Workerd checks compare the canonical observation. In stored fixtures,
-  identical observations collapse to one
-  row; differing reverse observations appear in `variants`, each with
-  `order: "reverse"`, complete `steps`, optional `waitedMs`, and `result`.
-  Setup uses the same rule, with `{ steps, variants }` only when orders differ.
-  This bounded two-order model deliberately does not enumerate all interleavings.
-- Every request records integer `after`: the number of answers delivered
-  when the provider called fetch, before harness jitter or body inspection.
-  It identifies a prefix of that run's release sequence; it includes auxiliary
-  requests and resets for setup and invocation. The canonical run releases
-  each cohort forwards, the reverse run backwards, with older cohorts first.
-  For concurrent A and B, C awaiting only B and C awaiting both have canonical
-  `after: 2`, but reverse `after: 1` and `after: 2` respectively. The differing
-  variant preserves that dependency. One integer per request keeps frontiers
-  linear, including a 300-page sequential call. A write sent before login and
-  a write duplicated concurrently or sequentially also differ.
-- Distinct queued replies for indistinguishable concurrent requests are a
-  fixture authoring error: the harness rejects them with a diagnostic. Use
-  identical replies or a request discriminator the provider controls. The
-  arrival order of identical requests cannot assign distinct responses.
-- `test/goldens/setup.ts` installs source dispatchers before a golden test
-  file imports any provider, connector or Effect module. `vi.resetModules()`
-  and dynamic imports refresh those graphs for each capture and release order.
-  The dispatchers retain their identity across captures: saved and prebound
-  functions, and functions captured by Effect, still consult the current
-  capture. Their defining prototypes are wrapped too. Native implementations
-  remain private to the source controller; outside captures the dispatchers
-  delegate unchanged, preserving Vitest's real clocks and runner timeouts.
-- The supported asynchronous model is explicit: fake fetch answers; fake
-  timeout, interval and immediate timers, including `AbortSignal.timeout`; Web Crypto's promise-returning
-  subtle methods; Request/Response/Blob body reads (`arrayBuffer`, `blob`,
-  `bytes`, `formData`, `json`, `text`, where present); default stream-reader
-  `read`/`cancel` and stream `cancel`/`pipeTo`; and promises/`queueMicrotask` chains rooted in those sources or
-  synchronous work. Effect's scheduler and sleeps use the same microtasks
-  and fake timers. A synchronous TextDecoderStream pipeline is supported.
-  Timer delays must coerce to finite nonnegative integer milliseconds within
-  the signed 32-bit timer range; other delays poison the capture. This keeps
-  Date and nanosecond clocks integral. New host asynchronous sources must be
-  registered and counted before use.
-  Native CompressionStream/DecompressionStream, `scheduler.wait`, and
-  native socket/worker/event-source constructors are rejected explicitly,
-  including when their errors are swallowed by a provider. CompressionStream
-  async iteration bypasses the reader-method spy and cannot establish
-  quiescence. No golden may silently bless that path.
-- A no-stimulus audit follows declared quiescence: request, counted-work,
-  timer, or call-settlement progress before an answer or clock tick fails
-  with an unsupported-source diagnostic. Waiting without a request, counted
-  work, or fake timer also fails. The audit is a secondary assertion: source
-  control starts at module load, and supported host promises and microtasks
-  are counted from entry through completion. Quiescence requires zero active
-  counted work, zero queued controlled microtasks, and no due timers; future
-  virtual timers are explicit harness stimuli. Unregistered native producers
-  are unavailable or throw, including saved constructors and swallowed errors.
-  `process.nextTick`, `process.uptime`, `Atomics.waitAsync`, native messaging
-  constructors, and performance timeline methods are unsupported. The
-  test-only `golden-source-boundary` transform rejects Node host-module imports
-  in provider graphs and rejects lazy module loading during scenario work,
-  before either can capture native references or schedule uncounted I/O. Only
-  the harness's fresh-graph loading phase admits test fixture imports.
-  Invalid captures cancel and drain their concurrent fake requests.
-- Settle, rejected-capture cleanup, and final teardown pump controlled timers,
-  microtasks, and fake requests within the original 10,000-host-turn windows.
-  Only outstanding captured Web Crypto operations can extend a window: after
-  exhausting it, await a snapshot of those native operations to settle, then
-  resume with a fresh bounded window. Each phase allows at most 100 native
-  extensions and reports an explicit error on exhaustion. Web Crypto always
-  settles independently of the harness's fake network, timers, and producers.
-  Body reads and stream reads are counted for quiescence but cannot extend a
-  window: their producers may require a fake response, future virtual time,
-  or never complete. No producer attribution or stream constructor tracking
-  is needed. Pending native crypto never advances virtual deadlines or merges
-  request cohorts. Clock advancement remains limited to 1,000 ticks.
-  Unsupported producer dependencies reject within the turn bound; teardown
-  always clears timers and releases capture ownership, including after failed
-  construction and overlapping capture rejection. The next capture must work.
-  Each capture has an async-context epoch that closes before ownership is
-  released, even when its native extension cap is exhausted. Controlled-source dispatchers reject closed
-  continuations before touching another capture's state. Fake request entry,
-  admission, response delivery, and serialization check their owning epoch,
-  including after asynchronous body inspection. Late work cannot record into
-  or receive a response from a later capture, which never waits for it.
-  Closing also attaches rejection handlers to outstanding counted promises,
-  consuming abandoned native body-read rejections without awaiting them.
-  Source regressions explicitly assert either completion or bounded rejection
-  followed by recovery. Crypto-delay probes at 11,000 and 100,000 host turns
-  must complete with unchanged observations; producer-fed bodies need not.
-- The network answers in zero virtual time. Before advancing to the next
-  timer, the loop requires eight quiet real event-loop turns and an audit.
-  A row records nonzero `waitedMs`, the virtual time spent on provider
-  timers. Elapsed-time readings count only those timers. A timer of 0 ms
-  set outside a timer callback is due at once and stays in the current
-  cohort. Unjoined timers at completion fail. Since `AbortSignal.timeout`
-  cannot be cancelled, remaining signal deadlines fire during teardown, outside
-  `waitedMs`; any resulting request or result mutation fails. Every successful
-  drive and scenario boundary has zero outstanding controlled work and timers.
-- Auxiliary routes answer token exchanges and other requests that are not
-  the tool's own, and are recorded by name with headers and body. A JWT in a
-  header or field is recorded as its decoded header and claims, with
-  `<signature>` for the per-run signature.
-- `setup` runs before each scenario; its requests must be identical in
-  every scenario and are recorded once.
-- Determinism: a fresh fake clock per scenario (timers, `Date`, and
-  `performance`, and Node `process.hrtime`/`hrtime.bigint`, starting at
-  2026-01-02T03:04:05Z), counted
-  `crypto.randomUUID`, and fixed `crypto.getRandomValues` and `Math.random`,
-  all restarted per scenario. `create(scenario)` receives a slug unique in
-  the process: the scenario name plus a per-capture suffix the goldens never
-  show. Load-time hrtime dispatchers also control Effect wall and monotonic
-  nanoseconds on the virtual clock. Default-date Intl formatting also reads
-  the virtual wall clock.
-  A process-wide cache (Google's delegated tokens) never carries
-  over from an earlier scenario or capture.
-- Secrets: every credential field and secret becomes `<secret:field>`, with
-  HTTP Basic shown decoded. Before that placeholdering, the harness fails
-  the capture if any secret reaches a caller-visible result (INV-5). The
-  guard decodes the result itself: JSON escapes, percent escapes in either
-  hex case, and base64 or base64url at any alignment, up to three layers
-  deep. It also finds any start of a secret that reaches 12 characters past
-  its public framing, so a truncated echo is a leak. Framing is a PEM armor
-  line and the DER structure that opens every key of its type (tags,
-  lengths, version, algorithm identifier), which guides and example keys
-  print. A later fragment, a shorter one in any encoding, or a secret with
-  its case changed is not detected. A base64 run is decoded only from 11
-  characters (8 bytes), shorter than the base64 of any start the guard
-  looks for.
-- The echo call carries every secret not listed in `unsent` in each
-  encoding redaction covers: raw, percent-encoded with upper- and lowercase
-  hex, base64, unpadded base64url, and `\uXXXX` escapes with upper- and
-  lowercase hex, plus the base64 of each `basic` pair. Every sent secret
-  contains `/`, `+`, and `=`, so its percent and base64url forms differ from
-  its raw and base64 forms. The `401 echo` case echoes the raw secrets only
-  unless the spec sets `errorEcho: "all"`: a provider that caps a vendor
-  message before redaction sees it would leak the start of a longer form its
-  cut goes through. The Google Workspace specs set it, since Google redacts a
-  message whole before cutting it to 500 characters. Their `401 echo` carries
-  `errorEchoForms`: every form above, the `Bearer` and `token` framings, and
-  an HTTP Basic pair holding the token as header, base64 and base64url.
-
-Object keys keep the order the provider produced. A migration changes the
-provider, never the spec or harness.
-
-`test/goldens.test.ts` compares every provider on Node and workerd. It fails
-if a provider folder is neither covered nor listed as remote-MCP-only, a tool
-has no call, or a golden file is missing or extra. Ordinary checks never write.
-Node compares forward and reverse observations byte for byte; workerd compares
-canonical observations. Each order starts a fresh module graph. Workers projection
-removes variants only at harness observation positions, never from vendor fields
-or schemas. Fixture updates retain both orders.
-There are no characterization tiers, path classifiers, or planning-only runs.
-
-`test/goldens-harness.test.ts` keeps the source and mutation guards on Node:
-replaced Authorization headers, changed auxiliary/login bytes, writes sent
-early or twice, and missing secret-encoding redaction must alter a capture or
-fail it. Mutation probes capture the affected call rather than repeating an
-entire provider catalog. Redaction negative controls use Forms, GitHub, Breeze
-and Tithe.ly to cover OAuth/Bearer, app-token, query-key and provider-kit lanes;
-the ordinary goldens still check every provider's complete secret echoes.
-The native-extension budget is checked directly at its 100-extension boundary,
-and a gated closed-epoch continuation must fail before entering the next
-capture's network. Genuine crypto completion, rejection, late dispatch and
-producer-fed stream probes retain their native settlement coverage without
-repeating a million-turn synthetic delay. Ordinary runs use one source-probe schedule. Nightly Node runs set
-`CONNECTA_GOLDENS_DETERMINISM=1` for an identical repeat, provider jitter seeds
-1 and 2, and the complete source-probe jitter matrix. Small native-source probes also run on
-workerd: `scheduler.wait`, CompressionStream, saved timers/microtasks and
-Effect scheduling, prebound crypto/clocks, module freshness, runner clocks,
-and Blob/TextDecoderStream promise settlement. Runtime-specific cases carry
-Vitest's `workers` tag; broad cases carry `node`, which the Workers project
-skips. Other mixed transport/auth/runtime suites use the same tags to retain
-native fetch, request/response streams, deadlines, signals, crypto and SDK
-settlement without duplicating their policy matrices. `vitest.config.ts`
-selects these files with globs that tolerate test-file deletion. Portable
-filenames alone do not enroll a new file in workerd.
-
-Repository verification policy, CI requirements, and exact commands live in
-[AGENTS.md](https://github.com/zackbart/connecta/blob/main/AGENTS.md#verification).
-
-JWT fixture specs import fixed, public throwaway RSA PEM keys, with an
-import/sign/verify self-test. This avoids expensive key generation on every
-fresh module evaluation without changing characterized JWT claims or bytes.
-The harness never caches evaluated module graphs. Global controls prohibit
-`it.concurrent`; parallelism must use isolated files/workers. Transformed code
-may be cached.
-
-`pnpm run goldens:update [provider...]` rewrites the named goldens (all
-when none are named) on Node; it is not part of `check`. A PR
-that changes agent-facing output on purpose regenerates the affected goldens
-and says why in its description; any other golden diff is a regression.
+#### Behavioral evidence (contributor)
+
+The characterization snapshot engine, provider JSON snapshots, source scheduler
+and its self-tests are retired under
+[#1072](https://github.com/zackbart/connecta/issues/1072). Provider changes no
+longer require golden enrollment, snapshot updates, byte equivalence or nightly
+capture determinism. Production invariants remain unchanged.
+
+Use the existing stateful fixture vendors and published-edge deployment adapters:
+
+- `pnpm run eval:outcomes` drives representative joins, retained paging, endpoint
+  refusal, auth handoff, value safety and recovery after committed refunds,
+  cancellations, DNS and environment updates, plus a single GitHub draft release
+  and Google document partial creation and shared-drive permissions. Graders inspect
+  independent downstream state and the physical mutation ledger, and reject
+  wrong targets, duplicate writes, missing completion and interrupted trials.
+  Every reference also rejects a fabricated correct answer without the work.
+  Promoted read journeys reject erased MCP data even with the vendor ledger intact.
+- `pnpm run eval:smoke` boots the Node template, Node eval deployments and native
+  Workers deployments, including the actual QuickBooks and Granola providers, then exercises
+  MCP and the operator page.
+- The shared `granola-workspace-journey` outcome uses actual provider reads,
+  independent fake meeting state and physical cursor/filter requests on both
+  Node/SQLite/QuickJS and native Workers/D1. It covers transcript-too-large
+  recovery, empty intermediate pages, selected fields, withheld photo/credential
+  values and shared-vault reuse after application reconstruction. No-op,
+  fabricated-read and erased-delivery controls must fail.
+- `test/identity-write-journey.node.test.ts` uses the existing Node deployment
+  adapter, stateful MCP fake, SQLite vault and QuickJS to grade admitted human
+  and machine identities, pool isolation, fail-closed discovery, endpoint and
+  connector policy, physical mutation counts, ambiguous-write reconciliation,
+  credential ownership and payload-free activity. Independent decoding checks
+  returned private values and credential echoes; positive record facts must
+  still arrive. An explicitly writable pool also exercises reopening a
+  read-only deployment without bypassing connector policy.
+- `test/cancellation-journey.node.test.ts` observes a queued client's departure
+  without another vendor send, and an active client's departure after the
+  vendor commits. The vendor must see its held response socket close before
+  releasing it; a later MCP read recovers the committed intent exactly once.
+  `test/cancellation-faults.test.ts` keeps signal-less token-resolution,
+  warmed-credential digest, stalled body-cleanup and abort/grant races on Node
+  and workerd. These replace the universal Promise-method/seam/owner matrix
+  and its enrollment self-test, plus migration-only runtime wrapper checks.
+- `test/browser/operator-flows.spec.ts` serves the actual operator shell and
+  routes over TCP with file-backed SQLite. Sign-in, Settings provenance, OAuth
+  connect/disconnect and credential save/test/replace/remove survive closing and
+  reopening the app, database and vault. An independent SQL connection reads
+  trigger counts: one save, one replacement, one removal, and no credential
+  writes from reads or a rejected replacement. A real SQL trigger failure leaves the old
+  credential usable after restart. MCP calls verify that those edits preserve
+  the reader pool's actual read access and write refusal. Activity renders
+  successful calls recorded before restart without either credential value.
+- The existing Node-template `eval:smoke` target constructs invalid config from
+  published imports before any I/O and reuses a stored token after restarting
+  the consumer process. Its Worker-fakes target saves a personal credential in
+  Chromium, refuses another owner's use, saves that owner's invalid credential,
+  then restarts workerd on the same D1 directory. Actual downstream records
+  remain readable only to the correct owner. Direct SQL inspection finds two
+  distinct durable encrypted rows and exactly one committed save for each.
+- Keep focused SQL batch/schema/retention rollback, clock-skew and absolute
+  expiry, NUL/UTF-8 and literal-prefix, cross-connection claims, cancellation,
+  corrupt-row and tracing-secrecy probes. Keep operator identity/slot fences,
+  deadlines, CSRF, restricted-view projection and sink secrecy probes. These
+  cover faults that a successful browser journey cannot reproduce. Retired
+  evidence includes the key-prefix source scanner, config expected-object
+  matrices, operator structure snapshots and native-composition sentinels.
+- `test/provider-privacy-journey.node.test.ts` sends credentials through real
+  HTTP MCP and a maintained API provider. Unknown vendor fields and keys carry
+  raw, escaped, percent-encoded, base64 and Basic echoes through direct calls,
+  QuickJS programs, failure and recovery. The independent decoder in
+  `test/helpers/secret-echoes.ts` checks the wire responses for secret fragments;
+  it does not normalize them to placeholders or compare saved output.
+- `test/provider-hostile-response.node.test.ts` reconciles real HTTP mutations
+  after HTML, malformed JSON and oversized acknowledgements with one physical
+  send. It distinguishes Stripe's reviewed pre-execution 401 refusal, and checks
+  read failure facts, secrecy and recovery through direct and QuickJS calls.
+  `test/provider-failure-sweep.test.ts` retains only concrete auxiliary, composite,
+  in-flight and untracked-call fault probes; no provider/tool argument roster or
+  catalog/finalizer agreement sweep remains. Existing
+  `test/sent-secrets.test.ts`, `test/sent-secret-output-boundary.test.ts`,
+  `test/request-secret-redaction.test.ts` and `test/catalog-secret-redaction.test.ts`
+  cover secrecy before projection, truncation, caching, paging and diagnostics.
+- `test/write-evidence.node.test.ts`, `test/remote-mcp-attempts.node.test.ts` and
+  `test/oauth-credential-attempts.node.test.ts` inspect physical socket sends.
+  Native transport parity, OAuth and write-provenance suites retain their
+  workerd coverage. The shared throwaway RSA key in `test/fixtures/rsa.ts` is
+  used by write-provenance and unknown-write-advice fixtures.
+- The request, catalog, auxiliary-call and renewal lifetime
+  suites, plus `test/auth-admission-binding.test.ts`, exercise cancellation,
+  held native work and garbage collection. These test actual request ownership;
+  the retired capture scheduler's source guards were only harness constraints.
+
+The remaining probes defend distinct reachable failures: auth admission and
+native scheduler ownership, grant/callback fencing and refresh coordination,
+SDK replay/redirect/SSE attempts, nested write provenance and refusal evidence,
+unawaited program drain and failed-program accounting, catalog drift and paging
+revocation, and hostile serializers, structural echoes, truncation and persisted
+pages. Broad scripted-executor policy/privacy cross-products and repeated
+post-401 result/error-shape tables are retired. Protocol claims link executable
+evidence files in `spec/coverage.json`; the invariant contracts above are defended
+by the actual behavior assertions in these journeys and focused probes.
+The required CI gate includes build/declarations, Node and Workers probes,
+outcomes, browser flows, installed consumers and Docker, audits and real Eve
+compatibility. Further contributor cleanup is tracked in #1072.
+
+Add a compact fault journey only for a meaningful outcome those suites cannot
+observe. Reuse their fixtures and adapters; do not reintroduce a snapshot
+format, module loader or virtual scheduler. Workerd enrollment is for native
+fetch, streams, Web Crypto, lifetime and request-byte behavior, as listed in
+`vitest.config.ts`; pure logic runs on Node.
 
 ## Optional deployment modules
 
@@ -1996,9 +1884,9 @@ declarations; elsewhere it lives in an unexported function or in
 (`ConnectorCallError`, `ExecutorAdmissionError`, `CallAdmissionError`) because
 callers and tests check `instanceof`, `name`, and `message`.
 
-Effect callers skip the Promise and take the program: `admit` and
-`acquireScoped` for request admission (`src/runtime/admission.ts`), `admitCall`
-and `acquireCallScoped` for call admission, `closeScope` and `closeScopeOnExit`
+Effect callers skip the Promise and take the program: `admit` for executor
+admission (`src/runtime/admission.ts`), `admitCall` and `acquireCallScoped` for
+call admission, `closeScope` and `closeScopeOnExit`
 for a connector scope, `withDeadlineEffect` where Promise code has
 `withDeadline`. The build prunes every declaration no `exports` target reaches,
 and `pnpm run check:declarations` fails if what remains names an Effect type.
@@ -2152,8 +2040,7 @@ never-settling evaluation/host calls, late rejection, execute-once ownership and
 original acquisition errors in workerd. `test/quickjs-pool.node.test.ts` covers
 readiness release, stale/malformed IPC, late host failures, backoff and bounded
 kill. Real Worker and QuickJS guest contracts, the HTTP Worker budget/queued
-request fixture and native-output suites supply runtime parity evidence;
-provider goldens do not execute a sandbox.
+request fixture and native-output suites supply runtime parity evidence.
 
 ### Native SQL storage (contributor)
 
@@ -2219,8 +2106,8 @@ published storage interfaces.
 The synchronous state-file parser, validation, file read, and one atomic
 SQLite import remain native synchronous leaves because `importStateFile` is a
 published synchronous API. `openSqlite` retains file modes, WAL, busy timeout,
-and database ownership. `test/sql-effect-contract.ts` runs native-path,
-affected-row, 50-claim, cancellation, and tracing checks on SQLite and native
+and database ownership. `test/sql-effect-contract.ts` retains affected-row,
+50-claim, typed-failure, cancellation, and tracing probes on SQLite and native
 D1. `test/kv-to-d1.test.ts` also reuses stores across separate workerd requests;
 the existing SQL contracts prove rollback, database-clock TTL, encodings,
 activity upgrades, and copy recovery.
@@ -2283,9 +2170,12 @@ An accepted write's blocked retry retains its original HTTP status; a slot
 occupied by an auxiliary read instead names the separate write step needed.
 Structured resend advice reaches output only when the core permits it. Generic
 unknown writes retain the core's diagnostic wait; Q8 removes it. The mapping
-adds no Promise entry or lifetime owner. The rule tables in `http-kit.test.ts`,
-Stripe's sixteen-branch comparison and `kit-core-verdicts.test.ts` establish
-these internal contracts. Maintained API providers use the kit through their
+adds no Promise entry or lifetime owner. `provider-failure-sweep.test.ts`,
+`guarded-attempts.node.test.ts`, `call-services.test.ts` and the native
+transport suites exercise these contracts through invocation, physical sockets
+and request closure. `http-kit.test.ts` retains focused numeric/text fact,
+request-equivalence and bulk-capacity fault probes. The migration-era
+kit/core verdict comparison is retired under #1072. Maintained API providers use the kit through their
 explicit provider subpaths; it stays off the root import graph and published
 declarations expose Promises.
 
@@ -2364,15 +2254,13 @@ inventories, and stale fallback cannot authorize post-entry auth recovery.
 ### Contributor provider kit
 
 Provider declarations use `src/http/vendor.ts` for HttpApi operations and
-`src/http/tools.ts` for list, get, read, write and action builders.
+`src/http/tools.ts` for list, get, read and write builders.
 `src/http/provider.ts` composes them with `defineProvider`; it returns the
 ordinary Promise-based Connector factory. The kit stays outside the root
-graph and its Effect types are internal. Tithe.ly is the first provider on
-it (B.5): `api.ts` declares the vendor, `tools.ts` the tools, and its goldens
-are unchanged.
+graph and its Effect types are internal. In each provider, `api.ts` declares
+the vendor and `tools.ts` the tools.
 
-Decision 0011's standard surface (Tithe.ly's step 2) adds four kit pieces.
-A `list` without the legacy `key` returns `{ items, page }`, with
+The standard `list` builder returns `{ items, page }`, with
 `page.nextCursor` only while `hasMore`, and the kit appends `limit` (the
 declared default and maximum), `cursor` and `fields` to the tool's filters;
 `read` and `get` take `fields: true`. `src/http/fields.ts` narrows after every
@@ -2460,7 +2348,7 @@ A refused method outside a read/write tool's input schema is inspected through
 Gmail's 49 non-GET refusals do not add a method field or a write hatch, and Forms'
 refused DELETE remains outside its write enum. GitHub's refused raw PUT merge
 is likewise outside its write enum; its named guarded alternative is unaffected.
-These 51 schema refusals happen
+Such schema refusals happen
 before authentication or I/O; details exposes the same reviewed reason as search.
 Every schema-reachable refused operation still fails with that reason before
 authentication or dispatch. This is policy inspection, never execution admission.
@@ -2611,12 +2499,11 @@ storage loses them with the store. Key-load outages or corrupt stored keys
 produce retryable `unavailable`, naming the cursor signing key without its
 value. See [cursor-key recovery](./deploying.md#recover-a-cursor-signing-key):
 after repairing/deleting a corrupt key, restart every process/isolate to clear
-cached keys. Pre-upgrade cursors require a new first page. Offline goldens
-preseed a fixed key only in their harness.
+cached keys. Pre-upgrade cursors require a new first page.
 
 The helper derives connection metadata and probe messages from
-validated options and still accepts complete legacy usage guides for compatibility.
-All maintained providers have completed the standard-surface migration.
+validated options and renders every maintained guide through
+`ProviderContext.usageGuide`.
 Candidate checks can refuse before authentication while
 preserving the provider's exact diagnostic. Its optional `authScope(options)`
 selector fixes OAuth grant ownership from deployment mode at construction;
@@ -2624,8 +2511,7 @@ CCB uses shared System Auth grants and personal Identity Auth grants. Tool
 arguments cannot select a grant's owner. On Node, every maintained-provider
 request uses the owned sender `listen()` installs, reads included. Without it,
 maintained-provider writes and reviewed POST reads are refused before sending;
-suites exercising those requests configure the sender themselves, as the goldens
-harness does. Anything a connection
+focused suites exercising those requests configure the sender themselves. Anything a connection
 caches across calls, such as its typed HttpApi client, is built with no
 services, because Effect constructors close over the context they run in and a
 cached value would otherwise keep its first caller's request alive (INV-7).
@@ -2669,8 +2555,20 @@ All six Google Workspace products use the shared standard-surface support.
 archived exact-byte official Discovery documents into deterministic OpenAPI.
 The primary vendored pin retains the official URL, revision and source digest;
 its `discovery` relation names the sibling source pin and normalizer format.
-Generation and offline freshness reproduce the conversion, and the generated
-module records its independent document digest. Full source method inventory
+The sole retained document is `evidence/discovery.document.json`; no converted
+`openapi.document.json` is retained for these pins. Generation and offline
+freshness validate the original bytes against `discovery.json` and the primary
+pin, then derive the conversion in memory, including reviewed summary overrides.
+Its digest uses two-space JSON indentation and a terminal newline; the generated
+module records that independent document digest, preserving freshness checks
+for changes to the normalizer or summaries. This supersedes Decision 0011's
+retained-conversion requirement for deterministic Discovery evidence. Frozen
+measurements read those same provider-owned originals but validate the existing
+`test/fixtures/google-discovery/manifest.json` digests independently: a provider
+pin update must fail the historical measurement rather than silently rebase it.
+That reviewed pin-change PR must re-measure and update the product's manifest
+entry and the Forms #1009 drift-check digests when applicable, or retire the
+measurement. Full source method inventory
 and canonical source-to-relative-path mappings survive normalization. Gmail's
 source `userId` becomes deployment-owned `me`; runtime paths are relative to
 the existing connection root. Reserved Slides ids remain one encoded segment.
@@ -2692,13 +2590,13 @@ independent batch-kind, revision and resource guards. Google indexes explicitly
 set `pathMatching: "uri-template"` on `OperationIndex` to handle encoded literal
 collisions and parameter action suffixes. Other indexes retain exact literal
 segments and their existing refusal ordering. The matching mode also binds
-discovery cursors. An indexed `googleClient` requires each named request's declared
-template and refuses a substituted id resolving to another operation before
-grant evaluation. Products opt in with `googleClient(connection, title,
-{ standard: true, index })`; their requests carry `template`.
+discovery cursors. `googleClient(connection, index)` requires each named request's
+declared `template` and refuses a substituted id resolving to another operation
+before grant evaluation. Every maintained Google product uses this indexed
+client; there is no unindexed settlement mode.
 Both the client and `googleHatchBinding(connection, { index, review })` require
 the explicit URI-template mode at construction. The hatch requires the binding's
-exact index identity. Standard clients and Google bindings reject a missing
+exact index identity. Clients and Google bindings reject a missing
 index with an explicit construction error. The provider-standard suite checks
 actual hatch construction through every Google product fixture, requiring its
 Google binding with the same connection and index. The Google binding
@@ -2707,7 +2605,7 @@ dispatch.
 
 The generator's `allSuccessResponses: true` option unions JSON response fields
 from every 2xx. Existing providers keep the first JSON success contract until
-their own reviewed regeneration; no committed provider index changes here.
+their own reviewed regeneration.
 
 `src/providers/_shared/google/hatch.ts` supplies JSON framing over the existing
 confined `Connection.sendPath`. It retains the hatch's origin/media guards,
@@ -2734,17 +2632,16 @@ For example, a direct value-mode result has outer `result.data`, the hatch's
 `result.data.page.nextCursor`, and vendor JSON at `result.data.data`:
 `call_tool({ address: "crm.forms_api_read", args: { path:
 "/forms/form_1/responses", cursor: previous.data.page.nextCursor },
-resultMode: "value" })`. This is an envelope illustration for an opted-in
-provider, not a claim that the Forms migration has shipped.
+resultMode: "value" })`. Google Forms uses this continuation envelope.
 
 `googleErrors(product, { standard: true })` declares the product's 404 meaning
 and uses common status fallbacks; revision-conflict meanings require a
-separate declaration. Standard-mode `googleClient` preserves failure phase
+separate declaration. `googleClient` preserves failure phase
 metadata for partial-create recovery while leaving settlement and wording to
 the kit. Its incomplete-body wording covers JSON and binary reads without
-claiming that binary success was expected to be JSON. Legacy mode retains
-its catalog and failure bytes. No shared-core auxiliary-write outcome change
-is part of this opt-in support.
+claiming that binary success was expected to be JSON. `googleGrant` still uses
+the nonstandard `googleErrors(product)` mapping for delegated-token rejection;
+that grant contract is separate from resource-request settlement.
 
 Drive's two-request reads also declare fixed steps: `get_file_content` uses
 `metadata` and `content`, and non-root `list_folder_items` uses `folder` and
@@ -2755,10 +2652,8 @@ Gmail declares separate initial and body-download steps for `get_message`,
 each of up to 25 summary reads, and `get_thread` names each stored body in
 Gmail's 100-message conversation limit. Serving these reads as writes keeps
 every request available once.
-The layer's request adapter keeps the legacy wording of a served write whose
-answer proves nothing (no answer, a 5xx, a redirect, or an unreadable 2xx) and
-reports how far a failed request got. The core still decides every write's
-outcome. Gmail's auxiliary draft and reply lookups pass both `effect: "read"`
+The request adapter reports how far a failed request got; the kit maps the
+failure and the core decides every write's outcome. Gmail's auxiliary draft and reply lookups pass both `effect: "read"`
 and a construction-declared step: the guarded client's early reservation uses
 that named slot, while the ledger marks the request auxiliary. A failed lookup
 keeps its read verdict and cannot make an unsent draft write unknown.
@@ -2767,7 +2662,7 @@ Sheets declares its seven API methods in `src/providers/sheets/api.ts`; its
 kit tools retain the private digest-bound cell cursor, legacy A1 path encoding,
 and create/append recovery advice. Its projections and the Google failure
 classifier read fields by the names Google gave them, which the kit's parse pass
-keeps. Its catalog and guide stay unchanged in step 1.
+keeps.
 
 Google's request adapter also offers a reviewed binary send. It marks the
 operation `googleBytes` for the product's `binaryBodies` selector and forwards
@@ -2801,10 +2696,8 @@ Every defect from a run probe or its hooks uses the generic withheld notice,
 even without a kit dispatch, because a private transport leaves no kit visibility
 evidence. An open operation probe retains its original defect.
 
-The REST bridge in `src/providers/_shared/rest/kit.ts` retains pinned index
-validation and legacy hatch schemas while the kit owns tool leases, fixed write
-capacity, transport, failures and result safety. It verifies schema equality
-before restoring legacy catalog key order. `indexedVendor` derives operation
+`src/providers/_shared/rest/kit.ts` owns the shared REST call shapes, pinned
+schema conversion and indexed vendor declarations. `indexedVendor` derives operation
 metadata from the index and builds the full manifest lazily; the typed client
 contains only named operations and probes. Bulk indexed declarations preserve
 the OpenAPI brace paths verbatim and carry explicit parameter Schemas. They
@@ -2828,7 +2721,7 @@ transport idempotency key. These hints describe behavior; write routing and
 endpoint restrictions still apply. For example, a tool that only creates a new
 note can declare `destructive:false` without promising idempotency.
 
-`restKitTools` may declare a `writeSteps` map whose values are `"once"`.
+Kit tools and the indexed hatch may declare a `writeSteps` map whose values are `"once"`.
 Construction freezes the map; every named step sends at most once and an
 undeclared step is refused before dispatch. Omitting it retains the single
 implicit write step. Auxiliary ownership reads in a write call retain that
@@ -2981,8 +2874,8 @@ result handling, reviewed value safety and the deployment privacy projection
 before paging or provider projections can read it. Read methods beyond GET
 and HEAD require a review. Construction fixes each write step's capacity;
 the guarded transport reserves it before preparation and the shared core
-decides the whole call's write outcome. Dedicated upload builders wait for
-the Google Drive migration in C.7.
+decides the whole call's write outcome. Drive uploads use write builders over
+reviewed raw-body sends.
 
 Reviewed path calls resolve their actual method and path through an indexed
 safety adapter; a provider-supplied template cannot bypass the policy.
@@ -3089,10 +2982,10 @@ same version to resolve a single copy. Connecta's own lockfile and packed
 install are checked for one copy (`test/package-surface.node.test.ts` and
 `scripts/check-package.mjs`).
 
-The stable `4.0.0` release was re-evaluated on 2026-10-01 with
-[`scripts/probes/effect-v4-evaluation.mjs`](https://github.com/zackbart/connecta/blob/main/scripts/probes/effect-v4-evaluation.mjs).
-Run `pnpm run build`, then `node scripts/probes/effect-v4-evaluation.mjs output.json`.
-The [raw observations](https://github.com/zackbart/connecta/blob/main/scripts/probes/effect-v4-evaluation-2026-10-01.json)
+The stable `4.0.0` release was re-evaluated on 2026-10-01 with this
+[historical probe source](https://github.com/zackbart/connecta/blob/1ab92695f2636f904274d900ce209553358ff1f3/scripts/probes/effect-v4-evaluation.mjs),
+retained in Git history rather than the current checkout.
+The [raw observations](https://github.com/zackbart/connecta/blob/1ab92695f2636f904274d900ce209553358ff1f3/scripts/probes/effect-v4-evaluation-2026-10-01.json)
 are synthetic Node requests and neutral esbuild bundles, not live-client or
 workerd lifetime verification. Bundle figures add representative prototypes
 alongside the current code; they do not claim savings from removing old code.
@@ -3101,7 +2994,7 @@ Two native input schemas with validation and JSON Schema rendering add 62,148
 bytes gzip to the root, taking it from 303,083 to 365,231 against a 339,526
 cap. Effect can reject excess properties when both decoding and rendering use
 `onExcessProperty: "error"`; its default strips them. The generated schemas
-still differ from the exact meta-tool goldens, including record rendering and
+still differ from the published meta-tool schemas, including record rendering and
 composed numeric bounds. A Schema replacement would need to preserve that
 contract and memoized rendering. Both MCP SDK packages still depend on Zod,
 so changing our inputs alone does not remove Zod from an installation.
@@ -3193,7 +3086,8 @@ compiling and configuring the real thing.
   rejections are observed; dispatch and lease guards still contain detached
   work. Per-await I/O cancellation remains useful for releasing resources,
   while prompt refusal is enforced at the boundary
-  (`test/promise-boundary-lifetime.test.ts`). Invocation owns
+  (`test/cancellation-faults.test.ts`, `test/operation-cancellation.test.ts`
+  and `test/cancellation-journey.node.test.ts`). Invocation owns
   the recovery and logical-call records it reads after teardown. Closing an
   outer call also revokes nested calls paused in preparation. Request-owned
   MCP sessions and token flights outlive individual calls and close with the
@@ -3286,8 +3180,9 @@ compiling and configuring the real thing.
   at construction) and the predicate matched, which the ledger records on the
   request. Only Stripe declares it (`src/providers/stripe/api.ts`, reviewed
   as a `manual` check in its `drift.json`): an API v1 answer carrying Stripe's
-  `Request-Id`. `test/provider-failure-sweep.test.ts` holds that list to the
-  sources. Q8 is decided in one place, `settleWrite` in
+  `Request-Id`. The real HTTP hostile-response journey checks this refusal
+  against an ambiguous committed write; there is no copied declaration list.
+  Q8 is decided in one place, `settleWrite` in
   `src/write-outcome.ts`, once per logical call and over every request it
   recorded. The invocation calls it for every failure of a served write: a
   thrown or mapped error, a custom connector's, a program's call, and its
@@ -3466,7 +3361,7 @@ compiling and configuring the real thing.
   (`keyProtectsLogicalCall`). Every resource request dispatched under the
   logical call, from any ledger, is recorded on it once per dispatch with
   its method and the genuine key it carried (`ProviderRequest.key`, set by
-  `callRest` only for a key fetch sends as given). The advice stands only when
+  the kit's guarded transport only for a key fetch sends as given). The advice stands only when
   exactly one boundary was entered, the invocation's object owns it as for
   `knownForLogicalCall`, that boundary tracks every request, and exactly one
   dispatched request was a write, carrying the named key; a request counts as
@@ -3511,10 +3406,10 @@ compiling and configuring the real thing.
   reconciliation even with an idempotency key; direct transport calls
   without a served verdict can still prove repeatability, but only with a
   genuine key sent to a vendor that honors it (Stripe today, through
-  `idempotencyHeader`): the REST write tool refuses an `idempotencyKey` that fetch
+  `hatch.idempotency`): the REST write tool refuses an `idempotencyKey` that fetch
   would send empty after trimming or would not send at all (CR, LF, NUL, any
   other control character but tab, DEL, or a code point past Latin-1), as
-  `invalid_args` before recovery is recorded, and `callRest` marks a request
+  `invalid_args` before recovery is recorded, and the guarded transport marks a request
   repeatable only for a key fetch sends as given.
   `providerCallFailure` (`src/write-outcome.ts`) is the one finalizer for a
   direct write's failure: the `api()` handler boundary, a guarded transport
@@ -3536,29 +3431,17 @@ compiling and configuring the real thing.
   `write_outcome_unknown`. The caller's own abort reason still passes by
   identity for a read and for a served call, whose timeout passes through
   unchanged for the invocation to report.
-  The catalog-driven `test/provider-failure-sweep.test.ts` checks every API
-  provider/tool on Node, fails on missing provider/tool examples or a
-  dispatched failure bypassing the helper, and covers served write/read
-  overrides with HTTP 503 for every tool and a connection reset after send
-  for each provider/verdict representative. HTTP 401 recovery uses those
-  representatives plus the distinct composite, auxiliary, owner-lookup and
-  POST-as-read paths; every provider's full golden failure matrix still runs.
-  Shared sender and real-socket evidence below own status/reset permutations.
-  Local metadata
-  tools prove zero sends; composite calls prove each distinct request leaves
-  once. The round-5 cases additionally cover Docs creation with initial text,
-  composite success followed by refusal, GitHub preflight failures, typed
-  handler errors after successful sends, Forms cursor conflicts after 200,
-  generic-code vendor refusals, auxiliary failures after resource dispatch,
-  redaction of refusal errors, and concurrent direct-call ledger isolation.
-  The round-6 cases cover a composite write's early refusal while siblings
-  await credentials or are in flight, requests started after the call ended,
-  connect-phase errnos with each body kind (all unknown for a write, and a
-  direct read stays retryable), a request aborted with a refusal-shaped
-  reason, an errno outside fetch's network error, and
-  undeclared handlers whose untracked send precedes a typed failure. Each
-  catalog case also checks that the ledger recorded every resource request
-  the network saw, and the inventory that every API connector declares it.
+  Shared provider outcomes and the real HTTP hostile-response journey check
+  returned data, failure/recovery, privacy and physical writes without a
+  catalog-wide status matrix. `test/provider-failure-sweep.test.ts` retains
+  fault probes for Docs creation with initial text, composite success followed
+  by refusal, GitHub preflight failures, typed handler errors after successful
+  sends, Forms cursor conflicts after 200, generic-code vendor refusals,
+  auxiliary failures after resource dispatch and concurrent direct-call isolation.
+  It also holds siblings awaiting credentials or already in flight when another
+  write fails, refuses requests after call closure, and probes network errors,
+  refusal-shaped abort reasons and untracked sends. Native transport and
+  request-lifetime suites retain their platform-specific evidence.
   `test/write-evidence.test.ts` uses real refused, reset, and held sockets on
   both runtimes: a refused write is unknown and a refused read retryable,
   including a write aborted with another fetch's real refusal as its reason
@@ -3831,7 +3714,7 @@ and workerd. `remote-mcp-native-bundle.node.test.ts` additionally loads an actua
 minified production bundle to verify call/cache registration, request Context,
 native storage, saved-original delegates, custom replacements and closed-owner
 refusal. Existing wire, physical-attempt, cache and OAuth lifetime suites remain
-the compatibility evidence; provider golden observations remain unchanged.
+the compatibility evidence.
 
 ### Native upward MCP orchestration (contributor)