@zackbart/connecta 0.37.1 → 0.39.0

package/documentation/architecture.md

@@ -31,9 +31,8 @@ implementation boundary. Use these sections for the affected subsystem.
 | Find code and deployment evidence       | [Source map](#where-else-to-look), [sharp edges](#sharp-edges), [repository policy](https://github.com/zackbart/connecta/blob/main/AGENTS.md) |
 
 Source paths and test names in each section identify its implementation and
-regression evidence. Recorded production probes and bundle measurements are
-historical observations tied to their stated date or version, not current
-benchmarks or proof that planned replacements have shipped.
+regression evidence. Decision records preserve historical measurements; current
+contracts and executable evidence describe the implementation.
 
 ## The two lifetimes
 
@@ -48,7 +47,8 @@ as the isolate — on Workers a lazy module-scope singleton, which is why both
 deployment shapes construct it outside the request handler.
 
 An OAuth connector, `remoteMcp()` or `api()` with a static grant, owns a
-runtime-local refresh completion gate in `src/auth/downstream-oauth.ts`.
+runtime-local refresh completion gate in
+`src/auth/downstream-oauth/refresh-coordinator.ts`.
 Joined scopes share the outcome while keeping their own request I/O and
 cancellation. Grant use and the caller's wait belong to the call. Renewal
 preparation is call-owned only until the first durable coordinator write
@@ -100,6 +100,18 @@ never retried and requires re-consent. Valid rotations retry their grant commit
 up to 32 times without another HTTP request; exhausted commits and all dispatched
 provider failures require re-consent. [Auth](./auth.md#refresh-failures) describes the lease and failure
 contracts.
+The grant body stores `expiresAt` beside the tokens it describes; reads never
+add it (INV-10). A call renews a token within `OAUTH_REFRESH_SKEW_MS` (60 s)
+of it before sending: the invocation's authorization check (`registerInvocationAuth`
+in `src/connectors/remote-mcp.ts` and `src/connectors/api-connector.ts`) runs
+the 401 flow before entering the connector, so a failed renewal is a
+pre-dispatch authorization failure, never an unknown write (INV-9).
+`KvOAuthProvider.renewalDue` decides from the grant read that check already
+made, in memory. The token request carries the access token it replaces
+(`earlyRenewalFetch`), and the coordinator adopts any stored token that differs
+instead of redeeming again. Status, listing, discovery and the connectionless
+catalog read never renew. [Auth](./auth.md#refreshing-before-expiry) has the
+operator contract.
 
 **Per request, and no longer.** The MCP server, its transport, downstream MCP
 clients, abort signals, and the connector scope a probe opens all belong to the
@@ -108,7 +120,10 @@ across requests on Workers is a cross-request capability leak, and a promise awa
 work the runtime may already have torn down. Deferred work has one sanctioned
 channel, `ctx.waitUntil`, threaded through `fetch(request, env, ctx)` — activity
 writes and OAuth renewals from claim submission use it. Catalog listing and SQL cache
-publication finish in the requesting scope. A fresh
+publication finish in the requesting scope. The operator surface's Promise
+edge (`ui.handle`) owns the request's signal and is awaited to its end even
+when the caller leaves, so a storage write it has started, such as a stored
+status observation, settles before the request does. A fresh
 `McpServer` per request is what makes the deployment stateless: no sessions, no
 server push, no stream resumability, scope resolved rather than remembered.
 
@@ -226,7 +241,7 @@ An admitted non-preflight `/mcp` request then takes five steps in
    ([#178](https://github.com/zackbart/connecta/issues/178)) but their URLs were
    handed out, and retiring a scoping boundary into fail-open is worse than any
    404 — then register the six meta-tools on a fresh `McpServer`
-   (`test/server.test.ts`, `test/code-first-surface.test.ts`).
+   (`test/server.test.ts`).
 
 ### Modern request metadata and transport refusals
 
@@ -443,139 +458,24 @@ Only an omitted or `undefined` `callAdmission` selects a connector's default.
 The shared schema rejects malformed defined policies at factory construction,
 and the registry validates custom connector policies before registration.
 Falsy values such as `false`, `null`, `0`, and `""` are construction errors
-(INV-11), never a way to disable admission. The generated provider fixtures
-exercise these refusals and unchanged defaults in
-`test/call-admission-options.test.ts`.
+(INV-11), never a way to disable admission.
 
 ### Production Worker disconnects
 
-The original production probe for [#573](https://github.com/zackbart/connecta/issues/573)
-ran on 2026-09-25 with compatibility date `2025-01-01`, first with no flags and
-then with `enable_request_signal`. It used Wrangler 4.114.0 and a Node 26.9.0
-client. A raw Worker stream established the runtime behavior; a custom auth
-provider returning a synthetic streaming 401 exercised Connecta's real admission
-wrapper. Each case had its own Connecta instance with one request permit and no
-queue. Health checks and subsequent MCP requests confirmed the same isolate ID.
-The [recorded observations](https://github.com/zackbart/connecta/blob/1ab92695f2636f904274d900ce209553358ff1f3/scripts/probes/worker-disconnect-2026-09-25.json)
-contain all twelve cases, including served flags and client-end timing.
-
-| Response and flag                                     | Raw stream abort / cancel | Connecta source abort / cancel | Admission after response; next request |
-| ----------------------------------------------------- | ------------------------- | ------------------------------ | -------------------------------------- |
-| Heartbeats, no flag                                   | neither                   | neither                        | active 1; 503                          |
-| Idle with a pending timer, no flag                    | neither                   | neither                        | active 1; 503                          |
-| Heartbeats, request signal enabled                    | abort only                | both                           | active 0; 200                          |
-| Idle with a pending timer, request signal enabled     | abort only                | both                           | active 0; 200                          |
-| One chunk, then no timer or I/O, either configuration | neither                   | neither                        | active 1; 503                          |
-
-The last row is a different failure. The client observed the response end
-_before_ its planned disconnect, although the source never closed itself.
-The runtime ended the response without running JavaScript cleanup. This does
-not show a missing abort on a still-live request. The other cases remained open
-until the client aborted. Admission was sampled 1.5 seconds later, followed by
-an actual MCP request; this measures retained capacity, not an infinite leak.
-
-Enable `enable_request_signal` when deploying on Workers: it let Connecta's
-abort listener cancel the source and release admission for live responses in
-this experiment. It does not solve runtime-ended streams. The admitted-request
-bound above recovers capacity on the first later request at or after its
+Enable `enable_request_signal` when deploying on Workers so Connecta can cancel
+the source and release admission for live responses. It does not solve
+runtime-ended streams. The admitted-request bound above recovers capacity on the first later request at or after its
 deadline, even if the old request's timer never ran. This is capacity recovery,
 not proof that workerd cancelled an old stream. A still-live request reaches
 the same hard deadline and is aborted in its own context.
 Cloudflare documents the flag in its
 [Request API](https://developers.cloudflare.com/workers/runtime-apis/request/).
 
-### Authentication release by collection on workerd
-
-Measured on 2026-10-20 with workerd 1.20260722.1 (Miniflare 4.20260722.0),
-compatibility date `2025-01-01`:
-
-- `FinalizationRegistry` and `WeakRef` are undefined without
-  `enable_weak_ref`; the flag's default-on date is 2025-05-05.
-- With `enable_weak_ref` and `enable_request_signal`, an object reachable only
-  through a fetch continuation is finalized once its invocation ends and
-  workerd cancels the fetch; while the invocation runs it is not. Pending
-  timers and listeners on the request's signal do not keep it.
-- Strong values in a WeakMap keyed by a `Request` (even one the handler
-  created), properties set on a `Request`, and WeakMap values keyed by its
-  `Headers`, `ctx` or `env` stay reachable after the invocation ends. The
-  lifetime registry in `src/auth-admission.ts` therefore stores `WeakRef`s.
-- No `gc()` is exposed. Allocating large arrays (32 × 1 MiB per request)
-  triggers collections, but the most recent unreachable object often survives
-  them; V8 in this build scans the native stack conservatively. The inspector's
-  precise `HeapProfiler.collectGarbage` freed it.
-- In the vitest-pool-workers harness, an isolate that had already collected
-  one scenario's cancelled work sometimes kept a later scenario's cancelled
-  work reachable through 400 rounds of pressure; standalone Miniflare never
-  did. `test/auth-admission-binding.test.ts` gives each collection scenario a
-  fresh isolate and requires two of four sentinels collected before asserting
-  that live charges stayed counted.
-
-A second production run on the same date tested the request bound at 2,000 ms.
-All twelve raw-stream and MCP cases passed with both flag configurations. Live
-MCP requests still rejected a competing request with 503 before the deadline;
-the first MCP request after the deadline returned all eight tools with 200 in
-the original isolate. Admission then reported zero active requests. Without the
-flag, the source still recorded no abort or cancellation, so recovery did not
-rely on runtime cleanup. The [recovery observations](https://github.com/zackbart/connecta/blob/1ab92695f2636f904274d900ce209553358ff1f3/scripts/probes/worker-disconnect-recovered-2026-09-25.json)
-also retain two inconclusive queue-handoff cases: concurrent client connections
-reached different isolates and could not establish an abandoned queued waiter.
-A [second trial using HTTP/2](https://github.com/zackbart/connecta/blob/1ab92695f2636f904274d900ce209553358ff1f3/scripts/probes/worker-disconnect-h2-2026-09-25.json)
-repeated the twelve passing core cases and verified queued cancellation with
-request signals enabled. Even on one HTTP/2 connection, the no-signal queue case
-crossed isolates and remained inconclusive. The Node and workerd regression
-suites cover expired waiters, orphaned handoffs, and identity-safe late release
-deterministically.
-
-The [historical probe source](https://github.com/zackbart/connecta/blob/1ab92695f2636f904274d900ce209553358ff1f3/scripts/probes/worker-disconnect.mjs)
-and observations are retained in Git history, outside the current checkout and
-npm package. The probe deployed a disposable Worker containing only synthetic
-data, verified the served configuration, saved observations, and deleted the
-Worker in `finally`. It used no `waitUntil`, which would change the lifetime
-being measured. The production runtime build number was not exposed by the
-deployment; these findings are tied to the date and flags above.
-
 ### Production Access bypass for agent endpoints
 
-P0 of [#837](https://github.com/zackbart/connecta/issues/837) asked whether
-`/agent/*` can skip a Worker-level Cloudflare Access application, so an agent
-sends only its `cta_` token, while every other path keeps Access and
-`ctx.access`. It can. The probe ran on 2026-10-15 against a disposable Worker on
-its `workers.dev` hostname, with compatibility date `2026-09-01`, `cf`
-1.0.0-beta.14, Wrangler 4.114.0, and curl 8.7.1 with `--path-as-is`, so raw
-paths reached the edge unnormalized. The Worker-level application allowed only
-a probe service token. Its unauthenticated refusal was therefore Access's 403
-page rather than a login redirect. The [observations](https://github.com/zackbart/connecta/blob/main/scripts/probes/access-agent-bypass-2026-10-15.json)
-record three identical rounds after each configuration change had produced
-three consecutive matching responses.
-
-- **Precedence.** A self-hosted application whose destination is
-  `{ "type": "public", "uri": "<host>/agent/*" }`, with one `bypass` policy
-  including `everyone`, overrides the Worker-level application on matching
-  paths only. Unauthenticated requests reach the Worker there. `/mcp`, `/`,
-  and every unmatched path still get the Access refusal. A service token is
-  still admitted on them with `ctx.access` from the Worker-level application.
-  This confirms Cloudflare's documented hierarchy, and that Worker-level
-  protection still covers the `workers.dev` hostname.
-- **`ctx.access` on a bypassed request is present, not absent.** Its `aud` is
-  nonempty and is the _path_ application's AUD, not the Worker-level one.
-  `getIdentity()` resolved to `undefined` for every credential tested: none, a
-  valid service token, a `cta_`-style bearer token, and a forged
-  `Cf-Access-Jwt-Assertion`. A service token on a protected path also gave
-  `undefined` identity, carrying the Worker-level AUD. A human
-  `CF_Authorization` cookie on a bypassed path was not tested, so what
-  `getIdentity()` returns there is unknown. That is one more reason the agent
-  route ignores Access context rather than relying on its contents.
-- **API shape.** A Worker destination is exclusive to one application. A
-  second application with `{ "type": "worker", "worker_id" }` plus `uri` or
-  `path` was refused with 409 `destination belongs to another application`. The
-  bypass must be hostname-and-path, stored with domain `<host>/agent/*`, and it
-  covers only that exact hostname.
-- **Propagation.** Creating or deleting each application took 15–19 seconds to
-  settle across runs. While a deployment or application change was propagating,
-  the edge returned transient 500 (`error code: 1104`) and 404 (`error code:
-  1042` or `1043`) responses. The recorded run has one such 404, on the
-  Worker-level-only service-token control for `/agent/x`. Deleting the path
-  application restored the 403 on `/agent/x`.
+Access uses a hostname-and-path bypass application for `/agent/*`; the
+Worker-level application protects other paths. A bypassed request can still
+carry `ctx.access`, so agent routes ignore that context.
 
 | Raw request path           | Access outcome | Worker pathname (+ search) |
 | -------------------------- | -------------- | -------------------------- |
@@ -607,139 +507,32 @@ leading `//`, and treats `%2f` as data, not a separator. The effective Worker
 pathname, `new URL(request.url).pathname`, is the raw request path with case,
 escapes, and slashes untouched, except that dot segments arrive resolved:
 `/mcp/../agent/x` arrives as `/agent/x`. Every path that
-resolves outside `/agent/*`, including every `/mcp` form, stayed protected. The
+resolves outside `/agent/*`, including every `/mcp` form, remains protected. The
 inverse is the risk: Access bypasses paths
 that connecta must not treat as an agent pool. Connecta's router compares raw
 pathnames without decoding, case folding, or slash collapsing, so an `/agent/`
-route must keep that property. It should accept exactly
-`/agent/<pool>`, with `<pool>` byte-equal to a declared pool name. It should
-refuse an empty segment, a trailing slash, any extra segment, `%`, uppercase
-variants, and a leading `//`, all with the same 404. It must ignore
+route keeps that property. It accepts exactly
+`/agent/<pool>`, with `<pool>` byte-equal to a declared pool name. It refuses
+an empty segment, a trailing slash, any extra segment, `%`, uppercase
+variants, and a leading `//`, all with the same 404. It ignores
 `ctx.access` entirely, since a bypassed request still carries an AUD.
 [Agent endpoints](./auth.md#agent-endpoints) implement exactly this in
 `src/routes/agent-path.ts`, and `test/agent-endpoints.test.ts` replays every
 row of the table above. The hyphenated row stands for any two-part pool name
-such as `<agent>-<user>`. The pool names in the recorded paths were replaced
-with placeholders after the run; the edge behavior for that path shape was
-unaffected.
-
-To configure the bypass, keep the Worker-level application described in
-[Cloudflare Access on Workers](./auth.md#cloudflare-access-on-workers). Then,
-for each hostname agents use (the `workers.dev` hostname, each Custom Domain,
-or route host), add a self-hosted Access application. In the dashboard, set
-domain to that hostname and path to `agent/*`, with one policy whose action is
-**Bypass** and whose include rule is **Everyone**. Through the API, that is:
-
-```json
-{
-  "type": "self_hosted",
-  "name": "connecta agents",
-  "destinations": [{ "type": "public", "uri": "connecta.example.com/agent/*" }],
-  "policies": [{ "name": "agents bypass", "decision": "bypass", "include": [{ "everyone": {} }] }]
-}
-```
+such as `<agent>-<user>`.
 
-Only the `workers.dev` hostname was probed. A Custom Domain application is the
-same documented hostname-and-path form, but it was not observed here. Do not
-rely on a fixed wait after a change. Changes settled in 15–19 seconds, yet one
-earlier round still saw a 403 on a bypassed path more than 30 seconds after
-the change. Test only after the positive and negative controls agree together
-for several consecutive rounds. The positive controls are bypassed paths
-reaching the Worker with the path AUD and a service token reaching a protected
-path with the Worker-level AUD; the negative controls are `/mcp` and `/`
-returning the Access refusal. The current script requires five such rounds
-after creating the bypass and three after other changes. The recorded run
-predates this: after the bypass it converged only the positive `/agent/x`
-control, then waited a fixed 90 seconds, and its negative controls were checked
-in the recorded rounds rather than before them.
-
-To repeat from a repository checkout, run
-`node scripts/probes/access-agent-bypass.mjs --profile <name> [output.json]`.
-`--profile` is required and has no default; every `cf` call passes it
-explicitly. Name the profile for the account that should host the probe; it
-needs
-Access application, policy, and service-token writes, plus Workers script
-writes. The script deploys and deletes the Worker with `cf`. `cf deploy` builds
-through Wrangler 4.136.0 or newer, so the probe installs Wrangler 4.145.0 into
-its temporary project. Wrangler needs no login. The script records only the
-count of existing Access applications, then names everything it creates
-`connecta-probe-<run>`. It force-deletes and verifies each resource in
-`finally`, then checks that the non-probe application ids are unchanged.
-Observations record statuses, outcome classes, pathnames, and which
-application's AUD matched, compared by digest inside the Worker. They contain no
-hostnames, account ids, tokens, cookies, or JWTs. `cf` delete commands prompt
-for confirmation and exit 0 without deleting when stdin is not a terminal, so
-the script passes `--force`. `cf deploy` printed `Deploy complete` and then
-kept running, so the script stops it after that line. The recorded run deployed
-with Wrangler 4.114.0 and used `cf` for Access. A standalone deploy and delete
-verified the `cf` deploy and delete path. The full probe has not been rerun on
-that path.
-
-Every subprocess (`cf`, `curl`, `npm`) runs through one runner. It enforces a
-deadline by killing the process group, keeps stdout and stderr in memory, and
-returns only facts: success, exit code, timeout, HTTP status, numeric API
-code, and an error slug from a fixed set (anything else is `unknown`). Commands
-that return data are parsed inside the runner against schemas that copy only
-whitelisted fields: ids, names, counts, booleans, and the Worker's `ctx.access`
-summary. Credentials stay in a holder that prints as `[secret]`. An unexpected
-shape, including `null` where a list belongs, is a failure, never an empty
-result. Errors are fixed diagnostics plus those facts. Teardown deletes every
-tracked id on its own. Then Access applications, service tokens, and Workers
-each get their own bounded discovery-and-delete pass by name, for resources
-whose create response was lost, so a failure in one family never skips
-another. Each discovered resource is deleted independently. Access policies are
-inline on their applications and go with them. A resource counts as gone only
-when a successful lookup omits it, and the final inventory verifies each family
-separately. Run
-`node scripts/probes/access-agent-bypass.mjs --self-test` to check the runner
-offline. It feeds canary secrets, suffixed slugs, malformed JSON, and a stalled
-process tree through it. It also runs teardown against a fake `cf` whose
-application listing always fails, after a lost token-create response, and
-checks that the token is still found and deleted. It also checks that a Worker
-that refuses deletion does not block another Worker's deletion. It runs no real
-`cf`, `curl`, or network command. This
-hardening and the joint convergence are verified offline only and have not run
-against Cloudflare.
+For the operator procedure and Access application JSON, see
+[Agent endpoints behind Cloudflare Access](./deploying.md#agent-endpoints-behind-cloudflare-access).
 
 ### Alchemy Worker deployment
 
-Two throwaway deployments on 2026-10-20 verified the Worker example's
-Alchemy path with alchemy 2.0.0-beta.83, effect 4.0.5, and Alchemy local
-state, then deleted every resource and confirmed by re-listing. Alchemy
-uploads the full Worker with `PUT /workers/scripts/<name>`, the endpoint an
-earlier full deploy had been suspected of losing `ctx.access` through.
-
-The first deployment ran a near copy of the stack with a temporary diagnostic
-route. With an Access service token in a non-identity policy, the Worker saw
-`ctx.access` carrying the Worker-level application's AUD and no identity, as
-expected for a service token. D1, the Worker Loader, R2, and secret bindings
-worked; `/agent/*` reached connecta through the bypass; `/ui/api/config`
-returned 403 `Cloudflare Access human identity required`; and
-`connecta doctor` passed with a `cta_` token issued inside the Worker. A code
-update through `alchemy deploy` kept the script tag, `ctx.access`, and D1 rows.
-Three consecutive probe rounds agreed.
-
-The second deployment ran the shipped `alchemy.run.ts` from the packed package
-in a separate project on Node 26, changing only resource names and the Access policy
-(a service token). The edge checks in the example's "Verify after deploying"
-held for three or more rounds after each deploy. `alchemy destroy` deleted the
-Worker and both Access applications and orphaned the retained D1 database; the
-next deploy adopted it by name with its rows. After deleting local state, a
-deploy reused the Worker with the same script tag, and `applicationId` took
-both Access applications over with unchanged AUDs and no duplicates. Removing
-`applicationId` afterwards planned an in-place update, and a further deploy
-planned no changes. The account API token needed only Workers Scripts Write,
-D1 Write, Access: Apps and Policies Write, and Access: Organizations, Identity
-Providers, and Groups Read.
-
 Four findings shape the operator rules. Alchemy local state under
 `.alchemy/state/` records secret binding values in plaintext. Alchemy sends no
 `keep_bindings`, so each deploy deletes secrets set outside the stack.
 `alchemy dev` does not provide `ctx.access` to a plain fetch Worker, so local
 development stays on `wrangler dev` and its `access.dev` identity. D1 needs
 `RemovalPolicy.retain()` so `alchemy destroy` cannot delete a deployment's
-state. Not verified: `Cloudflare.state()` remote state, custom domains, and
-taking over a Worker first deployed with Wrangler.
+state.
 
 npm strips `.gitignore` from the package, so the copied Worker example's
 ignore rules ship as `examples/worker/gitignore`, renamed by the README's copy
@@ -760,15 +553,8 @@ activity table beside it. `src/storage/sql.ts` owns the Promise edges.
 Each store creates its tables on first use. `memoryStorage()` is the default
 and the test double. Workers KV and the 0.28 JSON file store are gone: KV is
 eventually consistent and cannot compare-and-set, and the file store rewrote
-its whole file on every write. Each has a one-shot copy into its replacement,
-`copyKvToD1` on `/d1` and `connecta migrate-state` on Node. Both copy live
-entries verbatim, because physical keys did not change, and both keep any key
-the target already holds. `copyKvToD1` reports counts per key family
-(`familyOfKey` in `src/storage/keys.ts`), never a key. It resumes through a
-source-bound, atomically claimed token, because Workers KV's own list cursor
-can spell a key. Copy under maintenance after KV stabilizes, verify hashes
-and expiries, and mark cutover before reopening traffic; the permanent D1
-marker refuses stale copies afterward.
+its whole file on every write. Their one-shot copies were removed; deployments with old state must finish
+conversion on 0.37.1 before upgrading. See [Retired layout migrations](./migration-retired-layouts.md).
 
 `KVStorage` is `get`/`set`/`delete`/`list(prefix)`/`compareAndSet`, all
 required, and `createConnecta` refuses storage missing one (INV-11).
@@ -808,12 +594,10 @@ Keys and list prefixes must not contain U+0000 (NUL). D1, SQLite, and memory
 storage reject them with `TypeError` before accessing storage: Node 22's
 `node:sqlite` truncates TEXT results at NUL. Builders reject NUL in unencoded
 components.
-State-file import validates all keys before writing. The `connecta_kv` table
-keeps its existing TEXT keys, including compatibility with the 0.28 schema.
-Storage writes no log lines. A refused import names the file and an entry's
-position, never a key, a value, or the JSON parser's account, which quotes
-the file (INV-6). Database failures report only a fixed import step and an
-entry's position, including errors raised by target-database triggers.
+The `connecta_kv` table keeps its existing TEXT keys, including compatibility
+with the 0.28 schema. Storage writes no log lines. JSON state-file import is
+retired; deployments needing it must use the 0.37.1 bridge release before
+upgrading. See [Retired layout migrations](./migration-retired-layouts.md).
 
 Remote MCP catalogs use the SDK `ResponseCacheStore` over this same SQL KV.
 The `response-cache:v1:` family binds connector id, a hash of its configured
@@ -835,6 +619,142 @@ Only complete, intake-redacted tools/list, resources/list and
 resources/templates/list successes are stored. Resource payloads are not cached. SDK default
 in-memory caching is replaced, so raw catalogs never enter it.
 
+Stored catalog and negotiation keys use deployment-keyed partitions. A remote
+connector's whole cache configuration and negotiation input enter a stored key
+only through HMAC-SHA-256 (`src/storage-digest.ts`) under a key that never
+enters storage: every configured URL in full (the endpoint, a client metadata
+document, a static client's issuer and the redirect URI), static auth header
+values, resource headers, and a static OAuth client's secret. The
+operator-managed or request-resolved credential (joined with the forwarded
+principal), a custom connector's credential values, and the OAuth token
+response that fences a listing are keyed the same way. The key is the vault's
+`storageDigestKey()`, which `encryptedCredentialVault()` derives with HKDF from
+its credential key. Without a vault, or with a custom vault that lacks the
+method, a random key held only in the process is used: the partitions stay
+exact, but another process or isolate addresses different entries and fills
+its own cache, so cross-isolate reuse of remote catalogs, verdicts and health
+records needs a vault. A different URL, header, credential, token response or
+epoch addresses a different entry at once, including a value changed by
+redeploy, and an earlier entry is never served under the new value; rotating
+back to an earlier value within its TTL finds its entries again. A new
+deployment key addresses new entries. Entries written by earlier releases are
+not read and expire on their own TTLs (catalogs within `catalogMaxTtlSeconds`,
+refresh baselines within 48 hours, verdicts within six hours), so each remote
+connector's partitions refill once after the upgrade with one handshake and
+listing.
+
+A remote connector's `listTools` without a live connection in its request
+reads this cache before connecting. It derives the same partition a connect
+binds (the admitted principal, the caller's credential digest, or the owner's
+OAuth epoch and token digest) from storage reads only, then makes the SDK's
+two-probe read with the pre-connect empty server identity: the private slot,
+then a shared connector's public slot, served only when written public. OAuth
+grants are read by a non-mutating snapshot: no plaintext grant is sealed in
+place, no epoch is bound, nothing is refreshed. Every identity check during
+cache acceptance reads the grant again and refuses the entry unless the epoch
+its partition was derived from and the token digest both still hold. A missing
+or expired generation is a miss at every check and is never claimed or
+recreated. An unexpired complete entry is returned with no transport,
+handshake, session cleanup or storage write. A miss, an expired entry, an
+explicit `ttlMs: 0`, an invalidated generation, a credential, token or epoch
+change, an operator-disconnected or token-less grant, a cache read failure,
+and a downstream whose stored negotiation verdict is modern all connect as
+before. Modern downstreams connect without a handshake and read the cache
+through the SDK. The connect reuses the credential and negotiation verdict that
+read resolved. `list_changed` arrives only over a live connection, so an
+unconnected catalog changes at its TTL or on invalidation.
+
+A catalog served from this cache, before or after connecting, does not
+validate downstream credential health. An expired or vendor-revoked credential
+can still expose cached tools, and discovery reports no auth-related
+`catalogErrors` entry for it until the cache misses. Tool calls and resource
+reads reach the downstream and report auth failures with their handoffs. A
+status probe connects: a legacy downstream answers a handshake, while a modern
+downstream with a stored verdict connects without a request. A credential test
+always sends a live `tools/list` that bypasses the cache in both directions.
+
+In `"auto"` mode a remote connector stores its negotiation verdict, data only,
+in the `negotiation` key family, partitioned by connector configuration,
+credential and OAuth epoch, with secret-bearing inputs keyed as above. A later connect reuses it instead of probing with
+`server/discover`. A modern verdict lasts five minutes. A legacy verdict lasts
+six hours, because a server that adds the modern era still answers the legacy
+handshake. Two signals end a verdict early:
+
+- A legacy-verdict handshake refused with a 4xx other than 401, 403 or 429 (a
+  modern-only server answers 400 with its supported versions) is negotiated
+  again at once in the same connect. The new verdict replaces the old.
+- On a modern connection (adopted from the verdict or just negotiated), an
+  HTTP 400 is read through a bounded clone of its body, as the transport's
+  backward-compatibility rule requires. A modern server also answers 400 with
+  `HeaderMismatch` (-32020) and `MissingRequiredClientCapability` (-32021),
+  which concern the request alone and keep the verdict and the connection.
+  `UnsupportedProtocolVersion` (-32022) keeps them only while its
+  `data.supported` list (at most 64 strings) still names the request's
+  `MCP-Protocol-Version`; a missing, malformed or other list makes the verdict
+  unusable. Any other body, empty or not a recognized modern error (a legacy
+  server's sessionless refusal, a gateway's page), is a legacy refusal. Either
+  way the verdict is deleted and that client retired. The refused request
+  fails and is never repeated. The next connect, in the same request or a
+  later one, probes again. The clone read ends with the call, the request or
+  the connection scope: an abort cancels it, cancels the unread original and
+  takes no evidence (INV-7).
+
+An upgrade to a server that still answers the legacy handshake is therefore
+adopted within six hours. Losing the legacy handshake costs one refused
+request, and a downgrade costs the one request that met the refusal.
+
+**Discovery health.** An unscoped search (`search_tools` or `connecta.search`
+without `connector`) probes each connector for at most 5,000 ms, or
+`discovery.probeTimeoutMs` when that is shorter, and its probes end within a
+9,000 ms discovery budget. A tenth of the budget, at most 500 ms, is kept for
+recording outcomes: a probe that starts late gets only what remains before
+that slice, and one that cannot start reports `timeout`. Health reads, claims
+and writes start only while budget remains and the caller is still waiting;
+health is otherwise unknown. Once started, each is awaited to its end before
+the search returns, never raced or detached, since a storage write cannot be
+withdrawn once sent. The budget bounds when health work starts, not when it
+finishes, so slow storage can carry a search past it by one operation's
+latency. A scoped search,
+`connecta.describe`, native `tools/list` and tool calls keep the full
+`discovery.probeTimeoutMs`. A probe that times out on its own deadline, or a
+retryable failure that itself took at least one second or named its own wait,
+writes a record in the `connector-health:v1:` family: the connecta
+classification code, observation time, retry time (60 seconds later, or the
+downstream's shorter named wait, at least one second), and the connector's
+catalog invalidation generation. Each probe's time is its own, measured as it
+settles. Records hold no downstream text, tools, arguments or credentials.
+Each is keyed by connector id and the deployment-keyed digest (as for the
+catalog cache above) of the catalog owner partition (principal, subject,
+caller identity and pool, origin and public URL), the admitted endpoint (plain
+`/mcp`, `/mcp/<pool>` or `/agent/<pool>`), the connector's described
+configuration, whose endpoint keeps its path, and the package version. One owner's
+or endpoint's record never skips another's search. A change `describe()`
+cannot see, such as a static header rotated in deployment code, takes effect
+on redeploy; a record written before it keeps skipping for at most its retry
+time, about 60 seconds. Until its retry time an unscoped search skips that connector
+and reports it in `catalogErrors` with the recorded code, `retryable: true`,
+`retryAfterMs`, and a fixed message that names the scoped search to try it
+now; no tools from the failed walk are ever served. A scoped search still
+probes and settles the record. A record whose generation no longer matches
+lapses, so a vault credential change, OAuth connect or disconnect, or operator
+invalidation clears every partition at once. A success, or an auth or
+permission failure that shows the connector answers, clears the record this
+request saw. Caller cancellation, a probe the budget cut short, a fast
+failure, and a non-retryable failure record nothing. After its retry time a
+record lingers for 60 seconds: the request that dispatches the next probe
+claims it by compare-and-set, with a lease to an absolute time, the end of
+that request's discovery budget plus two seconds, so a slow claim write cannot
+shorten it; the others keep skipping until it settles or the lease lapses. Health reads are one `getMany` per unscoped search, made
+once per request; a health storage failure is logged and never fails
+discovery.
+
+A healthy connector whose complete catalog always takes longer than 5 seconds
+to list can therefore stay out of unscoped discovery: each unscoped probe
+times out and records it. A scoped search, or any operation with the longer
+`discovery.probeTimeoutMs` deadline that completes the listing (describe, a
+tool call), warms a reusable complete catalog that later unscoped searches
+read without the slow listing, and a success clears the record.
+
 `discovery.catalogTtlSeconds` (300 by default) is the fallback for legacy
 listings without `ttlMs`. Positive hints are bounded by
 `catalogMinTtlSeconds` (0) and `catalogMaxTtlSeconds` (86400, also the SDK
@@ -885,7 +805,15 @@ activity write. The first complete catalog is a baseline.
 Hash-only baselines publish bounded chunks before a manifest. They store the
 catalog digest and hashes of each tool name and fact, so added, removed and changed counts require no persisted tool names or
 schemas. They use the exact host auth/config cache partition, survive catalog
-expiry and invalidation, and expire after 48 hours. There is no connection-wide
+expiry and invalidation, and expire 48 hours after they are written. A refresh
+reads the manifest first. When its digest matches a baseline written within the
+last hour, the refresh writes nothing; an older matching baseline is rewritten
+with fresh chunks, so every refresh leaves a baseline for at least 47 hours.
+A manifest's lifetime is never extended without new chunks, so its chunks
+always outlive it. A changed digest writes the new baseline and reports drift
+against the previous one. An unchanged zero-TTL listing therefore writes no
+baseline; it still lists live every time and deletes its cache slots, since a
+concurrent request may have published an older reusable catalog there. There is no connection-wide
 fallback baseline across partitions. Private catalog events use the admitted
 principal actor basis even for shared-auth connectors; activity disclosure
 requires that same owner and the recorded pool's grants. Ownerless private
@@ -1283,9 +1211,8 @@ parse as text, so connecta reads downstream bodies as bytes
 (`src/byte-read-response.ts`), `ctx.oauth.fetch()` answers included. The
 operator page may show catalog metadata the operator loaded (descriptions,
 schemas), but withholds a tool name outside the grammar as it does in records.
-`test/operator-record-sources.node.test.ts` is a secondary lint over every other
-log call in `src/`. Fix the sink, not the source: a filter at each source missed
-the next one. Recorded HTTP status facts survive the bare write-401 fallback,
+Fix the sink, not the source: a filter at each source missed the next one.
+Recorded HTTP status facts survive the bare write-401 fallback,
 Google's uncertain-write wording, and oversized-response mapping; see
 [Read failure records](./operating.md#read-failure-records) for their operator
 meaning. These facts do not change agent error fields or write outcomes.
@@ -1361,7 +1288,11 @@ switched by the environment, and keep their entries under 30 lines.
 A maintained provider is one `defineProvider()` call (`src/provider.ts`): a
 name, title, `kind: "api"`, maintained skill, closed `options` shape and a
 synchronous `create`. Common values are checked before construction and the
-factory stamps its provider name onto `describe().source.provider`. API
+factory stamps its provider name onto `describe().source.provider`. The kit's
+`defineApiProvider` also takes optional `searchSynonyms` groups (single
+lowercase words, at most 32 groups of 2–8), checks them at definition and
+attaches them to each connector for
+[lexical discovery](./meta-tools.md#lexical-discovery). API
 implementations and their contract evidence remain vendored. Hosted MCP servers
 use generic `remoteMcp()` entries; provider reviews and hosted defaults are
 removed. Legacy hosted selectors fail at construction with the generic migration
@@ -1456,9 +1387,7 @@ acknowledgement, then reconciles vendor state with exactly one physical send.
 Focused provider suites retain MIME/draft restrictions, revision conflicts,
 CCB routing, Planning Center product exclusions and deployment pins. Native
 HTTP framing, cursor and request-lifetime fault probes remain in the HTTP suites.
-The catalog-wide status sweep and its argument roster, catalog/ranking copies
-and unused paging strategy tests are retired under #1072. Provider workflows
-belong in the existing shared outcomes; a new tool requires no failure-matrix row.
+Provider workflows belong in the existing shared outcomes.
 No legacy REST tool adapter remains.
 Large documents opt into generator options that drop restated operation ids
 and plain path parameters and cap one operation's details (`opBudget`).
@@ -1732,8 +1661,7 @@ path, or fields a schema leaves undeclared; such paths still apply at
 runtime).
 
 `test/fixtures/value-safety.ts` is the shared harness each vendor's
-`provider.safety.node.test.ts` runs; `reviewProblems` is pure, and
-`test/value-safety-harness.node.test.ts` proves wrong paths fail it. It fails
+`provider.safety.node.test.ts` runs; `reviewProblems` is pure. It fails
 on candidates from another pin, format, or option set; an unreviewed
 candidate; a verdict for an operation the index lacks; a table path the stamp
 lacks (unresolved, or edited since `providers:spec`); a flagged field no path,
@@ -1761,12 +1689,6 @@ and reports only added, removed and changed counts in the caller's partition.
 
 #### Behavioral evidence (contributor)
 
-The characterization snapshot engine, provider JSON snapshots, source scheduler
-and its self-tests are retired under
-[#1072](https://github.com/zackbart/connecta/issues/1072). Provider changes no
-longer require golden enrollment, snapshot updates, byte equivalence or nightly
-capture determinism. Production invariants remain unchanged.
-
 Use the existing stateful fixture vendors and published-edge deployment adapters:
 
 - `pnpm run eval:outcomes` drives representative joins, retained paging, endpoint
@@ -1785,7 +1707,10 @@ Use the existing stateful fixture vendors and published-edge deployment adapters
   Node/SQLite/QuickJS and native Workers/D1. It covers transcript-too-large
   recovery, empty intermediate pages, selected fields, withheld photo/credential
   values and shared-vault reuse after application reconstruction. No-op,
-  fabricated-read and erased-delivery controls must fail.
+  fabricated-read and erased-delivery controls must fail. Its fake, tasks and
+  deployment wiring live in `src/providers/granola/eval/`, unshipped;
+  `providers:generate` registers a provider's `eval/` wiring with the harness
+  (`eval/README.md`, provider-local eval wiring).
 - `test/identity-write-journey.node.test.ts` uses the existing Node deployment
   adapter, stateful MCP fake, SQLite vault and QuickJS to grade admitted human
   and machine identities, pool isolation, fail-closed discovery, endpoint and
@@ -1794,14 +1719,6 @@ Use the existing stateful fixture vendors and published-edge deployment adapters
   returned private values and credential echoes; positive record facts must
   still arrive. An explicitly writable pool also exercises reopening a
   read-only deployment without bypassing connector policy.
-- `test/cancellation-journey.node.test.ts` observes a queued client's departure
-  without another vendor send, and an active client's departure after the
-  vendor commits. The vendor must see its held response socket close before
-  releasing it; a later MCP read recovers the committed intent exactly once.
-  `test/cancellation-faults.test.ts` keeps signal-less token-resolution,
-  warmed-credential digest, stalled body-cleanup and abort/grant races on Node
-  and workerd. These replace the universal Promise-method/seam/owner matrix
-  and its enrollment self-test, plus migration-only runtime wrapper checks.
 - `test/browser/operator-flows.spec.ts` serves the actual operator shell and
   routes over TCP with file-backed SQLite. Sign-in, Settings provenance, OAuth
   connect/disconnect and credential save/test/replace/remove survive closing and
@@ -1835,17 +1752,10 @@ Use the existing stateful fixture vendors and published-edge deployment adapters
   after HTML, malformed JSON and oversized acknowledgements with one physical
   send. It distinguishes Stripe's reviewed pre-execution 401 refusal, and checks
   read failure facts, secrecy and recovery through direct and QuickJS calls.
-  `test/provider-failure-sweep.test.ts` retains only concrete auxiliary, composite,
-  in-flight and untracked-call fault probes; no provider/tool argument roster or
-  catalog/finalizer agreement sweep remains. Existing
-  `test/sent-secrets.test.ts`, `test/sent-secret-output-boundary.test.ts`,
-  `test/request-secret-redaction.test.ts` and `test/catalog-secret-redaction.test.ts`
-  cover secrecy before projection, truncation, caching, paging and diagnostics.
-- `test/write-evidence.node.test.ts`, `test/remote-mcp-attempts.node.test.ts` and
-  `test/oauth-credential-attempts.node.test.ts` inspect physical socket sends.
-  Native transport parity, OAuth and write-provenance suites retain their
-  workerd coverage. The shared throwaway RSA key in `test/fixtures/rsa.ts` is
-  used by write-provenance and unknown-write-advice fixtures.
+  Existing `test/sent-secrets.test.ts` covers secrecy before projection,
+  truncation, caching, paging and diagnostics.
+- The shared throwaway RSA key in `test/fixtures/rsa.ts` is used by
+  write-provenance and unknown-write-advice fixtures.
 - `test/executor-requests.test.ts` runs overlapping `execute_code` programs
   as separate workerd requests through the real Worker Loader executor, with
   real TCP host calls that read their own request's signal. Queued programs
@@ -1860,23 +1770,21 @@ Use the existing stateful fixture vendors and published-edge deployment adapters
   `test/request-context.node.test.ts` pins the same wake order and async context
   on Node for executor and call admission and QuickJS host calls, and gives back
   grants that shutdown overtook.
-- The request, catalog, auxiliary-call and renewal lifetime
-  suites, plus `test/auth-admission-binding.test.ts`, exercise cancellation,
-  held native work and garbage collection. These test actual request ownership;
-  the retired capture scheduler's source guards were only harness constraints.
+- `test/request-context.node.test.ts` and `test/auth-admission-binding.test.ts`
+  exercise cancellation, held native work and garbage collection. These test
+  actual request ownership.
 
 The remaining probes defend distinct reachable failures: auth admission and
 native scheduler ownership, grant/callback fencing and refresh coordination,
 SDK replay/redirect/SSE attempts, nested write provenance and refusal evidence,
 unawaited program drain and failed-program accounting, catalog drift and paging
 revocation, and hostile serializers, structural echoes, truncation and persisted
-pages. Broad scripted-executor policy/privacy cross-products and repeated
-post-401 result/error-shape tables are retired. Protocol claims link executable
+pages. Protocol claims link executable
 evidence files in `spec/coverage.json`; the invariant contracts above are defended
 by the actual behavior assertions in these journeys and focused probes.
 The required CI gate includes build/declarations, Node and Workers probes,
 outcomes, browser flows, installed consumers and Docker, audits and real Eve
-compatibility. Further contributor cleanup is tracked in #1072.
+compatibility.
 
 Add a compact fault journey only for a meaningful outcome those suites cannot
 observe. Reuse their fixtures and adapters; do not reintroduce a snapshot
@@ -1904,8 +1812,7 @@ behind the same redirect wrapper and a same-origin guard.
 client replacement, transport confinement and secrecy on Node, and a real
 service binding on workerd.
 `test/google-service-account-token.test.ts` exercises signing/cache behavior on
-Node and workerd; `test/google-service-account-remote.node.test.ts` checks
-real-socket token/MCP requests, invalidation and one physical attempt per write.
+Node.
 Operator setup lives in [Google hosted MCP](./auth.md#google-service-account-tokens-and-hosted-mcp).
 
 `createConnecta` takes closed typed `ui`, `vault`, and `activity`
@@ -2070,10 +1977,10 @@ storage is the root's namespaced to its principal.
 | Admission (`executor-admission.ts`, `call-admission.ts`)               | Queued waiters are Deferreds settled by whoever removes them from the queue; a wait is one flat race of grant, Clock timeout, and signal. The uncontended path stays synchronous. Two controllers, as [#453](https://github.com/zackbart/connecta/issues/453) requires.                                                                                                                                                                                                                                                                                                                                    |
 | One tool call (`invocation.ts`)                                        | One fiber: resolution, the read-only and schema refusals, admission, and the downstream attempt sit under a single `withDeadlineEffect`, whose expiry interrupts the call wherever it is. The permit is an `acquireRelease`; the connector call is `Effect.tryPromise` over the unchanged `Connector`.                                                                                                                                                                                                                                                                                                     |
 | `execute_code` (`execute.ts`)                                          | One fiber whose Scope owns the run's signal and executor lease, so a result, a throw, the watchdog, and cancellation all release the lease and abort the signal the same way. Public executor methods stay Promise-shaped; registered built-in execution composes directly as an Effect under the signal and `execute.watchdogMs`. Queued acquisition retains its Promise request handoff. Each guest host call is a fiber of its own.                                                                                                                                                                     |
-| Discovery (`catalog-service.ts`)                                       | A request-scoped cache: one shared read per connector (`runtime/shared-read.ts`), settled by the read itself and carrying its own signal and the probe timeout whichever asker starts it. Each asker waits under its own deadline and signal, so one that times out or is cancelled fails alone, and the read is cancelled only once every asker has gone. Fan-out is `Effect.forEach` under the discovery concurrency.                                                                                                                                                                                    |
+| Discovery (`catalog-service.ts`)                                       | A request-scoped cache: one shared read per connector (`runtime/shared-read.ts`), settled by the read itself and carrying its own signal and the probe timeout whichever asker starts it. Each asker waits under its own deadline and signal, so one that times out or is cancelled fails alone, and the read is cancelled only once every asker has gone. Fan-out is `Effect.forEach` under the discovery concurrency; unscoped search adds the discovery budget and health record (`discovery-health.ts`).                                                                                               |
 | Registry (`registry.ts`)                                               | The result stash is a program over `Storage`. Same-request catalog loads share one read the way discovery's do. Remote MCP caching uses the SDK ResponseCacheStore adapter over SQL-backed KV, with no cross-request catalog flight.                                                                                                                                                                                                                                                                                                                                                                       |
-| Remote MCP (`connectors/remote-mcp.ts`)                                | Each request scope's state holds a Scope, each connection is a lease forked from it, and a connect in flight is a Deferred carrying the client it connected. Closing a session and the transport are each bounded to a second.                                                                                                                                                                                                                                                                                                                                                                             |
-| Downstream OAuth (`auth/downstream-oauth.ts`, `auth/static-oauth.ts`)  | A refresh flight is a Deferred. Before the first durable coordinator write (claim CAS) is submitted, call/request closure stops preparation without a CAS, token request or state change. Submission transfers renewal to the storage coordinator under its own 35-second preparation deadline and 20-second token-request/body deadline, followed by the fenced rotation commit through the runtime deferred-work hook. A closed caller promptly fails without consuming the result, marking its ledger renewed or sending/resending a resource request.                                                  |
+| Remote MCP (`connectors/remote-mcp.ts`, `connectors/remote-mcp/`)      | Each request scope's state holds a Scope, each connection is a lease forked from it, and a connect in flight is a Deferred carrying the client it connected. Closing a session and the transport are each bounded to a second.                                                                                                                                                                                                                                                                                                                                                                             |
+| Downstream OAuth (`auth/downstream-oauth*`, `auth/static-oauth.ts`)    | A refresh flight is a Deferred. Before the first durable coordinator write (claim CAS) is submitted, call/request closure stops preparation without a CAS, token request or state change. Submission transfers renewal to the storage coordinator under its own 35-second preparation deadline and 20-second token-request/body deadline, followed by the fenced rotation commit through the runtime deferred-work hook. A closed caller promptly fails without consuming the result, marking its ledger renewed or sending/resending a resource request.                                                  |
 | Operator and activity data (`routes/operator.ts`)                      | Each JSON route is one program run by `serveOperator` behind the Promise `handle()`. Reads run under the request's signal; writes do not, so a vault write or OAuth disconnect that started reaches its cache invalidation.                                                                                                                                                                                                                                                                                                                                                                                |
 | QuickJS pool (`executors/quickjs.ts`, Node only)                       | Each child is a scoped resource whose release sends SIGTERM, then SIGKILL after a second; crash respawn backoff is a `Schedule`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
 
@@ -2186,10 +2093,8 @@ request fixture and native-output suites supply runtime parity evidence.
 
 ### Native SQL storage (contributor)
 
-`src/storage/sql-native.ts` composes KV, activity schema upgrades, retention,
-and bounded SQL copies as Effects. `src/storage/d1-copy.ts` composes the
-Workers KV copy, source-bound resume claims, verification, cutover guard, and
-recovery. Public factories and copy functions retain their Promise contracts;
+`src/storage/sql-native.ts` composes KV, activity schema upgrades, and retention
+as Effects. Public factories retain their Promise contracts;
 custom Promise SQL drivers retain the fallback lift.
 
 `src/storage/sql-driver.ts` constructs a public Effect 4.0.5 `SqlClient`
@@ -2208,17 +2113,8 @@ is the existing exact `effect` pin. Connecta does not adopt `@effect/sql-d1`:
 its 4.0.5 batch API drops metadata and its binding contract is wider than
 Connecta's published structural interface.
 
-The D.2 architecture allowance was measured against `0e314247` using cached
-official `node:22-slim` (Node 22.23.4, zlib 1.3.1-e00f703), no network, and
-read-only bundle artifacts: `/d1` grew from 62,516 to 88,305 bytes gzip
-(+25,789); the Worker example grew from 729,847 to 756,375 (+26,528).
-Final typed-driver failure normalization measures 88,319 and 756,377 bytes
-on that same official runtime. Executing real services and statement operations requires those runtime
-semantics; the earlier identity-compiler facade did not provide them. The
-explicit allowance changes only `/d1`'s cap from 62,542 to 90,000 bytes and
-the Worker example's cap from 743,000 to 760,000. Historical baselines and
-all other caps stay fixed. Final integration must remeasure the combined
-implementation and satisfy the same compatibility and privacy contracts.
+Bundle caps and baselines are authoritative in
+[`scripts/bundle-budget.json`](https://github.com/zackbart/connecta/blob/main/scripts/bundle-budget.json).
 
 The platform connection capability contains no request state. D1 prepares in
 the current request and retains no prepared handles or promises. SQLite keeps
@@ -2245,14 +2141,16 @@ value, matching that fallback. Interruption remains interruption. The lookup
 module imports no SQL or platform implementation and does not change the
 published storage interfaces.
 
-The synchronous state-file parser, validation, file read, and one atomic
-SQLite import remain native synchronous leaves because `importStateFile` is a
-published synchronous API. `openSqlite` retains file modes, WAL, busy timeout,
+`NativeStorage.getMany` reads several keys in one statement, answering by
+position exactly as one `get` per key would; the SQL drivers share it, a
+replaced `get` answers each key itself, and other stores fall back to one `get`
+at a time. Catalog reads fetch up to eight chunks per round trip with it.
+
+`openSqlite` retains file modes, WAL, busy timeout,
 and database ownership. `test/sql-effect-contract.ts` retains affected-row,
 50-claim, typed-failure, cancellation, and tracing probes on SQLite and native
-D1. `test/kv-to-d1.test.ts` also reuses stores across separate workerd requests;
-the existing SQL contracts prove rollback, database-clock TTL, encodings,
-activity upgrades, and copy recovery.
+D1. The existing SQL contracts prove rollback, database-clock TTL, encodings,
+and activity upgrades.
 
 ### Internal provider HTTP failures (contributor)
 
@@ -2293,7 +2191,7 @@ Stripe declares HTTP 409 as a conflict, alongside its fact-driven 429
 classification to an oversized 424 reply, preserving the dependency-failure
 meaning when the bounded body cannot be read. The original ceiling diagnostic
 and answered status remain; the core still decides write outcomes. It does not
-apply to 401 or alter Q8. A fixed read-phase fact distinguishes failed body
+apply to 401 or change write-outcome settlement. A fixed read-phase fact distinguishes failed body
 reads from malformed JSON only for vendors declaring that wording; raw
 exceptions never enter diagnostics. Other providers retain their mapping and
 wording.
@@ -2310,14 +2208,13 @@ The mapping records each request's own served provenance and raw 401 facts.
 reservation's answer even for a read-classified tool issuing a physical write.
 An accepted write's blocked retry retains its original HTTP status; a slot
 occupied by an auxiliary read instead names the separate write step needed.
-Structured resend advice reaches output only when the core permits it. Generic
-unknown writes retain the core's diagnostic wait; Q8 removes it. The mapping
-adds no Promise entry or lifetime owner. `provider-failure-sweep.test.ts`,
-`guarded-attempts.node.test.ts`, `call-services.test.ts` and the native
+Structured resend advice reaches output only when the core permits it. Unknown
+write outcomes are never retryable; a generic one keeps the core's diagnostic
+`retryAfterMs`, and one settled by a 401 drops it. The mapping
+adds no Promise entry or lifetime owner. `call-services.test.ts` and the native
 transport suites exercise these contracts through invocation, physical sockets
 and request closure. `http-kit.test.ts` retains focused numeric/text fact,
-request-equivalence and bulk-capacity fault probes. The migration-era
-kit/core verdict comparison is retired under #1072. Maintained API providers use the kit through their
+request-equivalence and bulk-capacity fault probes. Maintained API providers use the kit through their
 explicit provider subpaths; it stays off the root import graph and published
 declarations expose Promises.
 
@@ -2328,8 +2225,7 @@ declarations expose Promises.
   are Promises. A connector is called with `Effect.tryPromise`, never asked to
   return an Effect.
 - **Inbound authorization.** `authorize` in `src/routes/shared.ts` ships in
-  the declarations and in the `./activity` bundle; converting it cost 32 KB
-  gzip there for nothing a caller could see.
+  the declarations and in the `./activity` bundle.
 - **Pure synchronous code.** Ranking, schema rendering, classification,
   `validateToolInput`, the host-call budget, the emit collector, failure
   framing, and result shaping. The microtask scheduler never yields to I/O, so
@@ -2409,6 +2305,93 @@ within five minutes of expiry in the same auth partition. Partial walks and
 auth or permission failures refuse fallback; resources require unexpired
 inventories, and stale fallback cannot authorize post-entry auth recovery.
 
+**Repeated reads share one request's memo.** `src/runtime/request-reads.ts`
+gives each request owner a memo of storage reads, emptied when the request
+closes (INV-7). It holds plain strings keyed by the physical key in the
+underlying store, so namespaced views of one partition share an entry and two
+principals' partitions never do. A read consults it only where the call site
+opts in and states why staleness within one request is safe; every other read
+goes to storage.
+
+- Every write through the SQL drivers, `memoryStorage()` or a namespaced view
+  over them drops that key from every open memo in the same isolate, before
+  submission and again on settlement. A read that such a write overlapped is
+  not recorded.
+- Only the latest read of a key that the request started records. An earlier
+  read that settles later never replaces a newer fresh observation.
+- A fresh read records what it saw, so a memoized reader is never older than
+  its request's latest fresh read of the key.
+- A custom store, or a built-in one with a replaced method, is never memoized.
+- A runtime without `WeakRef` and `FinalizationRegistry` memoizes nothing:
+  workerd before compatibility date 2025-05-05 without `enable_weak_ref` reads
+  storage every time.
+
+The memo cannot see another isolate, another process sharing the database, or
+an entry expiring. After the first read, a memoized key can lag such a change
+for the rest of the request. So nothing that gates authority, sends a
+credential, or decides a write is memoized.
+
+Memoized:
+
+- the negotiation verdict, which only orders handshake versions;
+- catalog generation reads that only locate an entry, accepted or refused by a
+  fresh fence;
+- the credential reads behind connector status, drift and the operator UI card,
+  which only label a view. Only the built-in vault with its original `getAll`
+  and `metadata` shares a read; a custom vault, a subclass, or an instance
+  that overrides either method is called itself for every read, dispatch
+  included.
+
+Always fresh:
+
+- every OAuth grant read, including the token and epoch check behind each SDK
+  message (a disconnect need not revoke the vendor token), `peekGrant` and
+  every cache-acceptance identity check, compare-and-set loops, refresh claims
+  and leases, resets and disconnects;
+- the catalog generation fence before a cached entry is served or published;
+- the credential a call sends.
+
+`test/request-reads.node.test.ts` holds the memo's contract, including a
+disconnect written by another isolate between paginated `tools/list` pages.
+
+### Request budgets (contributor)
+
+`test/request-reads.node.test.ts` also guards the common request shapes the way
+bundle caps guard size. Each case counts downstream HTTP requests, D1 round
+trips (`all`, `run` or `batch`) and SQL statements separately, since a batch is
+one round trip but several statements. The fixture is production-shaped: D1
+over `node:sqlite`, a sealed vault holding the API credential and the OAuth
+grant, Cloudflare Access with `accessTokens()`, a D1 activity sink settled
+through `waitUntil`, the operator UI and QuickJS standing in for Dynamic Worker
+startup. "Cold isolate" is a new deployment instance over the populated
+database. The ceilings, measured value plus about 10% D1 headroom and exact
+downstream counts, live in its `BUDGETS` table. Measured on main in October 2026:
+
+| Request                                  | Downstream | D1 round trips | SQL statements |
+| ---------------------------------------- | ---------: | -------------: | -------------: |
+| Legacy remote MCP call, warm             |          5 |              6 |              7 |
+| Legacy remote MCP call, cold isolate     |          5 |              9 |             12 |
+| Modern remote MCP call, warm             |          1 |              7 |              8 |
+| Modern remote MCP call, cold isolate     |          1 |             10 |             13 |
+| OAuth remote MCP call, warm              |          5 |             19 |             20 |
+| OAuth remote MCP call, cold isolate      |          5 |             22 |             25 |
+| OAuth call after a 401, with refresh     |          9 |             39 |             48 |
+| OAuth call with proactive refresh        |          6 |             35 |             43 |
+| `api()` credential call, warm            |          1 |              3 |              4 |
+| `api()` credential call, cold isolate    |          1 |              6 |              9 |
+| Unscoped search, warm (3 remote, 1 api)  |          0 |             20 |             20 |
+| `execute_code`, 5 calls to one connector |          9 |             10 |             15 |
+| UI connector detail, `api()` credential  |          0 |              2 |              2 |
+| UI connector detail, credential remote   |          4 |              9 |              9 |
+| UI connector detail, OAuth remote        |          4 |             18 |             18 |
+
+Header-auth calls to the legacy (session) server handshake per request:
+`initialize`, `notifications/initialized`, the SSE `GET`, the call and the
+session `DELETE`. The modern server advertises a catalog TTL, so a warm call is
+the call alone. OAuth calls read the grant fresh before every SDK message.
+Run with `D1_BUDGET_REPORT=1` to print each measurement; a failing case prints
+its request and statement log.
+
 ### Contributor provider kit
 
 Provider declarations use `src/http/vendor.ts` for HttpApi operations and
@@ -2427,17 +2410,29 @@ exact vendor count as `page.total` from its page callback. The kit validates a
 nonnegative safe integer and includes it on continuing and terminal pages;
 without a vendor count the property is absent. Lists without the opt-in keep
 their existing schema and result bytes. Never derive an exact total from a
-partial page or an estimate. `src/http/fields.ts` refuses an unknown first
-segment before dispatch; a selected
-result renders against a sparse output schema. `src/http/hatch.ts` is the
+partial page or an estimate. `src/http/fields.ts` derives each `fields`
+description's anchor and example from the contract that validates it. It
+refuses before dispatch a path whose first segment is not a declared property,
+and a deeper segment only inside an object the schema closes with
+`additionalProperties: false`; a selected result renders against a sparse
+output schema. `src/http/hatch.ts` is the
 standard hatch (`_api_search`, `_api_details`, `_api_read`, `_api_write`) over
 an `OperationIndex` with explicit verdicts. It keeps the REST family's
 argument and envelope names and validates `fields` against the operation's
-declared response roots before dispatch. Search answers stay within 16 KiB
+declared response roots before dispatch. A deeper miss is reported in
+bounded `warnings` naming declared properties only, never refused, because the
+pinned index declares paths only to a bounded depth. Search answers stay within 16 KiB
 (at most eight compact entries, long labels cut and marked, continuation by
 cursor); details stay within 32 KiB, paging whole parameters and body
 properties, and chunking any piece larger than one answer, behind a bound
-cursor. Standard hatch search removes conversational framing; framing-only
+cursor. `src/http/hatch-response.ts` builds details' capped `response` section
+from the index's declared response paths in `fields` coordinates. It lists
+selectable paths and promises no readability. Its `withheld` hint comes from
+`ResultSafety.withholds`: `ValueSafety.withholds` reads the rules `redact`
+applies that change every non-null value they reach, matched with list
+markers. Custom redactions may declare their own hint. Rules that can pass a
+value through (`url:`, `origin:`, `[?…]`, `@keys`, string-only scrubbing) are
+never hints. Standard hatch search removes conversational framing; framing-only
 queries return no matches. It admits partial lexical matches alongside full
 matches. Action/read queries require all content nouns in the operation text,
 or any noun in the path/id with at least half the nouns in the text. Their
@@ -2584,9 +2579,10 @@ A binding may opt into `truncated: true` to supply reviewed size-cut paths
 (such as `data.content`) in its answer. The hatch then declares and propagates
 an optional top-level `truncated: string[]` on reads and writes. Without the
 opt-in, the schemas and results are unchanged; size-cut metadata is not inferred
-from vendor booleans or added to other providers. A separate `warnings: true`
-opt-in declares and preserves reviewed `warnings: string[]` beside `data`, even
-when `fields` narrows the vendor body.
+from vendor booleans or added to other providers. Every hatch read and write
+declares an optional `warnings: string[]` for `fields` entries that matched
+nothing in a nonempty body. A separate `warnings: true` opt-in also preserves
+reviewed vendor warnings there, even when `fields` narrows the vendor body.
 
 A binding may expand deployment-owned path defaults (Cloudflare) or canonicalize
 repository contents paths (GitHub) before indexed resolution, and may prepare a
@@ -3089,17 +3085,9 @@ including structural lookalikes and genuine router errors, retain their identity
 
 Four public `effect/http/*` modules are allowed only in the private dispatcher;
 all other root-purity and optional-implementation boundaries remain enforced.
-Direct public module imports avoid the area's barrel cost. The local D3
-measurement over the reviewed D1/D2 stack is root 373,435 to 393,470 bytes gzip
-and Worker 758,274 to 774,384 (official Node 22.23.4/zlib 1.3.1-e00f703, identical
-repository bundle options). The barrel alternative measures 423,348/787,614.
-The parent accepted this measured native-routing cost with a Worker cap of
-785,000 bytes, including room for separately measured native-auth and reviewed
-host/transport additions. Root and all other caps and historical baselines are
-unchanged by D3. Separate-input costs are not a combined gzip measurement;
-the integrated deployment must be measured again.
-
-`test/server.test.ts` asserts production routing directly on Node and workerd:
+Direct public module imports avoid the area's barrel cost.
+
+`test/server.test.ts` asserts production routing directly on Node:
 raw prefixes and malformed suffixes, extension methods, CIMD before auth/UI/body
 reads, Response/error identity, unmatched fallthrough, concurrent request
 isolation, and body-held permits through end/failure/cancel/abort/abandonment.
@@ -3111,85 +3099,65 @@ Root purity, declaration and bundle checks own import boundaries and size caps.
 The frozen legacy dispatcher, source transforms, diagnostic latency loops and
 rejected Effect MCP adapters were migration evidence; their historical source
 is linked from decision 0016 rather than rebuilt by ordinary tests.
-The upward MCP protocol leaves remain SDK implementations, with D7's separate
-native-orchestration work and compatibility evidence unchanged.
-
-### Why not Schema or HttpApi for core routes
-
-Both were measured and both lost. `effect` is imported through its barrel,
-which defeats tree-shaking: the first conversion step measured about +20 ms
-of Worker cold start for it, and that cost was accepted over deep imports at
-every call site. The catch is that a module the barrel reaches is paid for in
-full, however little of it is used. Effect Schema for config validation and the
-meta-tool inputs came to about +62 KB gzip and +13 ms of cold start in the
-root, for a validator no clearer than the hand-written schema in `src/config.ts`; the
-meta-tool inputs stay zod, which the MCP SDK bundles regardless. `HttpApi` for
-the operator and activity routes cost about +100 KB gzip on `./ui` and +130 KB
-on `./activity`, and matching the wire format meant opting out of most of what
-it does: unowned paths fall through rather than 404, a wrong method is a JSON
-405, and the content-type and size checks run before a body is read. The root
-entry imports `effect` and the four public HTTP modules confined to the private
-dispatcher (`test/purity.node.test.ts`).
-Effect 4.x is a long-term-support line, but its area barrels `effect/http`,
-`effect/http-api`, `effect/schema`, and `effect/sql` are still tagged
-`@stability unstable` and can change within it; only core modules such as
-`effect/Schema` are stable. That is why Effect is pinned to one exact version
-and every Effect upgrade is its own deliberate pull request. A deployment
-that also depends on Effect, such as the Worker example's Alchemy stack, must pin the
-same version to resolve a single copy. Connecta's own lockfile and packed
-install are checked for one copy (`test/package-surface.node.test.ts` and
-`scripts/check-package.mjs`).
-
-The stable `4.0.0` release was re-evaluated on 2026-10-01 with this
-[historical probe source](https://github.com/zackbart/connecta/blob/1ab92695f2636f904274d900ce209553358ff1f3/scripts/probes/effect-v4-evaluation.mjs),
-retained in Git history rather than the current checkout.
-The [raw observations](https://github.com/zackbart/connecta/blob/1ab92695f2636f904274d900ce209553358ff1f3/scripts/probes/effect-v4-evaluation-2026-10-01.json)
-are synthetic Node requests and neutral esbuild bundles, not live-client or
-workerd lifetime verification. Bundle figures add representative prototypes
-alongside the current code; they do not claim savings from removing old code.
-
-Two native input schemas with validation and JSON Schema rendering add 62,148
-bytes gzip to the root, taking it from 303,083 to 365,231 against a 339,526
-cap. Effect can reject excess properties when both decoding and rendering use
-`onExcessProperty: "error"`; its default strips them. The generated schemas
-still differ from the published meta-tool schemas, including record rendering and
-composed numeric bounds. A Schema replacement would need to preserve that
-contract and memoized rendering. Both MCP SDK packages still depend on Zod,
-so changing our inputs alone does not remove Zod from an installation.
-
-A one-endpoint `HttpApi` prototype adds 106,634 bytes gzip to `./ui` and 106,453
-to `./activity`. Even plain `HttpRouter` adds 45,324 to `./ui`, taking it to
-130,023 against a 128,983 cap. Both default handlers return an empty 404 for a
-wrong method and an unowned path; our routes need a JSON 405 for the former
-and module fallthrough for the latter. Their `toWebHandler` also builds its
-layer immediately and owns a runner, so adopting it would require proving
-global-scope safety and preserving our scheduler and response-lifetime rules.
-Those historical defaults are not the production adapter: the narrow public
-HttpRouter dispatch above preserves explicit method refusals, unowned fallthrough
-and the existing edge runner without `toWebHandler`.
-
-Effect's MCP server has a separate compatibility gate. Its `2026-07-28`
-adapter accepted a stateless `tools/list`, but its `2025-06-18` adapter refused
-a fresh request with 400. Initialization issued a session, and that session's
-next request returned 404 on a fresh handler; Connecta served the same fresh
-legacy list with 200 JSON and no session. The stable package exports no MCP
-client, so it also cannot replace our downstream SDK and OAuth implementation.
-[Issue #622](https://github.com/zackbart/connecta/issues/622) records the server
-parity requirements. These historical measurements supported retaining MCP protocol and validation
-implementations. Production HTTP dispatch now uses the separately proven narrow
-public adapter above; stable v4 alone did not establish its compatibility.
-
-The core's cost is recorded rather than guessed. Against 0.24.4 the root entry
-grew from 235,346 to 279,526 bytes gzip, the Worker example from 263,949 to
-314,336, and each provider by about 36 KB, since each reaches Effect through
-`remoteMcp()`. `pnpm run check:bundle` caps the deployed shapes (the root,
-`./worker`, `./ui`, the operator UI assets, `./d1`, `./auth/access-tokens`,
-the Worker example, and the other non-provider entries) against
-`scripts/bundle-budget.json`. Per-provider entries are reported with their
-size and change from baseline but not capped: every deployment already imports
-the root, which carries the Effect core, so a provider's standalone bundle
-counts that core a second time. An install carries about 53 MB of `effect`, with
-no dependencies of its own.
+The upward MCP protocol leaves remain SDK implementations with native
+orchestration and compatibility evidence.
+
+### Validation and HTTP boundaries
+
+Config validation uses `src/config.ts`; meta-tool inputs use Zod, which the MCP
+SDK also depends on. Core routing uses the narrow public HTTP adapter above.
+Effect is pinned exactly; deployments using Effect must resolve the same version.
+`test/package-surface.node.test.ts` and `scripts/check-package.mjs` check one copy.
+Per-provider bundles are reported, not capped, because their standalone graphs
+include the shared core again. Deployed non-provider shapes are capped by
+`scripts/bundle-budget.json`.
+The always-loaded agent surface has fixed-cost caps of the same kind: the
+`always-loaded agent surface budgets` cases in
+`test/meta-tool-schemas.test.ts` cap the instructions plus `tools/list` total,
+each tool description and output schema, the `usage` skill, and one default
+and one compact search row, measured on a pinned four-connector fixture.
+
+### Route names
+
+Connecta-authored agent text names a route in the wording of the surface that
+serves it, resolved when the text is built (`src/agent-routes.ts`). Nothing
+renders afterwards: no code scans or rewrites replies, program values,
+downstream results, resources, guides or caller data, so paging, previews,
+totals and offsets measure the final text.
+
+Two tables per surface. `AgentRouteNames` names the tools (`call_tool`,
+`call_destructive_tool`, `search_tools`, `execute_code`, `authorize_connector`,
+`skills` on the meta surface); a sentence uses a name only when written for a
+surface that lists that tool. `RoutePhrases` holds complete phrases for
+sentences every surface shares, such as "for a direct call_tool only" against
+"when calling this tool directly", "call directly (call_tool, connecta.result
+to page)" against "call this tool directly and page with read_result", and the
+authorization sentences, which on native pools tell the agent to give the
+error's nextAction to the user or operator. `program` is undefined on a native
+pool without `execute_code`, so text about program capacity branches on it.
+The eval code arm's phrases keep the text its comparator protocol recorded.
+
+Where each text gets its wording:
+
+| Text                                                            | Wording                                                                                                                                                                                                                                                                                                                                                        |
+| --------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Invocation refusals, authorization handoffs, paging notices     | The request's names, from the MCP route through meta-tools, programs and native pools                                                                                                                                                                                                                                                                          |
+| Connector and provider call text                                | `routePhrases(ctx)`; inside a call's Effect, the `Routes` reference; vendor tables' `words(detail, routes)`; an `api()` connection's write-401 refusal, configured at construction, receives the call's `Routes`                                                                                                                                               |
+| Contexts the registry builds                                    | The deployment's names (meta, or the eval code arm's); a call carries its request's names                                                                                                                                                                                                                                                                      |
+| Static provider schema descriptions                             | `routeDescription(build)`: the declared meta text; each request's catalog sets them on its own copy of each `api()` tool, which keeps the tool's source classification, built for its serving surface. Description paths are cached per connector and tool name, and rendered text per declared description and surface. Downstream catalogs are never touched |
+| Meta instructions, meta-only tool descriptions, built-in guides | Meta names, built once; built-in guides keep one digest across deployments                                                                                                                                                                                                                                                                                     |
+| Native instructions, the `execute_code` description             | Built per surface                                                                                                                                                                                                                                                                                                                                              |
+| Program-return and program-call paging notes                    | Meta names; they name only `execute_code`, which every surface running programs lists                                                                                                                                                                                                                                                                          |
+| The OAuth adapter's `UnauthorizedError`                         | Meta names; only its class reaches callers, which word their own error from the call                                                                                                                                                                                                                                                                           |
+
+The provider standard's S7 check refuses a spelled-out meta-tool name in
+provider code. Remaining literals are not agent route text: `execute_code`'s own
+budget and timeout errors, operator log lines, construction errors, the
+configuration reference, the OAuth callback page and operator fix prompts. The
+eval code arm marks its configuration with `renderRoutesAsPrograms`, an internal
+hook no package entry exports; no configuration key selects it.
+
+[Decision 0019](https://github.com/zackbart/connecta/blob/main/decisions/0019-core-validation-http-boundaries.md) records the rejected Schema/HttpApi measurements.
 
 ## Where else to look
 
@@ -3243,9 +3211,7 @@ compiling and configuring the real thing.
   accounting and claim ownership keep their existing ordering. Late
   rejections are observed; dispatch and lease guards still contain detached
   work. Per-await I/O cancellation remains useful for releasing resources,
-  while prompt refusal is enforced at the boundary
-  (`test/cancellation-faults.test.ts`, `test/operation-cancellation.test.ts`
-  and `test/cancellation-journey.node.test.ts`). Invocation owns
+  while prompt refusal is enforced at the boundary. Invocation owns
   the recovery and logical-call records it reads after teardown. Closing an
   outer call also revokes nested calls paused in preparation. Request-owned
   MCP sessions and token flights outlive individual calls and close with the
@@ -3262,11 +3228,9 @@ compiling and configuring the real thing.
   transfers preparation, token exchange and fenced rotation commit to the
   storage coordinator under its own deadlines and deferred-work hook; only
   the caller's wait still closes with the call. That completion
-  cannot resume a closed call or resend its resource request
-  (`test/call-renewal-lifetime.test.ts`,
-  `test/remote-mcp-renewal-lifetime.test.ts`). Explicit request revocation also
-  aborts pending authorization-code exchange and refuses late token writes
-  (`test/operation-cancellation.test.ts`). Request closure
+  cannot resume a closed call or resend its resource request. Explicit request
+  revocation also aborts pending authorization-code exchange and refuses late
+  token writes. Request closure
   revokes views and calls first, then runs every finalizer in reverse order,
   collecting failures. The caller's original cancellation signal is retained
   separately from the lease signal, so normal teardown never looks like caller
@@ -3326,7 +3290,10 @@ compiling and configuring the real thing.
   is a known failure only on refusal provenance recorded where the evidence is
   observed, never inferred from an error code: (a) the ledger proves it never
   left, or (b) the downstream served an HTTP refusal, a 4xx other than 408
-  (`refusedStatus` and `vendorRefusal` in `src/provider-call.ts`), under the
+  (`refusedStatus` and `vendorRefusal` in `src/provider-call.ts`); for
+  `remoteMcp()` only when that 4xx carries a JSON-RPC error body, since a bare
+  one may be a gateway's answer after the server acted (`ambiguous` on the
+  call's dispatch in `src/connectors/remote-mcp/transport.ts`), under the
   provider's existing served classification (a write's HTTP 409 is a `conflict`). One helper, `servedRefusal` in `src/write-outcome.ts`, decides
   (b) for the ledger and for a transport outside one: a refusing status the
   provider reads as `unavailable` or a timeout (Stripe's 424) is not proof, so
@@ -3340,13 +3307,13 @@ compiling and configuring the real thing.
   as a `manual` check in its `drift.json`): an API v1 answer carrying Stripe's
   `Request-Id`. The real HTTP hostile-response journey checks this refusal
   against an ambiguous committed write; there is no copied declaration list.
-  Q8 is decided in one place, `settleWrite` in
+  Write outcomes are decided in one place, `settleWrite` in
   `src/write-outcome.ts`, once per logical call and over every request it
   recorded. The invocation calls it for every failure of a served write: a
   thrown or mapped error, a custom connector's, a program's call, and its
   own deadline or the caller's cancellation, when no connector failure
   arrives at all. It reads the logical call's requests
-  (`logicalCallRequests`), which hold every resource request dispatched
+  (`LogicalLedger`'s `sent`), which hold every resource request dispatched
   under the call from any ledger: nested `api()` calls, remote MCP, guarded
   transports, `ctx.fetch` and the kit. Without an invocation (a direct call,
   or a context no invocation opened), only the outermost boundary calls it,
@@ -3415,9 +3382,8 @@ compiling and configuring the real thing.
   Remote MCP captures
   each physical read's entry before awaiting its response; a later send
   cannot overwrite it. The kit's response identity and Google's init identity
-  identify the request whose credential was renewed. The legacy guarded-fetch
-  `answeredRequest` helper has no production caller; tests retain it to exercise
-  renewal provenance outside the kit.
+  identify the request whose credential was renewed. Guarded mappers that throw
+  an authorization refusal identify its request through `refusalRequest(error)`.
   The decider normalizes every failure it settles,
   typed or not (a raw network error, an `AbortError`, a thrown string). Its
   verdict is final (`settledWrite`, which follows copies and redaction): the
@@ -3591,23 +3557,8 @@ compiling and configuring the real thing.
   unchanged for the invocation to report.
   Shared provider outcomes and the real HTTP hostile-response journey check
   returned data, failure/recovery, privacy and physical writes without a
-  catalog-wide status matrix. `test/provider-failure-sweep.test.ts` retains
-  fault probes for Docs creation with initial text, composite success followed
-  by refusal, GitHub preflight failures, typed handler errors after successful
-  sends, Forms cursor conflicts after 200, generic-code vendor refusals,
-  auxiliary failures after resource dispatch and concurrent direct-call isolation.
-  It also holds siblings awaiting credentials or already in flight when another
-  write fails, refuses requests after call closure, and probes network errors,
-  refusal-shaped abort reasons and untracked sends. Native transport and
-  request-lifetime suites retain their platform-specific evidence.
-  `test/write-evidence.test.ts` uses real refused, reset, and held sockets on
-  both runtimes: a refused write is unknown and a refused read retryable,
-  including a write aborted with another fetch's real refusal as its reason
-  after the server read its body; `test/write-evidence.node.test.ts` covers a
-  Planning Center POST that undici resends after a 421 to a closed listener, a
-  DELETE that a `RetryAgent` resends after a reset, and a streamed body and a
-  `Blob` with an overridden `stream()` that undici partly sends before its
-  producer fails. Each has the server holding the write and reports unknown.
+  catalog-wide status matrix. Native transport and request-lifetime suites
+  retain their platform-specific evidence.
   Additional tests:
   `test/remote-mcp-write-once.test.ts` (real SDK transport),
   `test/api-oauth.test.ts`, `test/google-workspace-delegation.test.ts`, and each
@@ -3694,10 +3645,10 @@ OAuth retry, grant, response-decoding or ownership orchestration.
 there before claiming a code/refresh grant, so an unsupported Node host consumes
 neither. The base-fetch leaves in static OAuth and remote MCP call
 `sendCredentialPost`; remote registration and disconnect revocation do so too.
-D4 must preserve this preflight and the distinction between request-owned code
+The adapters preserve this preflight and the distinction between request-owned code
 exchange and coordinator-owned refresh after claim submission. The existing
 spent-token algorithm intentionally remains conservative after a submitted claim,
-even if a later CONNECT fails before destination dispatch. D6 must preserve the
+even if a later CONNECT fails before destination dispatch. Remote MCP preserves the
 SDK JSON-RPC envelope distinction at the leaf: protocol POSTs are not credential
 POSTs; forms and registration JSON are. Discovery GETs remain native fetch.
 
@@ -3785,27 +3736,22 @@ unchanged. A narrow machine check restores only those two exact adjacent
 pairs and requires byte equality, with no other type, export or reference
 change. All 88 declarations still exclude Effect and have complete references.
 
-The superseding 2026-10-25 D3/D4 cost ruling authorizes only Worker
-`maxGzip: 785000` (previously 760000) and Clerk `maxGzip: 85000` (previously
-63087). Official cached Node 22.23.4 / zlib 1.3.1-e00f703 measured Clerk at
-47,688 -> 80,961 bytes gzip (+33,273): the generated SDK is unchanged, while
-native Effect adds 91.8 KB raw plus the native helper and small auth-source
-growth. The isolated D4 candidate measured Worker at 762,666, root at 377,177
-and D1 at 88,321 bytes gzip. Optional-graph optimization brought UI to 342,955,
-so the earlier unused UI allowance is revoked and its original 345000 cap
-remains. Historical baselines, root/D1 and all other caps, dependency pins and
-security/API gates remain unchanged. These independent measurements do not
-predict a combined gzip by addition; final artifacts must be rebuilt. Native
-registration, decorated fallback and request/native-storage semantics also
-require a smoke through an actual minified production bundle. Final post-hook
-official artifacts measure root 377,290, D1 88,321, Clerk 80,959, UI 342,959
-and Worker 762,774 bytes gzip, all within those caps.
-
 ### Native remote MCP programs (contributor)
 
 Remote MCP connection joins, credential and epoch checks, catalog intake,
-negotiation, calls, resources, Skills, auth and status compose native programs in
-`connectors/remote-mcp.ts`. `catalog-cache.ts` owns native SDK cache reads,
+negotiation, calls, resources, Skills, auth and status compose native programs.
+`connectors/remote-mcp.ts` keeps the published options, the redirect guard and
+`remoteMcp()`, which builds one runtime from per-seam factories in
+`connectors/remote-mcp/`: `config.ts` (options and validation), `errors.ts`
+(boundary error mapping), `transport.ts` (transport and write-once dispatch),
+`connection.ts` (the per-scope connection state machine), `catalog.ts`
+(catalog intake), `resources.ts` (Skills and resource reads), `oauth.ts` (the
+OAuth surface) and `call.ts` (`callTool`); `runtime.ts` types what they share.
+`auth/downstream-oauth.ts` keeps `KvOAuthProvider`'s state and declared
+methods; `auth/downstream-oauth/` holds the refresh coordinator and, by seam,
+the provider's native method bodies (grant and epoch store, consent records,
+refresh lease and spent records, SDK hooks), installed once each by
+`authMethods`. `catalog-cache.ts` owns native SDK cache reads,
 chunked publication, generation fencing, complete refresh acceptance and listing
 serialization; `connectors/negotiation-cache.ts` owns native negotiation storage.
 The published connector, cache and SDK callback methods remain Promise shells.
@@ -3824,7 +3770,7 @@ restore that same owner. Every operation captures its own generation, credential
 identity and listing binding before waiting; a later listing cannot adopt an
 abandoned publication. Request closure revokes the connector and cache scopes.
 No client, transport, response, signal, promise or live request Context is shared
-across inbound requests. D4's bounded refresh coordinator retains its separate
+across inbound requests. The bounded refresh coordinator retains its separate
 ownership, synchronous submission gate and waiting-request handoff.
 
 Two deliberate Promise waits remain: a connect waiter receives the Deferred's
@@ -3863,16 +3809,11 @@ select the underlying current methods at dispatch, including namespaces created
 while a source method is decorated. Original SQL shells call their own native
 program directly. Tests cover current and previously selected programs, own and
 inherited saved-original delegates, get/set/CAS and activity record/list,
-restoration, typed failures and interruption. The D4 native proof fixtures install
+restoration, typed failures and interruption. The native auth proof fixtures install
 their intentional throwing Promise shells before registration, so they establish
 native composition without authorizing bypass of later replacements.
 
-`remote-mcp-native.test.ts` runs native SDK/cache/request-boundary cases on Node
-and workerd. `remote-mcp-native-bundle.node.test.ts` additionally loads an actual
-minified production bundle to verify call/cache registration, request Context,
-native storage, saved-original delegates, custom replacements and closed-owner
-refusal. Existing wire, physical-attempt, cache and OAuth lifetime suites remain
-the compatibility evidence.
+Existing wire, cache and OAuth suites remain the compatibility evidence.
 
 ### Native upward MCP orchestration (contributor)
 
@@ -3926,19 +3867,9 @@ identity, credential, storage, executor and tool callbacks. Connecta's OAuth-lin
 binding, TTL, progress, closing and one-use claims are native orchestration around
 those leaves. The supported protocol and unsupported-feature refusals remain
 unchanged. Native consumer, failure, decorator, sharing, close and minified-bundle
-regressions live in `upward-native.test.ts` and
-`upward-native-bundle.node.test.ts`; existing wire, continuation, redaction,
+regressions live in `upward-native.test.ts`; existing wire, continuation, redaction,
 physical-attempt and body/admission suites remain compatibility evidence.
 
-The combined native/operator graph has a measured contributor bundle allowance
-in PR #1060: the UI gzip cap is 346,000 bytes, with its historical baseline
-unchanged. The official full checker measured 345,228 bytes after regenerating
-the merged UI assets. Removing unused Invocation/Catalog registration retention
-returned the public Worker entry from 198,744 to 77,426 bytes; live minified
-Context, inherited-method, decorator and restoration proofs retain native
-composition. Root, example Worker, public Worker, D1 and Clerk caps remain
-unchanged. This cost decision grants no later request-body-limit allowance.
-
 ### Catalog operation vocabulary (contributor)
 
 The standard hatch privately registers bounded vendor operation text against its
@@ -3953,13 +3884,3 @@ cache. Exact authored names and complete authored matches precede API pointers;
 ordinary result limits, offsets, catalog failure disclosure and byte bounds apply.
 The published discovery contract states compilation, query and cache bounds.
 No request identity, signal, credential or promise enters a vocabulary cache.
-
-### Authenticated body-bound cost (contributor)
-
-The separate #860 change has a measured allowance only for the example Worker
-gzip cap, from 785,000 to 786,000 bytes, with its historical baseline unchanged.
-The official full checker measures 785,036 bytes against D7's exact 784,948-byte
-lower graph, an actual 88-byte increase. It reuses the bounded platform body
-inspector, preserves native orchestration and avoids a new reader lifecycle.
-Root, UI, public Worker, D1, Clerk and asset caps remain fixed. The cost ruling
-does not approve protocol, cancellation or authority semantics.