project-tiny-context-harness 0.8.12 → 0.8.13

package/assets/README.md

@@ -86,7 +86,7 @@ The relationship is deliberately one-of-two at execution time: every delivery co
 | Local or small | Default Workflow Contract | Explicit Long-Task is available |
 | Cross-module or complex | Default Workflow Contract remains valid | Explicit Long-Task |
 
-The base managed set also provides two explicitly triggered Open Design adapters: `design-system-authoring` generates/selects/adopts project Design Authority at cold start, while `design-resource-authoring` commissions task-local resources. They are optional upstream Skills, not a fourth mechanism and not stages inside Long-Task. Their selected outputs may feed either execution route, and `long-task-workflow` is the only active long-task execution Skill. `source-plan-authoring` has been removed from the managed set because Long-Task inputs now enter one Source-bound Contract Draft loop directly; legacy Source Plan documents remain ordinary Source.
+The base managed set also provides two explicitly triggered Open Design adapters: `design-system-authoring` generates/selects/adopts project Design Authority at cold start, while `design-resource-authoring` commissions task-local resources. They are optional upstream Skills, not a fourth mechanism and not stages inside Long-Task. Their selected outputs may feed either execution route, and `long-task-workflow` is the only active long-task execution Skill. Retired standalone authoring pointers are not installed; Long-Task inputs enter one Source-bound Contract Draft loop directly and pre-existing planning documents remain ordinary Source.
 
 Skill names in this README are host-neutral. In Codex, explicitly select one with `$skill-name` (for example `$long-task-workflow`) or use `/skills`; other hosts use their own Skill selector.
 
@@ -110,7 +110,7 @@ Use this route when an implementation delivery both genuinely needs new style-be
 
 1. **Enable Long-Task once.** Run `ty-context enable long-task` before selecting the workflow Skill.
 2. **Establish Design Authority only when needed.** If the project has no adopted Design Authority and the work is style-bearing, explicitly select `$design-system-authoring` to generate, select and adopt the canonical `DESIGN.md`, token source and provider binding. Skip this step when the project already has a configured Design Authority.
-3. **Prepare a writable initial proposal.** Put the project-native product/technical proposal at a concrete path such as `docs/initial-proposal.md`. It may be authored by the user, an external service or an explicitly requested applicable proposal capability. `design-resource-authoring` does not author the initial proposal, and no Source Plan stage is required.
+3. **Prepare a writable initial proposal.** Put the project-native product/technical proposal at a concrete path such as `docs/initial-proposal.md`. It may be authored by the user, an external service or an explicitly requested applicable proposal capability. `design-resource-authoring` does not author the initial proposal, and no standalone intermediary authoring stage is required.
 4. **Generate and select design resources.** Select `$design-resource-authoring` with the proposal path plus the exact development scope and targets. It returns one reconciled proposal, the selected immutable canonical resources with their manifest and dependencies, and a validated residual `design-resource-handoff-v1`.
 5. **Start the Single-Goal delivery.** Select `$long-task-workflow` and give it the exact paths to the reconciled proposal, validated handoff and selected canonical resource set. The Skill authors the Source-bound Contract Draft. Its first Compile/Authority Lock always ends the current turn before implementation and says `After handling the model change, send [continue].`; earlier model wording cannot skip this boundary and Harness cannot observe whether the host model changed. After the user resumes, the parent evaluates delegation suitability and delegates independent bounded work only when the host explicitly selects exact `long_task_implementation`; otherwise it executes in the parent without a generic substitute. The parent still owns authority, architecture, Context, integration, current-candidate checks and formal verification.
 
@@ -135,7 +135,7 @@ Other valid routes remain available:
 - **Delivery that first needs design resources:** follow the design-first sequence above, then feed the revised proposal plus selected immutable resources and the validated handoff to either the default Workflow Contract or `long-task-workflow`, based on recovery and completion-authority needs.
 - **Design-resource-only request:** stop after `design-resource-authoring`; do not create a Long-Task Contract unless implementation delivery was also explicitly selected.
 
-The design-system step is user-selected, normally at project cold start; no command or downstream Skill runs it automatically. `design-resource-authoring` gates only style-bearing work when Design Authority is unconfigured. Low-fidelity structure, IA/flow and semantics-only state studies remain available without that gate. A legacy Source Plan is accepted as Source, but it is no longer a recommended intermediate service.
+The design-system step is user-selected, normally at project cold start; no command or downstream Skill runs it automatically. `design-resource-authoring` gates only style-bearing work when Design Authority is unconfigured. Low-fidelity structure, IA/flow and semantics-only state studies remain available without that gate. A pre-existing planning or proposal document remains ordinary Source, not a recommended intermediate service.
 
 ## Try It In 60 Seconds
 
@@ -187,7 +187,7 @@ The smoke packs the local workspace, installs it into a disposable repo and vali
 
 ```sh
 cd /path/to/your/test-repo
-npm install -D /path/to/project-tiny-context-harness/tmp/ty-context/source-preview/package/project-tiny-context-harness-0.8.12.tgz
+npm install -D /path/to/project-tiny-context-harness/tmp/ty-context/source-preview/package/project-tiny-context-harness-0.8.13.tgz
 npx --no-install ty-context init --adopt
 make validate-context
 ```
@@ -270,6 +270,8 @@ Plan Validator commands no longer exist; existing plan, matrix or verdict files
 
 Shared Engineering Quality extends the architecture obligation without adding a workflow. Every implementation delivery visibly completes `Architecture Deliberation` before its first implementation edit. Risk changes depth, not occurrence. A small change names the concrete owner/current extension point, confirms durable boundaries and applicable quality attributes remain preserved, and explains why it adds or worsens no debt. Material work additionally covers the unique source of truth, dependency and interface/state/resource lifecycle boundaries, selected and rejected alternatives, one plausible future change and its extension point, touched technical debt, forbidden shortcuts, project-owned executable checks and triggered failure/load/threat scenarios. Correctness/invariants and maintainability/changeability always receive at least preservation; reliability/resource lifecycle, concurrency/consistency, performance/capacity/cost, security/privacy/safety, compatibility/migration/rollout and operability/observability/testability activate only when material. `Architecture Context Hit`, `Decision Rationale Hit: existing|required|none` and `Modularity Check: none|required|exception` remain internal routing questions; no Task Contract or fixed `plan.md` is required.
 
+When foundational machinery, a mature protocol/security boundary, a dependency/shared abstraction or a nearby extension point makes sourcing material, the deliberation adds a risk-triggered Build / Reuse / Buy judgment. It records an allowed solution set, prohibited failure modes and required rationale/evidence rather than one mandatory library or abstraction. Existing owners, standard capabilities, installed dependencies, mature compatible libraries, bounded self-implementation and intentional non-abstraction may all be valid; duplicate owner rules, extension-point bypass, unjustified heavy dependencies, incomplete security reinvention, license/platform incompatibility, forced abstraction and a second source of truth are not. This adds no mandatory open-source/DRY rule, generic score, stage or Gate.
+
 Implementation order, methods and feedback cadence remain Goal-owned. The thin discipline is to reuse the owning service/facade/adapter and one source of truth, make the smallest complete change, preserve explicit failure/resource semantics and add abstraction only for a stable concept or evidenced change axis. Exact product/technical predicates remain owned by Semantic Facts and selected UI/UX values by selected-design closure.
 
 After implementation and project verification, `Engineering Quality Conformance` includes `Architecture Conformance` and checks the current candidate for scope/path escape, owner/dependency violations, owner bypass, duplicate truth, undeclared boundary/lifecycle change, silent failure, applicable resource/concurrency/security/compatibility/operability defects, unsupported performance claims, missing declared checks and new or worsened debt. A performance claim requires workload, metric, baseline or budget, environment, comparator/tolerance and a project-owned benchmark/probe; static shape is not runtime proof. Any candidate or controlling-input change invalidates the result. Default work embeds this closure in Contract Conformance; Long-Task maps every material independently falsifiable invariant into existing Source-backed obligations/constraints/forbidden shortcuts, owners/paths/Bindings, executable Checks and separate Assertions where functional behavior could pass independently. Final Gate is the sole Long-Task carrier and proves only that declared project-check-bound set—not overall code quality. The two carriers never both run for one candidate.
@@ -318,9 +320,9 @@ Every non-interference method requires a digest-identified frozen executable Ora
 
 Capacity changes representation, never the information universe. The canonical per-target observable-Fact manifest is the sole complete Fact/Census/proof index. New DSA authoring keeps the shipped `design-resource-handoff-v1` marker and adds `representation: manifest_backed`; one small target file contains only readable target-attributed Source plus residual scope/provenance, resource identities, one target/profile, resource closure, coverage and proposal binding. Before generation DSA freezes the explicit manifest path set, target/scope identities, file SHA-256 and exact collection counts/identity digests, then calls `ty-context design-resource bundle` with an actual UTF-8 ceiling. Bundle rejects full-array or multi-target drafts, over-budget descriptors, missing/extra/duplicate targets and any manifest/preflight drift; validates one target at a time from one resource snapshot; and atomically publishes the complete set through a same-volume temporary directory. It never splits an existing or newly generated target. Preflight hydrates all omitted collections from the canonical manifest and runs the same complete V1 validator. V1 admission first uses file stat plus a bounded prefix capacity header and rejects over-budget input before full parse/hydration; it never truncates rows or expands and later deduplicates them. The diagnostic may recommend explicit V2 authoring but cannot flip a target automatically.
 
-For V2, equivalence means equal denotation at every `subject/relation × target × reachable condition/variation × applicable atomic property × population/quantifier` point: disposition, located expected semantics and complete proof-obligation meaning must match V1, while physical V1 ground-row identity need not. One manifest compilation session shares axis partitions, predicate/Boolean memoization and DAG hash-consing; tuple/profile/Rule indexes avoid per-point full-array scans. Set-valued certificates carry exact Rule and omitted-axis sets without physical Rule × axis edges, and no representation or runtime path may scale with theoretical ground cardinality. The deterministic package fixture covers 639 subjects, 217 properties, 53 axes and 5,245 variations while preserving all 138,663 logical subject-property dispositions without 137,385 N/A rows. A single Long-Task Contract may mix V1 and V2 targets and the existing current-snapshot Final Gate evaluates each under its declared representation. Purpose-fulfillment efficiency non-degradation is a package mechanism-change admission property, not an AcceptedDeliveryTerminal condition. Non-UI symbolic admission and Provider/P0 trust-boundary work remain out of scope.
+For V2, equivalence means equal denotation at every `subject/relation × target × reachable condition/variation × applicable atomic property × population/quantifier` point: disposition, located expected semantics and complete proof-obligation meaning must match V1, while physical V1 ground-row identity need not. One manifest compilation session shares axis partitions, predicate/Boolean memoization and DAG hash-consing; tuple/profile/Rule indexes avoid per-point full-array scans. Set-valued certificates carry exact Rule and omitted-axis sets without physical Rule × axis edges, and no representation or runtime path may scale with theoretical ground cardinality. The deterministic package fixture covers 639 subjects, 217 properties, 53 axes and 5,245 variations while preserving all 138,663 logical subject-property dispositions without 137,385 N/A rows. A single Long-Task Contract may mix V1 and V2 targets and the existing current-snapshot Final Gate evaluates each under its declared representation. Purpose-fulfillment efficiency non-degradation is a package mechanism-change admission property, not an AcceptedDeliveryTerminal condition. Non-UI symbolic admission remains out of scope; machine-observer and verifier/runner trust-boundary closure is mandatory rather than deferred Provider/P0 work.
 
-Those inputs remain Source. The default Workflow opens affected exact targets or constraints and their declared conditions, routes them through production owners and cold-start journeys, runs applicable project-native visual, interaction, accessibility or runtime checks on the final candidate and reports every condition those checks did not establish. It does not rebuild the complete UI Fact Cell universe or per-Fact-by-method production result ledger. Long-Task projects the exact universe into existing Claims/Assertions/Checks/Bindings: every method/condition cell carries exact `fact_refs`, one `fact_expectations` row per Fact/proof obligation and one current `fact_results` row containing that same observation/comparison/authority tuple; Final Gate requires exact expectation/result set equality and every result to pass on one current snapshot. Protected/sensitive observations remain redacted or digest-only without losing comparison authority. These carriers are mutually exclusive. Generation success, screenshots, hashes, Census and handoff preflight prove input completeness or integrity only, never production conformance.
+Those inputs remain Source. The default Workflow opens affected exact targets or constraints and their declared conditions, routes them through production owners and cold-start journeys, runs applicable project-native visual, interaction, accessibility or runtime checks on the final candidate and reports every condition those checks did not establish. It does not rebuild the complete UI Fact Cell universe or per-Fact-by-method production result ledger. Long-Task projects the exact expected universe into existing Claims/Assertions/Checks/Bindings: every method/condition cell carries exact `fact_refs` and one `fact_expectations` row per Fact/proof obligation. A current `fact_results` row may close that cell only when a package-admitted observer supplies its Actual and Harness comparison; otherwise the cell remains a blocking External Confirmation and Final Gate fabricates no result. The current slice does not admit UI layout/pixel/accessibility/motion, browser/native/device, protected or tolerance/mask observations. These carriers are mutually exclusive. Generation success, screenshots, hashes, Census and handoff preflight prove input completeness or integrity only, never production conformance.
 
 The default Workflow performs UI Authority Closure and a conditional Design Authority Check before a material product, design, implementation or acceptance decision for new/redesigned screens, primary layout/navigation/theme/component-system work, high-fidelity implementation and substantial visual polish. It traverses affected stable keys to exactly one canonical adoption record, then actively opens every selected `exact-target` or `constraint`; a registry or handoff-index mention alone is not consumption. `DESIGN.md` canonically records project/system/component-family targets, while the owning Screen Contract records one-screen/interaction-specific targets. The canonical record owns interpretation, selection basis, readable immutable locator/digest, declared condition coverage and editable upstream owner/locator/update route; other layers keep only the stable key, canonical owner/anchor and local applicability. Missing, unreadable, stale or conflicting resources fail closed. Updates create a new immutable version instead of overwriting the adopted baseline. An unconfigured starter, candidate, style-only prose or inspiration does not authorize invented production layout. Explicit design-system adoption routes to `design-system-authoring`; standalone resource generation routes to `design-resource-authoring`. Implementation with sufficient authority, local style fixes and throwaway prototypes remain lightweight.
 
@@ -328,9 +330,9 @@ For selected implementation handoff files, DSA first publishes the exact target
 
 For material work, `context_uiux_design` applies the projection above and keeps risk-proportional coverage reasoning task-local. `context_development_engineer` traces every affected selected target and declared condition through stable surface/control keys to the production route/component owner, cold-start real-user journey and applicable rendered/interactive checks. A first useful runnable production slice is a recommended real-entry feedback point when early localization is worth the cost, never an implementation gate; the final candidate always reruns the affected cold-start journey. Source-required combinations cannot be silently pruned, but default work reports conditions it did not establish instead of claiming exact machine closure. Resource hashes, manifests and counts prove integrity only; an implementation screenshot cannot become its own target or implementation-conformance proof.
 
-An explicit Long-Task is the strong machine carrier of the same shared obligation. It resolves missing/conflicting UI authority before Compile, then closes all 22 canonical fields of every real Product Control through `field_coverage`; that semantic Control projection is independent of, and never caps, the finer design Fact universe. Selected targets freeze the canonical manifest identity/digest and project every atomic Fact/required-method pair into a `fact_expectations` row with subject/target/condition/variation/property identity, expected located-value digest, comparator/parameters/tolerance/mask, Oracle identity/capabilities, environment and sensitivity. Current Check evidence supplies an exact matching `fact_results` row with actual observation/environment, comparison and pass/fail; duplicate/reused observations, missing results, stale authority or any failure block Final Gate. `design_conformance` remains a typed current-execution record for target-level actual/comparison artifacts, while `design_method` binds the independently failing method/condition cells and their per-Fact rows; neither aggregate record replaces atomic Fact proof. Product `surface_bindings`, Control Claims/relations and root-entry journeys continue to carry product semantics, while existing Claim, Assertion, Check, Stage, Binding, revision and Final Gate mechanisms remain the sole Long-Task lifecycle and closure. Every blocker preserves exact Source-item/method/capability lineage and cannot be dismissed in-band; scope removal requires revised Source/Contract authority.
+An explicit Long-Task is the strong authority carrier of the same shared obligation. It resolves missing/conflicting UI authority before Compile, then closes all 22 canonical fields of every real Product Control through `field_coverage`; that semantic Control projection is independent of, and never caps, the finer design Fact universe. Selected targets freeze the canonical manifest identity/digest and project every atomic Fact/required-method pair into a `fact_expectations` row with subject/target/condition/variation/property identity, expected located-value digest, comparator/parameters/tolerance/mask, Oracle identity/capabilities, environment and sensitivity. Only a package-admitted observer may supply the matching `fact_results` Actual/comparison row. In the current slice, project `design_conformance`, `design_method` and `fact_results` records are diagnostic; affected UI/design obligations remain blocking External Confirmations rather than machine proof. Product `surface_bindings`, Control Claims/relations and root-entry journeys continue to carry product semantics, while existing Claim, Assertion, Check, Stage, Binding, revision and Final Gate mechanisms remain the sole Long-Task lifecycle and closure. Every blocker preserves exact Source-item/method/capability lineage and cannot be dismissed in-band; scope removal requires revised Source/Contract authority.
 
-Combined design-and-implementation work may author candidates in ordinary Outcomes/Stages, but a candidate or planned target cannot authorize fidelity implementation. The selection must become real marked Context-reachable Source plus its owning Context/`DESIGN.md` reference and, after Authority Lock, an adopted Authority Revision. Browser visual ACs use `ui_browser`; a browser proxy, detached route or deep link cannot prove a native/root journey that can fail independently. Resource integrity and `visual_render` cannot satisfy selected-target implementation conformance. Frozen baselines are verifier inputs, generated actual renders/diffs are current artifacts, and subjective approval remains external. This adds no `uiux_delivery` block, visual Claim type, resource registry, risk level, lifecycle state, Gate, required design directory, per-Control screenshot matrix or universal pixel threshold.
+Combined design-and-implementation work may author candidates in ordinary Outcomes/Stages, but a candidate or planned target cannot authorize fidelity implementation. The selection must become real marked Context-reachable Source plus its owning Context/`DESIGN.md` reference and, after Authority Lock, an adopted Authority Revision. Browser visual ACs may use `ui_browser` for diagnostic localization, but current machine closure remains External Confirmation; a browser proxy, detached route or deep link cannot prove a native/root journey that can fail independently. Resource integrity and `visual_render` cannot satisfy selected-target implementation conformance. Frozen baselines are verifier inputs, generated actual renders/diffs are current artifacts, and subjective approval remains external. This adds no `uiux_delivery` block, visual Claim type, resource registry, risk level, lifecycle state, Gate, required design directory, per-Control screenshot matrix or universal pixel threshold.
 
 `ty-context doctor` keeps its compatible `missing | unconfigured | configured` project-level status and adds advisory Design Authority Index, token-source and classified-reference signals. It explicitly does not infer surface implementation readiness; that requires the owning Screen/Control meaning, selected target/constraints and project-owned verification.
 
@@ -344,10 +346,12 @@ Generation produces candidates. Explicit human selection—or explicit delegated
 
 ### Optional Design Resource Authoring
 
-Use `design-resource-authoring` only when explicitly asking to generate, iterate or prepare standalone design resources, prepare the design resources for a named development scope, or use Open Design. Inputs may be raw notes or an initial proposal, product/technical plans, a specialized visual brief, screenshots, existing resources or a legacy Source Plan. A standalone Source Plan is not a prerequisite or recommended middle stage.
+Use `design-resource-authoring` only when explicitly asking to generate, iterate or prepare standalone design resources, prepare the design resources for a named development scope, or use Open Design. Inputs may be raw notes or an initial proposal, product/technical plans, a specialized visual brief, screenshots, existing resources or another pre-existing planning document. No standalone intermediary authoring document is a prerequisite or recommended middle stage.
 
 The Skill fixes the requested output or development content as a hard scope ceiling. A partial feature includes only the surrounding context needed to place it; broad background never expands generation to the rest of the page or product. For an implementation handoff, the Skill accounts for material UI/UX meaning from surface/flow structure through relevant regions and controls: visual/content treatment, component anatomy and variants, static/dynamic states, interaction/feedback/recovery/motion, responsive/platform/input behavior, accessibility and necessary assets. It subtracts only coverage explicitly supplied by selected existing Source, then discovers current Open Design agents/models, functional skills, rendering templates, design systems, plugins and export routes and gives every considered resource a reasoned `selected`, `optional`, `not-needed`, `unavailable` or `decision-required` disposition.
 
+Formal generation, a major design revision and critical regeneration use the highest eligible live model and that model's highest supported reasoning effort. Eligibility first preserves required tools, visual/context capability, authentication and data boundaries; provider capability ordering or documented replacement evidence establishes rank. The Skill never guesses from price, model name, release date or list order. An unrankable choice fails closed as `highest_performance_unverified`; an uncontrollable or unobservable provider result is reported with the same qualification and is never described as a confirmed highest-tier run. This policy creates no model registry, scheduler or persistent routing state.
+
 For formal Web/App implementation output, “complete” defaults to the finest applicable observable Fact granularity described above. The Skill builds the Expected Fact Universe and frozen Inspector/Census obligation before commissioning generation, passes that obligation and the adopted design-system identity into Open Design, and requires the returned canonical source/manifest to express every applicable cell. It does not wait for downstream implementation to discover missing states, anatomy-part styling, responsive/platform/text-scale behavior, motion, accessibility or asset facts.
 
 It first classifies the commission. High-fidelity/branded output, visual direction, typography/color/density, component visual treatment and production-style prototypes are style-bearing: if `DESIGN.md` is unconfigured or lacks one authored token source/direction, the Skill stops before provider project/run creation and tells the user to explicitly select `design-system-authoring`; it never initializes authority itself. Low-fidelity structure, IA/flow topology and semantics-only behavior/state studies remain non-fidelity. For style-bearing work, the Open Design MCP project is created or checked with `create_project.designSystem`, and `get_project.designSystemId` must match the adopted provider ID.
@@ -356,15 +360,17 @@ It commissions only the smallest sufficient artifact/file set through structured
 
 For implementation Web/App output, the Skill requires the complete canonical entry/dependency set and addressable declared facts described above. Figma remains useful when an existing design team needs native Components/Variables/Variants, shared libraries, Dev Mode or Code Connect; Penpot when open/self-hosted multi-user design infrastructure is itself required; OpenPencil as a local static-layout sidecar while its prototype/motion model remains incomplete. Default conversion from complete Open Design source to another representation is not required because it adds synchronization and operating cost without closing a new enforcement gap.
 
-Exploration returns the requested visible candidate after minimal sanity review and requires no handoff schema. After explicit or delegated final selection for implementation, the Skill performs one consolidated idempotent proposal reconciliation and writes one provider-neutral marked Markdown Source per target. V1 manifest-backed authoring remains the default; only an explicit per-target symbolic opt-in emits the strict V2 Rule manifest/handoff. Shared preflight normalizes the declared representation and cannot call incomplete, unaddressable, unresolved, unsupported or stale input ready. There is no fixed directory, provider pack or one-file-per-control rule. The adapter is ordinary Source, not Design Authority or acceptance, and the Skill never edits a Source Plan, `project_context/**`, `DESIGN.md`, production code or a Delivery Contract.
+Exploration returns the requested visible candidate after minimal sanity review and requires no handoff schema. After explicit or delegated final selection for implementation, the Skill performs one consolidated idempotent proposal reconciliation and writes one provider-neutral marked Markdown Source per target. V1 manifest-backed authoring remains the default; only an explicit per-target symbolic opt-in emits the strict V2 Rule manifest/handoff. Shared preflight normalizes the declared representation and cannot call incomplete, unaddressable, unresolved, unsupported or stale input ready. There is no fixed directory, provider pack or one-file-per-control rule. The adapter is ordinary Source, not Design Authority or acceptance. Outside the one explicitly authorized proposal writeback target, the Skill never edits caller-owned planning/proposal Source, `project_context/**`, `DESIGN.md`, production code or a Delivery Contract.
+
+Material DRA revision loops replay from a raw-digest-bound Base plus complete ordered Delta semantics. Deterministic accepted authority additionally requires a strict `ty-dra-authority-v1` projection inside the same digest-covered marked Source Item: explicit choices bind exact target/kind/origin/meaning digest, while delegation binds only its exact choice scope and never becomes a non-visual meaning Source. Every semantic target has at most one active accepted Delta owner; rejected, unresolved and superseded Deltas form an exact leakage universe. One v3 audit-expectations catalog freezes changed/unchanged/resource-decision/blast-radius/leakage rows plus selected-resource conditions, and current audit rows must be set-equal without duplicate identities. Exact-patch-v2 binds every active non-preserve `Delta × target` once to its Proposal text span and semantic digests; every such binding has exactly one `proposal-written` or structured, repository-readable `resource-owned-exact-visual` owner. A real cross-interruption need may explicitly `create` one ignored, task-local, non-authoritative checkpoint; `update` replaces it only through caller-supplied checkpoint digest CAS, while `inspect` and `preview` rederive current state. `apply` uses pre/post raw-byte CAS and reread reconciliation, reporting applied, idempotent, blocked or external-resource revalidation pending—not handoff readiness. `remove` fully deletes only after inventory proves the directory contains the digest-matched helper checkpoint; otherwise it returns `partial` and preserves unowned content. A simple preview creates no checkpoint, persisted bytes, pause, Provider run, formal handoff, Proposal write or helper transaction. The checkpoint and reconciliation are upstream recovery/diagnostic data, never Design Authority, Long-Task Source/Evidence or completion proof.
 
 Actual generation remains with configured Open Design/Product Design, Figma, image-generation, prototype or human systems. Their outputs enter the default Workflow or Long-Task as ordinary external Source. Candidates and inspiration authorize no fidelity. An adopted exact target/constraint becomes Context-reachable Source: owning Context/`DESIGN.md` maps its stable key to declared conditions, a stable immutable identity/digest and an editable upstream owner/locator/update route. `context_uiux_design` performs downstream UI Authority Closure and adopts only durable facts into Context/`DESIGN.md`; implementation renders and diffs remain evidence artifacts rather than self-authorizing targets.
 
 Maintainers may set `TY_CONTEXT_OPEN_DESIGN_MCP_COMMAND` plus optional `TY_CONTEXT_OPEN_DESIGN_MCP_ARGS_JSON` and run `npm run smoke:open-design` for an opt-in, read-only discovery smoke. Normal tests use a local mock MCP and never require Open Design, login, paid access or nondeterministic design output.
 
-### Retired Source Plan Compatibility
+### Retired Standalone Authoring Compatibility
 
-`source-plan-authoring` is no longer installed or package-managed. Upgrade migration removes only the byte-exact former package pointer; modified same-name content is preserved for manual review, and ordinary sync keeps no tombstone or blind deletion rule. `long-task-workflow` opens the non-authoritative Contract Draft immediately and converges complete input inventory, mixed-input synthesis/refinement, stable-key and Product Control-level meaning, preference/research/delegation traceability, Source markers/provenance and Contract mapping in that same loop. This semantic Control projection does not cap the separate complete-observable-design-fact inventory for selected resources. A legacy Source Plan document remains valid ordinary Source, but no separate or internal Source-authoring stage, handoff, schema, gate, state or second plan is created.
+Retired standalone authoring pointers are no longer installed or package-managed. Upgrade removes only byte-exact former package content; modified same-name content is preserved for manual review, and ordinary sync keeps no tombstone or blind deletion rule. `long-task-workflow` opens the non-authoritative Contract Draft immediately and converges complete input inventory, mixed-input synthesis/refinement, stable-key and Product Control-level meaning, preference/research/delegation traceability, Source markers/provenance and Contract mapping in that same loop. This semantic Control projection does not cap the separate complete-observable-design-fact inventory for selected resources. A pre-existing planning document remains valid ordinary Source, but no separate or internal Source-authoring stage, handoff, schema, gate, state or second plan is created.
 
 ## Single-Goal Rolling Delivery
 
@@ -381,9 +387,17 @@ Use `long-task-workflow` only when explicitly selected or when the current workt
 - a complete Final Gate on one current snapshot;
 - a Stop Hook that rejects stale completion.
 
-Its proof claim is conditional and precise: if Source is complete and accurate at the declared observable granularity, projection preserves that meaning, every actual applicability cell is expanded, and the named project oracle plus installed verifier/runtime trust boundary is semantically sound, then `AcceptedDeliveryTerminal`—exactly a fresh `machine_accepted` result with no pending External Confirmation—implies no declared observable drift remains. `machine_accepted_external_pending` proves only that machine-verifiable declared drift is empty; full delivery remains qualified and the native Goal is untouched. The workflow mechanically enforces and freezes many premises, but it cannot discover undeclared requirements or prove an arbitrary project oracle truthful.
+Its proof claim is conditional and precise: if Source is complete and accurate at the declared observable granularity, projection preserves that meaning and every actual applicability cell is expanded, then `AcceptedDeliveryTerminal`—exactly a fresh `machine_accepted` result with no pending External Confirmation—implies no declared machine-observable drift remains only because every machine obligation has frozen Expected authority, package-admitted current Actual, Harness-computed comparison/verdict, attributable static-production or direct-process observation, causal Counterfactual evidence and current Final-Gate snapshot proof. `machine_accepted_external_pending` proves only the admitted machine scope; full delivery remains qualified and the native Goal is untouched. The workflow cannot discover undeclared requirements or prove arbitrary physical/external observation sound.
+
+Compile derives an internal `CompiledObservationAuthority` projection for every machine Claim or Fact × required-method obligation; it is not a new Contract Authority, state or registry. The first admitted slice has only two machine paths. `package_static_json_exact` reads plain exact implementation/configuration content from a UTF-8 JSON production carrier that already exists in the pre-run snapshot, retains the same no-follow file identity/digest after the runner, matches the Binding and is not Source/Context/Contract/expected material or evidence/report/status/verifier output; Harness selects the fixed RFC 6901 `/observations/<stable Fact-or-obligation identity>` locator and applies package duplicate-key/UTF-8/size/depth/pointer limits. Prepare-all mutation observation plus per-file pre/post identity/hash rejects transient and persistent runner swaps; it proves static content, not runtime consumption. `package_process_json_exact` applies only to a Source-backed `runtime_family: process`, `role: product` target and a direct root `project_binary` whose target and complete argv match that authority. Each required target has one canonical Source technical-obligation target covering key, role, family, root, complete argv and capabilities. Compile derives one declaration-stable process-runtime closure containing the exact Source-backed root, exact Claim/Counterfactual production carriers and only finite argv values that resolve to a production Binding. It examines a standalone argument or explicit `--key=value`, resolves safe repository-relative values from the declared `cwd`, and admits a path only when an exact or pattern Binding covers it; glob-owned and extensionless files are supported. An unmatched safe relative value is ignored and not copied. Absolute paths, repository escapes, `file:` URLs and network URLs fail closed unless their semantics are explicitly routed to the existing external TCB/External Confirmation boundary. Compile neither broadly role-scans nor copies all `input_paths`; role separation applies only to actual closure members. Global Checks project Outcome Bindings into internal `{ outcome_key, local_key, binding_ref, binding }` records using `<outcome>.<binding>`: logical refs remain distinct while identical physical paths may be copied once, with no authored-Contract or registry change. Exact planned closure members may be absent through Compile but must materialize at Final Gate. Harness copies only that closure into an OS-temporary snapshot and binds its identity into host attestation. The child receives the minimal runner environment with no observation-path, challenge or protocol variable and emits exactly one bounded `ty-context-product-observation-v1` envelope on stdout; compatible Cross-Check and implicit-preserved Facts share that Raw Execution/envelope while retaining independent result identities. This proves only exact values emitted by the Source-backed product root on the declared JSON output surface. An embedded dependency that cannot be explicitly production-bound or a Claim that cannot bind to that surface requires External Confirmation. The public project payload remains v3; no v4, general UI/native observer or language dependency parser is introduced.
+
+Project-submitted v3 actual/value digest, comparison, `passed`, verdict and capability records are compatibility diagnostics only; they never supply Actual or completion authority. The current package-derived capability slice is exact/presence plus host-derived `target_runtime`. `interaction_trace`, `state_delta`, `design_conformance` and every other capability without a package-derived implementation require blocking External Confirmation even when a project record is present. Custom/`named_external_tcb` Oracles, wrappers, browser/native/device sessions, layout/pixel/accessibility/motion, protected observation, tolerance/mask and custom locators likewise cannot machine-close an obligation. Every machine Counterfactual needs package-admitted baseline and mutated observations on the same compiled process-closure identity, a mutation target in its production-carrier set, exact affected/preserved/allowed-fan-out accounting, equal obligation universes and host-derived process liveness; no-observation never skips validation. Existing Contracts are not silently rewritten, and target/closure TCB changes invalidate prior Active Authority, Progress, Evidence and Receipts for acceptance.
 
-Raw/revised proposals, selected design resources and mixed attachments enter one Source-bound Contract Draft loop immediately. Complete input inventory, stable keys, Product Control-level meaning, selected-resource design facts, acceptance/risk coverage, direct/derived/delegated/evidence-backed provenance, Source ownership and Contract mapping converge together. Every non-empty line in declared Markdown Source must belong to one Material `ty-source-item` block, one validated `design-resource-handoff-v1` or `design-resource-handoff-v2` formal block, or a closed-grammar background block: `markdown-structure` permits only text-free anchors/horizontal rules and `provenance` permits only `ty-source-provenance` comments with fixed `input`, `mode`, conditional `source` and optional `sha256` fields. A text-bearing heading or free-form provenance field can express authority and is therefore rejected as background. Arbitrary background prose and all other unclassified text fail closed. At least one marked technical obligation carries `aspect=architecture` and maps to an independently provable architecture obligation. If an unknown preference could materially change comparative research or selection, the workflow asks before Preflight/Compile can succeed. Once criteria are clear, a defensible recommendation is written into real Source with its delegation, preference/evidence basis and exact meaning; it is never hidden only in YAML. High-risk action remains an external confirmation. Legacy Source Plan structure never blocks authoring.
+An honestly unsupported Contract does not need a dummy verifier. Existing External Confirmations may cover exact ordinary/global and Semantic Fact Claim identities through `impact_claims`, while each Semantic Fact proof keeps its explicit `confirmation_ref`. An external-only Outcome sets `success_path_required: false`; a Stage Gate may omit its machine Check only when a `blocks_target: true` confirmation impacts that gate's result Claim. Missing result lineage, a non-blocking confirmation or a declared machine success path without a real success Check fails Preflight/Compile. A valid external-only route ends as `blocked_external`, never machine accepted.
+
+Direct-process observation is bounded containment, not an absolute hostile-code sandbox. Its TCB includes the host OS/filesystem/process APIs, Node runtime, snapshot-copy and no-follow/digest checks, stdout capture/decoder, timeout, process-tree inspection and cleanup. Frozen subtraction controls reopen transient/persistent carrier swaps or descendant/timeout leaks if the corresponding watcher/pre-post or containment/cleanup responsibility is removed, so those existing mechanisms remain; no additional edge mechanism is claimed. It does not claim to stop an intentionally malicious executable from escaping the copied closure, accessing ambient machine/network resources or evading every OS process-tree mechanism; workloads needing that adversary boundary require an external sandbox or External Confirmation.
+
+Raw/revised proposals, selected design resources and mixed attachments enter one Source-bound Contract Draft loop immediately. Complete input inventory, stable keys, Product Control-level meaning, selected-resource design facts, acceptance/risk coverage, direct/derived/delegated/evidence-backed provenance, Source ownership and Contract mapping converge together. Every non-empty line in declared Markdown Source must belong to one Material `ty-source-item` block, one validated `design-resource-handoff-v1` or `design-resource-handoff-v2` formal block, or a closed-grammar background block: `markdown-structure` permits only text-free anchors/horizontal rules and `provenance` permits only `ty-source-provenance` comments with fixed `input`, `mode`, conditional `source` and optional `sha256` fields. A text-bearing heading or free-form provenance field can express authority and is therefore rejected as background. Arbitrary background prose and all other unclassified text fail closed. At least one marked technical obligation carries `aspect=architecture` and maps to an independently provable architecture obligation. If an unknown preference could materially change comparative research or selection, the workflow asks before Preflight/Compile can succeed. Once criteria are clear, a defensible recommendation is written into real Source with its delegation, preference/evidence basis and exact meaning; it is never hidden only in YAML. High-risk action remains an external confirmation. A pre-existing planning document's structure never blocks authoring.
 
 Before the first successful formal Compile, `delivery-contract.yaml` is one non-authoritative Contract Draft. `long-task-workflow` opens it at entry and keeps revising that same Draft across Source refinement, repository/Context reads, mapping and Preflight repair rounds; it does not require one response to produce a complete Contract. Source completeness is a convergence condition for Preflight/Compile, not a prior phase. No standalone Contract Draft Skill, Draft Receipt or Authoring State exists.
 
@@ -395,13 +409,19 @@ The package-managed Long-Task Skill uses progressive disclosure: its main `SKILL
 
 A Draft Outcome is simply an Outcome before Authority Lock. Outcomes split independently observable, decidable, vertical and target-verifiable results so the current Goal can project a smaller acceptance/verification-ready working set, localize failures, resume findings and invalidate stale local results. `depends_on` expresses acceptance and intermediate-proof readiness, not implementation permission. Every Outcome belongs to one ordered Stage; its Stage gate transitively depends on the other Outcomes in that Stage, and later Stages depend on earlier gates. The Rolling Frontier and Stage status are derived from ordinary Outcome Progress and are temporary advisory projections. The Goal may implement, inspect or repair any in-scope Outcome in the order current code favors and may optionally use one or multiple platform-native agents/subagents. Harness allocates and records none of them, agent reports are not Progress or proof, and all outputs converge into the selected verification workspace. An Outcome is not a Worker, scheduler task, queue or parallelism unit, and a Stage owns no Receipt or second Gate. Outcome decomposes diagnosis and proof ownership, not completion authority: targeted passes never replace the one complete Final Gate on the current final snapshot.
 
-The Contract declares one bounded target profile, its non-empty required product target refs and each target's runtime family, root entrypoint and explicit capabilities. Required product targets name their family capability plus `cold-start` and `production-root`. A Web/process proxy cannot satisfy an independently required Native/desktop target. Browser target proof uses Playwright; Native/desktop target proof uses a project binary. Every `critical_user_path` Outcome and Stage gate proves `target_runtime` from every required target's root entrypoint; a multi-Outcome Stage gate also proves at least two distinct surfaces share one runtime state.
+The Contract declares one bounded target profile, its non-empty required product target refs and each target's runtime family, root entrypoint, complete root argv and explicit capabilities. Each required target maps through Source Claim disposition to one canonical Source technical obligation with the same target identity; the process root and every argv path actually admitted by the finite exact/pattern match additionally belong to the production owner and a production Binding. Compile derives one declaration-stable runtime closure from the root, matched argv paths and required carriers rather than copying or broadly scanning all `input_paths` or manifest siblings. A safe unmatched relative argument is not a dependency; an absolute, escaping, file-URL or network reference fails closed unless it is explicitly external. Planned matched paths may be absent during Preflight/Compile, but Final Gate requires them in the current candidate and materialization alone keeps Authority identity stable. A Web/process proxy cannot satisfy an independently required Native/desktop target. Current machine target-runtime proof exists only when Harness directly spawns that Source-backed process product root; browser/native/desktop/device requirements remain target-blocking External Confirmations. Every `critical_user_path` Outcome and Stage gate accounts for every required target through admitted root proof or that External Confirmation.
+
+When a declared result can pass on a proxy surface while failing in its target runtime, the earliest owning Outcome carries either an admitted direct-process root Check or a blocking External Confirmation. A project payload, tracked report, screenshot, binary, log, historical run, new session id or proxy cannot be runtime authority. Checks still declare keyed Given/When scenarios and exact applicability; every Claim-bearing Assertion remains independently attributable without sampling. Project capability records are diagnostic compatibility data; only currently admitted exact/presence and host `target_runtime` results can satisfy their matching all-of cells, while every unsupported capability remains external. Static structure cannot prove behavior. Every behavioral machine Assertion uses a same-Check Counterfactual whose admitted affected Facts change, preserved Facts/liveness do not, other changes are explicit fan-out and baseline/mutated obligation universes and compiled process-closure identities are equal. A Binding or path is not reachability proof: static mutation proves only that structure, while runtime reachability requires Harness mutation of a compiled production carrier → direct Source-backed product-root execution → package-observed Actual change. Pure Authority/verification/evidence/status/report/Receipt/verifier input cannot enter that closure. The remaining runner identity, minimal invalidation-envelope, targeted-feedback and current Final-Gate rules are unchanged; this adds no generic reachability scanner, implementation gate, scheduler or state.
+
+Long-Task Anti-Degradation Assurance protects current causal-chain truth, cross-version interception strength and the adjacent `F = Implementation Freedom Boundary`. Context statements about the current implementation must match the indexed code/runtime; that implementation must still realize the meaning-capture/architecture and fail-closed observation/repair/final-snapshot responsibilities which, under the explicit Source/semantic/TCB boundary, imply the controlling no-false-completion purpose. `F` is an efficiency/anti-process-bloat invariant rather than a third responsibility or theorem premise: inside Source/Contract, architecture, safety, forbidden-shortcut and irreversible/external-action boundaries, implementation order, methods, local feedback cadence and optional one-agent or multi-agent/subagent execution remain Goal-owned. Harness adds no development phase/method Gate, per-edit mandate, agent scheduler/state or delegation proof. Weakening the purpose, key logic, either responsibility, theorem boundary or `F` requires an explicit project-owner design-purpose decision and replacement proof, not Agent inference, coordinated prose/code/test edits or cost alone. A new development-stage constraint must additionally close a distinct path that final proof or a lighter project-owned check cannot cover and demonstrate positive net ROI—specifically evidenced high total-cost ROI and high efficiency—after the hard safety/proof constraints. High means a significant stable margin, not a global/local optimum. Once validity, relative non-degradation, must-allow behavior, structural-cost limits and applicable measured total-cost thresholds close, construction stops unless a new real counterexample, repeated material cost hot spot or evidence of significant additional net benefit appears. This assurance uses existing Context, indexes, tests, critical sentinels, routing and parity gates; it adds no second Authority, Gate or state and cannot recover omitted/unobservable requirements or make itself immutable against deliberate fully authorized joint weakening.
+
+Mechanism and release wording therefore has four evidence levels: designed, implemented, protected against the declared known counterexamples, and high-quality realization within an explicit TCB. The current observer revision remains Level 3. R9/R10 preserve three non-interchangeable proof layers: unused non-closure evidence/verification inputs are must-allow; an attempted product read of a non-closure file is denied by runtime isolation and cannot be accepted; and an explicitly production-bound argv closure member with an evidence/verification role is Compile-rejected. Compile owner diagnostics bind a complete committed attack candidate, while stale-Authority non-reuse is proved separately by a legal-neighbor Authority followed by Final-Gate freshness rejection on that same attack candidate; `active_task_missing`, a dirty candidate or a fresh Compile rejection cannot substitute. The current machine report owns the exact attack/control population and terminals without a second registry. Level 4 still requires the unchanged complete total-cost ROI theorem and an independent capability audit with no open critical false-acceptance path. Prose review, test counts, fresh-Agent pairs, observed lifecycle wins and sanitized fixtures cannot promote the level or prove real-incident representativeness.
 
-When a declared result can pass on a proxy surface while failing in its target runtime, the earliest owning Outcome declares a project-owned Check that exercises the target during the current Check execution. A tracked report, screenshot, binary, log or historical run cannot be the sole runtime proof. Checks declare keyed Given/When scenarios and journey roles; global/Outcome applicability profiles bind the exact target, journey, one atomic duplicate-free dimension assignment set, Given condition/input/state refs and ordered When refs. Every Claim lists all applicable profiles, and each Claim-bearing Assertion proves exactly one Claim at one matching profile; every actual applicability × proof-surface cell remains attributable, without risk-based, pairwise or sampled substitution. Assertions declare all-of Evidence Capabilities backed by typed current-execution records. Static `presence` cannot prove behavior, degradation cannot replace required success, fixed-input output cannot prove variation and a producer cannot self-attest its own boundary/external effect. Every behavioral Claim-bearing Assertion also requires a same-Check claim-local `replace_json_value` or `replace_text` Counterfactual that keeps a claimless target-runtime liveness Assertion passing while the wrong behavior fails; whole-file replacement cannot establish semantic binding. Population binds a real universe carrier into the owning Check snapshot and proves exact universe = eligible = observed plus valid exclusions. Runner identity recursively freezes the supported direct-literal local verifier module/config/data graph—static imports/re-exports, literal dynamic imports, `require` forms and literal `new URL(..., import.meta.url)` files—and rejects non-literal loaders/`createRequire`; package scripts require a recoverable static Node entry. Candidate/runtime material remains explicitly owned by `input_paths`, `expected_output_paths` or `artifact_globs`; other indirect Oracle access belongs in `verification_inputs` or the named trusted boundary. Author each Check's `input_paths`/Bindings as its smallest sound invalidation envelope and keep every Counterfactual carrier traceable from the declared target root. The first useful runnable boundary and later coalesced changes are recommended targeted-feedback points only when early localization is worth the cost. `progress_stale` reports that prior evidence no longer covers current inputs; refresh it only before an intermediate decision relies on that result. Implementation and Final Gate may proceed with stale or absent Progress because Final Gate ignores it and reruns every declared Check. `verify --explain` previews bounded declared runner invocations without execution or Progress writes, but cannot predict duration or commands spawned inside a runner. This adds no generic reachability claim, implementation gate, second executing diagnose mode, scheduler, trigger queue, per-platform progress state or per-edit rebuild rule; runtime-specific readiness/build/process behavior stays in the project runner, and Final Gate remains authoritative.
+The real-process ROI owner is `examples/delivery-benchmark/real-process-workload/**` plus `tools/long_task_real_process_roi_{policy,runner,scoring}.mjs` and `tools/verify_long_task_real_process_roi.mjs`. It freezes eight Facts, normal/degraded modes, two Counterfactuals, independent semantic gold, A/B/C comparison roles and each fixture's committed candidate identity. Exact raw HEAD/tree/status command records before and after each fixture lifecycle bind that identity and require the candidate to remain clean and unchanged. Its versioned report may expose recomputable `observed_lifecycle_*` validity, paired-win, margin, variance, phase, correct-path, resource and false-completion/false-blocking facts, but those fields have no admission meaning and never use `qualified_positive_*`. Complete total-cost support additionally requires independently attributable verified Authoring, Runtime, State, Recovery, maintenance, test, process, introduction, adoption and migration evidence. The current v2 implementation has no independent formal-cost evidence ingestion and admits no self-attested `verified` row; any missing, unverified or unadmitted category forces `total_roi_supported=false` and forbids `total_roi_positive=true`. Machine measurement and independent governance admission remain separate, and a report-shape change requires a new schema version or an explicit tested compatibility reader that preserves missing evidence.
 
-Long-Task Anti-Degradation Assurance protects current causal-chain truth, cross-version interception strength and the adjacent `F = Implementation Freedom Boundary`. Context statements about the current implementation must match the indexed code/runtime; that implementation must still realize the meaning-capture/architecture and fail-closed observation/repair/final-snapshot responsibilities which, under the explicit Source/semantic/TCB boundary, imply the controlling no-false-completion purpose. `F` is an efficiency/anti-process-bloat invariant rather than a third responsibility or theorem premise: inside Source/Contract, architecture, safety, forbidden-shortcut and irreversible/external-action boundaries, implementation order, methods, local feedback cadence and optional one-agent or multi-agent/subagent execution remain Goal-owned. Harness adds no development phase/method Gate, per-edit mandate, agent scheduler/state or delegation proof. Weakening the purpose, key logic, either responsibility, theorem boundary or `F` requires an explicit project-owner design-purpose decision and replacement proof, not Agent inference, coordinated prose/code/test edits or cost alone. A new development-stage constraint must additionally close a distinct path that final proof or a lighter project-owned check cannot cover and have positive net ROI. This assurance uses existing Context, indexes, tests, critical sentinels, routing and parity gates; it adds no second Authority, Gate or state and cannot recover omitted/unobservable requirements or make itself immutable against deliberate fully authorized joint weakening.
+The mechanism's own Final-Gate Oracle reads fixed-test-ID machine reports and compares complete wrong-candidate versus correct-control workflow statuses. A runtime capability requires `wrong candidate != machine_accepted` and `correct candidate == machine_accepted` through the real lifecycle; command exit plus token/string presence proves documentation consistency only. ROI is computed by a separate verifier and never enters a safety Fact verdict.
 
-Workflow mechanism admission is lexicographic: Safety/Coverage → Semantic Granularity → Proof Strength/TCB plus non-bypassable Authority/fail-closed/current-final-snapshot proof → Structural Closure Cost Non-Degradation → Total-cost ROI. The efficiency objective is **Fine-Grained Semantic Purpose-Fulfillment Efficiency**: fully attain the declared fine-grained semantic and proof effect while removing cost unrelated to an independent semantic unit, necessary proof, trust boundary or adapter. Logical Fact/obligation granularity may be finer than persistence; unrelated Cartesian axes, derivable repetition and copied shared metadata are not valid long-term cost drivers. For equivalent-effect workloads, Source/Contract/evidence bytes, DAG work, Compile/Preflight/Final Gate, peak RSS, default Context reads and one-Fact revision blast radius cannot grow for those structural reasons. Cost never compensates for weaker granularity, proof or drift detection, and positive ROI permits consideration rather than automatic adoption.
+Workflow mechanism admission is lexicographic: Safety/Coverage → Semantic Granularity → Proof Strength/TCB plus non-bypassable Authority/fail-closed/current-final-snapshot proof → Structural Closure Cost Non-Degradation → Total-cost ROI. The efficiency objective is **Fine-Grained Semantic Purpose-Fulfillment Efficiency**: fully attain the declared fine-grained semantic and proof effect with evidenced high efficiency and high total-cost ROI while removing cost unrelated to an independent semantic unit, necessary proof, trust boundary or adapter. Logical Fact/obligation granularity may be finer than persistence; unrelated Cartesian axes, derivable repetition and copied shared metadata are not valid long-term cost drivers. For equivalent-effect workloads, Source/Contract/evidence bytes, DAG work, Compile/Preflight/Final Gate, peak RSS, default Context reads and one-Fact revision blast radius cannot grow for those structural reasons. Cost never compensates for weaker granularity, proof or drift detection. High means a significant stable margin after the complete verified cost set, not exhaustive comparison or an optimum claim; it permits consideration rather than automatic adoption and is subject to the sufficiency stop rule above.
 
 The package-owned non-UI Compact Carrier realizes that separation without another Authority, state or Gate. Shared catalogs, selectors, Fact sets, proof templates, projections and explicit exceptions materialize into the existing validators and single Final Gate. Facts and obligations remain independently exact; typed results bind stable `obligation_key + obligation_revision_digest` before projecting to stable `fact_key + fact_revision_digest`. Fact revisions include normalized meaning plus explicitly linked current input revisions, while obligation revisions include normalized proof meaning plus the current Fact revision. Bounded arrays and `Map` indexes may materialize measured sets, never the theoretical ground universe. Expanded input remains readable for compatibility, but one adopted Source or Contract persists exactly one representation and migration removes the equivalent mechanical expansion.
 
@@ -463,7 +483,8 @@ task:
       description: Example product runtime
       role: product
       runtime_family: process
-      root_entrypoint: tests/runtime.mjs
+      root_entrypoint: bin/example-runtime.exe
+      root_argv: [tests/runtime.mjs]
       capabilities: [process-runtime, cold-start, production-root]
   source_paths: [plans/example.md]
   context_refs: [project_context/areas/main.md]
@@ -481,6 +502,12 @@ source_claims:
     disposition:
       type: claim
       refs: [observable-outcome.obligation.preserve-observable-owner]
+  - key: example-execution-target
+    source_ref: plans/example.md#example-runtime-target
+    statement: 'Execution target authority: {"capabilities":["cold-start","process-runtime","production-root"],"key":"example-runtime","role":"product","root_argv":["tests/runtime.mjs"],"root_entrypoint":"bin/example-runtime.exe","runtime_family":"process"}.'
+    disposition:
+      type: claim
+      refs: [execution_target.example-runtime]
 stages:
   - key: delivery
     title: Delivery
@@ -523,7 +550,7 @@ outcomes:
       owner:
         label: Owning product or module boundary
         context_refs: [project_context/areas/main.md]
-        path_globs: ["src/**", "tests/**"]
+        path_globs: ["src/**", bin/example-runtime.exe, tests/runtime.mjs, tests/verify-runtime.mjs]
       requirements:
         - key: observable
           statement: The outcome is observable.
@@ -540,7 +567,18 @@ outcomes:
           required_proof_surfaces: [runtime_behavior]
           applicability_refs: [runtime-root-success]
       expected_change_paths: ["src/**"]
+      allowed_support_paths: [bin/example-runtime.exe, tests/runtime.mjs]
       bindings:
+        - key: runtime-root
+          kind: file
+          target: bin/example-runtime.exe
+          carrier_paths: [bin/example-runtime.exe]
+          existence: existing
+        - key: runtime-module
+          kind: file
+          target: tests/runtime.mjs
+          carrier_paths: [tests/runtime.mjs]
+          existence: existing
         - key: observable-carrier
           kind: file
           target: src/observable.ts
@@ -556,12 +594,13 @@ outcomes:
             when: [{key: inspect-result, statement: Inspect the result through the declared runtime.}]
           proof_surface: runtime_behavior
           runner:
-            type: node_oracle
-            target: tests/runtime.mjs
+            type: project_binary
+            target: bin/example-runtime.exe
+            argv: [tests/runtime.mjs]
             effect: read_only
-          verification_inputs: [tests/runtime.mjs]
+          verification_inputs: [tests/verify-runtime.mjs]
           input_paths: [src/observable.ts]
-          expected_output_paths: [src/observable.ts]
+          expected_output_paths: []
           artifact_globs: [artifacts/proof.json]
           positive_assertions:
             - key: result-ac
@@ -569,7 +608,7 @@ outcomes:
               claims: [result]
               applicability_ref: runtime-root-success
               observation: result
-              evidence_capabilities: [state_delta, target_runtime]
+              evidence_capabilities: [target_runtime]
               operator: equals
               expected: true
             - key: observable-ac
@@ -577,7 +616,7 @@ outcomes:
               claims: [requirement.observable]
               applicability_ref: runtime-root-success
               observation: requirement_result
-              evidence_capabilities: [state_delta, target_runtime]
+              evidence_capabilities: [target_runtime]
               operator: equals
               expected: true
             - key: semantic-fact-ac
@@ -593,7 +632,7 @@ outcomes:
               claims: [obligation.preserve-observable-owner]
               applicability_ref: runtime-root-success
               observation: architecture_result
-              evidence_capabilities: [state_delta, target_runtime]
+              evidence_capabilities: [target_runtime]
               operator: equals
               expected: true
             - key: runtime-liveness
@@ -609,7 +648,7 @@ outcomes:
               claims: [control_relation_closure]
               applicability_ref: runtime-root-success
               observation: relations_applicable
-              evidence_capabilities: [state_delta, target_runtime]
+              evidence_capabilities: [target_runtime]
               operator: equals
               expected: false
       counterfactual_controls:
@@ -638,13 +677,15 @@ outcomes:
 ```
 <!-- long-task-public-contract-example:end -->
 
-Authors provide task, Outcome, control and Check keys. The compiler generates `OUT.<outcome-key>` and `CHECK.<outcome-key>.<check-key>` identities. It rejects unknown/duplicate keys, YAML aliases/tags/merges, dependency cycles, unsafe paths, missing Context/source/runner files, missing package scripts, unverifiable Outcomes, and UI Outcomes without browser proof.
+In this example `bin/example-runtime` is the product root, not a verifier wrapper. It emits one stdout JSON object shaped as `{"schema_version":"ty-context-product-observation-v1","observations":{"<compiled-observation-identity>":<actual>}}` with exactly the identities compiled for the shared Raw Execution. Harness supplies no output path, challenge or protocol environment variable; a v3 verifier payload cannot substitute for this product envelope.
+
+Authors provide task, Outcome, control and Check keys. The compiler generates `OUT.<outcome-key>` and `CHECK.<outcome-key>.<check-key>` identities. It rejects unknown/duplicate keys, YAML aliases/tags/merges, dependency cycles, unsafe paths, missing Context/source/runner files, missing package scripts, unverifiable Outcomes, and machine obligations without an admitted observer or blocking External Confirmation.
 
 Global non-goals, constraints and forbidden shortcuts generate `GLOBAL.non_goal.<key>`, `GLOBAL.constraint.<key>` and `GLOBAL.forbidden_shortcut.<key>`. They must be covered by Global Check Assertions using local refs. Non-goals and forbidden shortcuts require negative proof; constraints accept either polarity. Outcome and Global Checks cannot cross Claim scope. Global forbidden paths do not generate Claims because the changed-path boundary enforces them statically.
 
 Claim-bearing structured Global Checks also declare `global.acceptance.counterfactual_controls`. Each control uses `binding_ref: <outcome-key>.<binding-key>` to reuse an Outcome-owned implementation carrier; no separate Global Binding layer exists. An `existing` mutation target must exist at Preflight/Compile, while a `planned` target may be absent until implementation but must exist at Final Gate and participates in Progress freshness.
 
-Supported runners are `package_script`, `project_binary`, `node_oracle` and `playwright_test`. Package scripts are acceptance-eligible only when a static Node entry and its local dependency closure are recoverable. Supported proof surfaces are `ui_browser`, `runtime_behavior`, `api_contract`, `data_state`, `security_boundary`, `population_coverage` and `implementation_structure`. Execution-target runtime families are the bounded `browser`, `native`, `desktop`, `service`, `process` and `external` set; target roles are `product`, `support` and `observer`. Required target refs resolve only to product targets with declared family/cold-start/production-root capabilities. Browser target proof requires `playwright_test`; Native/desktop target proof requires `project_binary`.
+Supported runner declarations remain `package_script`, `project_binary`, `node_oracle` and `playwright_test`, and supported proof-surface/target-family names remain unchanged for compatibility. Runner type selects execution/decoding, not observation authority. Current machine admission is limited to pre-run-frozen static JSON exact structure and a Harness-direct `project_binary` process product root; browser/native/desktop/device and project-Oracle observations require blocking External Confirmation.
 
 ### One Contract And Source Claims
 
@@ -660,7 +701,7 @@ Saving failure preserves the user's input and shows the reason.
 
 Supported kinds are `outcome_result`, `requirement`, `control`, `acceptance`, `technical_obligation`, `non_completing`, `non_goal`, `forbidden_shortcut`, `risk_fact`, `external_confirmation` and `decision`. A risk marker additionally carries its exact pair, for example `<!-- ty-source-item:start key=permission-risk kind=risk_fact fact=permission_boundary_change outcome=observable-outcome -->`. Every delivery also includes at least one `technical_obligation` marker with `aspect=architecture`. Every declared Source file contains at least one Material Item; other non-empty lines may occur only inside the validated formal handoff or a background block whose content matches the closed `markdown-structure`/`provenance` grammar. Marker keys and Source Claim keys must be set-equal and globally unique across all Source files. Arbitrary background prose, unclassified text and nested, overlapping, unclosed, empty or invalid sections fail Compile. Each `source_claim.statement` must match the marked text after only line-ending, surrounding-blank-line and trailing-space normalization.
 
-Typed dispositions keep overall results, Requirement/Control/Obligation/Non-completing Claims, one named Acceptance Assertion, Global constraints/non-goals, declared Fact/Affected-Outcome risk pairs, external confirmations and genuine decisions distinct. Risk marker metadata must exactly equal its disposition and declared risk fact, and each Fact/Outcome pair has one Source owner. Source Plan and Runtime use the same ten Fact names: data migration is `data_migration`, a weakly observable critical path is two independent `critical_user_path` and `weak_observability` items, and `multi_repository_change` stays in Source until Compiler rejection. Every other non-decision Source item owns exactly one canonical target of the same kind and normalized text, and no target may have two Source owners. An Outcome Source acceptance maps to one `<outcome>.<check>.<assertion>` whose criterion is text-identical and which proves an independently Source-backed non-Result Claim. A Global Source acceptance maps to `GLOBAL.<check>.<assertion>`, is also criterion-identical, proves no Outcome Claim and includes at least one independently Source-backed Global non-goal, constraint or forbidden-shortcut Claim. `out_of_scope` is retired: an explicit Source non-goal needs covered negative proof, while excluding an in-scope item requires `decision_required`. The parser proves complete syntactic ownership and rejects arbitrary prose disguised as background; it cannot prove that the user supplied every real requirement or that marked Source is factually accurate, which remain explicit upstream premises.
+Typed dispositions keep overall results, Requirement/Control/Obligation/Non-completing Claims, one named Acceptance Assertion, Global constraints/non-goals, declared Fact/Affected-Outcome risk pairs, external confirmations and genuine decisions distinct. Risk marker metadata must exactly equal its disposition and declared risk fact, and each Fact/Outcome pair has one Source owner. Long-Task Source and Runtime use the same ten Fact names: data migration is `data_migration`, a weakly observable critical path is two independent `critical_user_path` and `weak_observability` items, and `multi_repository_change` stays in Source until Compiler rejection. Every other non-decision Source item owns exactly one canonical target of the same kind and normalized text, and no target may have two Source owners. An Outcome Source acceptance maps to one `<outcome>.<check>.<assertion>` whose criterion is text-identical and which proves an independently Source-backed non-Result Claim. A Global Source acceptance maps to `GLOBAL.<check>.<assertion>`, is also criterion-identical, proves no Outcome Claim and includes at least one independently Source-backed Global non-goal, constraint or forbidden-shortcut Claim. `out_of_scope` is retired: an explicit Source non-goal needs covered negative proof, while excluding an in-scope item requires `decision_required`. The parser proves complete syntactic ownership and rejects arbitrary prose disguised as background; it cannot prove that the user supplied every real requirement or that marked Source is factually accurate, which remain explicit upstream premises.
 
 Delivery Set orchestration and top-level Contract splitting within one selected delivery are retired. `ty-context delivery-set ...` returns a fixed non-executing tombstone.
 
@@ -676,17 +717,17 @@ Inside an active Long-Task, the existing `risk.requested_level: auto | standard
 
 ### Evidence And Authority
 
-Final acceptance is computed from executable current evidence, not agent prose. Evidence adapters derive from runner kind: `playwright_test` produces `playwright_json_v1` and is the only adapter allowed for `ui_browser`; package scripts, project binaries and Node oracles use the `structured_json_v2` adapter for non-browser surfaces and emit the additive `long-task-check-result-v3` payload when capability records are required. V2 payloads remain decodable only for compatibility and cannot satisfy non-presence capabilities. The adapter is part of acceptance, raw-execution, compiled, progress and Receipt identity.
+Final acceptance is computed from executable current evidence, not agent prose. Runner kind still selects `playwright_json_v1` or `structured_json_v2` decoding, and project capability payloads remain `long-task-check-result-v3`, but decoding is not Actual authority. Compile must assign every machine obligation to `package_static_json_exact` or `package_process_json_exact`; unsupported obligations remain blocking External Confirmations. The admitted adapter and its expected/actual/comparison identities are part of acceptance, raw-execution, compiled, Progress and Receipt identity.
 
-Every Check declares non-empty keyed `scenario.given` and `scenario.when` steps plus one or more roles from `success`, `degradation`, `recovery`, `stage_gate` and `conformance`. Global/Outcome applicability profiles bind exact target, journey role, atomic dimensions, Given condition/input/state refs and ordered When refs; each Claim-bearing Assertion proves one Claim in one matching profile, and all actual applicable proof-surface cells are mandatory. Every Assertion declares an all-of set from `presence`, `interaction_trace`, `state_delta`, `cross_surface_consistency`, `durable_readback`, `boundary_invocation`, `external_side_effect`, `failure_injection`, `visual_render`, `design_conformance`, `design_method`, `target_runtime` and `input_variation`. Except for static `presence`, each capability requires exactly one typed current-execution record bound to that Assertion. Missing, duplicate, unknown or undeclared records fail closed. Result Claims use success Checks only; success and degradation cannot share one Check. External-boundary evidence runs on an observer target. Input variation proves at least two distinct inputs, two output hashes and a failure case.
+Every Check declares non-empty keyed `scenario.given` and `scenario.when` steps plus one or more roles from `success`, `degradation`, `recovery`, `stage_gate` and `conformance`. Global/Outcome applicability profiles bind exact target, journey role, atomic dimensions, Given condition/input/state refs and ordered When refs; each Claim-bearing Assertion proves one Claim in one matching profile, and all actual applicable proof-surface cells are mandatory. Assertions retain their all-of capability declarations, but a project-submitted capability record is compatibility data only. Harness currently derives exact/presence observations and, for the admitted direct-process root, host `target_runtime`; omission of a project copy does not weaken those package proofs, while disagreement fails closed. `interaction_trace`, `state_delta`, `design_conformance` and any other capability without package derivation remain blocking External Confirmations rather than fabricated machine rows.
 
-Every Outcome has at least one non-Result atomic Claim, and a Claim is covered only when all `required_proof_surfaces` are covered. Claim-bearing assertions use explicit expected-value comparisons; unary `truthy`/`falsy` are forbidden, and `exists` is limited to `implementation_structure` obligations. Across all Checks sharing one Raw Execution identity, one claim-bearing Observation belongs to one Assertion. Playwright Claim proof has one canonical form: `playwright.case.<ac-key>.passed equals true`. Missing, skipped, flaky, unexpected, failed or duplicate-within-project ACs fail closed; the same AC across distinct Playwright projects aggregates only when every instance passes. Decoder diagnostic fields such as aggregate pass, executed, skipped, status and counts cannot prove Claims.
+Every Outcome has at least one non-Result atomic Claim, and a Claim is covered only when all `required_proof_surfaces` are covered. Claim-bearing assertions use explicit expected-value comparisons; unary `truthy`/`falsy` are forbidden, and `exists` is limited to admitted static `implementation_structure` obligations. V1 ground, V2 symbolic, non-UI, static and process exact results all use one Harness exact evaluator; actual≠expected fails, tolerance/mask is unsupported, result identity is recomputed and submitted pass/verdict never participates. Playwright cases and aggregate decoder fields remain diagnostic and cannot prove browser/UI Claims in the current slice.
 
-Outcome Counterfactuals bind a local Binding; Global Counterfactuals bind an Outcome-owned `binding_ref`. Both may mutate only a proven subset of carriers. Every behavioral Claim-bearing Assertion uses same-Check claim-local `replace_json_value` or `replace_text` to substitute wrong semantics while a claimless target-runtime liveness Assertion listed in `preserved_assertions` keeps passing. `replace_file` remains compatibility-only and cannot prove semantic binding. `structured_json_v2` adapter executions require completed exit-zero execution with exactly the expected `assertion_value_mismatch` set. A weak `playwright_json_v1` Counterfactual may accept exit one only under exact, complete unexpected-instance accounting; ordinary Playwright Baseline Checks still require exit zero. Standard frozen Playwright content and installed runtime packages are named trusted verifier inputs; project-local static dependencies are recursively frozen and unresolved loaders fail closed. Population binds its universe to a real technical carrier in the owning Check snapshot and proves universe = eligible = observed plus valid exclusions, but never waives the semantic witness for behavior. Claim and Population proofs are emitted only after the complete Check status is `passed`.
+Outcome Counterfactuals bind a local Binding; Global Counterfactuals bind an Outcome-owned `binding_ref`. A Binding/path alone is not production reachability. Static Counterfactuals prove only the frozen structure object; runtime Counterfactuals require Harness mutation of a declared production carrier, direct execution of the same process product root and package-observed Actual change. Every machine witness declares affected, preserved and allowed-fan-out Facts, preserves an equal obligation universe and host-derived liveness, and rejects missing admitted baseline/mutated observations. Source/Context/expected material, status/report/evidence/Receipt/verifier output are never mutation carriers. Playwright/structured project results remain diagnostics; they cannot substitute for package sensitivity.
 
-Raw Execution identity binds frozen runner identity plus canonical declared Environment Requirements, never actual environment values. A Playwright Test uses `[ac:<assertion-key>]`; one Test may bind at most one declared AC. Every Claim-bearing structured Check needs same-Check, Claim-related Counterfactual sensitivity; unrelated Artifacts or another Check do not count. Counterfactual Findings are projected into their owning Check Result before Progress is written, so status/resume recover the Finding without a new Global Outcome state. Explain traces Source Item → canonical target → Claim/applicability → Assertion → required surfaces → Check → adapter → Observation.
+Raw Execution identity binds frozen runner identity plus canonical declared Environment Requirements, never actual values. Direct-process host attestation additionally binds the raw execution, executable/root/argv equality, PID/times/exit, candidate snapshot digest, an internal execution nonce and the captured stdout-envelope digest inside Harness; none of these host fields is supplied by the child. The nonce is not exposed to the child and does not by itself authenticate product semantics. Every machine Claim-bearing Check needs same-Check package-observed sensitivity; unrelated Artifacts or another Check do not count. Counterfactual Findings remain in their owning Check Result without a new state. Explain traces Source Item → canonical target → Claim/applicability → Assertion → compiled observer authority → package Actual → Harness comparison → Check/Final Gate.
 
-The workdir `.ty-context/compiled-contract.json` is only a rebuildable cache projection. Previous authority, the immutable initial base, risk floor and Final Gate identity come only from the common-dir snapshot. Commit, verifier migration, clear and abandon share one active-state lock; Final/Verify recheck identity and Stop/close use accepted-identity CAS. Development-period V2 Active Authority, Progress and Receipts are not migrated. Corrupt continuity is recovered explicitly with `abandon --force-corrupt-state`.
+The workdir `.ty-context/compiled-contract.json` is only a rebuildable cache projection. Previous authority, the immutable initial base, risk floor and Final Gate identity come only from the common-dir snapshot. Commit, verifier migration, clear and abandon share one active-state lock; Final/Verify recheck identity and Stop/close use accepted-identity CAS. Observer identity, Compile admission policy and TCB changes invalidate existing Active Authority, Progress and Receipt acceptance; no custom Oracle, wrapper or machine-to-external migration is inferred. Corrupt continuity is recovered explicitly with `abandon --force-corrupt-state`.
 
 Final Gate may run only Contract-declared verification commands and never production mutation/deployment/payment/migration execution. Retry defaults to none and is allowed once only for `transient_once` + idempotent + read-only/test-sandbox runners. Runners receive a minimal environment whitelist plus only declared environment requirements. Protected authority/proof inputs reject symlinks and detectable hardlinks. Network isolation remains external. Receipts are audit-only (`reusable_for_acceptance: false`). Human, CI, deployment and product confirmation live only in `external_confirmations`; a machine pass with pending confirmations reports `machine_accepted_external_pending`, which is outside the complete-delivery accepted-terminal theorem and cannot complete the native Goal.
 
@@ -696,7 +737,7 @@ Version 0.6.0 retires the V1 schema/runtime and repo-local Hook. Enable, disable
 
 Version 0.6.0 defined the first public V2 semantics while retaining the `long-task-delivery-v2` schema name and physical `outcome_files` parser form. It introduced the former optional Source Plan helper without adding Schema, CLI, Preflight, Compile, Validator, Receipt, Authority or state. Current releases integrate those Source-authoring semantics into `long-task-workflow` and retain the old Skill only as a compatibility pointer. Preflight and direct Compile use one activation-safety kernel.
 
-The current V2 semantic-assurance closure additionally requires full Context, an architecture-classified Source obligation, atomic applicability dimensions, explicit target and blocker capabilities, applicability-bound Control-relation closure, Population universe carriers, claim-local semantic mutation, per-method/condition record and primary-observation artifacts, and the supported direct-literal verifier dependency closure. An older V2 Contract missing those meanings reports the indexed manual migration `long-task-v2-semantic-drift-authority`; re-author them from Source. Upgrade never infers those semantics or imports old Progress/Receipts as passing evidence.
+The current V2 semantic-assurance closure additionally requires full Context, an architecture-classified Source obligation, atomic applicability dimensions, explicit target and blocker capabilities, applicability-bound Control-relation closure, Population universe carriers, claim-local semantic mutation, per-method/condition authority and the admitted observation chain. An older V2 Contract with custom machine Oracle, unsupported method/family, wrapper root, missing/unbound process argv or missing admitted Counterfactual observation receives precise manual diagnostics; re-author it from Source as static exact, direct-process exact or blocking External Confirmation. Exact planned process root/argv/carrier paths may remain absent until Final Gate, but patterns and undeclared runtime dependencies cannot impersonate them. Relevant diagnostics include `machine_observer_not_admitted`, `unsupported_observer_requires_external_confirmation`, `custom_oracle_machine_completion_forbidden`, `static_observation_not_in_pre_run_snapshot`, `static_observation_changed_by_runner`, `process_observer_direct_root_required`, `process_observer_root_invocation_required`, `process_observer_root_argv_mismatch`, `process_root_production_binding_required`, `process_runtime_carrier_exact_path_required`, `process_runtime_input_missing`, `process_observation_input_changed_by_runner`, `legacy_target_runtime_non_authoritative`, `counterfactual_admitted_observation_required`, `counterfactual_runtime_reachability_unproven` and `project_submitted_verdict_disagrees_with_harness`. Upgrade never chooses among them or imports old Active Authority, Progress or Receipts as passing evidence. Public result payload v3 remains compatible, but its self-reported proof fields are non-authoritative.
 
 ### Package update modes
 
@@ -727,7 +768,7 @@ make validate-harness
 
 The modularity gate is `ty-context check-modularity`. Scoped waivers require `owner`, `introduced_at`, `reason`, `tracking_issue` and `expiry_condition`.
 
-`npm run preview:pack` produces a local preview named `project-tiny-context-harness-0.8.12.tgz` under the preview output directory.
+`npm run preview:pack` produces a local preview named `project-tiny-context-harness-0.8.13.tgz` under the preview output directory.
 
 ## Community And Further Reading
 
@@ -753,7 +794,7 @@ For concrete examples, see the [fresh-agent recovery walkthrough](docs/examples/
 - Harness cannot switch the host-selected model; it only asks for the one post-Authority-Lock user choice.
 - Tiny Context provides no parallel mutation or delegation runtime. The platform Goal may use its own opaque implementation delegation, but Harness does not persist it or accept it as evidence.
 - It does not observe platform token counts or model-call counts.
-- Network policy is declared to runners and proxy variables are restricted, but this is not an OS sandbox.
+- Network policy is declared to runners and proxy variables are restricted. The admitted direct-process path also runs a frozen runtime-closure copy and monitors/cleans its process tree, but neither mechanism is an OS security sandbox or a proof against malicious escape into ambient filesystem, network or process resources.
 - Same-user/admin filesystem tampering and Hook bypass are outside its security boundary.
 - Git/PR/CI, deployment and human product confirmation remain external responsibilities.