# Run Supervision and Self-Contained Outcomes

Status: Accepted future supervision contract with separately identified implemented AX/evidence slices; full supervision is not released. Proposed supervision API/policy additions and their examples are not supported by the current release. [BACKLOG.md](../BACKLOG.md) owns the next selective AX/navigation/existing-runtime release and the remaining future work; this document owns behavior and evidence boundaries. The selective release does not activate independent owner-loss supervision, execution deadlines, public completion streams or unapproved source/retention expansion. Native authority, unchanged credentials, the agreed three-platform scope and positive closure requirements remain mandatory for the future feature. MPRIS and removal of `inspect` stay excluded.

## Goal and Boundaries

A coordinator should receive a finite Run's outcome without polling. Optional periodic diagnostics make overdue work discoverable, and an independent execution deadline can terminate an owned generation. Neither policy is required for ordinary jobs or controlled services.

- Preserve `spawn`, `message`, and `inspect`. Ordinary Run inspection is a manual request for the same compact snapshot used by timed diagnostics, with a readable context index for selective investigation. Retain resolution, activation, Control, and runtime diagnosis; do not remove existing expert routes implicitly.
- Do not add resumable suspension, checkpoints, automatic restarts/retries, a synchronous wait budget, global supervision defaults, or a new actor type.
- Do not treat a diagnostic heartbeat as progress, semantic attention, or evidence that a task is healthy.
- Preserve owner filtering, process-identity proof, lifecycle locks, parent/root delivery lineage, redaction, retention boundaries, and native Pi history.
- The current [Run lifecycle](./async-runs.md), [Recipe standard](./template-recipes.md), [inspection contract](./inspection.md), and [coordinator delivery](./coordinator-delivery.md) remain the shipped behavior until implementation lands.

## First-Layer UX/AX: Progress, Decision and Drill-Down

The accepted direction applies at every public level: give the human an understandable process state, give the agent enough compressed context for its next decision, and offer only a relevant way to inspect deeper evidence. Compact output is selected meaning, not a truncated raw dump. Full structured detail remains explicit; a pointer is data, not body, work or native authority. Do not promise a later completion unless its delivery is actually established.

Locally implemented Control receipts now follow AX in the existing `tools-message.ts` owner: flat Markdown-list records identify run/action without a duplicated namespace and keep result, delivery, handling and observed Run state distinct. Queued and delivered both leave handling unconfirmed; archive/prune reports its completed operation, while legacy kill reports attempt plus unconfirmed termination. Multiline values retain original line separators/internal Markdown under an outer indentation. At most one contextual next node names the inspect tool and its target/view: actor-delivery evidence uses Control, a stop attempt uses Trace, and changed owner/generation directs the caller to its own Run inventory instead of a blind retry. Unrecognized custom advisory text stays an indented instruction leaf, never guessed arguments or automatic execution. Already-terminal refusal needs no routine extra inspection. Public input schemas and underlying action/status facts remain unchanged; advisory next_actions now agree with the compact hint. Full structured detail remains explicit via verbose JSON.

The kill record says **result: kill attempted** and **termination: unconfirmed**. This is a presentation correction, not a new stop claim or native proof: legacy `killed/stopped` fields, immediate terminal progress/handled markers, caller-generation preconditions and B2/C integration remain unresolved. Trace records the attempted action, not whole-scope closure. A failed tool call after actuation may also have partial effects; compact returned-result improvements do not resolve that exception path or justify automatic retry. Public kill/archive/prune refusals for changed owner or generation now omit the replacement's nested status from compact/details/verbose output, while retaining the original action/refusal facts and owned-inventory hint. The omission is a public response restriction, not a new observation or permission; same-identity already-terminal detail remains available, and privileged kernel results are unchanged. Controlled source/packed witnesses cover all three actions and both replacement reasons without signals or workload. Explicit verbosity is not extra ownership authority.

Runtime error presentation now fences its argument-repair heuristic at dispatch: caller value normalization and synchronous missing-value errors before the first executor entry retain their existing usage guide; after any executor entry or async-launcher handoff, the public adapter rethrows the original value without rebuilding an Error from its text. AggregateError members, cause and details remain original. A later template step can fail after earlier controlled effects, so missing-value wording is not evidence that the invocation was unapplied. Async launcher-side validation remains its original message rather than being guessed to be caller-repair guidance. The local dispatch bit is not an admission/actuation/closure receipt; pre-dispatch guidance likewise proves no absence of preparation effects. Existing retry policies, result formatting, error spacing and source/native permissions are unchanged. Source and packed controlled ports cover plain/delegated execution, early/late missing inputs and async handoff-option faults without new native workloads; these are not positive native partial-actuation or SDK rendered-phone acceptance.

Launch first-layer inspection confirmed that real new-generation metadata already reports running; no extra liveness or fabricated accepted-state reader is needed. Compact launch receipts now expose the existing reused flag as **existing Run reused**, including the bounded core fallback. A complete actually shown direct-location row replaces the redundant session-wide map hint; absent, unavailable or wholly omitted rows retain that optional request. All exact selected location values/roles, JSON-compatible expert details and the shared 16 KiB compact bound remain. The older shared handoff function and completion formatter retain their text, so saved batch versions/replay are unchanged; new AX launch receipts now use the separately rendered typed request. Two existing pure launch contract groups live with tools-response and remain selected by conformance. The compact launch slice now renders bare block YAML, opaque scalar contents, native model/thinking groups and one typed optional next node. Its whole nested navigation row and16KiB exact-fit/one-byte-over refusal are covered by the response owner, including reuse and optional-field fallback; missing navigation cannot evade the bound. Prior full source/npm SDK observations in this section describe the earlier compact syntax. Updated launch-only fixture parsing retains those assertions and old saved-message support, but fresh full SDK/native acceptance remains separate. Both public spawn and async registered tools use this existing owner; dispatch errors/verbose schemas are unchanged. Control's unmigrated field and inspect-action primitives keep their byte-exact receipts; compact launch uses the shared YAML emitter instead. The whole tools-response owner is replayed from the actual installed dist. SDK fixture grammar assertions change only for the compact launch text; identity, lifecycle, source, native absence, cleanup and completion-codec properties remain. No packet version, clock/controller default or new source authority was introduced. The retained source/packed SDK journeys still require actual launch/terminal reference reads without extra inspection or new workload permutations; headless formatter checks are not a fresh execution of those journeys.

Source properties exercise real public already-terminal refusal, archive/prune and identity-change routes with isolated controlled metadata, plus data-only phase/opacity/hint witnesses. The packed compiled owner is checked without a real kill. These checks do not prove rendered TUI/phone behavior, actual native closure or a later terminal delivery. The canonical backlog retains first-layer outcome/failure and owner-specific partial-failure work plus the gated stop integration; this section is not a second task list.

### Cross-Surface Presentation Contract

The project-wide [Agent Experience (AX) standard](./agent-experience.md) is the canonical presentation contract for Inspector, public tool text/errors and agent-bound context. It combines Markdown readability with named structural context, defaults to flat list/key-value records, nests only for meaningful relationships and preserves embedded Markdown as one value. Its syntax, omission markers, examples and acceptance rules live there, not in a second release-specific style manual.

Status: Adopted design, rollout incomplete. The next selective release targets independently ready AX behavior through the existing surface owners, subject to its own source/packed and loaded acceptance. It neither waits for excluded future features nor waives applicable source/privacy/generation/clock/native gates. Current one-line receipts, brace-based detail rendering and older saved formatting described below remain implementation evidence, not the new target. New capture presentation must keep old packet bytes stable; neither the standard nor a renderer acquires source/body permission, result freshness or lifecycle authority. [BACKLOG.md](../BACKLOG.md) owns implementation slices and live acceptance.

Fresh non-runtime compact explicit inspection now follows the same standard without changing its source/authority contract: Run recipe/trace/control replies keep their existing run/view-only header; registered-tool status keeps source/callability/activation/usage facts and actual required/optional argument sequences; Recipe registry keeps its original counts/current-policy/partiality and focused doctor preserves complete identity/resolution/rejection plus the already-portable literal source_location. Structured/verbose payloads, forced tool-schema JSON, exact owner/session refusals, Recipe resolution and all source/whole-output bounds remain unchanged. These are current read-time tool projections, not a saved format migration or A1/B1 default snapshot integration.

Compact text selects the first existing hint only. The shared formatInspectionHint recognizes exactly the existing read-only recipes doctor/imports verbose/summary verbose strings; no general command parser, advisory execution or inferred mutating tool authority is added. Other text becomes one opaque instruction value retaining Markdown/CRLF, while full next_actions stays in details. The two original owners preserve all17inspection/7response declarations and add one property each for fresh layout, three actual Run views, unchanged privacy/JSON/schema, argument sequence/none/unknown, immutable input, one selected known hint, hostile/opaque multiline advice and whole oversized references. Actual npm pack/install replays entire18inspection/8response owners via production-import-only remapping, retaining all original fixtures/assertions/isolation/cleanup and the existing runtime branch. First red evidence exposed singleton lists accidentally rendered inline; the local actual-sequence field fixes both one/many argument classes without a generic formatter mode or changed data. No new source reader, registry, lock, module/edge, lifecycle/correlation/native/clock authority or ordinary output cap.

Runtime compact inspection and the four locally owned UI notices now form one independently falsifiable AX validation cohort. compactRuntime status/runs/triage selects exactly its former facts and count formulas, with no collection/source/snapshot changes: package/schema/review identity, full exact-owner runs length, and failure/pending/stale/backpressure/Trace/retained-attention counts. Structured JSON remains exact; verbose navigation remains separate from complete inventory, and triage count66stays distinct from40projected pending rows. One new inspection property uses240owned plus1foreign controlled rows to verify unchanged one-observation-per-listed-row behavior, lines=1not capping inventory, unchanged input/order/owner filtering, independent navigation and exact structured text.

Four existing core UI notice sites now emit AX records: callback failure keeps original error/cause forwarding and opaque Markdown; completion recovery keeps the same pending batch/evidence/reason and dedup/no-send/no-handled behavior; idle completion count is labeled delivery accepted only after send acceptance and existing durable finalization; shutdown counts and whole dynamic-fenced summary path explicitly mean teardown report, not native closure. No notifier level, dedup key, callback containment/stale-context rule, attempt/retry/timing/acceptance/teardown policy or packet byte changes. Forwarded watcher/retirement messages remain their producer's responsibility. One new UI property verifies original Error identity/message/cause, runtime close/owner trigger, report counts and an exact path containing backticks/newline; existing uncertain-recovery and two-member ready properties keep their full scenarios/assertions under new notice grammar. All18inspection/30UI declarations remain, now19/31; actual installed replay remaps production imports only and preserves the complete existing source fixtures, including independent current-session navigation and historical captures. This is local/source/package evidence, not a loaded client or positive native/backend release claim.

New producer-owned watcher/automatic-retirement messages now follow AX in observability, with no runtime transport reinterpretation. Watcher diagnostics render exact code/scope, whole dynamic-fenced path, opaque captured Error detail and the same recovery wording. Raw error detail/signature/signature-key evaluation, monotonically assigned ID, timestamp,32entry suffix, root/run attach/error/remove/rearm/close and reconciliation behavior remain unchanged. Rendering reuses detail.slice(2) rather than observing Error.message again; non-Error values still supply no new diagnostic string, and getDiagnostics does not regenerate older message text. A property covers exact backtick/newline paths, CRLF/author content, one getter observation per attempt, same-signature suppression, restored acceleration, monotone bounded suffix and primitive-error withholding; all original watcher scenarios remain.

Automatic retirement has flat run/retirement/result/reason-or-diagnostic/closure records: stop means request returned, cancel means cancellation reported, and skip/failure retains the same selected original error text. Closure remains unconfirmed. Fallback says stop path failed, not graceful stop failed: existing try/catch includes notification after the stop port returned, so callback failure can follow effects. No candidate/attempt/sendStop/cancel/Boolean report/result/error/optional-notify semantics are changed, no lower discarded cause recovered, and source result strings are not rewritten from presentation. One seven-part property retains stop/cancel/skip/failure/no-notifier/notifier-fault behavior, exact primary/secondary/notification message-getter counts and causes, partial notifier effects, current once-only attempted suppression and unchanged result records. Pure local formatting is called inside the original optional notifier arguments; no notifier means no added error coercion. Actual npm pack/install replays whole52observation/31UI owners by production-import-only remapping, keeping all50original observation declarations and existing fixtures/assertions/isolation/teardown. No new source/read budget, global notification cap, timer/retry, native/work/lifecycle authority or saved-message migration.

Inspector document/detail AX projection is now separately implemented in inspector-overlay.ts: root fields are flat, objects/actual sequence members nest two spaces, singleton sequences remain lists, and empty []/{} preserve type/absence distinctions. Structural braces/trailing commas/positional #member labels are removed, not source data. Multiline values start below the key and keep uniform outer indentation, authored heading/paragraph/blank/list/colon/backtick/middle-dot text and literal source characters. The terminal text renderer does not execute/interpret body Markdown. A private per-render InspectorDocumentLine distinguishes compiled labels from opaque body lines before wrapping/styling, so authored next/tool labels gain neither metadata color nor action authority. Unsafe object keys use exact single-line JSON-quoted names. Native visibleWidth/sliceByColumn handles grapheme-aware wrapping; the existing separator-break preference remains but no trimEnd/trimStart discards source whitespace. Body soft lines keep uniform outer indentation, while field continuations may hang. CRLF/CR/LF are terminal line boundaries; the existing tab-to-two-spaces display policy remains, and raw strings/JSON/journals stay unchanged. Soft wrapping invents no omitted count/gap. Root-section stripe assignment remains, including every nested/wrapped line. No source collection/read cap, retained body/metadata, privacy, machine schema, saved capture version, canonical sequence, shared chronology, stable ID, cache/filter/focus/key/scroll/action/lifecycle policy changes.

All12original overlay declarations remain with only approved first-screen layout/color assertion replacements. Two new properties cover singleton/multi/record/nested sequences, empty containers/none, quoted multiline key, opaque CRLF/CR/LF Markdown and apparent actions, compiler-versus-body theme calls, literal long CJK/ZWJ/combining paths with leading/trailing spaces, exact reconstruction under50/88/138inner columns (52/90/140outer), deep indentation bounds and unchanged frozen source data/stripe ownership. Original narrow/medium/wide row/chronology/selection/cache/redaction/generation-kill/selector/navigation scenarios remain. A separate red caught opaque soft-line hanging indentation before its correction; both new properties first failed on the pre-change renderer. The actual npm pack/install harness now replays the whole14overlay owner instead of four chronology selections by changing production imports only, retaining original fixtures/assertions/isolation/dispose/teardown. Source/compiled render evidence does not satisfy operator-reload/live colored-terminal/phone acceptance. Remaining public inspection errors/list/action chrome and A1/B/C/A3/D/native/release gates stay independent.

Ten locally authored inspect refusal sites now use AX in tools-inspect.ts: runtime/recipes/run/tool unsupported view, misplaced Recipe identity, unsupported Trace source after original Run authorization, invalid tool target, missing registered tool, unavailable callable schema, and unsupported inspect target. Existing branch predicates/order/callbacks remain. target_kind describes only selector family, never admitted ownership; unknown caller text and selected activation strings are opaque values. Supported options are real sequences. Only missing-tool and unavailable-schema errors retain their already-present producer-known read-only Recipe doctor/tool status next, with missing-tool no-spawn-substitution safety visible. formatInspectionHint's three compact-success literals are unchanged; no general string command parser or new recovery action.

Private formatInspectFailure admits only bounded compiler facts/lists without an omission flag and explicitly selected variable scalar fields with whole-field coverage. Under the existing16KiB model-text allowance it reserves one byte for the unchanged public leading LF and mandatory facts/safety; each variable seeds its shorter complete rendering or omission row. It keeps an optional complete action if that baseline fits, then selects whole variable fields in source order. The baseline can only grow, so an omitted field/action really exceeds the final shared budget rather than only a larger placeholder reservation. Unfit values show field-local shown0/omitted1/total1; unfit actions use next_action omission coverage, not a next node. No target clipping, private/raw text-length inference, repaired input scalars, new Error metadata/cause/schema or source/input/work cap. Direct locally constructed Error.message has no leading LF until the original adapter; an exact-fit composed public message remains16384bytes. A focused red exposed the missing spacing reservation before its correction. A separate seven-boundary red exposed false response_too_large omission from reserving placeholders larger than short values; the monotone minimum seed fixes it without an iterative refill or another budget.

Both new owning properties first fail on the old text. The ten-site matrix runs both verbose modes with exact Error constructor/message/metadata, supported lists, callback order and unchanged Control journal bytes. The boundary property covers exact ASCII/CJK/ZWJ/combining/CRLF and malformed-input spelling, one-byte overflow, huge whole target/tool/action omissions, independent final-render impossibility checks at seven tight name boundaries while preserving fixed safety/default facts, original undefined/primitive/Symbol/plain/trapped-message/AggregateError rejections through four dependency ports and original String/getter failure order, single selected getter observations, foreign-session refusal before source echo and the unchanged runtime observed-status fallback. No blanket catch means original dependency exceptions stay exact at this owner, including private nested causes, while existing fail-soft catches remain. Source/private lengths are not inferred from omission rows. Discovery/status callbacks can precede a later local refusal, so no no-effects/no-replay-safety receipt is invented. All19original inspection and4invocation declarations remain with approved error-text expectation changes; two new properties give21inspection. Actual npm pack/install replays whole21inspection/8response/14overlay and earlier owners by production-import-only remapping with original fixtures/assertions/isolation/cleanup. Earlier initial focus/package runs preceded the final one-byte-reservation fix; final candidate broad source/npm evidence is the retained acceptance. Successful structured/details/schema/compact/runtime routes and previous Inspector/attention/completion/capture compatibility are unchanged. Source/loaded UI, recipient, clock/native and integrated release gates remain separate.

Inspector Kill confirmation now closes an evidenced narrow/low-viewport action defect without changing the action port. Previously terminal10rows yielded seven available dialog body rows, but decorative blanks placed the Cancel/Kill choices after that suffix cut, even while Enter/y remained active; row fitting also silently shortened a long captured Run name. The modal now projects its same captured run/status plus compiler action through the already accepted AX document renderer, keeps the original full strings available in a separate descriptive viewport, and pins closure: unconfirmed and both choices outside it. Padding no longer hides controls. A range and PgUp/PgDn hint appears only on overflow. Two private dialog offset/page-size numbers are per-instance UI state, never source/journal/Trace identity or native metadata. The existing viewport row function remains unchanged; tests cover terminal10/12/30rows and widths24/52/90/140. No unsupported claim about arbitrarily smaller terminal heights is added.

Existing arrow/Tab choice, default Cancel, Enter-selected action, y-direct confirmation, Esc/n cancellation, original captured run/generation and exact once-only port invocation remain. Paging/resize only affects descriptive lines, preserves choice and clamps scroll; opening resets the view/default choice. Narrow footer hints make Enter selection rather than unconditional yes explicit. No new action/permission/mandatory-scroll gate, status/evidence/body/native read, timer, canonical mutation, closure guarantee or feedback/error-result rewrite. A successful legacy kill still appears only in the normal Run status header, without duplicate success text; it is not whole-scope closure.

Both new properties first fail on the old modal. All14existing overlay declarations remain unchanged. One12partition matrix reconstructs the complete long captured name from public rendered pages, verifies original fields remain complete, pins closure/buttons and selected Cancel, fits widths/heights and proves Enter after reading still does not actuate. Another y/Enter partition preserves selection through paging/resize, n/Escape reset, exact old-generation callback once and original success suppression. Whole16overlay plus original Inspector owner/security run from source and actual npm pack/install by production-import-only remapping, retaining fixture data/assertions/isolation/dispose/cleanup; test helper only adds optional terminal rows. This is source/headless acceptance, not operator-reload/live phone/terminal proof. Lossy legacy180-unit domain feedback and160-unit overlay caught feedback, unowned causes and remaining list/warning presentation keep separate producer contracts; no hidden tail is reconstructed here. Other source/clock/recipient/native/release gates remain.

Inspector feedback producer migration exposed a required rendering dependency: the existing banner was one clipped row, not an accessible opaque multiline value. This cohort therefore closes the read-only viewport prerequisite first and leaves legacy source selection unchanged. i snapshots only the currently selected feedback.message string into a private reader, using the existing AX documentProjection without parsing body labels/actions or reading Error/cause. Independent feedback offset/return focus preserves parent document/detail/list/selector state; Up/Down/PgUp/PgDn scroll, Left/Esc returns, and action/confirm/tab/source/i keys inside the view do not replay or navigate work. Ctrl-C still closes. The view works without a current Run and does not renew feedback as current owner/generation evidence. Data is transient UI text, not a new receipt/capture/schema.

Root feedback remains an explicit first-line/column preview with i access and actual-gap U+2026 instead of silently implying a full body; selected message bytes remain unchanged. Private feedbackFromAction is set only on the existing confirmKill callback path and reset at a new request. Only that path pins closure: unconfirmed and No automatic retry outside both root preview and feedback scrolling; this is unknown native scope, not a positive actuation or no-effects fact. Local guard/cancellation feedback does not invent that action history. Paging reserves the pinned rows, and actual banner length shifts existing selected-row/stripe positions. Existing backend180-unit String/normalization/trim and overlay160-unit replaceAll/slice/caught-error selection are not changed; previously discarded privacy/cause/scalar/completeness information is not recovered. Format/reader metadata grants no body permission or new source selection.

Both new properties first fail on the original reader-less banner. All16prior overlay declarations/assertions/fixtures/cleanup remain. The opaque-value property exercises an injected already-selected multiline action result with authored CRLF/paragraph/list/next/tool/code text, exact complete rendered value access, pinned safety at24/52/90/140columns with terminal10rows and once-only original-generation callback despite read-only key attempts. The navigation/legacy property checks cancellation without invented action uncertainty, selector focus restoration without applying it, no-Run feedback, snapshot equality to the original normalized160-unit caught message, one original Error.message observation/cause unchanged and narrow viewport scroll/back hints. The actual npm pack/install harness replays whole18overlay plus prior Inspector/security/21inspection/8response owners by production-import-only remapping with original assertions/isolation/dispose/teardown. lib/inspector.ts is byte-equal to the cohort backup; its180-unit producer, action/result/owner/generation behavior and lost lower causes are untouched. Existing overlay confirmKill exception selection remains unchanged apart from the private action-path marker. This is selected-value access/source/npm proof, not native closure, changed source admission or authorized live terminal/phone acceptance. The next bounded task remains producer-owned fresh Kill feedback under its original180/160limits; remaining list warnings, default clocks/native integration and release gates stay separate.

Fresh Inspector Kill feedback producers now use AX without a new source-selection or action contract. inspector.ts owns a pure formatActorInspectorKillFeedback shared by domain returns and the overlay catch; action/result/state-or-diagnostic/closure are compiler records, while the selected value remains opaque under formatMarkdownField. The only new import edge is Inspector→tools-response, earned by actual two-owner formatting reuse, not a new presentation domain/registry. Dynamic selected previews carry preview_basis=selected legacy preview; upstream completeness/privacy unproven. Positive local clipping has boundary U+2026 plus field-specific [omitted: unknown], not a private-tail length. Compiler ownership/generation refusal literals have no invented legacy loss/basis. A malformed selected preview is unavailable/malformed_legacy_preview/unknown without a fabricated ellipsis; valid pairs at a cut retract one code unit, never reconstructing or repairing source text. Failure records retain No automatic retry safety and closure unconfirmed; fixed unavailable/rejected results do not prove native effects/closure.

Domain selection keeps original String(value ?? empty), whitespace replacement/trim and180-UTF-16 rule; a clipped branch still starts from at most179prefix units so the old ellipsis allowance is unchanged. Overlay keeps Error.message versus primitive String, original replaceAll then160slice, and original template coercion even for nonstandard returned objects/Symbols. Existing getter/String/method exceptions are not caught, coerced differently, wrapped or repaired. This preserves earlier normalization/loss rather than pretending the new renderer can restore authored Markdown or full causes. The formatter itself supports opaque already-selected multiline values, but grants no permission to bypass these producer stages. Mutable getters can still produce distinct successive observations: source status getter twice on terminal, generation not read afterward, and original try/catch partial effects remain. Old short success Killed run text and its UI suppression remain unchanged. Banner color recognizes only exact anchored AX action/result headers plus old legacy prefixes, with no body/action/identity routing; feedbackFromAction remains independently derived from actual UI callback path.

All14original domain and18overlay declarations remain with approved error-text expectations only. The old195-character prefixed-envelope assertion is replaced with a direct no-wider180-unit source-preview check plus exact unknown marker; AX scaffolding is presentation overhead, not more source text. Two new domain properties cover compiler/invalid-target refusals, exact180/181, surrogate boundaries178/177, malformed prefix, normalized Markdown, selected opaque multiline rendering,4versus4000unprojected-tail invariance, original status/effect/killed/reason/coercion order, one Error.message read/cause unchanged, exact unprintable getter/coercion throws and twice-read terminal state without generation access. One overlay property covers exact160/161, cut pair159, malformed text, known AX error color, once-only generation call and no replay in the reader, original replaceAll/custom-slice/template/getter failures without rescue. The prior feedback snapshot property still binds the same normalized160selected bytes inside the new exact AX envelope. Whole source owners35tests pass; actual npm pack/install now replays whole16Inspector (15onWindows due existing skip) rather than two selected session properties, plus whole19overlay and previous21inspection/8response owners by production-import-only remapping, preserving all original fixture/assertion/hook isolation/disposal/cleanup. No new executable MJS. Current read-time UI messages need no saved-journal aspect and never regenerate prior packets. Underlying result/ok, owner/generation/native calls, hidden causes, producer budgets, source/privacy/clock/default/native and operator-reload/live terminal/phone/release gates stay separate.

Trace table column/line previews and narrow warning captions now close the concrete Inspector list gap without changing Trace admission. renderTraceList receives only the existing inner width. Private traceTableLine uses native truncateToWidth on the first retained physical line and marks an actual CRLF/CR/LF remainder or terminal-column cut with U+2026; it does not normalize/mutate the selected item or infer original/private loss counts. Short rows remain whole, and an authored ellipsis is not converted into a new clipping fact. Native ANSI resets remain styling metadata, so matching assertions strip terminal sequences while width checks use visibleWidth. Full detail still uses the exact selected item, original projection_sequence and unchanged chronology metadata/body budgets. No new source read, probe, permission, global fit policy, extra banner row, row/order/filter/cache/selection/scroll/stripe/rank/ID behavior or public JSON/canonical schema change.

On columns narrower than the original status prefix, the warning uses Trace incomplete… rather than clipping away the negative fact or showing a partial count as exact. Available chronology uses # recorded ≠ lifetime when the longer caption cannot fit; unavailable rank keeps #? unavailable before a reason with a real display-gap marker. Wider views keep original wording/counts when it fits. Compact captions are compiled semantic equivalents, not guessed counters or lifetime offsets. Remaining dropped counts/reasons retain the expert/full already-admitted detail surfaces; this does not reopen source tails or create automatic polling. The default namespace/aligned Run selector and generic fit/row policy remain untouched.

All19original overlay declarations/assertions/fixtures/cleanup remain. Two new properties first fail on the old unmarked clipping/hidden lifetime caption. A frozen mixed-item case covers24/52/90/140columns, long CJK/ZWJ/combining summaries, short whole rows, authored ellipsis and short-first-line/CRLF-only gap, same selected-id/source-sequence42/full second-line detail, source-filter rank7, unchanged JSON/source values and exactly one cached Trace projection. A three-mode warning matrix covers available recorded chronology, actual retained compaction with unavailable rank, and empty/incomplete projection at those widths/terminal10rows; it preserves complete essential meaning, original wide compaction/drop facts and journal bytes without inventing numbered history. Actual installed npm whole21overlay/16Inspector and earlier21inspection/8response owners replay by production-import-only remapping with original assertions/hook isolation/disposal/cleanup. One initial test fix supplied the required recorded_observations basis on unavailable metadata; another used native terminal-sequence stripping because truncateToWidth emits ANSI resets. Neither changes product/source semantics or weakens the original row/chronology properties. Source/headless evidence is not operator-authorized loaded terminal/phone acceptance; native/time/source/recipient/default/integrated release gates remain independent.

### Inspector Chronology: Bounded Implemented Subset

The human Inspector now consumes shared newer-higher recorded-observation ranks before source/display clipping, rather than filtered row positions. Normal retained canonical101→102 keeps100 visible rows with advancing numbers; source filtering and scrolling preserve the shared basis. Projection keys/timestamps/ordinals come from existing bounded reads and pre-tail session metadata, without wider bodies, a new clock or persistent numbering service. Missing/lost/private/ambiguous metadata, known bounded-history loss, metadata overflow and inconsistent legacy equal-time joins show `#?` with a visible reason; no exact original lifetime offset is invented. Mutable snapshots/late evidence can rerank a later observation but do not change stable event identity or mint a canonical event. Existing ordering, source counters/detail, body budgets, selection and saved packets remain independent.

[Actor Inspector](./actor-inspector.md#chronological-numbering-requested-replacement) owns the detailed human contract. Source and actual npm compiled owner properties cover the bounded behavior, width/scroll/filter/selection and rejection boundaries; synthetic on-disk fixtures are not authenticated producer history. Live colored-terminal/phone acceptance and operator-authorized reload remain gated, as do integrated release/native/clock authority. This human-only display change adds no agent tool parameter or public Trace JSON field and does not belong in the main actors operating Skill.

### User-Approved Omission Disclosure

Agent-facing information/outcome messages may contain selected body previews as well as file references; they are not location-only envelopes. The latest approved display target is **[omitted: N chars]** or **[omitted: unknown]**, with U+2026 at actual display-gap boundaries and the shared cross-surface structure above. Exact N is an admitted Unicode code-point count for the already-authorized privacy-projected source. This target is not yet implemented uniformly; each owned projection below distinguishes its implemented spelling from immutable older formats. Generic compatibility completion admission captures excerpt_format=bracketed_omissions_v1 and render their existing exact primary/diagnostic counts as [N characters omitted]; this adds no text/count source or publication permission. All three prior navigation-format variants without that aspect flag retain their exact old text through reload/phases, with pre-change rendering fingerprints covering representative tracked excerpts and independent exact-path checks. Actual source/packed SDK model contexts independently match the primary/diagnostic marker to accepted source counts. Earlier legacy summary/body/attention strings may contain only an ellipsis and may already have lost the original length. Never invent that length or disclose hidden-secret lengths; old unavailable counts must be stated as unknown. New permitted captures must retain the necessary count before discarding text. This is a narrow disclosure decision, not approval to publish broader primary/Actor bodies or retain richer summary sources. Keep existing budgets and complete references, and preserve old admitted packet text with separate new-capture formatting rather than retrofitting immutable history. BACKLOG owns implementation.

Fresh explicit agent Trace summaries now follow AX omission spelling at the existing read-time projection: projectRunTrace uses the already-redacted retained turn, collapses whitespace as before and preserves the160UTF-16 source-preview allowance without splitting an original surrogate pair. A clipped prefix ends with U+2026, then [omitted: N chars] from normalized retained turn; upstream [omitted: unknown]. N counts only code points removed at this normalized retained-display stage, not discarded session4000 or other upstream losses. If retained text is malformed (including a legacy split surrogate), the summary is Agent turn [omitted: unknown] (malformed retained text), without an invented count/gap, source repair or expanded read. Short valid summaries and authored old-marker/ellipsis text stay literal and unchanged.

This current summary leaf is derived, not a saved capture format: projectRunTrace's agent branch is consumed by explicit inspect/Inspector; curated canonical-only projectRunTraceJournal does not call it. No new capture aspect, journal/schema field, data source or writer is added. Existing detail, normalized/privacy/selection/retention contracts, IDs, symbol chronology/sequence, timestamp/order/filter/source counts, read budgets, canonical journals and immutable packets remain unchanged. Explicit session privacy is not recertified as original private-producer privacy. Both original owning omission declarations remain, with all original partitions plus ASCII exact/one-over, already-clipped5000→4000source/3840display-loss, authored historical marker, unchanged public key set and independent retained-tail count checks. The actual npm pack/install harness now replays all17Trace-owner declarations by remapping production imports only; its compiled public inspect witness checks both tool text/details, exact scalar/unknown spelling, source bytes/privacy and malformed upstream retention without a new Actor/native workload. Saved strings are not restyled merely because a fresh read has a new summary.

Dataflow assessment distinguishes remaining paths: ordinary completion summary is currently fixed synthesized status text, not an authored answer. Legacy stdout reads at most 8 KiB and then 4000 UTF-16 before collection/display, so full original counts are unavailable. Canonical Trace forbids body; attention body-500 preview remains a legacy outbox route, not authority to introduce canonical body, retain pre-record text or broaden summary sources. Normal notify/followup reference coverage shares the existing path-group owner with steer. Newly formatted legacy body/steer-diagnostic clipping now reports explicit unknown privacy-safe omission counts rather than inferring raw tail lengths.

Fresh urgent-steer admission uses observability's one canonical AX layout after the unchanged exact run/generation/directory/event lookup. There is no presentation selector or alternate new-message layout; ordinary notify/followup shares the AX primitives at the existing sink without a new shared byte cap. Stored steer content remains untouched. AX uses flat run/checkpoint/body values with authored Markdown/CRLF preserved, not interpreted as trusted next/tool metadata. Legacy body source stays within its500UTF-16 pair-aligned allowance; clipped/malformed local preview and unproven upstream completeness/privacy use [omitted: unknown], never private-tail counters. Canonical Trace still admits no body. Literal body annotations sit outside the source fence; string Markdown remains an opaque value.

Optional artifacts/run_files groups select whole exact JSON-quoted paths from each group's first eight unique nonempty slots, omitting rather than repairing malformed Unicode or filling from later declarations. Artifacts remain first; later groups retain minimum zero-shown coverage reservation. shown/omitted/total counts describe declared paths, not characters, existence, production or body permission. Fences/indentation/coverage share the unchanged16KiB UTF-8 limit with the complete essential checkpoint. Exact-fit/one-byte-over and unfit minimum coverage still refuse before admission through existing retryable diagnostics, not a new scheduler/retry service or partial message.

Envelope.content already stores the selected presentation bytes. Recovery replays that string directly; no new journal aspect is needed and no saved text is regenerated. Existing identity is reused before formatting, including when its current summary is malformed and would fail a fresh format. Direct RunDelivery conflict/phase validation stays unchanged. At the steer checkpoint, complete source/installed49declaration observation and29declaration UI owners retained all48/28original scenarios, plus two new properties covering opaque values, legacy unknown/scalar behavior, first-eight/byte coverage and pending/queued/presented old-text recovery. The actual packed extension also selects the new AX text before its exact completion epoch. No Actor/native workload, new body source or authority is added.

Fresh ordinary notify/followup uses formatRunAttentionMessage's single AX layout at deliverRunAttentionNotifications. Unused alternate new-message path/body branches are removed; no old history or committed string is regenerated. The separate terminal-transition path keeps its shared location helpers. Existing private AX checkpoint/body/reference primitives are renamed for their actual ordinary/urgent reuse inside observability, not promoted into another domain. Common helpers preserve raw authored Markdown/CRLF, scalar-aligned500UTF-16 legacy previews, literal structured values, unknown local/upstream privacy/completeness and whole JSON-quoted paths with shown/omitted/total. Selection still deduplicates nonempty strings and considers only the first eight before malformed filtering; rejected slots are never filled from later declarations, Artifacts precede Run files, and empty groups stay quiet. Counts are declaration coverage, never missing files/body/read permission. Ordinary delivery adds no steer-sized byte cap or later-group reservation: whole declarations can exceed16KiB without clipping or a new refusal.

Sink behavior remains one visible notification per projectable event and only followup's non-displayed pi-actors-run-trace message with identical text/original event details. command.done stays non-projectable; physical order, seen-id/startup priming, object identities, thrown sink values/earlier notification effects and wake policy remain unchanged. A new property covers opaque values, single-entry default formatting, empty/all-malformed/first-eight/whole-large references, scalar/malformed/private-tail body classes, dynamic structured literals, sink order/content/details and exact failures. All49earlier observation and29UI declarations remain; the source/installed whole50observation owner adds this one property while the existing canonical source/sink and packed-path witnesses retain every prior identity/order/reference/count/assertion except approved layout decoding. Previously measured short/body/reference steer fingerprints remain historical evidence; saved-envelope identity/content replay is the retained compatibility obligation, and unchanged full urgent byte/replay owners still run. No source/journal/retention/privacy, timer, native or completion authority is added.

The removed legacy formatBodyPreview had only the already-supported raw outbox body, no retained original privacy projection or authoritative completeness record; canonical Trace still forbids body. Its older normalized500-UTF-16 preview used an unknown-count marker; that spelling is historical data, not a new-message mode. Fresh steer admission/delivery diagnostics now instead use AX event/attention/stage fields and a raw240UTF-16 opaque preview, preserving Markdown/CRLF instead of flattening it. Pair-aligned clipping appends U+2026 plus diagnostic_omission: [omitted: unknown]; malformed visible text is unavailable with an explicit reason/unknown marker, never repaired or given a fabricated gap. Short complete selected message values need no loss decoration. The canonical body formatter now keeps opaque Markdown under the same pair-aligned allowance, with explicit unknown local/upstream loss. Complete valid short previews keep their text. Different raw hidden-tail lengths produce identical markers, and actor metadata such as redacted=true does not admit a counter. This does not add privacy masking, certify the legacy raw prefix as original-private, expose a new body kind, retain source/count data or modify recorded errors. recordRunSteerDeliveryFailure still normalizes whitespace, trims and stores its existing bounded message-only4096 UTF-16 last_error, not a complete original Error/cause/archive; raw counts cannot be reconstructed from it. Exact saved-envelope replay and normal committed content remain unchanged. Actual legacy-record AX formatting and real source runtime failure properties cover unknown counts, scalar safety, existing pending/attempt/error facts and unchanged thrown Error/cause; the actual npm package formats legacy bodies and replays the same owned runtime test against compiled modules via a temporary import-only remap, without duplicating its fixture/teardown or starting an Actor/native workload.

The urgent-diagnostic layout separates stage facts: admission remains retryable (including missing generation), not an assertion of no committed effects or workload replay; a send exception is request failed with delivery/presentation unconfirmed. Recovery with unknown/conflicting evidence keeps its loaded phase queued and exact status/reason, without reset/send. No new identity is exposed: the same event ID was already present. All four notification branches reuse existing facts/current context and pure tools-response fields; no source reader, persisted aspect, public tool/schema, wake/seen-id/retry/acceptance policy or error wrapper is added. Original29UI declarations remain: the original diagnostic property grows3→6partitions without dropping private4/4000tail, malformed scalar, pending/attempt/last_error/source Error/cause assertions; raw multiline and exact240/241 classes add opaque-value/boundary checks. One new four-part property covers missing generation, genuine canonical malformed-checkpoint admission and actual saved-envelope unknown/conflict recovery, preserving exact content/phase/attempt facts and zero recovery sends. The actual installed harness replays the whole30UI owner by production-import-only remapping and keeps its original packed steer-before-completion epoch journey.

The 65/64/1 SDK row-cap witness now measures its upper bound at the actual outcome-selection stage: existing header/inventory/overflow footer plus an extra outcome and zero-location count line, before lower-priority captured location rows consume remaining context. It still verifies the complete model payload at at most 16 KiB and retains the same actual Run, 64 synthetic companions, full identity inventory and source recovery. Including greedily filled location bodies in the earlier outcome-selection budget was a brittle test coupling, not a new workload or permission; no budget or row-cap assertion is relaxed.

### Operator Trace Navigation Feedback

Operator reported after restart/live smoke that chronology is wanted, but the standing first-row explanation, left gutter before the selection triangle and navigation stalls are not. This is qualitative loaded feedback, not complete colored-terminal/phone/native/release acceptance. The targeted correction removes routine available/unavailable chronology banners while keeping row #N/#? and full existing detail metadata/reason; real incomplete-history warnings remain on the first screen. Trace cursor prefix loses only its added left cell, with matching unselected alignment. Run/menu/document/Kill/feedback semantics and chronology/id/source ordering stay unchanged.

The concrete hot-path regression was renderTraceList calling readRunTraceJournal/summarizeRunTraceJournal outside the cached Trace projection on every render. Journal summary now loads lazily into that same current Run/generation traceCache. Navigation/source filtering/detail/resize reuse it; existing explicit invalidation/keying and one-second refresh stay unchanged. No new reader, source read, watcher/cache registry, input/body budget, time policy or persistent state. Refresh admits new warning summary alongside refreshed items instead of mixing a fresh warning with old projected rows. Cache stores only existing scalar warning summary, not raw journal/extra bodies. This fixes an evidenced source IO path, not a measured guarantee that every possible live stall has vanished.

Two independent old-source reds then green properties cover the clean first event row/no standing banner/no cursor gutter at24/52/90/140 while retaining ordinal102 or #? and projection_sequence0/unknown reason in detail. Real filesystem openSync/readSync/closeSync instrumentation with syncBuiltinESMExports proves initial2journal opens/reads grow to44on the old code for the navigation sequence, but remain2on corrected code; after explicit invalidation/new compaction, reads refresh and the genuine incomplete-history warning appears, then navigation again adds no IO. Actual projection/Run-list reads stay one per cache generation. Hooks only observe actual IO, settle synchronously and restore full descriptors/named ESM bindings before cleanup; no dependency result replacement. A new fixture typing error (Reflect.apply's unknown fd return) was corrected before genuine reds, not counted as a product failure.

All23prior overlay cases/helpers/scenarios remain, with only three approved old helper-banner assertion sites updated to no-banner plus explicit opt-in detail checks, preserving chronology/filter/#?/source loss coverage. Whole25overlay/16Inspector/13runtime/55registry source/npm replay keeps original fixtures/hooks/import and exact production URL remap/child/cleanup; matrices/repeats nonadditive, no independent review or live FPS claim. Generic fit/composition, action/selection, refresh cadence and earlier full selected_run_id/Run gap fix stay byte-unchanged. Existing history outcome now mentions cached scroll IO. Latest operator direction is a bounded fix, not Grow Loop restart or approval to auto-reload, spawn more agents or publish. After retained validation, await operator reload/retest; all A1/B/C/A3/D/source/recipient/native/clock/default gates remain separate.

### Run Control Gaps and Read-Only Selected Identity

The confirmed narrow Run label/selector crop is now corrected only in inspector-overlay.ts producers. renderRunControl receives inner column width and applies native truncateToWidth(..., ellipsis) before the unchanged generic row/fit. Run option content similarly reserves its existing four-column offset plus six marker/padding/border columns before generic menu composition; source selector and generic fit/compositing are byte-unchanged. Whole fitting labels remain without ellipses, rank/order/status-color/focus/windowing and application/cancellation semantics stay the same. #rank remains a cached-list position, not authenticated identity/chronology.

Recipe/Control read-only documents prepend compiler selected_run_id through the existing literal document renderer and navigation. Capture run.run once at its original stateDir path site, then preserve original body read/projection before the new identity projection. Identity is separate from the body object, so authored selected_run_id fields cannot overwrite it; no new reader, raw metadata field, input cap, action/key or Kill modal is required. The identity prelude and original body remain scrollable with existing Enter/arrows/pages, even at10/12rows; stripe sections include the new prelude. All original Trace/document/Kill/feedback bodies/action ports and source budgets stay unchanged.

Two independently named old-source reds then green properties use actual file-backed64-character shared-prefix Run records through the real Inspector reader, with a short Run and a deliberately authored same-name field. At24/52/90/140columns and10/12/30rows they verify native bounds, real-gap/no-gap markers, original ranks/cache-one-read/selected cancellation across resize, application of another Run, whole identity reconstruction using public Recipe/Control paging, no action callback/confirmation and unchanged source bytes. All21prior overlay case/helper bodies remain untouched; whole23overlay/16Inspector plus13runtime/55registry source/npm replay retains old fixtures/assertions/import URL remap/cleanup. First green trial exposed a new test reader assumption (always scrolling the first row even when the whole identity was already visible); corrected only that new oracle to read the visible page before PgDn. It was not a product fault. Initial old-source style/identity reds remain valid; expanded authored-field assertions are green on the retained candidate, not extra independent reds. Native/headless tests are not loaded theme/phone, SDK-independent judgement, native closure or arbitrary-below24-column acceptance.

This closes the concrete source gap in the inspected owner closure, not project-wide uniformity or integrated release. Retained historical assessment/probe stays below. Remaining acceptance here needs explicit operator reload and real colored-terminal/phone observations; local preparation is exhausted absent a new material counterexample. No further scan/restyling/retest solely to sustain Grow Loop. Existing A1/B/C/A3/D/source/recipient/native/clock/default/release gates stay separate; no commit/publication/reload/native actuation is implied.

### Run Control and Selector Convergence Assessment

Bounded source assessment of inspector-overlay.ts renderRunControl/runSelectorOptions/renderMenuBox/compositeMenuLine/row/fit and their existing tests found a real local presentation gap, not merely an outstanding loaded-UI gate. Run control passes a full compiler-composed label to row/fit, and selector composition clips full menu content with truncateToWidth(..., ""); a narrow crop can remove name suffix/status without any gap marker. Neither native controls nor status-color columns need forced Markdown restyling; the issue is truthful bounded visibility plus safe full selected identity access. #N is current cached-list rank, not identity or authenticated chronology; exact action targets/generations remain internally separate.

A retained private two-record fixture at /tmp/pi-actors-run-control-assessment-T08NCZ was admitted through actual readActorInspectorRuns, not a fake readRuns result. Both64-character ASCII Run names share63characters and differ only at x/y; actual reader retained generation-0/generation-1 and conservative status unknown. It is deliberately synthetic file-backed metadata, not live workload/readiness/native/lifetime proof. Headless neutral-theme Overlay render/selector/open/cancel at24/52/90/140columns kept all lines within width and only one cached Run-list read. At24/52 both header and selector lost full identities and status without ellipsis; at90/140 both whole names fit. No Kill callback or workload was installed/invoked, and the existing refresh interval was disposed in finally. This is a positive asserted counterexample to presentation completeness, not a new failing repository test, SDK journey or loaded phone/color acceptance.

Only canonical backlog and human/evidence docs change in this assessment. Runtime/test/dist/Skills/package state stays exact: prior startup-warning candidate hash4e65080c6a774a06669ce25cbb103ee55278cf783840628426f648ad5be2f463 covers lib/scripts/tests/dist, so prior source/npm/full1547+5skip, conformance463+1skip and preservation159 remain applicable behavioral evidence, not freshly rerun or proof that this newly exposed gap is fixed. Existing21overlay/16Inspector tests are rerun as a bounded baseline; no assertion/fixture/source projection is weakened to make the gap disappear. Retain generic fit/composition/native selection policy, all earlier AX projections, caches/order/focus/keys and original action ports. Next correction must mark real producer gaps and provide safe read-only whole selected identity through existing owners, with no new source reader/quotas or mandatory Kill modal. Human docs now disclose the current limitation; no changelog fix claim, production edit, commit/publication/reload or new native/default/recipient authority. BACKLOG is retargeted from assessment to that concrete local correction; loaded colored-terminal/phone and A1/B/C/A3/D remain independent.

### Startup Recipe Registry Warning Projection

Private runtime.ts formatRecipeToolWarnings now projects report, actual category sequences (shadowed_sources/skipped_tool_exposure/other_diagnostics) and old doctor advice as opaque instruction, with whole selected warning values through existing formatMarkdownField. Original shadow/bash startup suppression, three classification filters/includes and membership, header/map/template/push/spread/join/template-coercion order remain. Compiler-owned start/end slot ranges capture the original rendered warning entries, not parsed authored labels or inferred diagnostic completeness. Only known compiler bullet prefix is removed; original layout join/coercion still executes before new projection, although its layout result is discarded. Trailing LF preserved; no borrowed model16KiB quota or root/state/body/cause reread. Malformed selected warning becomes an unavailable warning entity with reason, no repair/private character counts. Existing runtime.notify hasUI gate stays after formatting; watcher direct UI remains separate. One earned runtime→tools-response edge reuses the unbounded field primitive, total394local edges, no new domain/helper bucket.

Actual loadTools fixture inputs establish skipped exposure via args items:string with repeat {items.length}, ordinary reserved-name/invalid duplicate diagnostics, mixed categories and order, and singleton lists. Duplicate argument names with CRLF/headings/blanks/backticks/literal dots/bullets/authored next/tool labels, a full6000-CJK warning over16KiB and malformed scalar exercise only actual resolver/Schema outputs, never fake dependency results. Stable primitive shadowing warnings are suppressed before this formatter; no invented shadowed runtime witness. Existing source/npm suppression/shadow/native-rearm scenarios remain whole.

Two independent old-layout reds then green properties cover literal/native Text24/52/90/140 rendering and original classification includes ledger, old layout join receiver/content exactly once, formatting before visible/hidden UI, exact startup/classification/join/UI post-scan faults with opaque/undefined/primitive causes, and original join-result template coercion (opaque result, native Symbol TypeError and exact coercion fault). Global Array.join/String.includes descriptors restore after synchronous operation settlement before cleanup; no dependency/schema result replacement. First style reds preceded extra conservation partitions, which are green on the retained candidate, not extra independent reds. All11prior runtime case/helper bodies unchanged; add2registered properties → whole13runtime source/npm (12pass plus old native skip on Darwin/Windows). Installed replay changes only runtime minimum count, keeping all55registry and original production import/exact URL remap, child fixtures/hooks/assertions/cleanup. Repeats/SDK/compiled matrices nonadditive, not independent review or loaded terminal/phone/RPC-client/native/closure proof. Existing generic runtime/watch-notices history covers this without redundant record. Other Inspector convergence/loaded UI and A1/B/C/A3/D/source/recipient/native/clock/default/release gates remain separate.

### Recipe Registry Watcher Notification Constants

Only two literal arguments in runtime.ts changed: notifyFailure warning now uses report plus original restart/register_tool advice as opaque instruction; scheduleReload info uses report containing the whole old Recipe tools refreshed from ~/.pi/agent/recipes text. No helper/import/domain/budget, root/state/activation read, automatic action or new actual-root/readiness/closure fact. Watcher calls ctx.ui.notify directly, unlike runtime.notify's hasUI gate; caller/port behavior remains distinct, including hasUI=false with an explicit callback. Parent/root admission, failureNotified/setWatchStatus, notifyAfterReload/latest pending state, timer/unref/load/getResolutionContext, stale-event checks, close/rearm and catch/reportCallbackError/no-throw containment are byte-unchanged outside those constants. A success-notifier fault can leave pending info for a later real event exactly as before; no automatic replay is introduced.

Two independent old-layout reds then greens in tests/runtime.test.ts retain all nine prior cases unchanged. Warning property covers missing parent/root open failure/root or parent error, failed-before-UI dedup, direct UI with either hasUI value, UI/notify-getter/callback faults with exact opaque/undefined/primitive causes, contained secondary observer throws and rearm reset. Refresh property covers active/draft/POSIX-Windows separator/null/mixed latest-pending events, original ctx/resolution and load-before-notify, closed stale callbacks, load/info failures with original secondary-before-primary reporting, and pending info on a later controlled draft event. Native Text checks24/52/90/140 widths; no model16KiB cap or actual root certification. Injected documented watchPath/exists/load/UI ports and real timers are deterministic fixture infrastructure, not independent/native/loaded-host review. Existing real filesystem rearm scenario remains whole and platform-skipped as before.

Initial new fixture used a TypeScript parameter property unsupported by Node strip-only mode although tsc passed; corrected only the new fixture constructor before obtaining the two genuine original-layout reds. Preserve that parse-failure log separately, not as a product red. Explicit test-environment import now precedes production values for the runtime owner. Actual npm pack/install replay adds whole11runtime cases (10pass plus old native skip on Darwin/Windows) alongside unchanged whole55registry and all existing owners; original production import/URL remap, fixtures, hooks/assertions/cleanup and embedded child remain unchanged. Matrix/callback/render/replay repetitions are nonadditive; exactly two added registered tests, not a new test suite. Existing generic runtime/watch notices history outcome already covers this change without duplicate record. Source/package/headless tests do not close loaded colored-terminal/phone/RPC client, source/native/recipient/clock/default or A1/B/C/A3/D release gates. Other startup diagnostics/registry/receipts/errors remain separate.

### Registry Notification Arguments

Only the normal Tool activated, Promoted draft recipe and Deleted tool notification arguments now call private registryNoticeText with original single name interpolation at the same notify argument site. report preserves old compiler notice identity, tool only the old selected display; no callable/active/full-host-removal/closure fact or automatic invocation/retry/reload. Callback lookup still precedes name conversion, ctx/info type and original post-effect positions/errors/receipts/details/transaction/deletion behavior stay unchanged. Malformed selected name is unavailable without repair/hidden character counts; full well-formed values remain as before with no16KiB model/steer quota borrowed for UI.

Port inspection proves tools.ts→runtime.notify→unchanged hasUI→ctx.ui.notify. Installed SDK TUI routes info to showStatus and ThemedText/native Text: literal multiline/native-column wrapping, adjacent-status coalescing/theme behavior unchanged. RPC docs declare notify fire-and-forget message transport, no response/display/handling guarantee; JSON/print have no UI. Source/native headless evidence is not loaded colored-terminal/phone acceptance. Pi extension/TUI/RPC docs and dynamic-tools example read; no new custom component, renderer, RPC schema or transport behavior.

Three separately named old-layout reds then green properties cover actual runtime.notify visible/hidden gate, each post-persistence/promotion/deletion callback snapshot, original info type and opaque/undefined/primitive post-effect throw once, plus actual SDK non-error/content/details. A fourth property preserves old selected-name conversion exactly once after notify lookup via direct legacy method-bearing identity, opaque CRLF/body labels, full well-formed values beyond16KiB and malformed unavailability. Actual native Text rendering at24/52/90/140 widths preserves report/tool visibility and fits columns; no loaded theme/RPC client claim. Direct legacy objects are not cloneable SDK DTOs, temporary callbacks no live host/tool execution. All51prior case inputs/scenarios/assertions/cleanup retained except two approved deletion-notice text expectations; whole55source/npm uses original production import/URL remap and child fixture, plus unchanged runtime/journey owners. Inner route/fault/SDK/render partitions nonadditive, not independent/native review. Generic reg-guards history covers this scoped notifier extension, no redundant history mutation. Other runtime/watcher/startup notices and loaded terminal/phone/source/recipient/native/clock/default/integrated release gates stay separate.

### Outer Registration Transaction-Failure Text

Only the existing post-cleanup outer Error template now calls private registrationTransactionFailureText with original stage, resolutionContext.generation, activeSkillSummary and Error.message versus String(error) template conversions, left-to-right at the same Error/formatter site. No new trim, private-cause retention, reader/catch, rollback/transaction policy, callback replay or source/recipient authority. Persisted byte restoration/unlink, Map restore/delete, registerRuntimeTool(existing), setActiveTools and all cleanup faults remain byte-identical. A later formatting failure may follow effects/cleanup; inner activation/persisted-admission messages remain opaque error content, not a new full rollback/removal/readiness/retry guarantee. Resolution generation is labeled as such, never a Run/live epoch/correlation.

Whole opaque generation/legacy-summary/error fields grow from shorter full/omitted seeds under16KiB including old LF, prioritizing a fitting surfaced error. Malformed selections unavailable without repair/hidden character counts. Fixed stage/result add no no-effects fact, diagnostics list, fresh active-state or invocation hint. Two properties first red old layout then green real private new/update activation callbacks observing persisted bytes and Map at activation, byte/Map restore/reactivation order, real persisted-admission and filesystem persist stages, raw delete/reactivation/setActive cleanup faults×opaque/undefined/primitive, SDK isError and unprintable primary failure after cleanup. Controlled ports have no live host/native work; private fixture cleanup grants no wider cleanup authority.

Scoped global Error observation verifies post-cleanup constructor lookup then generation get/coercion, summary and Error.message/coercion order, with five formatting-fault stages×opaque/undefined/primitive retaining exact rejects after cleanup. No trim preserves leading/trailing opaque Markdown; exact16384/one-over generation/summary/error, CJK/ZWJ/combining and malformed unavailability remain. Descriptor is restored after awaited execute. All49prior test case bodies/assertions/fixtures/cleanup remain unchanged; whole51source/npm reuses production import/URL remap and original child fixture. Inner matrices/SDK/compiled/repeated runs nonadditive, not independent/native review. Generic reg-guards history covers this bounded text extension without redundant history mutation. Inner errors/notifier/receipt and loaded terminal/phone/source/recipient/native/clock/default/integrated release gates remain separate.

### Draft Invalid-Recipe Refusals

Only promoteDraftRecipe false-raw and false-candidate errors now use private draftRecipeFailureText. Raw readRawRecipeConfig and diagnoseRawRecipeConfigFailure remain separate calls in their original order. Reason truthiness and original once-only template coercion stay at the same Error/formatter site: undefined reason remains absent; truthy legacy message object displaying empty remains an empty selected reason. Candidate validated/tool/diagnostics getter/join stay intact, with Error lookup before join, unlike normal candidate sourceDiagnostic construction. Only old reason/joined diagnostics become opaque fields with fixed draft/result; no new path/body/cause, reader/catch, source retention, policy/transaction merge, quota or automatic retry/rollback/invocation.

Whole opaque value fits16KiB including old LF or is wholly omitted/unavailable with selected-field count, no private char counts or malformed repair. Existing candidate4096UTF16 diagnostic capture stays untouched, including malformed legacy cut. Two properties first red each old layout, then green real raw read→diagnose and real candidate-admission/SDK paths. Scoped fs read/stat and global Error descriptors expose raw two stat/read calls, reason getter/coercion and Error order; descriptors and named ESM bindings are restored in finally after awaited call and explicitly checked. The first read uses actual null JSON and the second targeted I/O throws a captured native Error handled by the real diagnoser, not a fake returned dependency result. Uncaught diagnoser stat/message/coercion and candidate join faults preserve opaque/undefined/primitive values. Candidate fixture reuses actual admitUserRecipe plus restored join/Error instrumentation; original normal branch scenarios remain. No command/Actor/operator registry mutation or loaded host acceptance in new fixtures.

Exact16384/one-over ASCII/CJK raw reasons, malformed unavailability, opaque Markdown/CRLF, undefined/truthy-empty presence, legacy4096/malformed candidate cut and actual SDK isError/content/details stay covered. All47prior scenarios/assertions/inputs/cleanup remain; only the shared real-candidate fixture gains an isolated draft branch without changing prior branches/results. Two new properties give whole49source/npm through original production import/URL remap and child fixture; matrices/SDK/compiled/repeated partitions nonadditive, not independent/native proof. Generic reg-guards history covers this scoped extension without redundant history mutation. Other transaction/persist/activation/rollback/notifier errors and loaded terminal/phone/source/recipient/native/clock/default/integrated release gates remain separate.

### Normal Candidate-Admission Refusal

Only executeRegisterToolUnlocked candidate-admission refusal now projects its existing requestedSource truthy/falsy branches via private candidateAdmissionFailureText. Real admitUserRecipe, validated/tool checks, diagnostics getter/join and original sourceDiagnostic construction before Error remain. Source-branch old displayed source, joined diagnostics, legacy skill summary and doctor advice keep their left-to-right template conversions; recipe branch omits source/summary/advice entirely. A truthy legacy display rendering empty stays source branch, while falsy captured source can stay recipe branch despite a delegated authored source. No new source/body/cause read, catch, admission policy, complete-list reconstruction, quota, generic wrapper/domain, no-effects/rollback/readiness or retry/invocation authority.

Whole scalar/literal/advice values start from shorter full-or-omitted seeds under16KiB including old LF, prioritizing fitting diagnostics over large optional source/context/advice. Source remains a complete dynamic-fence literal; diagnostic/skill summaries are opaque Markdown and old advice opaque instruction. Existing boundedAdmissionDiagnostic4096UTF16 selection (4095prefix+ellipsis) remains untouched, not widened/repaired or counted as whole original/private text. A malformed retained cut is unavailable with selected-field count, no inferred char loss or source repair.

Four properties first red old layouts and then green source/recipe branches, actual SDK errors, real-admission join/pre-Error ordering and legacy diagnostic/budget boundaries. Context activeSkills getter throws a captured native Error inside actual admitUserRecipe; the dependency itself returns its real candidate/diagnostics, never a fake result. Serialized targeted Array.prototype.join and global Error getter instrumentation observes actual returned diagnostic join/get/coercion and pre-Error lookup, restoring both descriptors in finally after the one awaited call. Source/summary/doctor and falsy-from/empty-display branch controls plus seven secondary fault stages×opaque/undefined/primitive values preserve originals. Cap4096, malformed cut, exact16384/one-over source/summary/advice, Unicode/CRLF/backticks/Markdown remain; inner matrices/SDK/compiled/repeated cases are nonadditive, not independent/native proof. New fixtures invoke no command/Actor/operator registry mutation.

All43prior registry scenarios/assertions/fixtures/cleanup retained with only two approved layout regex changes. First broader owner run exposed two additional stale source-error text expectations in agent-journeys and registration-truth; backed up both before edits and changed only those regexes, preserving exact journeys/inputs/semantic assertions/cleanup. Whole47registry/source/npm and both original journey owners pass. Existing generic reg-guards history covers this extension without redundant history mutation. Draft/raw/candidate/transaction/persist/activation/rollback/notifier and loaded terminal/phone/source/recipient/native/clock/default/integrated release gates stay separate.

### Public Source-Normalization Refusal

Only the existing executeRegisterToolUnlocked from-normalization catch wrapper now calls private sourceNormalizationFailureText with the original displayed source, reason, legacy active-skill summary and doctor advice. normalizeFromReference inner messages and catch extent remain untouched, including spread/getter errors already inside that old catch. Error.message.trim versus String(error), diagnosticSource derivation and left-to-right source/reason/activeSkillSummary/recipeDoctorAction template evaluations stay in place. Canonical doctor construction observes its input twice (regex then identity interpolation); undefined display or disagreeing displayed source/hint identity is preserved, not repaired. Existing opaque/undefined/primitive coercion failures stay raw at their original stages; no new private cause retention/disclosure.

Source is one whole dynamically fenced literal; selected reason/summary retain opaque multiline Markdown, commas and body labels. Legacy summary keeps the original sorted first20/join behavior without reconstructing a complete list or discarded counts. Only old advice becomes opaque instruction, never parsed/typed action or automatic doctor/retry. Whole scalar/action representations start from shorter full/omitted seeds then grow monotonically under16KiB including public LF. Unfit selections count fields/actions, not raw/private characters; malformed text is unavailable without repair. No source/body reread, source/privacy/recipient authority, catch enlargement, quota or generic formatter/Error domain.

Three properties first red old public layout, then source/npm green: actual std:/skill:/invalid reasons, first20 comma-summary projection and SDK isError; controlled direct spread/Error-message/trim/source/reason/summary/doctor-test/doctor-identity observations plus exact secondary faults and pre-catch getter rejections; primitive/undefined/Symbol String behavior, unprintable failure and undefined display; exact16384/one-over source/reason/summary/instruction fields, CJK/ZWJ/combining boundaries, malformed unavailable and dynamic fences/CRLF/Markdown. A first expectation missed the second canonical doctor conversion; corrected test, not product behavior, then restored only the old callsite for three corrected layout reds and restored the candidate in finally. The unused pure helper remained during that old-site replay; no full-owner byte-equality claim for the temporary state. Final whole-owner comparison removes only helper and normalizes one call.

All40prior cases/scenarios/assertions/fixtures/cleanup retained with only two approved std:/skill: hint-label expectations updated, and whole43source/npm through original production import/URL remap and child fixture. Direct adversarial objects are not SDK DTOs; matrices/SDK/compiled/repeated runs are nonadditive, not independent/host/native acceptance. No new command/Actor/operator registry mutation in these fixtures. Existing generic reg-guards history covers this bounded wrapper extension without redundant history mutation. Candidate validation/draft/transaction/persist/activation/rollback/notifier and loaded terminal/phone/source/recipient/native/clock/default/integrated release gates remain separate.

### Draft-Path Refusal References

Only assertDraftPath outside-root and current-not-found errors now use private draftPathFailureText. Original captured allowed root (not refused caller path) or resolved draft path remains a whole literal field with dynamic fences and uniform multiline indentation; fixed field/result and exact old summary-inspection advice are opaque instruction. Full reference fits16KiB including old public LF or has whole-field omission/unavailability, no malformed repair/private-tail counts, input/work quota, new probe/body read or generic Error wrapper/domain. getRecipeRoot/resolve/relative/equality/dot-prefix/exists and Error/formatter/caller/name-lock order stay unchanged. Original dot-prefix refusal is not repaired into a different containment rule; existsSync false text is not upgraded into certified absence/native/host proof or no-effects permission. No typed action, automatic retry/reload or new listing guarantee.

Two independently named old-layout reds then green root/missing properties cover exact literals, root equality/dot-prefix refusal, backticks/CRLF/Unicode,16384/one-over ASCII/CJK/ZWJ/combining budgets, whole omission and malformed unavailability. Dynamic recipe-root getters keep outer lock path short while preserving original two root observations; long/malformed paths exercise existing lexical/native APIs, not a new input quota or simulated filesystem result. A third property preserves four root/draft-trim/String observation fault positions×opaque/undefined/primitive values with exact root/draft read counts, original native TypeError and an existing invalid-content draft reaching the original next lookup port without reading its body. SDK cloneable root/missing requests each reach facade once with unchanged isError/content/empty details; direct changing getters are not host DTOs. No command/Actor invocation, operator registry mutation or loaded-host acceptance in new fixtures.

All37prior registry declarations/scenarios/assertions/fixtures/cleanup are unchanged; new properties give whole40source/npm via original production import/URL remap and sibling-process fixture. Matrix/SDK/compiled/repeated partitions are nonadditive, not independent/native review. Existing generic reg-guards history covers this scoped reference extension without redundant history mutation. Source normalization/admission/draft transaction/persist/activation/rollback/notifier and loaded terminal/phone/source/recipient/native/clock/default/integrated release gates stay separate.

### Runtime-Owned Delegated Default Refusal

Only the buildAuthoredRecipe runtime-owned-default-key error template now projects defaults/key/result and exact old remove-default/retry advice as opaque instruction. It retains its single original first-key interpolation at the same Error/formatter site. normalizeDefaults copy and Object.keys/find order, private eight-name isRuntimeOwnedRecipeInput membership and delegated from condition remain unchanged. No new helper/catch/parser/quota, complete key-set/value/source/body echo, metadata, admission/mutation, typed action or automatic retry. Finite native ASCII keys make full text provably fit16KiB with old public LF without invented clipping/private-tail counts. This is not a global command-template default ban or a no-effects receipt: every original copy/getter observation still happens first.

Two properties first red old text, then green every recognized key through normal and controlled changing-getter draft authoring paths, first-key order with all/reversed keys, numeric/unknown/case/space/malformed aliases and copied Symbol properties. Exact ownKeys/descriptor/value copy ledger, resolution/getTools/blocker phases, plain Error, no value coercion or source/body echo and immutable target/draft/Map/active inventory remain. The draft route preserves direct changing-getter behavior, not a cloneable two-source SDK DTO. A late value getter throws opaque/undefined/primitive after an earlier recognized-key getter: original complete copy still wins over an early refusal. A command-template second-template fault remains exact despite a runtime-owned-name default, proving this delegated guard was not broadened (not a guarantee of later admission). Actual SDK opposite-key-order requests each reach facade once and preserve first-key AX isError/content/empty details and unchanged caller defaults. No actual command/Actor invocation or live operator registry mutation in new fixtures.

All35prior cases/scenarios/assertions/fixtures/cleanup retained with one approved selected-key/advice regex order-label update. Two new properties give whole37source/npm using original production import/URL remap and sibling-process fixture; inner key/route/fault/SDK/compiled/repeated partitions are nonadditive and not independent/host/native evidence. Existing generic reg-guards history covers this bounded template extension, no redundant history mutation. Draft paths/source/Schema/admission/persist/activation/rollback/notifier errors and loaded terminal/phone/source/recipient/native/clock/default/integrated release gates remain separate.

### Authored-Recipe Fixed Validation Refusals

Exactly four diagnostic strings now use fixed field/result in registry.ts: normalizeDefaults non-object and buildAuthoredRecipe missing command-template description, null at that authoring stage and missing final template. No supplied value/default/description/source/body echo, new helper/catch/parser or input/work quota. Predicates, args/from/description/default/retained-template getter/trim/copy order, Error/formatter and normal/draft callers remain unchanged. Front null/empty still selects deletion; undefined can inherit an existing source. Earlier source-mode/new-registration checks and later runtime-owned-key/Schema/admission/persistence/activation/rollback/notifier errors stay separate. New presentation is not a global null/source rule, retry/overwrite authority or no-effects receipt; existing discovery/lock/port observations may already have occurred.

Four independently named properties first red each old constant, then green normal/draft paths (plus logical-from for defaults). They check exact resolution/getTools/blocker/description.trim stages, template reads, a controlled changing-draft getter for authoring null, plain Error/private-metadata boundaries, absence of supplied bodies, unchanged target/draft/Map/active inventory and no dispatch/notice. Changing-getter/method-bearing description probes preserve direct API observations, not cloneable SDK DTOs. A fifth property preserves six args/description-trim/default-spread-key/descriptor/value/retained-template fault classes×opaque/undefined/primitive values, plus exact Schema duplicate-argument text before description. Real SDK empty-description reaches the local AX guard; non-object defaults fails host schema before execute, and front null still returns deletion not found. Prior retained SDK properties already prove that a new registration without source reaches its earlier source-mode error rather than late required-template; no duplicate new case is added. No actual command/Actor invocation or operator registry mutation in new fixtures. A first fixture type error from an extraneous async property was corrected by removing that fixture field before genuine reds; product types/schema stayed unchanged.

All30prior registry scenarios/assertions/fixtures/cleanup remain with only two approved null/required text expectations updated in the prior shape property. Five new top-level tests (four named loop registrations plus one fault/SDK property) give whole35source/npm through original production import/URL remap and sibling-process fixture. Inner route/fault/SDK/compiled/repeated partitions are nonadditive, not independent/host-readiness/native proof. Static output below1024bytes is evidence, not a new product cap;16KiB with old public LF remains. Existing generic reg-guards history covers this constant extension without redundant history mutation. Other errors and loaded terminal/phone/source/recipient/native/clock/default/integrated release gates remain separate.

### Template-Shape Helper Refusals

Only three compiler strings changed in registry.ts: assertTemplateIsNotNestedRecipe nested-object refusal and getInputTemplate empty-sequence/unsupported-type refusals. AX identifies field template and fixed result, lists actual string/object/sequence kinds where old error named them, and preserves the exact nested-shape correction as opaque instruction. No supplied value/source/body echo, new helper/catch, parser, input/work quota, automatic retry/update or no-effects authority. All typeof/Array/key/getter/trim/reference-test/expansion predicates, Error/formatter order and callers are unchanged. Existing external expansion/accessor errors, front null/empty deletion, undefined/inherited source and later buildAuthoredRecipe null/required/description/default/argument/admission errors retain their original ownership; supported kinds are not a new global null rule or proof that every object/sequence is valid.

Three independently named properties first red each old guard, then pass new fixed layouts through ordinary front lookup, ordinary second authoring getter and controlled changing-getter draft authoring paths. The latter deliberately changes draft between source-mode admission and promotion; it preserves direct API observations, not a cloneable two-source SDK request. Exact parameter-template/draft read counts and resolution/getTools/blocker phases, plain Error metadata, absent target/immutable draft/Map/active inventory and no undisplayed source/body remain. A fourth property preserves six accessor/reference/ownKeys/descriptor/array-expansion/object-expansion fault classes×opaque/undefined/primitive values, exact external repeat error, valid string/object/sequence/undefined reaching original blocker, null/empty deletion and unchanged later authoring null/required errors. Direct unsupported function/Symbol/numeric/boolean values are not stringified for copy. Actual SDK nested/empty guards cross isError; numeric template7 is cloned/coerced to string7 and reaches original blocker, not the direct unsupported-type refusal; original caller value remains7. No schema spoofing or actual command/Actor execution.

All26prior registry cases/fixtures/assertions/cleanup remain, with one approved nested-shape regex label change Next to instruction; four new declarations give whole30source/npm via original production imports/URL remap and child fixture. Matrix/direct/SDK/compiled/repeated cases are nonadditive and not independent/host-readiness/native evidence. Fixed messages are below1024bytes in tests, not a new product cap; public16KiB already includes old leading LF. Existing generic reg-guards history covers this bounded constant extension, with no redundant history mutation. Other authoring/source/promotion/admission/persist/activation/rollback/notifier errors and loaded terminal/phone/source/recipient/native/clock/default/integrated release gates remain separate.

### Duplicate Registration Refusals

Only the ordinary executeRegisterToolUnlocked and promoteDraftRecipe already-registered errors now reuse private duplicateRegistrationText. It projects only the original selected normalized-name display as field/value, fixed Tool already registered result and exact Use update=true to overwrite as opaque instruction. No typed update/next or overwrite/retry permission follows. Distinct ordinary authoritative-file/current-Map and draft current-Map/target-exists short-circuit predicates, blocker-before-update, getter/path/normalization/Error/formatter order and all other transactions/guards/receipts remain unchanged. The original final template conversion stays once at each old Error site, including native Symbol refusal and opaque/undefined/primitive throws. Outer locks/discovery callbacks may already have observations; the errors do not certify no effects or rollback. No private source/body/activation read, policy unification, schema/machine data, generic catch/domain/work quota or live mutation.

Whole well-formed selected name fits16KiB including old public LF and mandatory instruction/result or has one-field omission; malformed text is unavailable without repair/private char-tail inference. Two new properties independently red/green each path before shared validation. They retain current-map-only, malformed-target-file-only and both predicates; exact resolution/getTools/map/blocker/update stages; immutable target/draft/map/active state; original fault values at ports/update/display; exact dependency blocker text before update; five controlled legacy normalization/lock/target/display conversions;16384/one-over ASCII/CJK/ZWJ/combining bounds, malformed and Symbol rejection; and actual SDK cloneable isError normalization. The draft candidate remains deliberately invalid and unread at this refusal boundary; ordinary authoritative-file parsing keeps its original behavior. A first fixture type error (missing required defaults) was corrected by providing a real typed config before genuine presentation reds, not by changing product types. All24prior registry declarations/scenarios/assertions/fixtures/cleanup are byte-equal; whole26source/npm uses the original production import/URL remap and sibling-process fixture. Existing concurrency/ordinary update/draft promotion scenarios stay intact. Matrices/SDK/compiled/repeated runs are nonadditive, not independent/live-host/native acceptance. Generic reg-guards history already covers this bounded extension; no redundant history mutation. Other source/template/promotion/admission/persist/activation/rollback/notifier errors and independent review/loaded terminal/phone/source/recipient/native/clock/default/integrated release gates remain separate.

### Ordinary Registration Name and Source Refusals

Only three executeRegisterToolUnlocked errors now project AX: invalid normalized name, reserved selected name and new registration missing all sources. Invalid-name text adds no raw caller echo; reserved-name value keeps its original single template conversion at the old Error site; missing-source text shows actual from/template/draft choices with the unchanged correction as opaque instruction. This is not a new required-source rule for listing or update. Empty-name listing, existing-tool source reuse, dependency blocker text and all other source/promotion/admission/transaction/notifier errors stay original. Predicates/name/has/getter/normalize/reserved-set/resolution/template/authoritative-map/blocker and Error/formatter boundaries remain ordered, with no new catch, overwrite/retry, state/body probe, schema/machine data or operation.

A small private reservedRegistrationNameText formats only the already selected display scalar, not live ports. Whole well-formed display fits16KiB including old public LF or gets one-field omission; malformed selection is unavailable without repair or raw-name-tail counts. Legacy method-bearing identity inputs retain their normalizer/path/receipt observations rather than being repaired into canonical metadata. New fixed diagnostics do not certify no effects; old name locks and discovery callbacks may already have observations.

All22prior registry cases/fixtures/cleanup remain, with one approved missing-source text expectation changing Next to instruction. Two new properties first fail old text, then cover exact guard-phase ports and caller getters, standard Error shape, no undisplayed description/default/source access, immutable absent target, positive empty-name listing and actual existing-tool update with retained template. Eight unowned fault classes×opaque/undefined/primitive values plus exact dependency-blocker text retain originals without a wrapper. Controlled reserved-display identity preserves all four old normalizer/path/name conversions; exact16384/one-over ASCII/CJK/ZWJ/combining bounds and malformed scalar retain whole values/coverage. SDK cases cover actual invalid/reserved/new-source errors, empty listing, number-to-string name coercion reaching the existing new-source guard and object schema rejection before execute, without altering caller args. Temporary recipe/controlled activation fixtures do not invoke any tool/Actor or prove actual host readiness. Whole24registry npm replay retains original production import/URL remap and every previous owner; matrix/SDK/compiled/repeated runs are nonadditive. Existing generic reg-guards changelog outcome already covers this slice; no redundant history record is added. Other registry errors/notifications and independent review/loaded terminal/phone/source/recipient/native/clock/default/integrated release gates remain separate.

### Registration Source-Mode Guard Presentation

Only four literal message sites in assertRegisterToolInputModes now use AX: removed values, invalid/empty from, mixed source modes and explicit args/async with from inheritance. Field/result records keep the original diagnostic clauses, actual replacement/reference-form/source-mode/inherited-field sequences, and the unchanged old correction text under instruction. No parser or typed mutating next, no source-value echo, new helper/catch, no-effects/admission/callability receipt or retry authority. Compiler-only text is bounded far below16KiB, including the existing formatter's LF; no input/work quota or new clipping/count fact is needed.

Every predicate/hasOwn/descriptor/getter/trim/mode-count and Error/formatter call stays in its original place. Existing outer name locking is unchanged and is not absence-of-effects evidence. A duplicate old non-empty-from sentence belongs to normalizeFromReference, not this guard; the first ambiguous edit was refused without changing the owner hash, then a unique conditional context selected only the intended site. Normalizer/name/source-resolution/authoritative/blocker/admission/persistence/activation/rollback/draft errors and all successful receipts/details/callbacks/notices remain untouched. No schema, source read, saved-message migration or default/native/clock policy changes.

All20prior registry cases/fixtures/cleanup remain, with only four approved existing text-regex expectations switching Next label to instruction. Two new properties cover seven direct guard classes×named/unnamed calls, exact descriptor/getter short-circuit order, no supplied-source/object coercion or lookup/activation/notifier callback, standard Error metadata and bounded opaque compiler copy. Eight observation fault classes×opaque/undefined/primitive values preserve exact unowned rejection. Real SDK checks keep removed values/object-valued from schema errors outside execute, while empty string/mixed/inherited fields reach AX refusal. A corrected initial test assumption exposed that actual SDK cloning/coercion turns numeric from7 into string7, leaving original caller input numeric and retaining the preexisting successful unnamed list result. Product schema/guard behavior was not changed to manufacture rejection. After correcting that test, four precise literal reversions made the owner byte-equal to its original backup and established two genuine layout reds; candidate literals were restored without resetting cumulative work. Whole22registry installed replay preserves original production-import/URL mapping and all previous owners. Matrices/SDK/compiled/repeated runs are nonadditive. This is neither a blanket SDK error/privacy certificate nor loaded-host/native/terminal/phone/integrated release acceptance; external gates remain separate.

### Draft Promotion Receipt Presentation

Only promoteDraftRecipe returned success text in registry.ts now uses private draftReceiptText. It presents the original selected name, new/update outcome, source=draft, exact original callable display and first prior hint. It does not import the normal-registration receipt's args/defaults/body/path/warnings/boundary facts or persistence/activation/rollback policy. In particular a negative/absent activation still follows the existing promotion path and new/update wording; no new admission failure or inferred callability is introduced. Validation/read/write/admission/map/activation/argument-summary/notify and details/error behavior remain unchanged, with no extra source read, new catch, saved-message migration or default/native/clock authority.

The old name→callable→hint template conversions are explicit in-place arguments at their original post-notify text site. Zero remains zero rather than false, and an opaque legacy object's selected string remains opaque rather than a Boolean coercion. Hint selection stays the prior captured first action, not a decision from visible flag text. Symbol conversion retains its native TypeError after effects instead of being silently accepted by String(Symbol). Details keep the original raw selected value and later activation reads, including controlled disagreement; the formatter never asks activation for fresh facts. Only an exact canonical producer-known tool-status hint becomes typed read-only inspect; invocation/other advice is opaque instruction, not trusted execution metadata.

Whole tool/flag/action projections start from shorter complete-or-omitted forms and grow monotonically under16KiB including the unchanged public LF. Fields/actions have selected-entry coverage, not original/private char counts. Malformed selected text is unavailable without repair or guessed loss. No new input/work quota, automatic invocation, reload, rollback/retry or primary/body permission.

All18prior registry properties/scenarios/assertions/fixtures/cleanup remain byte-equal from the prior list property onward. Two new properties first fail on old prose/list-style expectations, then cover void/negative/true/toggling/zero/opaque activation×new/update, exact cfg/activation/coercion/notify observations, unchanged draft bytes/target contents/details/next_actions, no undisplayed metadata and no ordinary-registration rejection/rollback. Five original fault positions×opaque/undefined/primitive values preserve post-write/map facts with one activation and original notification admission. Exact16384/one-over selected callable text, CJK/ZWJ/combining UTF8 edge, malformed scalar, eight single old conversions, a truthy object displaying false without hint-policy repair and actual Symbol TypeError are verified. Real SDK normalization covers a cloneable draft request and unverified non-error promotion result, not actual loaded host/tool readiness. All new cases use temporary recipe roots and invoke no Actor/tool. Whole20registry actual installed replay reuses original production imports/URL remap and all previous owners. SDK/matrix/compiled/repeated executions are nonadditive; source/package proof does not close independent review, loaded terminal/phone, source/recipient/native/clock/default or integrated release gates. Registry errors/notifications and all completed returned-text slices stay separately scoped.

### Registry Name List and Deletion Returns

Two independent returned-text leaves in registry.ts now use AX. listTools still selects the original in-memory Map keys, native sort and conditional map/join. The old compiler-prefixed rows capture each raw key's original template conversion; the new renderer indents those selected strings rather than coercing keys again or reading tool bodies/activation/files/session state. registered_tools is an actual sequence, including singleton and opaque CRLF names. Coverage shown/omitted/total counts only this selected name group, not private characters, active/callable/global/loaded-host or lifetime inventory. Entire-group selection fits16KiB including existing public LF, otherwise all names are explicitly omitted; malformed selected text makes the group unavailable without repair. This intentionally introduces neither a page/partial subset nor a row/work quota. None means actual empty selection, never a withheld group. Saved messages and details are not migrated or expanded.

Deletion returns only the original selected tool/result, preserving the exact complete-registry manual reload sentence as opaque instruction, not typed action or reload permission. A current-map miss remains a returned result with original details and no orphan-file deletion/deactivation; existing outer name locking/validation still applies, so it is not a global no-effects receipt. Success retains lookup→optional unlink→Map deletion→active-set update→notify order, and all intermediate exceptions remain original after whatever effects already occurred. No new catch/rollback, host removal/native/callability inference, automatic reload/retry or source read. Name template conversion is retained exactly once at its old returned-copy site; whole scalar omission/unavailability has field coverage, not raw identity-tail counts. This also preserves legacy method-bearing direct-API normalization/path/receipt observations rather than trying to repair or revalidate their machine payloads.

The two nearby tasks share source/npm evidence but have independent red→green falsifiers: list property green precedes deletion implementation. All16previous registry declarations/scenarios/fixtures/cleanup remain, with one approved old deletion-text assertion changed. Two new properties cover empty/single/mixed/native-sort/opaque Unicode+CRLF names, immutable Map order, no body/status/path callbacks, exact16384/one-over ASCII and UTF8 whole-group limits, malformed groups and one original raw-key coercion; opaque/undefined/primitive source failures stay exact. Deletion covers found/missing×recipe-file present/absent, orphan preservation and exact port ordering plus six fault boundaries×three original failure kinds, including already unlinked/deleted/active-updated/notified facts with no retry or rollback. A controlled method-bearing legacy identity proves exact original four normalizer/path/receipt conversions, whole selected-name byte bound and malformed unavailability without changing details. Actual SDK normalization confirms list and both deletion outcomes are returned non-error results; it does not prove host tool removal. Whole18registry installed replay retains the original production import/URL remap, sibling-process comparison and all earlier owners, not copied assertions or new native work. Native/loaded terminal/phone/recipient/source/clock/default/integrated release gates remain separate. Draft promotion/transaction/errors/notifications and completed normal receipt/Inspector slices stay independently closed.

### Normal Registration Receipt Presentation

Only the successful normal executeRegisterToolUnlocked registration/update-or-persisted receipt now uses private registrationReceiptText in registry.ts. It projects the same tool/result/source/callable flag, originally observed optional display boundary, required/optional args, command warnings and first prior hint. Source is template as a scalar or one whole dynamically fenced literal reference; args/warnings are actual lists including singletons, with CRLF/blank/relative indentation opaque inside each value. Callable invocation advice stays instruction content, not a trusted executable next. The producer-known unverified status hint alone becomes typed inspect/tool-target/status; no body parser, extra hint or automatic invocation. Compact text does not add raw defaults/description/template or new machine/state fields.

No transaction, rollback, callback, notifier, source read, lifecycle policy or details field changes. Original warning map/join and full advisory argument/template evaluation remain before new copy, preserving existing post-effect getter/coercion failures. The optional display activationBoundary result is captured at its original call, not queried again: a controlled toggling getter intentionally leaves compact and details boundaries different exactly as before. The old details evaluation tail is unchanged. Existing list/delete/draft/notices/transaction errors remain separate, and no new catch repairs their original primitive/undefined/opaque failures. Saved messages are not regenerated; a formatted success remains existing persistence/callability evidence, not an independent live host or native proof.

Text remains within16KiB including the existing formatter's leading LF. Whole field/list/action representations start from shorter full-or-omitted seeds and only grow. Fitting complete safety warnings have first priority before name/source/hint and large argument groups. No partial argument/path, fabricated char count, input/work quota or loss repair. Whole-group omission counts selected list entries, including complete large warning labels; malformed/non-text selections are unavailable without another coercion or new source permission. Machine args/defaults/warnings remain unchanged even when compact text omits them.

All14original registry declarations/scenarios/fixtures/assertions/cleanup remain, with only the first approved success-layout assertion changed and the test environment explicitly imported before production. Two new properties first fail on old prose/unbounded group text, then cover unverified/callable/toggling activation×new/update, exact cfg/activation/notify observation order, opaque Unicode/CRLF warning labels and unchanged persisted bytes/details/next_actions. Opaque/undefined/primitive failures from notify, warning read, required-argument Array-subclass join and late activation getter occur after retained persistence with one activation and no new rollback/retry. Exact16384/one-over required and optional groups, non-disclosure of actual default values, warning priority/oversized warning coverage, malformed selected args, dynamically fenced real backtick-bearing source and actual SDK register_tool success normalization are covered. These fixtures register only in temporary recipe roots; they do not invoke a tool or prove real host activation.

Actual installed replay now includes the whole16registry owner. Its original sibling-process lock-collision fixture resolves one production module via new URL rather than import syntax; the existing production-only remap now covers that exact reference as well, without copying scenarios or changing child code/assertions/cleanup. This process-lock comparison grants no new Actor/native readiness/exit claim. Original registration-truth/SDK/native fixtures remain intact. Earlier whole2spawn/16Control/21inspection/8response/21overlay/16Inspector and prior owners remain. The source, matrix, SDK and compiled replays are nonadditive. Independent review, loaded terminal/phone, source/recipient/native/clock/default/integrated release gates remain separate.

### Owned Spawn Guard Presentation

Only three locally authored pre-launch errors in tools-spawn.ts use private spawnGuardText: unsupported state_dir, as lacking run: namespace and invalid id spelling. The record names field/result and one selected caller value, with the existing expected format/id rule. It does not label that value as an admitted Run, current owner/generation, launched/no-effects receipt or new source/privacy/native authority. state_dir values are never serialized or read again. Invalid-as branches retain the original template coercion exactly once before presentation, so a changing second getter value, custom startsWith/slice/regexp coercion or thrown primitive keeps its original behavior. Multiline CRLF/blank/relative indentation remains opaque under uniform outer indentation; body next/tool text never becomes an action.

Whole well-formed selected values fit16KiB including public LF or receive field-local response_too_large coverage for one selected scalar, not chars/private tails. Malformed selected UTF16 is unavailable/malformed_selected_text without repair or a false budget reason. There is no input/work quota, new catch, Error cause/details/schema or dispatch policy. All post-guard launch/session/Recipe/draft/navigation/transport/compact/verbose/details code stays byte-equal to the original; saved packets/journals are not migrated. The existing limits constant earns one tools-spawn→limits edge, not a presentation domain.

The new tools-spawn.test.ts mirrors the existing library owner rather than splitting by feature. Both properties first fail on the original prose, then pass in source and actual npm import-remapped replay; conformance adds only this owner to its original suite list. One property covers3guards×both verbose modes, exact state_dir/as and target method/coercion observations, opaque CRLF caller text, standard Error metadata, original unowned getter/method/regexp/owner/session rejection including undefined/primitive and no retry. The other covers exact16384/one-over namespace/id values, whole Unicode CJK/ZWJ/combining byte boundaries, empty id and malformed scalar with unchanged source. Actual SDK checks use cloneable public arguments: namespace/id facade errors survive as host isError; unsupported state_dir is rejected by the unchanged SDK schema before execute. Initial test assumptions incorrectly tried to clone a function-bearing accessor value and then expected state_dir to reach execute; those failures corrected the test/claim, not product schema or guard behavior. No widened fake host schema, bypass or SDK-wide AX/privacy claim. Direct adversarial accessor probes remain separate from host-cloned DTOs. Original mixed tools/invocation/native and packed SDK launch fixtures/assertions/cleanup stay untouched and are not copied into the new pure-guard owner. The installed harness adds whole2spawn properties while retaining whole16Control/21inspection/8response/21overlay/16Inspector and previous owners. MJS runner selection is syntax-checked and executed exactly; counts remain nonadditive. Independent review, loaded terminal/phone, source/recipient/native/clock/default/integrated release gates remain separate.

### Owned Control Guard Presentation

Only four locally authored guards in tools-message.ts now project AX errors: unsupported runtime Control action, unavailable runtime port, unavailable Run generation and undeclared actor-local action. Private controlGuardText emits only the already normalized caller target/action, fixed bounded result and actual supported_actions/available_actions string sequences. It never selects raw input/status/private owner/generation/correlation or parses multiline next/tool labels into actions. The original string-only declaration filter/order/duplicates/empty values remain; this is not a new action grammar. Built-in runtime options name accepted verbs, not readiness or a new mutating next. No no-effects, sent/handled/closure or replay guarantee is fabricated.

Current errors remain plain Error without added cause/details/enumerable metadata. The old undeclared join/template evaluation remains before formatting: its method/getter/coercion failure or effect is part of the original observable boundary, even though the new option list is not parsed from that joined string. Original request normalization, session/access/dependency failures, status/getter order and selected dispatch branches are unchanged. Runtime handler and kill/archive/prune exceptions are not caught by the new formatter; actor-local send retains its existing awaited-send-only catch and exact private cause/lock rules. No schema, machine response, successful compact/verbose/details, saved text, source read, runtime action or native/clock/default activation changes.

The16KiB text cap includes the existing leading LF. Variable identity and entire option group start from the shorter complete-or-omitted representation, then only grow: first the caller identity, then the full group if the final record fits. This avoids false overflow from a larger placeholder and never clips a target or selected action value. Omission coverage counts one selected target field or selected declaration entries, including duplicates, not private/upstream character loss or validated-action capability. Malformed selected UTF16 withholds the whole group as unavailable/malformed_selected_text without repair or fake budget reason. No new input/work quota, private-tail count or routine next action is added.

All14original Control declarations/scenarios/assertions/fixtures/isolation/cleanup remain. Two new properties exercise all4guards×both verbose modes through direct plain Error and the actual SDK runToolCall host isError boundary, exact callback/session/owner/generation/control getter order, no private input/status/owner/generation leakage and opaque CRLF Markdown with body-authored next. Original unowned getter/normalizer/status/runtime-handler exceptions include exact opaque/undefined/primitive values after controlled callback effects, plus actual Array subclass join and joined-result coercion faults. Budget cases cover exact16384/one-over caller ids and option groups, a fitting singleton with a larger omission placeholder, real list duplicates/empty/none, CJK/ZWJ/combining UTF8 at the exact byte edge, malformed group and immutable source arrays. The initial implementation was drafted before these tests; precise cohort-only restoration to the byte-equal original owner established2reds, then the candidate was restored without resetting cumulative work. Whole16Control (15non-Linux due existing skip),21inspection/8response/21overlay/16Inspector npm owners retain original tests via production-import-only remapping. Counts are nonadditive; headless/host/package proof does not replace independent review or operator-authorized loaded terminal/phone/native/integrated release acceptance.

### Control Partial-Failure Evidence: Existing Facts, Not a New Receipt Contract

The three mutation paths have different evidence boundaries; one generic exception-to-status conversion cannot truthfully recover them:

- **Legacy stop — source inspection, not a new signal experiment.** In async-runs, stopRun validates ownership/generation/process identity, calls signalOwnedRunProcess, then separately appends Trace, marks terminal handling, finalizes interrupted execution and writes progress. A signal/helper attempt can precede every one of those persistence steps. A missing Trace/handled/progress record therefore proves no absence of actuation; a present legacy record proves no whole-scope closure. Native helper failure may also follow an attempted group/tree operation or fallback. The returned signal plan is not retained as an authoritative partial-stop receipt on every exception path. Do not manufacture stopped:false, scope_closed, a signal count or an unapplied claim from a thrown error. B2/C and the caller-generation boundary still own the missing stop protocol.
- **Actor-local Control — controlled journal counterexample plus source inspection.** runs-control-delivery admits a queued record before endpoint resolution/transport, then records delivered separately. A controlled namedPipeSend callback can mark that exact record claimed/handled and subsequently throw; the caller receives delivery_failed with the original admitted control_id/generation while the journal correctly remains handled. This witness proves monotonic recorded handling, not actual native execution or Windows support. A delivery exception is not a handling failure or permission to replay. The delivery owner now retains its surfaced primary value in non-enumerable Error.cause and, when failed-status recording also throws, ordered AggregateError.errors with the original metadata/message for that branch. Endpoint-not-ready creates its existing logical failure before persistence so a later write failure cannot erase its genuinely admitted id/generation. A post-send delivered-record fault is a persistence failure, not evidence that transport did nothing; subsequent failure-record faults retain both. Failure-text coercion may itself throw: preserve that value after the original cause and use bounded vocabulary failure text unavailable, never replay a hostile getter/stringification. Ordinary single-failure messages/reasons stay compatible; newly combined FIFO write/close failures have a distinct static summary while preserving both exact causes and already-written bytes. Raw cause/errors remain Kernel-local and non-enumerable under ordinary JSON/object spread, not a new public schema or complete host-format privacy certificate. Source and actual npm tests reuse controlled transport/write faults and the existing real FIFO fixture; the FIFO fault writes one byte, actually closes its fd, then throws a controlled close error, proving retained partial bytes without another workload or closure claim. The sendRunControl facade now preserves its surfaced admission/awaited-delivery rejection if lifecycle release also throws: standard ordered non-enumerable AggregateError errors/cause retains exact original then release values, including undefined/primitive/original AggregateError, without field access, coercion or flattening. A single rejection and release-only failure after successful transport remain exact. Controlled live-host port fixtures actually admit one Control, record claimed→handled, keep the lifecycle lock held while transport is pending, then reject/resolve transport before the injected release fault. A contender proves the same existing lock interval, not kill independence; no runner/socket is launched or signalled. Every pending call settles before builtin restoration, fixture identity is captured before await and state/host_exit:not_asserted remain retained. Getter-based admission failures cover no-send/no-record paths without inventing an id. Existing conservative public errors still withhold saved correlation and keep private nested causes. This cause-only change leaves return await/endpoint-generation locking untouched and does not implement B2. Failures before a Control is returned and opaque lower-journal/file-state masking remain separate: do not reconstruct a missing id, infer exhaustive successful release/native closure or recover a cause already lost below the facade. The actor-local public adapter now catches rejections only around sendRunControl, after existing request/access/declaration checks, and throws a new bounded Error retaining the exact rejection as non-enumerable cause. It never coerces the raw value or copies error fields: message text contains only a flat AX record of caller-owned run/action, delivery/handling uncertainty, a multiline possible-effects/no-replay warning and one structured fresh-owned-inventory next action. A whole oversized id yields run_omission with reason/shown/omitted/total; no saved correlation or raw exception field is read to build the public copy. Verbose does not widen it. Admission correlation remains Kernel-local even for an unchanged logical session: retained ids do not prove active reply scope after await or A→B→A. Target text is whole or explicitly omitted under the existing 16 KiB model bound, reserving the complete safety summary. Actual Pi 1.0 public runToolCall verifies error/isError normalization against source and npm code; a controlled pending named-pipe port with the live test host's observed identity preserves handled journal state across context/owner/generation changes, not native execution, Windows support or host exit. The fixture launches no runner/socket, retains live-host state, and settles every pending call before restoring builtins. Recipient-bound correlation enrichment now remains host-contract/adoption-gated after completed preparation, not permission to copy raw fields. Do not synthesize a missing id or expose the raw input/endpoint/journal as compact context. Existing owned Control inspection is the selective route when correlation is available; it is not a fresh transport/handling guarantee.
- **Retirement — source/npm controlled filesystem counterexamples.** runs-retention still records queued before archive rename/tombstone creation or artifact-copy/prune removal, then handled. Manual retirement now preserves a single surfaced rejection exactly, including primitive/undefined and original AggregateError, and keeps later formatter/failed-record/lifecycle-release faults in ordered private AggregateError errors with cause fixed to that first rejection. Formatter text is attempted once; hostile conversion adds its exact failure and uses failure text unavailable. The sibling journal appender separately preserves append plus release failures as a nested boundary, never flattening original aggregates. Actual controlled rename/copy/removal witnesses retain already changed bytes with one action, including completed removal before a later handled-record error. A committed queued record can fail its release before evidence id is returned and before operation admission: do not invent that missing return/correlation. Handled bytes can coexist with a later failed record or lifecycle-release failure; no record is rewritten into rollback, atomic receipt or native closure. Faulted lock-scope fixtures retain state and assert no native workload/host exit. Standard guards, ordinary success/refusal fields, TTL, raw-cause privacy and source selection remain separate; existing lower-layer already-masked exceptions cannot be recovered here. A Run-local Trace may no longer exist after prune, and no new public failure DTO or permission to follow arbitrary archive/artifact bodies is added. Do not repeat archive/prune merely to obtain verbosity.
- **Lifecycle/release — source inspection.** sendRunControl currently retains its lifecycle lock across await deliverRunControl. This legacy path does not satisfy the accepted no-awaited-transport-under-lifecycle-admission rule and cannot certify kill independence from a stalled sender. Blindly removing await moves release ahead of transport completion and changes the endpoint/generation race: equivalent current-generation admission/transport fencing must be resolved before such a change. Finally-based release remains another effect boundary. The generic synchronous withFileMutationLock wrapper now preserves an exact surfaced callback rejection and a later release fault in ordered non-enumerable standard AggregateError errors/cause, without field access, coercion, flattening or re-execution. A single callback/release-only failure or normal result remains exact, including undefined; returned thenables are not inspected and no async semantics is added. Actual controlled owner/contender/file-write witnesses retain the same held token/interval and written bytes across injected Error/undefined removal-boundary faults. Faulted owner/frame/lock state remains retained; this is not a new native workload, host exit, rollback, exhaustive release proof or public receipt. Existing acquisition/reclaim/atomic writer behavior stays separate, as do direct acquire/release callers and any lower fault already masked before the wrapper. A release call is still not positive cleanup proof.
- **Atomic replacement — source/npm controlled writer counterexamples.** The shared file-state replacement loop now keeps a single surfaced rename rejection exactly, including null/undefined/primitives and original aggregates. Null-safe guarded retry-code observation retains an accessor rejection after the original in private non-enumerable standard AggregateError errors/cause; neither value is coerced or flattened. Unavailable/nonmatching/failed classification does not retry. Ordinary EPERM/EBUSY retry behavior remains 20 attempts / 19 actual 50ms waits, and onBeforeReplace stays once. Real temporary text/JSON writer fixtures inject rejection before or after actual rename, verify old/new bytes independently of the thrown value and preserve post-commit effects without replay/rollback. Getter failures include Error/undefined; hostile text/code values are not coerced. Actual retry witnesses preserve eventual success, exact exhausted last error and existing waits. Builtins restore after synchronous settle; fault frames remain and no new native workload, native/host exit, fsync/power-loss, source/body or transaction authority is asserted. Unsurfaced best-effort staging cleanup and any lower exception already discarded remain separate.

No new public failure DTO, native receipt, source permission, default status switch or lifecycle implementation is adopted by this reconciliation. First preserve the distinct owners' causal/correlation evidence, then derive a compact explanation only from facts actually available to the original recipient. Unavailable facts stay unknown; no automatic retry or retrospective receipt reconstruction. BACKLOG owns remaining recipient-bound correlation, legacy summary/omission permission and gated stop/transport-admission work; completed owner-specific delivery/retirement/facade/mutation/replacement cause preservation does not close them.

#### Recipient-Bound Correlation Preparation

Preparation is complete for optional actor-local failure correlation on the inspected Pi1.0.0 public SDK boundary. The current conservative error remains the implemented contract; no new field, lifetime registry, public status switch, host-floor increase or transport-lock change is adopted.

- **Kernel admission versus public reply:** tools-access checks the invoking logical session against Run ownership before dispatch; admitted error ids/generation are private historical facts. Neither a matching logical id, retained manager, copied error nor verbose request proves the recipient of a later error result. Missing returned admission correlation is never reconstructed.
- **Existing actors wrapper:** extension-runtime's withCurrentThinkingContext currently spreads the SDK context into a plain object before invoking core tools. This snapshots manager/signal data and does not retain the SDK's lazy getter revocation as a reply capability. The private opt-in supervision epoch pins manager/clock-owner lifetime for its own source admission, not Control result publication; borrowing it or adding another registry is not an approved remedy.
- **Public SDK guards:** ExtensionRunner creates fresh context wrappers whose getters call runner.assertActive. Invalidation on disposal/reload rejects later guarded access, but a completed tool's context remains readable while that runner lives, and a copied manager reference remains ordinary readable data after invalidation. Context signal is the current operation getter and may be undefined for idle public tool execution; cancellation is not ownership or atomic result publication.
- **Result pipeline:** public agent-core runToolCall catches a thrown Error into text/isError, then may await afterToolCall before returning. It has no extension-context/recipient check at that final boundary. The owning property `SDK context guards do not grant an atomic recipient lease for Control error enrichment` uses actual registered SDK-wrapped tool contexts and public runToolCall, not fake context getters: two calls mint different wrappers with the same manager; the first remains readable after completion; a pending post-tool hook permits controlled SDK disposal after normalization; guarded reads then reject, a spread copy still reads the old manager and the authored candidate marker still returns as an error. No real correlation or Actor action is published by the probe.

This is a bounded public-SDK/core-helper counterexample to treating getter validity or cached equality as an atomic reply lease, not proof of a live AgentSessionRuntime session-switch leak. The normal runtime awaits abort before shutdown/invalidation; public runToolCall itself emits no transcript/events, and the probe makes no provider/model/network request, starts no Actor/runner/socket and asserts no native/host exit. Existing actual public Control source/npm properties separately retain private causes and handled facts across stable/session/A→B→A/manager/owner/generation changes.

The exact remaining gate is a reviewed trusted host/recipient-publication contract covering the original tool call, error normalization, result hooks and final routing, together with fresh owner/generation checks and explicit permission for selective admitted fields. A host integration might supply that contract; this assessment neither mandates an upstream SDK change nor silently adopts one. Until it is approved and proved on supported source/npm host journeys, keep withholding saved correlation and use fresh owned inventory. The optional enrichment does not block the already-delivered conservative error path and must not reopen completed cause preservation or B2 locking. Do not repeat this preparation without changed API/contract evidence.

## Exact Launch API

Add two independent optional fields to the root JSON/Markdown Recipe contract and the public `spawn` request:

- `report_every: Duration | null`: Optional minimum interval between eligible diagnostic deliveries for this generation; at least `1m` (`60000ms`) when enabled. It is disabled by default.
- `max_runtime: Duration | null`: Maximum admitted execution duration for this generation, followed by runtime-owned termination.

`Duration` is a string matching `^[1-9][0-9]*(ms|s|m|h)$`. Normalize to positive integer milliseconds; reject overflow or an unrepresentable deadline before launching work. Numbers, zero, negatives, fractions, whitespace, compound durations, booleans, and empty strings are invalid. `null` is the only explicit disable value; omission means inherit, not disable.

`report_every` has an exact lower bound of `1m`: `60000ms`, `60s`, and `1m` are equivalent, while `59999ms` and `59s` are rejected, not rounded or clamped. This is a minimum, not quantization into whole-minute steps: `60001ms` is valid. `max_runtime` is independent and keeps the positive-duration grammar without this floor, so `500ms`, `30s`, or even `1ms` can be execution ceilings. Neither setting implicitly enables the other.

Planned Recipe example:

```json
{
  "async": true,
  "report_every": "2m",
  "max_runtime": "20m",
  "template": "generate-report"
}
```

Planned launch override:

```json
{
  "recipe": "project-work/repo-health",
  "report_every": "1m",
  "max_runtime": null
}
```

Resolve each field independently: explicit launch value, including `null`, overrides the effective root Recipe; an omitted Recipe field inherits through direct delegation; an unresolved field is disabled. A derived root Recipe's explicit value or `null` overrides the delegated source. There is no implicit interval or deadline.

These are literal Run policy fields, not template flags or inferred placeholders. Do not interpret `values.report_every`, `values.max_runtime`, or similarly named actor arguments as supervision. Do not add reserved arguments to every registered tool. Async registered tools inherit their effective root Recipe policies; per-launch overrides in this increment are exposed through `spawn`. An inline synchronous execution path must reject root supervision fields as `run_supervision_requires_run`, not silently ignore an apparent execution limit. `spawn` always creates a Run and can therefore honor the fields even when the source Recipe is not marked async.

Named imports and command graph nodes are not Runs: their Recipe-level policies do not establish or reset the enclosing Run's timers. Separately spawned children have independent policies, while an expired parent's owned-tree teardown still applies. Direct Recipe/tool specialization must retain the resolved policy through the existing contract resolver rather than copying its template or rediscovering a different source.

All four combinations are supported: diagnostics only, deadline only, both, or neither. Absence of both does not make a finite task infinite; it disables these two automatic policies only. Existing terminal delivery and shutdown/parent teardown remain in force.

### Effective Policy and Clock Identity

Persist the effective millisecond values, their Recipe/launch/unset provenance, and one generation start anchor before workload execution. Return the following normalized fields alongside the existing launch metadata; `run` remains the logical id without the `run:` target prefix:

```json
{
  "run": "review",
  "run_instance_id": "<opaque generation>",
  "started_at": "<ISO timestamp>",
  "supervision": {
    "report_every_ms": 120000,
    "max_runtime_ms": 1200000,
    "deadline_at": "<ISO timestamp>"
  }
}
```

Disabled millisecond fields are `null`; `deadline_at` is `null` when `max_runtime_ms` is disabled. The initial launch response also exposes the authorized `cwd` and `evidence` pointers defined below, so diagnosis does not depend on receiving a later heartbeat.

Elapsed wall duration starts once at generation admission and includes startup, retries, delays, and nested work; it is not CPU time or time since the last report. Use a monotonic clock while the supervisor remains alive and persist the absolute deadline for reattachment. Recovery must not calculate a fresh `now + max_runtime`, replay missed intervals, or silently reset an unprovable clock. A missed deadline is acted on when trustworthy supervision resumes; clock uncertainty is diagnostic evidence, not permission to fabricate a new budget.

Private [`run-supervision.ts`](../lib/run-supervision.ts) owns stored policy/clocks, runtime-local timing and the deadline wake protocol together; its timing primitives do not establish independent supervision. `captureRunSupervisionTimeOrigin` takes the wall sample once at generation admission and retains its monotonic start/provider/epoch in a WeakMap behind the exact frozen origin reference. `createRunSupervisionTimebase` decodes the existing stored-clock contract, requires that genuine origin and matching captured start, binds one immutable policy and rejects copied/serialized origins, changed policies and wholly absent/invalid clocks without a current-time fallback. Same-runtime late handles share the original elapsed and continuity state, not renewed allowance; owner/generation admission is still a separate obligation. `observe()` reads only monotonic samples, snapshots each field once before validation/arithmetic, floors display elapsed and ceils positive remaining/wake milliseconds so sub-millisecond evidence cannot fire early. Subsequent wall-clock jumps do not retime it. Deadlines over 2,147,483,647 ms yield bounded wake slices recomputed from the original origin, never clamped policy duration or missed-tick replay. Disabled deadlines yield no deadline wake; report cadence/acceptance remains separate. A throwing, reversed, nonfinite/unsafe or changed-epoch source latches first uncertainty across every handle for that origin, stops further source reads and returns unknown elapsed/remaining. Previously proven due facts remain due, not pending, but grant no actuation or scope authority. Frozen stored policy and absolute deadline remain unchanged. Coordinator/independent-runtime origin ownership, cross-runtime controller authority, independent live scheduling, trusted restart recovery after origin loss, terminal timing integration and public/source/packed controller journeys remain open; controlled-source tests and wake plans do not prove native enforcement or real controller independence.

Private [`createRunSupervisionController`](../lib/run-supervision.ts) now owns one deadline wake lifecycle over that timebase. It consumes an exact frozen Run/generation/optional-owner binding and synchronous caller-admitted identity/clock reads; it does not itself admit canonical storage or reconstruct authority from metadata. Before observation and again before arming/notifying, it requires the same identity and normalized immutable stored clock. Disabled ceilings (including reporting-only policy) create no deadline timer or identity polls. Enabled controllers use bounded host `setTimeout` by default or a controlled asynchronous scheduler, recomputing remaining time from the original origin on early/long/overdue wakes without fixed-tick replay or renewed allowance. Safe-integer remaining time uses integer elapsed subtraction so a fractional sample cannot lose a millisecond to large-number cancellation. `start()` is idempotent and cannot restart a stopped/unproven/due controller; `snapshot()` never samples state or clock. Ticket revocation fences duplicate, stale and post-stop callbacks before cancellation or handoff. Invalid/throwing/inline timer providers, binding/clock changes, invalid timing, clock uncertainty and due-observer failure retain bounded failure without implicit retry; missing/failed cancellation stays explicitly `timer_cleanup: "unproven"`, not proof that a physical host timer was removed. Reentrant stop from a port cannot rearm or resurrect the watcher. A previously proven due fact can survive later clock uncertainty. At most one immutable `run_deadline_due` observation is handed off per controller; it says `stop_requested: false` and `scope_closure: "not_asserted"`, is not durable delivery acceptance, and never signals, appends a stop claim, finalizes status, mutates files or touches routine report cadence. Ports are kernel-owned synchronous contracts, not awaited model/work hooks or actor policy fields. Coordinator/independent-runtime composition, cross-runtime controller authority, trusted restart recovery, durable B2 arbitration and terminal timing still need integration. A controlled-provider matrix and actual Node-timer smoke exercise this protocol, but do not prove an independent supervisor process, hung-host behavior, native closure, public strict-deadline support or installed/public controller journeys; C and the combined release gate remain unchanged.

Private [`runs-supervision.ts`](../lib/runs-supervision.ts) now supplies canonical state ports rather than relying on caller-created identity/clock DTOs. `readRunSupervisionBinding(stateDir, expected)` freshly admits exact published Run/generation/optional owner through the shared context-identity owner, then independently reads and decodes captured clock metadata under its 1 MiB source bound; the marker retains its separate 16 KiB bound. Only frozen identity/clock and an observation-change callback are returned, never values, private tokens, local paths, lifecycle/result facts or role bodies. Missing/partial/coercible/contradictory clocks remain unavailable without a current-time read, actor-value fallback or metadata repair. `createRunSupervisionControllerFromState` requires the original genuine runtime origin and assembles but does not automatically start/register the deadline controller. Its real `readCurrent` port rereads canonical metadata at each check, preserving root-directory/marker object identity across the controller lifetime. Fresh same-generation PID/status/other non-clock updates are allowed; policy/start/deadline changes, replaced same-generation state/markers and stale owners/generations fence callbacks, never retarget to latest state. A per-read metadata stamp protects the observation window, not a promise to freeze all metadata for the whole lifetime. No result/progress/stop claim/export/ACK/clock file is written, no process probed and no work/producer/native authority reconstructed. Construction may bind retained origin policy before a later source-change refusal; it does not roll that binding back or capture a substitute origin. The strict capped JSON path now requires the complete declared file: premature EOF after an otherwise valid JSON prefix is unavailable, not admission of an unread malformed trailer. The shared identity/index descriptor reader has the same full-read guard, and bounded ownership-marker reads select strict UTF-8/full reading; default legacy uncapped/best-effort JSON/JSONL behavior is unchanged. Existing ambiguous-alias rejection and supported system-temp alias rules are preserved, not weakened into new path adoption. These are mutable filesystem observations, not atomic multi-file snapshots, a filesystem sandbox, native scope identity, independent-process enforcement or proof against hung state I/O. Coordinator/independent-runtime origin ownership, cross-runtime controller authority, supervisor recovery, terminal timing and public source/packed supervision journeys remain open; C and release gates are unchanged.

The real ordinary `startRun` pipeline now offers opt-in kernel `AsyncRunStartOptions.onSupervisionClockCaptured`, separate from Recipe/actor values and all public tool schemas. Only a fresh ordinary generation with this observer captures a genuine monotonic origin; its wall sample creates the same stored `createdAt`/`started_at` and policy cohort. Under the existing lifecycle admission, after fallible launch metadata assembly, it synchronously hands off one frozen `AsyncRunAdmissionClock` containing exact Run/generation/optional owner, state directory, frozen clock, the original origin reference and an opaque original snapshot-reference reader (never raw launch metadata). The observation says `publication: "unpublished"`, `work_started: false`, `visibility: "kernel_only"`; it precedes new-generation metadata, capture setup, native spawn and destructive preparation of prior Run evidence. It is not a launch/status/work/membership receipt, and canonical binding cannot admit that new generation before publication. The caller must retain the exact reference in its own runtime; serializing an origin does not restore continuity. This capture belongs to the caller process, not automatically to an independent supervisor or a restart-recoverable clock service. Normal synchronous callback return values are ignored, not treated as policy or permission. Thrown errors escape unchanged before new work; native Promises/thenables are refused without awaiting under the lock, with native Promise rejection settled to avoid an unhandled rejection. A deferred observer may already have initiated its own side effects; refusal does not cancel/roll them back, and earlier ownership/Recipe-usage effects may also remain. Compatible singleton and legacy reuse return before this hook, preserving original clocks without recapture/backfill; a truly new generation gets a new origin. Prepare-only descendant stages keep their existing unpublished path and emit no ordinary handoff. Fallible metadata assembly (including Recipe-context collection, artifact expansion and transport normalization) now precedes handoff, retained-evidence cleanup and capture acquisition even without a kernel observer. A red witness exposed the prior ordering: an invalid artifact placeholder delivered an origin, removed six prior evidence files and left both capture FDs open despite zero native starts. Two new properties exercise artifact/transport failure across fresh/synthetic-previous layouts and observer/default paths, plus successful artifact preparation before exact observer refusal. Such preparation failure now preserves prior bytes, opens no captures and preserves its exact error without a handoff or native start. These are isolated no-work fixtures, not producer/native-scope proof; later publication/capture/spawn failure cleanup and multi-effect atomicity are not established by this ordering change. With no kernel observer, no origin handoff/controller/reference carrier is introduced. Neither the origin reference, hook nor private monotonic evidence is added to persisted Run metadata or launch output; ordinary actor arguments cannot activate the hook or override policy. Real disposable-runner fixtures cover capture-before-spawn/publication, lifecycle-lock presence, same/legacy/new generation behavior, observer rejection and canonical post-publication use, settling captured producer exit before cleanup. This hook closes admission-time capture/handoff only: default/SDK coordinator ownership acceptance, cross-runtime authority, independent runtime, recovery, terminal timing and public/native feature acceptance remain required. No default controller/timer or public supervision policy is enabled.

Private `createRunSupervisionOwner` in `runs-supervision.ts` now supplies one explicit runtime-local retention/registration lifetime over the existing canonical controller, not an independent supervisor. Its `onSupervisionClockCaptured` callback retains the exact genuine origin, normalized clock and admission root/marker frame without timers or a launched-Run claim. It rejects copied origins and conflicting identity/origin bindings, snapshots data fields without invoking accessors, and preserves the original elapsed allowance. `start(expected)` explicitly admits published canonical state and the original frame before allocating one controller for that identity; repeated calls cannot create another or restart a stopped/faulted controller. `snapshot` performs no IO or clock sampling. `stop` is final; `release` revokes callbacks, removes its retained record and refuses that origin's replay in this owner. Failed launch handoffs remain retained, never successful launch receipts, until explicitly released. Permanent `close` stops retained controllers and preserves known cancellation uncertainty, including failures discovered after reentrant close returns. Reentrant canonical assembly cannot hide a new controller after close. Curated snapshots expose no origin, private path, values or process identity. Real disposable-runner witnesses join the existing handoff to this owner across fresh/singleton/legacy/rejected starts and settle captured runner exit before cleanup; controlled clocks/schedulers exercise pending publication, no renewed allowance, frame replacement and callback revocation. No default owner, timer, public policy, stop actuation or native membership is enabled.

Private `createActorExtensionRuntime(pi, supervisionPorts)` now optionally composes that owner into one coordinator session epoch. The normal `index.ts` factory remains unconfigured: no default owner, public tool parameter, timer, report wake, controller activation or actuation is introduced. The epoch pins the original SDK sessionManager object as well as owner id; event/tool contexts are fresh wrappers, not lifetime identity. Same-manager wrappers may use the original observer, while another manager with the same string id cannot adopt it. Startup captures one epoch before asynchronous preparation but rejects handoffs until ready; only the winning epoch may finish startup. Replacement closes the prior owner, stale callbacks refuse before inspecting capture data, and a trusted shutdown event through a fresh valid same-manager wrapper closes private retention/UI resources. Known invalidated contexts are matched from cached identity without rereading them; an unknown invalidated wrapper cannot authenticate a shutdown. Busy/idle observations and UI callback failure do not themselves revoke the independent private retention epoch. The same synchronous pinned callback is forwarded through ordinary spawn, registered async tools and both internal review launch adapters; ordinary actor values never become that callback. Review callbacks are pinned when their scheduler starts, not retargeted at late launch. No saved-data reconstruction, controller claim/start, deadline notification, native signal or terminal-duration inference occurs here. Host-facade/kernel properties retain their narrower role: overlapping startup and real UI failure are checked independently of retained observations, and a private 1ms ceiling may become due without stop authority. Natural completion still returns timing_unproven. At that private-only checkpoint, legacy parent teardown stayed unchanged: fresh-wrapper private disposal did not repair its cached-context owner lookup or certify delayed same-owner teardown. The separate default-routing repair below does not confer native isolation.

A separate source/packed fixture now composes this private kernel through real public SDK AgentSessionRuntime services, lifecycle events and synthetic-provider tool execution. Four genuine finite Runs (spawn and registered async-tool invocation per layout) exercise fresh tool contexts, busy/idle original observations, persisted same-id resume with a different manager, rejection of another live same-id manager and old hooks, unchanged old-generation clock fields, no DTO/origin reconstruction and disposal through fresh shutdown wrappers. Probe sessions launch no additional Runs. The fixture uses only currently admitted public tool inputs: max_runtime remains refused by that public schema, not silently enabled to make the probe pass. Both runner and workload PIDs are captured before subsequent fixture assertions/awaits, and natural0 plus fresh ESRCH precede SDK teardown and parent deletion; no surviving-workload teardown or owned-scope closure is claimed. Controlled scheduler/deadline ports remain unused. This is private opt-in composition, not the default entrypoint, new public status/reporting or independent/hung-host supervision. Crucially, AgentSessionRuntime emits shutdown before invalidation, while bare AgentSession.dispose only invalidates/disconnects: a raw SDK host must explicitly deliver trusted shutdown beforehand. These journeys do not certify automatic bare-disposal revocation. Supported host-lifetime coverage, default/public routes, ordinary detached-runner frozen timing and cross-runtime recovery remain open.

**Default parent-session teardown routing.** The coordinator now retains a separate original-manager/current-lifetime shutdown binding in the ordinary default path, independent of supervision/completion opt-ins and UI callback failure. A trusted fresh wrapper must match that exact current manager and owner; known current invalidated contexts use cached binding. Old contexts/managers, same-ID replacement, A→B→A, unknown invalidated wrappers and reused retired managers refuse. Shutdown consumes the binding before cleanup and rechecks replacement before continuing into the existing owner/generation-fenced teardown, without callback replay. Existing quit/reload/new/resume/fork semantics stay session-scoped, not newly process-scoped. Property tests cover both default and internal-stream profiles, duplicate callbacks, reentrant wrapper validation, current stale getters and UI failure. A separate real default SDK lifecycle exercises new/resume/fork/quit through actual fresh wrappers and checks newly written exact-owner/trigger teardown summaries, including errors after disposal. It forbids model calls and starts no Actor/native workload: zero attempted candidates proves routing only. Existing parent-teardown properties separately preserve exact generation guards and partial-failure continuation. This neither establishes host-instance isolation between concurrent same-ID hosts, signal/whole-scope termination, independent crash/hung-host supervision nor bare-dispose coverage. B2/C/D native acceptance and original timing/source/stream gates remain open.

**Controlled Linux SDK-quit witness.** A separate source/npm mode of the existing coordinator fixture now loads the real default entrypoint and operating Actors Skill, then publicly spawns two genuine bounded gated command Runs under different SDK session owners. Actual runner handles are captured before await; controlled workload readiness supplies each direct PID. Live command/cwd/start-time frames match captured owner/generation metadata before quit. Disposing the first real SDK runtime while its Run is live produces exactly one matching teardown attempt and one run.kill/SIGKILL event. The captured runner's actual close is signal SIGKILL, not an inferred137 result; fresh ESRCH then verifies runner and direct-workload absence while the owned release gate remains absent. No native close/code/signal is invented for the non-child workload: its outcome is verified absence only. The second owner's runner/workload remain live with unchanged identities through that stop and later settle naturally0 after their own gate release. Both source and actual npm-installed entrypoints replay this witness without private supervision ports, a second spawn provider or external model calls. The parent independently checks raw stdio/actual host close, physical metadata/ready files/reports and all four captured identities per layout, then requires fresh ESRCH for those PIDs plus the host immediately before deleting successful fixture state. Failed checks retain the root and primary/cleanup failures; cleanup releases controlled fixture gates, never retries destructive shutdown. These four genuine Runs per retained source/npm pair are distinct from the older ten-natural-Run coordinator/research journey, which still replays unchanged semantics. Its generated root prefix is shorter solely to keep the full-map witness inside the unchanged16KiB budget under nested TMPDIR; the separate omission witness and all assertions stay intact. This proves the captured ordinary Linux quit case, not complete scope membership/closure, escaped descendants, Windows/macOS, every replacement trigger, crash/hung-host enforcement or independent ownership for parallel same-ID hosts. No production kernel/native backend/policy change follows.

**Three-platform source/packed SDK-quit acceptance.** The same default-entrypoint witness now passed on the actual Linux/macOS/Windows runners in [Validate 42438289689](https://github.com/llblab/pi-actors/actions/runs/42438289689), for candidate `4461d0f`. Each installed job's own checkout records `43c7d56803f3c2914cd133ad3710aa380aeb582e`, whose authenticated tree is `7deafe2c2f7c5fb096df4620817475f7c0359474`. The shutdown case passed in 6154.480984 ms on Ubuntu, 10945.970667 ms on macOS and 39570.4326 ms on Windows. These are whole-case elapsed durations, not cross-process clock alignment or kernel-exit times. Both layouts retain actual platform/command/start-time and runner birth-metadata correspondence; cwd is required on Linux and checked only where supplied elsewhere. POSIX records actual runner SIGKILL close; Windows records numeric exit/null signal with the `taskkill /PID <captured pid> /T /F` request, never a synthesized137 or POSIX close. Surviving foreign-owner identities, absent owned gate, raw stdio/host close and final fresh ESRCH for every captured safe PID remain mandatory. The90s fixture watchdog,180s host timeout,8s absence policy and product limits are unchanged. This accepts only the ordinary captured runner/direct-workload graceful-quit case on those tested CI profiles; descendants, other triggers, concurrent same-ID hosts, crash/hung-host enforcement, complete scope membership/closure and independent owner-instance authority remain open.

**Local integration validation before candidate formation.** Normal npm run validate now completes on the cumulative Linux/Node26 working tree:1596tests/1591pass/5skip, followed by506conformance tests/505pass/1skip, with zero failures. These overlapping populations are not additive. Types, Recipe QA, distributive parity, package checks and dry-pack pass; the separate dependency audit finds zero vulnerabilities. The first full attempt timed out; its buffered stdout was not retained, so no earlier-stage pass is inferred. A durable focused reproduction narrowed a genuine test-process stall to three owned fs.watch handles after all56supervision tests reported success. The intentionally reused controlled context no longer has shutdown authority; cleanup now uses a fresh valid manager lifetime, retaining every startup/observer assertion and explicitly checking close events for owned watches. The process exits naturally, without force-exit/unref or a production change. A separate diagnostic observes zero retained watches after cleanup. The subsequent full product log is retained under /tmp/pi-actors-validation/v-GH5Rrc; later context-only reconciliation has its own validation. This closes the current local validation slice, not A/B/C integration, loaded UI acceptance, native macOS/Windows CI, owner-loss enforcement, version selection or D3 candidate acceptance. No commit, publication, reload or operator Run action occurs.

Participating owners sharing one exact genuine origin in this module/runtime now coordinate through a private weak claim. Activation reserves it before canonical assembly; a contender receives `controller_claimed` while another owner's controller or provisional assembly holds it. Stop alone does not transfer an allocated controller's claim: explicit release/close revokes its callbacks before handover. Failed assembly drops only its own reservation; a late nonholder cleanup cannot erase another owner's claim. The origin's first identity/state/frame binding persists across owner release, preventing copied-state adoption. Handover observes the original elapsed allowance, never a new current-time budget. This is cooperative logical ownership, not proof that an old physical timer was removed, exactly-once due notification across successive controllers or global scope authority. Distinct origins, module instances, processes and unregistered low-level controller constructors are outside that claim. Real launch handoff and controlled assembly/handover witnesses cover this boundary; cross-runtime authority, independent supervision/recovery, ordinary detached-runner frozen timing and public/native acceptance remain open.

A compatible singleton reuse retains its original anchor, deadline, and report schedule. Compare normalized effective policies, so `60s` and `1m` are equivalent; conflicting policies fail closed instead of retiming a live singleton. A genuinely new generation receives new clocks. Running policies are not mutable through `message` in this increment.

New metadata records `createdAt` and `started_at` from the same generation-admission anchor. The stored supervision fields form a coherent cohort: positive integer milliseconds or explicit null, a canonical ISO start, and exactly the deadline implied by that start and ceiling. Partial, coercible, or contradictory clocks fail closed rather than being repaired. A pre-supervision generation with wholly absent clock fields stays explicitly unconfigured; it can be reused under disabled policies without rewriting its metadata, but cannot acquire a new allowance or today's Recipe policy merely by reattachment.

## Runtime-Owned Supervision

Supervision belongs to the runtime outside the actor's workload callback. It must remain effective while the coordinator is busy/idle, a child command hangs, or the actor emits no Trace. The UI/delivery scheduler does not own termination, and missing model-context acceptance cannot extend an execution deadline.

Intervals are eligibility thresholds, not hard-real-time delivery promises. The first diagnostic becomes eligible after `report_every`; later eligibility follows the last accepted diagnostic delivery plus the interval. While a report is pending, refresh its latest snapshot instead of enqueueing every elapsed tick. Reattachment produces at most one currently due snapshot, never a catch-up burst. No configured interval means no periodic model wakeups.

In addition to each Run's interval, the exact top-level coordinator session admits routine diagnostic batches no more often than once per `60000ms`. This is one shared gate for all its Runs and containing trees, not a separate allowance for every Run, child session, or staggered timer. Both floors use `RUN_DIAGNOSTIC_MIN_INTERVAL_MS` from the policy owner; the gate is a delivery ceiling, not an implicit reporting default. It may postpone diagnostics further than their per-Run eligibility.

Advance the shared cooldown only from accepted routine diagnostic delivery, not a proposed packet, ordinary completion, explicit urgent `steer`, or manual `inspect`. An admitted packet with unresolved acceptance retains its one diagnostic admission slot without spawning additional diagnostic packets. Preserve/recover the gate with exact owner and acceptance evidence across busy/idle transitions and reattachment; uncertain timing/acceptance defers routine diagnostics rather than inventing a fresh slot. At the next eligible boundary, merge the latest due snapshots fairly instead of replaying missed intervals. Independent top-level sessions retain independent gates.

Terminal outcomes and explicit urgent semantic attention bypass the routine diagnostic cooldown, while retaining their existing safe-boundary, budget, lineage, and exact-acceptance rules. An execution deadline never waits for this gate. Manual inspection neither consumes nor resets it, and ordinary completion delivery never depends on enabling periodic diagnostics or execution limits.

Keep timers tied to the exact owner, logical Run id, and `run_instance_id`. Recheck authoritative lifecycle/process evidence before freezing a diagnostic or applying termination. Old timers cannot affect a replacement generation.

### Deadline and Terminal Truth

`deadline_at` begins the canonical stop procedure, not an optimistic terminal declaration. Under the lifecycle lock, revalidate ownership, generation, process identity, and current terminal evidence, record the reason `max_runtime`, and stop admission of further owned work. Use the existing verified termination/escalation path for the workload and attached descendants whose exact parent-generation lineage is proven. Never kill by remembered PID, shared working directory, or logical Run id alone.

- A terminal outcome accepted before the deadline stop claim wins and is delivered normally.
- A deadline claim accepted while the generation is running owns the eventual timeout reason, even if the process subsequently exits with code zero during shutdown.
- Add `timed_out` as a terminal Run status only after process termination and owned-tree cleanup are confirmed. Extend all terminal readers, collectors, renderers, and retention guards consistently; a leaf command's existing `timeout` is not automatically a Run-level deadline.
- Until termination is proven, retain a truthful nonterminal status with `phase: "stopping"` and bounded stop-failure diagnostics. Sending a signal or exhausting a wait does not prove death.
- Persist one generation-bound terminal outcome. Preserve accepted publications, captures, and useful partial artifacts; mark unfinished task output partial. Termination does not roll back filesystem or external side effects and does not authorize automatic retry.

Natural-result producers bind once to the kernel-published PID, owner, and generation under the lifecycle lock before executing work. Native command preparation and every attempt/retry must serialize admission against the same stop claim, not use an unlocked check-then-spawn. If admission rejects a later retry, retain already settled attempt receipts/captures, mark the command interrupted, and clear active accounting without assigning a native exit to the unspawned attempt. Prepare capture resources before spawning; the executor must manage stream/exit/error handling before exposing a synchronous kernel-only managed-attempt callback inside launch admission. This callback carries the retained fresh handle, not native birth/identity proof. The private birth binder must consume the exact runtime-local executor admission captured before spawn plus its fresh managed context under the same producer/generation lifecycle admission. Copied or late contexts, different nested factories, retroactive adoption, native contradictions, or failed acquisition/persistence cannot authorize a replacement binding. Retain a write-once observed PID/native identity on its intent only after acquisition; this timestamped observation is neither current liveness nor complete scope membership. Existing intent-only records remain unresolved, and adding birth observations never releases the replacement/retirement fence. Direct-member settlement requires the exact retained birth/intent and authentic synchronous native-close receipt, checked before lifecycle acquisition and revalidated under scoped evidence authority. Rejected fabricated/copied receipts must not consume later genuine settlement permission; only an accepted close/member correspondence consumes the recording attempt before lock/storage admission. Persist immutable observed exit code or signal; never normalize a null native exit to success or synthesize a Run kill cause. Evidence may be recorded while stopping or after accepted natural result without changing root truth. Already recorded settlements can survive producer death, but stored data is not a runtime capability. Private evidence-only recovery may store `{basis: "verified_absence", observed_at: "<canonical ISO>"}` only for a retained birth after captured producer exit and member ESRCH, under exact generation/owner/fingerprint/birth revalidation. It never supplies unobserved exit code/signal, repairs missing identity from a bare PID, changes root outcome/cause/clock, or dispatches a signal. Existing settlement wins without reprobe; unsupported/denied/live/mismatched evidence remains unproven. Missing native-close details stay unknown, and even every recorded member settling cannot establish exhaustive membership or release the scope fence. A post-spawn observer/admission failure retains captures and the first error until the managed process settles, then rejects without retry or rollback. Revoke the single-use factory when its synchronous admission window ends, including refusal. Capture-write failures must remain inside stream management, preserve bounded tails/draining and the first error, and explicitly mark the attempt stream incomplete with physical saved bytes separate from bytes observed (unknown saved bytes are null). A known-PID handle error alone is not an exit; retain management until close. Persist observed settled attempts and command interruption through the producer's generation/owner/native-fingerprint-fenced evidence port independently of ordinary result publication. Stopping does not forbid factual evidence writes; preserve accepted root status and do not infer terminal or work authority from a receipt. Before actuation, separately retain launch/membership evidence and recover unobserved settlement/interruption when runner death precedes its receipt. The private intent-only admission primitive (`native-launches.json`, `run-native-launches-v1`) retains owner/generation/runner binding and command-attempt admission before a factory; it is not installed in ordinary runners yet. Neither an absent journal nor a throwing factory proves no native child, and the journal never proves complete membership. Lifecycle cleanup exceptions must not replace the exact factory return/throw: expose release uncertainty separately and fence further producer operations; absence of a cleanup diagnostic does not prove lock release. Any retained intent-only journal, including corrupt, foreign, nonregular, empty, or unreadable evidence, blocks replacement and archive/prune before state mutation; natural acceptance or runner exit does not release that fence. Compatible active singleton attachment keeps the same generation and clock without reopening scope. Wire ordinary runners only after positive scope closure/recovery and live birth/member binding; reject incompatible or unknown persisted fields instead of erasing evidence. Separately spawned child Runs still need their own generation-bound admission and membership proof. Natural-result acceptance and stop claims use that same lock; after waiting, revalidate the captured identity instead of adopting the latest generation. Keep an accepted result immutable, and stamp its generation/acceptance time in the runtime rather than trusting workload-provided metadata. This local result publication does not by itself establish forced whole-tree termination. After an accepted stop claim, retain a later workload result as an explicitly nonterminal capture without a natural-success/failure terminal Trace or handled marker. Runner exit or a complete workload payload cannot authorize reuse while the claimed owned scope remains unproven.

An unavailable or denied OS liveness probe is not evidence of absence, and an identity mismatch alone is not death of the captured execution. A single-process exit observation is only one member of stop proof: it does not establish process-group/tree cleanup or the termination of separately owned descendant Runs. A POSIX group absence probe likewise establishes only one absence fact, not group ownership, complete membership, or separately owned descendant-Run cleanup. Session-owner discovery and delivery ancestry cannot substitute for that control authority. Aggregate the complete proven scope before finalizing a stop.

No new user-facing grace-period setting is introduced. Termination uses the existing platform policy; `max_runtime` is an execution cutoff followed by verified cleanup, not a guarantee of instantaneous OS process death. Shutdown and parent teardown keep their existing authority and cannot be disabled by null supervision fields.

Status, control and producer-evidence readers share regular-file, generation-bound natural/capture validation. Status precedence and the rendered result use one parsed result snapshot, so an earlier accepted natural result remains `done`/`failed` after later malformed or matching pending stop evidence, without a synthetic stopping cause or file changes. Stop-request ACKs likewise prefer accepted natural evidence before reading later stop records, after exact generation/owner/protocol checks and without native probes or file changes. Invalid/captured/unbound data cannot acquire that priority; pending stop claims keep their nonterminal ACK. Supported legacy result records remain display-compatible without gaining accepted-natural authority. This fixes result projection, not native-scope closure or public supervision enforcement.

## Owned-Scope Proof Gate

This is bounded implementation evidence, not a new public API or approval of a production containment backend.

[`startRun`](../lib/async-runs.ts) protects the new Run's own state and launches a detached runner. Spawn and async registered tools use that path, but actual-spawning-member admission and authenticated cross-owner descendant membership are still absent. [Delivery lineage](../lib/run-delivery-lineage.ts) routes completions; [parent-session teardown](../lib/runs-parent-teardown.ts) filters exact session owners. Neither is descendant control authority. [Ordinary native attempts](../scripts/async-runner.mjs) still use `withRunWorkAdmission`, not the private native intent/birth/settlement ports.

Private [child intent/preparation persistence](../lib/runs-descendant-launches.ts) retains declared targets in `descendant-launches.json` (`run-descendant-launches-v1`), not control capabilities. The kernel-only `prepareDescendantRunGeneration` shares `startRun` metadata creation but requires fresh state: it allocates the real child generation under parent-then-child lifecycle locks into unpublished `prepared-run.json`, never canonical `run.json`/progress, native spawn, captures, Recipe launch usage, `run.start`, or a started-Run receipt. This avoids an unstarted preparation becoming an ordinary `exited` Run or terminal candidate and preserves earlier evidence rather than replacing it. Before committing the parent's optional `preparation` fact, it records `descendant-preparation.json` (`run-descendant-preparation-v1`) with reciprocal exact-generation references and `parent_producer` (the original admitted PID/captured fingerprint, explicit null if unavailable), then revalidates the callback-scoped genuine parent plus current staged child metadata. This binding never comes from actor values or refreshed parent metadata. Caller UUIDs, delivery lineage, copied producer data, self aliases and live singleton substitution cannot supply that generation. Child and parent writes are not one atomic transaction: failures retain available evidence, never imply no birth elsewhere, and do not retry or resume implicitly. Known child-release failure preserves the original action outcome, quarantines the parent producer, and retains the first cleanup cause, not proof of released locks. Any staged metadata, marker, or parent journal stays fenced against replacement/archive/prune, even when later writes fail; missing records are not closure proof, and ordinary live singleton attachment still preserves its generation/clock.

Same-runtime `reconcileRunDescendantPreparation` can explicitly repair a missing parent fact or add preparation monotonically to its exact declared intent, preserving id/admission time/target, child files, root results and budgets. It requires the genuine producer's evidence permission, even while stopping or after natural acceptance; a new fact revalidates parent identity after child-lock contention plus exact unpublished staged evidence and original producer binding. Legacy-unbound or foreign producer references remain readable data but cannot create/upgrade a prepared fact or backfill identity. Already accepted facts win unchanged without child probes. Each failed I/O call ends without implicit retry; a later explicit call may make fresh observations. This establishes metadata evidence, not native birth, authenticated workload-spawner/live membership, complete scope, lock release, or power-loss recovery. The stored binding is reference evidence, not native identity acquisition or reconstructed permission.

Private `recoverRunDescendantPreparation` now admits evidence-only parent repair after producer loss: it matches exact parent/child references and original PID/fingerprint to supported saved parent identity, then requires a fresh ESRCH-only absence observation. It revalidates under parent-then-child lifecycle admission after contention and observations; absent/unbound/unsupported/reused identity, changed metadata and published child state remain refused or unproven. No producer capability, native exit code/signal, work permission or scope closure is reconstructed. Root result/cause/progress/clock and child files stay byte-preserved, including opaque root evidence. Accepted facts reuse without child/native probes. Explicit calls do not retry failed persistence internally. Cleanup preserves the primary outcome and first release failure, with runtime-local recovery-scope quarantine; durable quarantine recovery, incomplete preparations and whole-scope closure remain unimplemented. Ordinary child starts remain unwired.

The local native Linux evidence establishes these separate boundaries:

- **Group absence is not descendant closure.** A disposable leader exited and its original group returned `ESRCH` while a `setsid` descendant remained nonterminal and non-waitable. The fixture subsequently reaped it.
- **Resource emptiness is not historical ownership.** A cooperative cgroup-v2 fixture retained its detached descendant until exit. A separate same-UID migration fixture moved a descendant from source A to sibling B: the leader/process group disappeared, but source/destination/outer-parent population was `[0,1,1]` while the descendant lived. The outer parent stayed populated, so this does not contradict recursive cgroup accounting.
- **One namespace boundary rejected one migration path.** With `nsdelegate`, equal control-file modes/ownership and matching host-visible UID/GID/groups, no-new-namespace and user-only controls allowed A→B. The joint user+cgroup namespace case rejected that path-based migration with `ENOENT`, leaving population `[1,0,1]`. Namespace inheritance was verified; descriptor escape, arbitrary namespace escape and production integration were not.
- **Primary-ID restoration is not transparent group compatibility.** A three-case Node `v26.8.1` probe restored UID/EUID/GID/EGID, user lookup and private-workspace owner IDs by mapping only the caller's own UID/primary GID. Fixture-file access succeeded and joint-namespace migration stayed denied. However, a non-primary baseline group's virtual ID still differed, despite unchanged group count and host-visible UID/GID/groups. This does not prove lost kernel membership or lost group-based filesystem access.
- **The tested unprivileged full-group request was refused.** One fresh child attempted exactly one `gid_map` write containing two single-ID ranges for its already-existing primary/supplementary groups, after its own UID mapping and private `setgroups=deny`. The write returned `EPERM`; `gid_map` remained empty. No retry, privileged helper, account change or host-policy change followed. This bounds that request in this environment, not every possible architecture.

Recorded successful fixture cleanup reaped the held descendants, removed only fixture-owned resources/workspaces, and left caller namespaces/cgroup/host credentials unchanged. Those observations are not arbitrary-failure cleanup, controller-loss recovery, statistical corroboration, or native Darwin/Windows proof.

The namespace candidate remains parked; the strict native direction adopted below does not adopt this namespace mechanism or authorize another mapping experiment. No security sandbox, mapping helper, production backend, blanket elevated-privilege requirement or host-policy change is selected. Further design must preserve the complete-owned-tree contract and unchanged workload credentials rather than silently accepting credential drift or weaker closure.

Before positive whole-scope closure, establish trusted generation-bound resource identity, seal every native/child-Run admission path, account for recursive exact-generation child closure and unresolved launches, and preserve immutable evidence. All recorded members settling is still insufficient. Unknown authority remains unproven; PID/PGID presence, delivery ancestry or a resource path cannot substitute. Native scope authority, ordinary native/child journal wiring and retained-journal retirement remain gated by [Checkpoint C](../BACKLOG.md). Checkpoints A/B may advance without a production native backend; public feature ingress waits for its runtime readiness, and positive deadline acceptance plus all agreed branches must pass Checkpoint D before the single release.

### Owner-Loss Termination: Approved Outcome and Mechanism Gate

The operator approves the outcome and now adopts the strict native direction: an independent native controller with separately prepared authority over protected per-platform scopes, preserving workload UID/GID/supplementary groups and refusing silent best-effort fallback. The instruction to record the direction and do the necessary work authorizes scoped development toward prerelease, not a claim that a backend exists. Linux, macOS and Windows remain the intended platform set; macOS/Windows native execution is available through the existing Validate CI matrix, not this Linux workstation. Concrete privilege changes, service installation, credential/account/host-policy changes, release and publication still need their own admission. A native helper role is approved; its implementation, packaging, precise authority and each OS mechanism remain to be established. No production owner-loss watcher, metadata schema, native API or public switch is implemented by recording this decision.

**Current evidence and missing authority.** The ordinary start metadata has logical ownerId plus the runner's pid/process_identity; these are not the Pi host's birth identity. The original SDK-manager/current-lifetime binding fixes trusted graceful shutdown and stale callbacks inside its coordinator, not independent observation of host death. The controlled source/packed quit witnesses prove only their captured runner/direct-workload cases on the tested Linux/macOS/Windows CI profiles, not complete membership, crash supervision or whole-scope closure. A fixture's captured SDK-host frame is test evidence, not a production owner capability. Session ids, copied history, PID/PGID integers, paths, environment, heartbeat files and serialized DTOs must not mint or reconstruct that capability.

**Owner instance, not just session id or PID.** The required conceptual owner is a trusted Pi host lifetime together with its logical-session epoch. It is not a proposed serialized schema. Several session epochs may share a host process; reopening/importing the same session id does not adopt another live instance's Runs. The trusted quit/reload/new/resume/fork path keeps its existing epoch-revocation semantics; /tree does not itself end that epoch. A physical host death may end several of its admitted epochs, but cannot authorize stopping an independently live host with the same session id. File-research permission after resume remains separate from live-work adoption.

**Required lifecycle before ordinary activation.**

- Retain genuine host-birth/lifetime authority at trusted composition, with an independent observer that can survive loss of that host. Pin it before workload birth; do not acquire a replacement identity after loss.
- Bind each exact Run/root/generation to that original owner instance and its already-authoritative native scope before any work can execute. The bind/spawn failure windows must preserve uncertainty; no unbound work or inferred historical adoption.
- Authenticate native and separately spawned descendant-Run membership at ingress, including cross-owner descendants. Existing delivery ancestry, discovery/catalog rows and declared/staged child targets do not supply this authority.
- Treat a trusted epoch revocation or proven original host exit as a stop trigger. A missed heartbeat, delayed callback, UI failure, slow model or SIGSTOP alone is not positive owner death. Runtime deadlines retain their own clock/cause rules, not an invented owner-loss timeout.
- Revalidate the exact owner-instance/Run/scope relation at actuation, seal further ingress and preserve natural/first-cause arbitration. PID reuse, A→B→A, replacement, duplicate callbacks and supervisor reconnect cannot revive an old grant.
- Confirm the complete admitted native/child scope before terminal finalization or guard release. A Kill attempt, runner close, captured-member settlements or an empty old process group is insufficient for escaped descendants.
- Keep malformed/legacy-unbound state and lost observer authority explicit and fenced. Do not rebuild permission from journals, reset clocks, migrate old packets, signal guessed PIDs or retry destructive work to obtain a cleaner receipt. No minimally implied keep-alive/transfer exception is added.

**Existing ownership seams.** extension-runtime owns trusted host/session composition; the async-runs admission facade and existing lifecycle/ownership domains own exact-generation admission; the supervision/controller owners own independent observation and stop arbitration; existing native/descendant owners own membership and closure evidence. These are responsibilities, not approved new API signatures or a second registry. Any earned OS adapter must follow the local DAG and keep actor configuration/data outside its authority ports.

**Adopted direction; mechanism proof remains open.** Prefer OS-enforced native scopes behind the existing lifecycle/supervision owners, not a PID-tree scanner, process-group-only watcher or second global registry. Retain the original owner lifetime and exact Run generation before work; let the independent controller survive Pi loss, seal admission, request native stop and positively establish complete scope closure. Protect the controller's authority from workload-controlled mutation within the explicitly established threat boundary; a separate process alone is not a security boundary. This does not adopt a new native API, arbitrary same-UID security sandbox, clock carrier or public activation.

- **Linux preferred candidate:** pidfd-based original-host observation plus a protected cgroup-v2 subtree and cgroup.kill where available. Prove the actual delegation/control boundary and deny migration outside the owned scope; a writable same-UID sibling invalidates a naive emptiness claim. Prepared delegation or a narrowly authorized system broker may be necessary; never run Pi/workloads as root by implication or alter their credential/group view. Availability of Linux or a delegated user subtree alone is insufficient. The parked namespace/group-compatibility experiments remain parked.
- **Windows preferred candidate:** original process HANDLE plus Job Objects, assigning the workload before it executes, with appropriate no-breakaway/nested-job policy and controlled handle ownership. TerminateJobObject and KILL_ON_JOB_CLOSE have distinct roles; a retained/duplicated handle changes last-close behavior. Ordinary creation of one's own processes/jobs commonly needs no administrator, but existing enclosing Jobs, access rights and program compatibility must be checked. External-service launches such as WMI Win32_Process.Create do not automatically join the Job; authenticated descendant-Run ingress remains required.
- **macOS feasibility first:** establish an actually supported native scope mechanism before implementing the common backend path. kqueue exit observation is not containment; process-group/launchd group cleanup does not cover escaped descendants. Apple's current XNU event header marks NOTE_TRACK/NOTE_TRACKERR/NOTE_CHILD unsupported since10.5, so their recursive-fork tracking cannot be assumed. Elevated helper rights alone do not identify a complete scope primitive. Evaluate supported mechanisms and their exact authority, ingress/escape and compatibility boundaries; expose an unresolved mechanism as a gate, not a weaker macOS implementation. A Linux guest/VM on macOS is a different execution environment, not native Darwin acceptance, and requires a separate product decision.

Source-level references for this direction are the [Linux cgroup-v2 delegation/containment and cgroup.kill contract](https://docs.kernel.org/admin-guide/cgroup-v2.html), [Microsoft Job Objects](https://learn.microsoft.com/en-us/windows/win32/procthread/job-objects), [Apple XNU event flags](https://github.com/apple-oss-distributions/xnu/blob/main/bsd/sys/event.h) and [Apple launchd process-group cleanup description](https://github.com/apple-oss-distributions/launchd/blob/main/man/launchd.plist.5). These support limits/candidate selection, not native acceptance on the installed OS or proof of production compatibility. Further scoped preparation/development is permitted; actual privilege/setup operations and any relaxation of scope, workload compatibility or the three-platform promise remain separately gated.

**macOS source-feasibility result; native proof still absent.** The bounded source pass used Apple XNU revision [f6217f891ac0](https://github.com/apple-oss-distributions/xnu/tree/f6217f891ac0bb64f3d375211650a4c1ff8ca1ea), not execution on macOS or proof that a CI runner uses that exact kernel. It identified a concrete authority/bootstrap gate, not a proof that all macOS architectures are impossible.

- **Coalitions are a conditional kernel candidate, not a selected backend.** In this snapshot, [coalition syscall dispatch](https://github.com/apple-oss-distributions/xnu/blob/f6217f891ac0bb64f3d375211650a4c1ff8ca1ea/bsd/kern/sys_coalition.c) checks task_is_in_privileged_coalition before create/terminate/reap; root UID alone does not satisfy that predicate. [Spawn binding](https://github.com/apple-oss-distributions/xnu/blob/f6217f891ac0bb64f3d375211650a4c1ff8ca1ea/bsd/kern/kern_exec.c) checks privileged-coalition membership or a coalition-spawn entitlement for explicitly supplied coalitions. The [header installation rules](https://github.com/apple-oss-distributions/xnu/blob/f6217f891ac0bb64f3d375211650a4c1ff8ca1ea/bsd/sys/Makefile) classify coalition.h with Apple-internal private headers/XNU exports, not the ordinary public DATAFILES. The resource model has active accounting and termination state, but coalition_terminate requests lifecycle termination/empty notification, not a whole-scope signal: its syscall comment explicitly permits existing members to fork, and [the implementation](https://github.com/apple-oss-distributions/xnu/blob/f6217f891ac0bb64f3d375211650a4c1ff8ca1ea/osfmk/kern/coalition.c) marks termination once active_count reaches zero. No supported third-party launchd/controller bootstrap, sealed complete-membership kill protocol or compatible recovery path was established. Neither the API name, readable coalition id, root helper nor debug unrestrict_coalition_syscalls setting supplies those missing grants; do not change boot/SIP policy to obtain them.
- **EndpointSecurity is not sufficient containment by itself.** Apple's [client contract](https://developer.apple.com/documentation/endpointsecurity/es_new_client(_:_:)) requires its entitlement and user TCC/Full Disk Access approval; the [initialization result](https://developer.apple.com/documentation/endpointsecurity/es_new_client_result_t) also distinguishes not-running-as-root. The documented event enumeration includes NOTIFY_FORK, not an AUTH_FORK gate; AUTH_EXEC alone does not gate a forked child that executes work without exec. Apple's [global sequence contract](https://developer.apple.com/documentation/endpointsecurity/es_message_t/global_seq_num) explicitly accounts for dropped events. Such telemetry may aid a separately proven mechanism, but does not itself supply inherited scope confinement, membership retained before work or authoritative complete closure. No entitlement/FDA setup or ES implementation is adopted.
- **Audit-session identity is not an immutable scope capability.** The inspected [audit-session implementation](https://github.com/apple-oss-distributions/xnu/blob/f6217f891ac0bb64f3d375211650a4c1ff8ca1ea/bsd/security/audit/audit_session.c) supports joining via Mach session ports and updates audit credentials; obtaining another session's port is separately privileged. The reviewed interface did not establish an irreversible per-Run admission seal, authoritative whole-session kill or complete closure. Do not substitute an ASID or move the workload into another audit context without a compatibility/authority contract.
- **App Sandbox is not a transparent lifecycle backend.** Apple's [supported overview](https://developer.apple.com/documentation/security/app-sandbox) describes restricting resources through entitlements. Applying a new sandbox would change ordinary workload access and needs a separate execution-compatibility decision; this overview supplies no per-Run scope-kill/closure contract. This pass does not adopt sandbox-exec profiles, a VM/guest substitution or arbitrary-process security sandboxing.

The next admissible macOS mechanism needs a concrete supported controller/bootstrap path (or an explicitly accepted bounded SPI/OS integration contract), a pre-work native scope identity, actual fork/setsid and external-service ingress rules, stop/seal plus positive complete-emptiness/recovery semantics, and an explicit supported macOS/SDK matrix. Native-CI falsifiers must cover ordinary versus required controller authority, creation/binding failure before work, same-UID unrelated controls, fork/setsid membership, ingress/stop races, controller/owner loss, identity reuse and actual settled captured processes. A denied syscall or observed fork counter alone cannot pass C1. **Supported OS-manager bootstrap check.** Apple's [SMAppService contract](https://developer.apple.com/documentation/servicemanagement/smappservice) controls helper executables inside an app's main bundle and is available on macOS13+. Agent/daemon plist names must refer to the corresponding bundle LaunchAgents/LaunchDaemons directories. [Registration](https://developer.apple.com/documentation/servicemanagement/smappservice/register()) is subject to user approval; a daemon is not bootstrapped until administrator approval, and registration has subsequent-login/boot semantics rather than an automatic Pi-owner-death lease. This identifies deployment/consent requirements, not native scope authority; no app-bundle distribution, minimum-OS policy or service installation is adopted for the current npm extension.

[Unregistration](https://developer.apple.com/documentation/servicemanagement/smappservice/unregister()) promises to stop the running helper service and prevent later launches. Neither that contract nor its completion callback supplies an exclusive per-Run coalition handle, controller coalition privileges, sealed descendant admission or positive closure of escaped descendants. The older [SMJobRemove contract](https://developer.apple.com/documentation/servicemanagement/smjobremove(_:_:_:_:_:)) optionally waits for the job process to exit, not an expressly guaranteed complete-owned-scope proof; SMJobSubmit/Remove are deprecated on macOS since10.10. Do not introduce that legacy path as a new guaranteed fallback. The previously inspected launchd process-group cleanup description remains only group cleanup, not a missing whole-scope contract. As a supplementary CLI reference, the reviewed [Xcode launchctl manual mirror](https://keith.github.io/xcode-man-pages/launchctl.1.html) describes bootstrap/bootout as service/domain definition operations and kill as sending a signal to a running service; it explicitly warns that print output is not API and procinfo output is diagnostic-only. Parsing those diagnostics cannot supply a stable scope-identity contract. This mirror is not installed-runner evidence. The overall result is a source-contract limit: it does not assert what an unobserved macOS launchd build internally does or prove that every OS-manager integration is impossible.

The bounded public OS-manager question is now resolved to a gap: the reviewed supported interfaces do not establish the exclusive scope/issuer/lifetime relation needed by C1. A successful registration, job label, PID, unregister callback or helper exit cannot be promoted into that relation. Further implementation needs a concrete confirmed OS authority/scope contract, or an explicitly bounded macOS SPI/CI feasibility contract naming the private interfaces, supported OS/SDK matrix, actual issuer/bootstrap, required job/privilege setup, capture/cleanup and falsifiers. That would still be investigation, not production adoption or evidence of success. No private authority, service/boot/SIP change or weaker execution semantics follows from these source observations. With no new concrete mechanism/authority input, stop rather than repeat either source scan or manufacture a prototype around an assumed scope.

#### macOS SPI and CI Feasibility Plan

**Status and admission.** Both A and B are recorded and priority-reviewed. The operator subsequently admitted authoring A and, separately, a metadata-only inventory mode in the same manual workflow: the first-profile fixture/harness, inventory collection wiring and non-native authoring checks are prepared below. Neither macOS inventory nor Darwin SPI/native fixture execution has been admitted or performed by those authoring checkpoints. B is not implemented. Neither this authoring admission nor recording/review permits native execution, CI launch, job/service registration, rights changes, push, or Grow Loop resumption. A is a deliberately narrow observational pilot; B remains a conditional authority/closure investigation. Neither PASS_A nor any research-job completion closes C1, enables a backend, selects a clock carrier, or supplies source/packed product acceptance.

**Priority order.** Check authority and cleanup safety first, then ABI/profile admission, then observation quality and matrix coverage. Do not widen a failing pilot to new APIs, privileges or OS versions to obtain a green result.

**Candidate interfaces and non-authority.** A initially needs only proc_pidinfo with PROC_PIDCOALITIONINFO and PROC_PIDUNIQIDENTIFIERINFO, bound to the fixture's positively captured processes. Pin the reviewed declarations to [XNU f6217f891ac0 and its private proc-info header](https://github.com/apple-oss-distributions/xnu/blob/f6217f891ac0bb64f3d375211650a4c1ff8ca1ea/bsd/sys/proc_info_private.h); verify full declared ABI/return size and field semantics rather than guessing a pair of uint64 values. Preserve reserved fields/layout; do not fetch latest headers, patch system headers or reinterpret unknown bytes in CI. Preserve native uint64 identities losslessly as canonical unsigned decimal strings in research artifacts, never rounded JavaScript Numbers or unchecked signed casts; retain the reviewed coalition type/index mapping. A readable symbol, coalition id, birth/version DTO or matching hash is observation, not a retained native control capability. coalition_info_resource_usage is not required by A: aggregate accounting may describe a shared CI coalition and does not establish membership completeness or closure. Coalition create/terminate/reap and private coalition spawn attributes are B candidates only, with no selected userspace binding or admitted caller authority.

**Research matrix, not a product support policy.** Use Node24 to match current validation and native, non-Rosetta execution on these proposed profiles, as listed by the reviewed [runner-image catalog](https://github.com/actions/runner-images#available-images):

- **First pilot:** macos-15 / arm64, Xcode16.4 build16F6, macOS SDK15.5.
- **After a reviewable first witness:** macos-26 / arm64, Xcode26.6 build17F113, macOS SDK26.5.
- **Architecture check:** macos-15-intel / x86_64, Xcode16.4 build16F6, macOS SDK15.5.

Use a job-local DEVELOPER_DIR, never sudo xcode-select or SDK installation. Labels do not pin immutable images. Before private calls, compare actual OS/build/architecture, ImageVersion, Xcode/build, SDK, compiler and reviewed fixture ABI/profile against the explicitly approved experiment profile; persist the exact tuple plus source/binary hashes. Missing labels/toolchains, unexpected root execution or unreviewed image/profile drift yield ENVIRONMENT_BLOCKED before workload admission, not silent substitution or a new product minimum-OS rule. The runner manifests are catalog evidence, not execution on those images.

**A — bounded read-only native SPI pilot.** First-profile source authoring is admitted and prepared; native execution still needs separate admission. Later matrix rows remain behind first-witness review and their own profile admission.

1. **CI isolation:** use an opt-in, non-publishing research run on an exact approved commit with contents-read-only permission, no secrets, fork-triggered privileged execution or pull_request_target. Do not add this research result as a replacement for the normal three-OS product validation. The normal product Validate workflow remains unchanged.
2. **Ordinary rights:** preserve numeric UID/EUID/GID/EGID and supplementary groups. No sudo, entitlement, Full Disk Access, service/job registration, private spawn binding, coalition mutation, SIP/boot change or actual operator Pi/Run is involved. Do not enumerate unrelated system processes or dump the CI environment.
3. **Finite topology:** one dedicated driver and two independent fixture branches A/B, each with one short-lived child: at most five fixture processes including the driver, outside the test harness. The unrelated control is fixture-owned too. Direct parents capture positive birth/PID before waits/assertions, retain birth/version correspondence and publish bounded readiness frames. The outer harness retains the driver's real child handle, raw stdio and actual close; the driver cannot self-certify its exit.
4. **Observation cases:** ABI/access results; own captured-PID identity and coalition membership; controlled fork/setsid before/after observations; two-branch comparison; natural gated settlement. A does not deliberately kill an owner/controller, inject stop races or claim ingress confinement. Shared coalition ids across branches are a legitimate result and a veto on adopting that inherited coalition as an exclusive Run scope, not failure of a correctly recorded observational pilot.
5. **Lifecycle and budgets:** fixtures remain gated until frames are captured; each workload has a finite30s watchdog, the host bound is180s and the supported absence-observation window is8s. These are research bounds only, not product-budget changes or proof of exit. On frame-persistence or readiness failure keep gates closed and retain known effects/frames; do not invent missing births or add a workload to repair evidence.
6. **Cleanup:** normal cleanup releases only the owned fixture gates; each actual parent reaps its direct children. Preserve actual waitpid/close code/signal only where observed; non-child absence has no fabricated exit code. Before deleting scratch require the relevant actual settlements and fresh ESRCH for every positively captured process, including the driver observed by its outer parent. PID mismatch/reuse, live/EPERM/unknown proof, timeout, harness loss or missing birth/settlement retains the root and ordered primary/cleanup faults. A never uses coalition kill, pkill, PID-group scans or read-check-then-kill(pid) as a fallback. CI VM disposal is not the fixture's closure proof.

**A authoring checkpoint — not a native witness.** Test-only [C driver](../tests/fixtures/macos-spi-pilot.c), [shared C transport core](../tests/fixtures/macos-spi-transport.h) and [Node harness](../tests/fixtures/macos-spi-pilot.mjs) are outside the distributive and import no runtime owner. The existing source/packed infrastructure test owner holds the synthetic parser/profile/gate/report/absence properties and the opt-in C-unit below. Importing the harness does not run commands, read files or probe native processes. For this pilot, ordinary validation runs the JS properties and explicitly skips the compiler cohort unless admitted by its test-only flag; no compiler dependency or public tool/Recipe/default path is added. The product Validate workflow remains unchanged; the separate manual research workflow below is authoring-only.

The first implementation supports only macos-15/arm64, Node24, Xcode16.4 build16F6, SDK15.5. The explicit native CLI, **not executed by this checkpoint**, takes three arguments: --execute-readonly-pilot-a, the reviewed profile JSON path and /Applications/Xcode_16.4.app/Contents/Developer. It requires ordinary-user Darwin manual CI (CI=true and GITHUB_EVENT_NAME=workflow_dispatch), a clean exact approved commit matching GITHUB_SHA, and the exact profile before compiling/running the driver. The [manual research workflow](../.github/workflows/macos-spi-pilot-a.yml) is now authored, not dispatched. Its execution still requires separate approval of the exact commit and reviewed v2 profile, contents-read-only permissions, no secrets and a finite outer job deadline. Authoring and passing local guard tests are not that approval.

The closed profile schema is pi-actors-spi-a-profile-v2 with string fields schema, profile, platform, arch, node_major, os_version, os_build, darwin_release, image_version, xcode_version, xcode_build, sdk_version, sdk_build, compiler_version, developer_dir, github_repository, commit, fixture_sha256, transport_sha256 and harness_sha256. The new transport_sha256 binds the compiled header as well as the driver and harness; v1/missing-header profiles refuse, never silently upgrade. The actual tuple is measured and retained; it is never automatically promoted to the approved tuple in the same job. Hashes bind reviewed sources, not an OS scope grant. Missing/mismatched profiles refuse; no guessed approved JSON or catalog snapshot is shipped as native authority.

The C fixture checks pinned sizes/offsets, performs self-only proc_pidinfo queries, retains native uint64 fields as decimal strings and reserved arrays, and captures actual fork births before readiness gates. A fixture-local fd3 record lock serializes bounded stdout frames even with a small PIPE_BUF; it is not a Run/global authority lock. The driver-native getgroups vector is retained and compared unchanged across forks, without sorting/deduplication or substituting Node's potentially augmented getgroups view. The outer parent also checks UID/EUID/GID/EGID at driver readiness.

The harness persists raw stdio and frames before opening each next gate, never replays a failed gate write, and retains actual exit separately from actual close. Raw truncation, malformed/partial frames or persistence faults cannot yield PASS_A. For a known ABI refusal it closes only the input gates and continues collecting real waits/end/close. The observation deadline writes a non-pass receipt, not a synthetic exit: an externally stopped/hung process can leave close/stdio pending for outer CI handling. There is no force-exit, unref or signal-based cleanup fallback. This limitation must remain visible when admitting the future CI job.

After actual settlements, absence is one fresh ESRCH-only sweep of positively captured fixture PIDs. The proposed8s window is an upper observation budget, not a requirement to retry: any present/denied/unknown result is retained as possible identity reuse or incomplete proof, never retried into a later green receipt. Every evidence root is retained, including successful runs. Only a complete admitted native result exits zero; all blocked/inconclusive/non-go results exit nonzero, and an unexpected failure after possible native effects is never relabeled as a pre-execution refusal.

Local checks parse the driver translation unit with Linux -fsyntax-only, exercise JS synthetic records and separately compile/execute the shared C transport core with simulated syscalls as described below. They do not link Darwin libproc, execute the C driver, establish ABI availability on macOS, or supply any first native matrix witness. Native driver/harness lifecycle and capture/cleanup behavior remain to be exercised on the exact separately admitted profile.

The R1–R4 source remediation adds an explicit-IO capture boundary, with no native fallback for unit callers. Both readable error paths mark raw capture incomplete and latch admission closed; parent descriptor release failure is recorded inside the running capture and cannot bypass its actual-close wait. A failed send is never replayed; pre-failure accepted effects remain recorded. Early acquisition cleanup attempts every acquired release and retains exact single or ordered aggregate originals; post-spawn receipts keep private exact causes and persist getter-free ordered summaries. JS capture fault injection covers stream errors, release/cleanup faults including primitive/opaque causes, short/failed writes, persistence, deadline/timer setup and gate writes, without process/filesystem hooks or real children. C transport separately retains its first errno and byte progress, emits bounded best-effort diagnostics through nonblocking stderr (including first-cause fields on secondary faults), and stops stdout after a terminal failure. The diagnostic wire/parser and raw stderr retention retain their JS synthetic checks; the C-unit below additionally executes the actual shared emitter against explicit syscall shims. Neither layer proves native availability or real Darwin descriptor/lock behavior. These fixes admit neither native execution nor a CI workflow change.

The N1 follow-up handles Node's asynchronous failed-spawn path (including EMFILE/ENFILE with null/undefined stdio). The child error listener is installed before optional stream access. A missing immediate PID remains an attempt with birth=null and close=null; no late PID reconstruction, birth/exit file or PID probe is permitted. Its Node close event is retained separately as handle_close, not a workload exit status or absence proof. Attempt persistence and deferred owned-resource cleanup follow the provider error, preserving original/cleanup ordering and single release; the capture still awaits the actual handle-close event. Native CLI consumers preserve those causes and refuse the unbound attempt before reading process-close fields or probing PIDs. Non-native regressions cover both observer modes, absent/mixed/available pipe shapes, late PID and unbound exit events, and persistence/descriptor/parent-release faults. No C emitter or Darwin runtime evidence is added by N1.

**Opt-in shared C transport unit — simulated syscalls, not PASS_A.** The [host-only C unit](../tests/fixtures/macos-spi-transport-unit.c) and driver include one transport core; no copied algorithm, whole-driver include or Darwin stub backend is used. Test-local compile-time bindings replace fcntl, write, clock_gettime, poll and getpid only inside the core. The test reporter uses ordinary libc stdout/stderr outside that boundary. Finite scripts validate arguments and retain ordered calls, errno, requested buffers and separately accepted byte prefixes; exhaustion/mismatch records failure and supplies a terminal shim error, never success. Each terminal case also refuses a later emit without additional core IO. First-cause and partial-progress state is checked independently of diagnostic delivery.

The executed 19-case cohort covers full/short writes, lock/write EINTR/EAGAIN recovery, retry-budget boundaries, terminal lock/write/zero-write faults, initial/retry clock faults, combined write/unlock failure, unlock-only failure, unavailable/EINTR/EAGAIN/EPIPE/partial stderr and format overflow. Success calls deliberately leave unrelated errno values. JS assertions decode bytes actually formed by C; complete accepted diagnostics alone count as delivered records. Failed attempts and partial prefixes are retained separately, never repaired or promoted to complete raw capture. Host errno constants are not macOS errno-number evidence.

The existing tests/installed.scripts.test.ts owner runs this only when PI_ACTORS_C_TRANSPORT_UNIT=1; ordinary runs show an explicit opt-in skip and do not invoke a compiler. The first unit host is local Linux, not a Linux-only product support decision. Unsupported host, wrong flag or missing compiler blocks/fails a requested cohort; there is no install/download fallback. PI_ACTORS_C_TRANSPORT_CC may name one existing compiler executable, never shell-split flags. The owner snapshots exact unit/header bytes into a retained /tmp/pi-actors-validation/ct-* root, compiles only that unit with C11/Wall/Wextra/Werror/O2, and records source/header/binary hashes, real parent-captured compiler/unit handles, raw stdio and actual closes through the explicit capture port. It never runs pilot driver, native probes, jobs/services or controlling signals. Successful and failed roots remain retained.

A local opt-in invocation from the repository root, not a native-pilot/CI command:

```bash
mkdir -p /tmp/pi-actors-validation
TMPDIR=/tmp/pi-actors-validation npm_config_cache=/tmp/pi-actors-validation/npm-cache PI_ACTORS_C_TRANSPORT_UNIT=1 npm exec -- node --import ./tests/test-environment.mjs --experimental-strip-types --test --test-name-pattern='^portable C transport unit' tests/installed.scripts.test.ts
```

This adds executed C logic evidence only. Actual Darwin ABI/libc/syscalls, main's real descriptor/O_NONBLOCK setup, fd3 lock inheritance/serialization across fork, real backpressure/stdio delivery and native lifecycle/absence still require the independently admitted exact-profile witness. A passing C-unit is not PASS_A, C1, B admission or backend activation; it does not authorize a workflow, native trial or later matrix row.

**Research workflow authoring checkpoint — no CI execution.** The manual-only workflow defaults both execute_pilot_a and inventory_only to false, requires exactly one selected mode before claiming any evidence root, refuses replay attempts and mismatched approved/GITHUB_SHA/GITHUB_WORKFLOW_SHA before checkout, and never cancels an in-progress trial for another dispatch. Its fresh job-owned /tmp/pi-actors-validation base is not reused, removed or uploaded if already present. prepare/collect/admit CLI entrypoints require the manual native host context and the exact run/attempt/source/workflow/repository marker created by the claiming step; they cannot adopt an existing local validation base. Reviewed JSON travels through environment data, is digest-checked as exact UTF-8 bytes, and stays outside checkout; no approved tuple is generated from job observations. The [envelope/evidence helper](../tests/fixtures/macos-spi-research.mjs) performs declared-profile/source binding only; the existing native harness remains the actual environment-tuple admission owner. If no reviewed full tuple is available, native execution stays closed; any inventory-only run needs its own admission.

**Inventory-only authoring checkpoint.** The separately selected inventory_only mode requires an approved exact source/workflow commit but no pre-existing v2 profile; both profile inputs must be empty. Their workflow fields are optional only for this mode: pilot preparation still requires independently reviewed exact JSON/digest and source binding, and the native step additionally requires execute_pilot_a=true plus inventory_only=false. Selecting both modes fails before checkout/root creation; neither selected leaves the job disabled. No metadata-to-pilot transition, profile approval or native invocation is automatic.

The inventory step declares ten fixed argv commands: git status/HEAD, sw_vers version/build, uname release/native architecture, xcodebuild -version, and xcrun SDK version/build/clang --version. A shell capture retains each invocation's raw stdout/stderr and observed shell status before proceeding; a failure stops later commands without inventing their receipts. Nonzero status may include a pre-exec/redirection failure and is not an invented native process exit. These are metadata-command observations, not process-birth/native-scope/closure proof. Node24 host metadata records full Node version, numeric UID/EUID/GID/EGID, supplementary groups, ImageVersion and the fixed job-local DEVELOPER_DIR; it never dumps the environment. No C compilation, driver, SPI, privilege change, SDK installation or service registration occurs on this path. Tool-version executables run only in a separately admitted future CI inventory, never in local authoring tests. HOME/TMPDIR/clang-cache point to inventory-scratch outside both collector source roots and the upload allowlist.

The existing collector/quotas are shared, not a second inventory exporter: mandatory inventory-request/host/prepare and stdout/stderr/code receipts precede optional workflow files. Complete inventory needs the actual inventory outcome success, actual native outcome skipped, clean matching source commit, all ten zero-code receipts, native arm64 and a complete host/tuple snapshot; malformed, missing, interrupted or failed data remains bounded non-positive salvage. The export records mode=inventory, INVENTORY_ONLY, inventory_complete and measured_tuple with separate requested_profile; it never creates requested-profile.json, a profile-v2 schema/digest or PASS_A. review_candidate/profile_approved/pilot_executed/C1/B remain false even for a complete inventory. External admission additionally checks the observed job mode, inventory/native/collector outcomes, exact job identity and complete manifest; full-write-then-error cannot admit inventory when the collector failed. A human must review measured facts and explicitly approve a later full v2 profile and separate pilot dispatch; image drift or missing metadata never repairs itself into approval.

Only contents:read is granted. Checkout does not persist credentials; Node24 setup does not run package-manager work. No npm install/test/build, SDK installation, xcode-select, privilege/service operation or release action is added. Research limits are 15min/job, 5min/native step, 2min/inventory, 1min/envelope/collection/export-admission and 3min/upload. The existing 180s capture deadline remains observation, not a global CLI kill; timeout/cancellation/VM loss supplies no process-closure proof. Automatic native replay is refused; a separately approved new dispatch is not a repair of old uncertain effects.

The collector uses an explicit filesystem IO port, freezes regular top-level workflow/native evidence bytes and records per-file hashes; it excludes only native home/tmp/clang-cache directories, not primary receipts. It saves mandatory workflow files and frozen producer inventories before required native receipts/raw files, then spends any remaining budget on optional regular files. An unavailable/malformed inventory permits bounded non-pass salvage, never a fabricated complete inventory. Only one native invocation root may form a review candidate; the root limit remains16. Excess, symlinks, ambiguous roots, partial raw stdout, missing receipts and mismatched binary/profile/source data yield no review candidate, never primary-file truncation. The owner projection is reused for captured-frame/close/absence consistency.

**Upload-budget boundary.** The complete upload allowlist is bundle/ plus the exact workflow/job-owner.txt file; raw workflow/ directory/glob fallback is removed. UB-2 aligns upload with the collector's existing regular-file inventory: include-hidden-files=true preserves already-selected dotfiles inside the bounded bundle instead of silently dropping manifest entries. This does not add another source root or recurse into excluded native home/tmp/clang-cache directories. Static workflow and memory-IO regressions cover dotfile bytes/digests/reservations, matching export eligibility and continued cache exclusion; they do not execute the upload Action. The marker is bounded before creation to1024bytes. Total exported file contents are bounded to33554432bytes/256file slots:32505856bytes/254slots for evidence, plus1047552bytes/one slot for bundle/collection.json and1024bytes/one slot for bootstrap. A bundled copy of the marker is independently charged as evidence. The4MiB per-evidence-file cap remains. Byte reservations precede writes, including growth after stat; failed or partial writes do not refund bytes or slots and are not given successful-copy digests. These are content limits, not ZIP/directory/transport-overhead or heap/work bounds. Before its sole manifest write, the collector chooses a full manifest or a bounded non-pass summary with explicit inventory/diagnostic omissions. Original causes remain private and ordered; bounded summaries are not lossless serialization of opaque originals. A metadata failure cannot rewrite an earlier manifest into green or red.

**External export eligibility (UB-1).** A positive JSON file is not a receipt of its own successful persistence: full-write-then-error may leave valid positive JSON behind. The workflow gives collection an explicit collector id, then invokes the existing helper's admit mode with the selected job mode and native/inventory/collector outcomes sourced from workflow inputs/Actions step metadata, not manifest claims. Pilot eligibility requires native/collector success; inventory-only eligibility instead requires inventory/collector success and native skipped. Both require a complete fault-free bounded manifest with coherent mode-specific file receipts and matching run/attempt/source/workflow/repository identity. A collector failure/cancellation/skipped step therefore forbids acceptance even if upload succeeds and positive JSON survives; no manifest retry or overwrite repairs it. Consumers must retain/check the external admission/step evidence rather than accept standalone review_candidate text. Eligibility still has review_required=true and never grants C1/B authority. Native outcome remains independent of collection/admission/upload failures. always() upload preserves only the positively job-owned allowlist, with14-day retention and an error on missing files. If checkout/Node/collection is unavailable, bootstrap alone is not a complete archive; actual step outcomes remain Actions facts. Hard cancellation may prevent upload entirely.

**RW-1 completeness boundary.** The native harness now owns a closed pi-actors-spi-a-evidence-v1 inventory. It writes an incomplete initial declaration, extends it synchronously before every preflight launch, binds stdout/stderr byte lengths and SHA-256 after actual close, and seals it only for a positive owner projection with every preflight settled; a write failure latches the producer closed. The final report binds exact evidence-inventory.json bytes with evidence_inventory_sha256. Inventory/persistence failure remains INCONCLUSIVE, not a retained PASS_A. This is a file-evidence protocol, not native scope authority.

Before review_candidate, the collector requires the original workflow/requested-profile.json bytes and verifies their SHA-256 against the reviewed envelope plus exact profile-field equality; the native reserialized requested-profile.json is not a byte substitute. It also requires workflow ownership/envelope/prepare/harness files, every canonical native inventory member and all declared preflight birth/exit/close/stdout/stderr files. Each preflight must match its declared command/args, captured parent/credentials and exact attempt/birth correspondence, zero-code/null-signal settlement, complete raw IO, no timeout and no capture faults. Frozen stdout/stderr lengths and digests must match the producer inventory; same-length corruption and truncation are non-pass, not merely present files. Undeclared preflight files, incomplete/noncanonical inventory, missing members or digest/receipt mismatches prevent a candidate. Available files are frozen before completeness validation; a per-file read/copy failure preserves its private original cause and continues bounded salvage without repairing the failure. Manifest persistence is attempted once, retaining ordered original/later failures. Memory-IO regressions remove every required file and cover byte/digest/receipt mismatches, the original missing-profile/preflight counterexample and opaque/undefined IO faults. No native execution is added by this checkpoint; the changed harness hash needs independent approval in any future native profile.

Actions are immutable-pinned to official repository refs verified during authoring: [checkout3d3c42e](https://github.com/actions/checkout/commit/3d3c42e5aac5ba805825da76410c181273ba90b1), [setup-node949feb2](https://github.com/actions/setup-node/commit/949feb2413d6458794dcd2491c4babbbce0c15c1), [upload-artifactcf430e0](https://github.com/actions/upload-artifact/commit/cf430e030ddbb5b0abf93d22962f4752f3646cd9). Official v7 refs and action.yml Node24 runtimes were inspected read-only; Actions themselves were not executed or exhaustively security-audited. No profile tuple or Action SHA placeholder is shipped. Existing installed-script tests cover the actual pure request/result guards and explicit-memory-IO collector, plus static workflow wiring; they do not run Actions, macOS inventory, driver/SPI or C binaries. Runner compatibility, actual Actions behavior and evidence retrieval remain native-CI acceptance work.

**A outcomes.** PASS_A requires a reviewable complete witness for all admitted observation cases and confirmed fixture cleanup on that exact profile. It says only that the chosen observational ABI/cases worked. NO_GO_PROFILE identifies an unavailable/denied/incompatible interface on the admitted profile, not all-macOS impossibility. ENVIRONMENT_BLOCKED identifies an unadmitted/missing execution profile; INCONCLUSIVE covers incomplete/contradictory frames, source/lifetime uncertainty or unproven settlement. Only PASS_A is a positive research result; other statuses must remain non-pass/blocked even if artifact upload succeeds. A report-only or skipped execution is not PASS_A. No numeric exit-code protocol is selected here.

**B — issuer/bootstrap and complete-scope feasibility, gated.** PASS_A permits review, not automatic transition. Before any B implementation or experiment, name one concrete issuer path, its authentic caller/grant, pre-work root/Run-generation binding, exclusive native scope identity, retained lifetime, supported OS/SDK/SPI profile, exact setup/privilege needs and rollback/cleanup boundaries. The current candidates do not supply that path: root alone cannot mint privileged-coalition membership; a launchd label, PID, unregister callback or parsed diagnostic is not a scope grant. A transient launchd job, app-bundle/ServiceManagement distribution, administrator approval, entitlement/FDA or private binding requires its own explicit admission before use. Without an admissible issuer path B stays blocked, not a prototype around assumed authority.

B's candidate must establish a generation-safe actuation primitive, sealed admission, authoritative membership/emptiness and recovery. A PID/birth check followed by a PID-only signal is not atomic lifetime-bound actuation. coalition_terminate is not the missing whole-scope Kill, and tasks-started/exited or aggregate counters alone are not an authoritative empty/closure receipt. Reject the candidate if these contracts cannot be established; do not fill the gap with polling, saved metadata or a process-group fallback.

**B falsifiers and decision.** Start with the smallest authenticated own-scope/foreign-control pair, then bounded cases for fork/setsid and controlled external-service ingress, ingress/stop contention, actual original-owner death, independent live same-session-id host, paused-but-live negative owner, natural/first-cause precedence, owner/controller loss/replacement, stale identity and partial persistence/actuation. Capture real births/readiness/parent closes, preserve the unrelated control and original failures, and require positive full scope closure before finalization/guard release. External-service work must either join the authenticated scope before work or refuse before work; no implicit external-service exception. Unknown identity, authority, membership, actuation or closure means no positive result, no destructive replay and retained evidence.

A B-success decision only permits subsequent backend design/review on the tested profile: all required scope/issuer/seal/closure and isolation properties must have real native witnesses. It is not C1/C2/C3/B2/D acceptance or permission for default/public activation. Failure of a required property rejects that candidate/configuration; unresolved evidence stays inconclusive. Do not widen privileges, change workload compatibility, drop macOS or substitute a VM to force success. The canonical BACKLOG owns admission and execution tasks; this document owns the plan and proof boundaries.

**Falsification before default activation.** Real source/npm public launches must cover owner death after admitted binding, death at each bind/spawn boundary, trusted session replacement, original-identity reuse, an independently live same-id host, authentic cross-owner children, fork/setsid escape, supervisor loss/restart and partial persistence/actuation. Include a paused/hung-but-live owner negative case so liveness uncertainty cannot become a timeout-based Kill. Capture actual births/readiness/close where observable; use fresh supported absence proof before cleanup, retain uncertain state and preserve ordered faults. Native CI results must correspond to the candidate on each agreed OS; platform-name injection and an old HEAD's green matrix are not evidence for the working tree. Bare AgentSession.dispose still needs a trusted shutdown-before-invalidation host contract.

This records the adopted direction, not completion of C1 or implementation/acceptance of owner-loss termination. BACKLOG.md alone owns the next executable slices: macOS feasibility first, then concrete native authority/bootstrap/compatibility proof within C1; live membership and positive closure remain C2/C3, with B2/D integration and native CI still required. Neither design adoption, existing graceful-quit test preparation nor a local green suite declares prerelease readiness.

### Readonly Retained-Origin Timing

Private `RunSupervisionOwner.observeTime(expected)` now explicitly samples elapsed through the exact origin retained at genuine generation admission. It first resolves the existing owner record, validates its pinned root/marker frame and fresh canonical owner/generation/normalized clock, requires the captured clock signature, then uses the existing timebase. It returns frozen identity/basis since_admission/timing plus unchanged(), or explicit missing-publication/foreign-clock/frame/owner-stopped/released/closed refusal. Outer available means the binding was observed; inner timing may still be unproven with null elapsed/remaining. Since-admission time is not verified workload liveness, active Run elapsed selection, frozen natural-terminal duration or native closure, and its basis intentionally differs from snapshot live/terminal timing.

No origin is created/backfilled, allowance renewed or policy inferred from actor values. The monotonic provider is sampled once when its shared evidence is healthy, with no later wall sample. The existing first clock fault/due facts remain sticky across observers/controllers. This is readonly with respect to files, policy, work and controllers, not a pure getter: it can advance the origin's shared monotonic/fault observations. It neither claims nor starts a controller, schedules/cancels a wake, notifies due, signals or ACKs. Another owner may keep the controller claim while this owner observes time. Existing snapshot() remains a distinct no-IO/no-time-sampling projection.

Retention identity/logical stop/close and metadata frames are rechecked before and after sampling; reentrant stop/release/close or generation/clock changes discard output rather than returning a stale elapsed value or resurrecting a record. Returned unchanged() rechecks retention and captured canonical/frame observations without sampling the provider again, not future liveness, refreshed time, global storage immutability or a multi-file transaction. Role bodies, result/stop/Trace evidence, directories for discovery and process APIs are not read/probed; only canonical ownership/clock metadata uses its existing bounded strict readers. The port reads no lifecycle, so even an existing terminal result cannot make a later elapsed sample into a frozen terminal fact.

Five owning properties cover enabled/disabled policy, unchanged-sample snapshots, no controller claim/timer/notify including another holder, missing/foreign/copied frames before sampling, sticky reversal/epoch/provider faults with preserved due, reentrant revocation/canonical change, and readonly/no-body/no-wall/no-process behavior. The real fresh-launch test additionally refuses this port during unpublished admission, accepts the retained since-admission observation after publication and still leaves the owner retained before explicit start. These are bounded local timing/retention witnesses, not independent supervisor lifetime, cross-process origin recovery, positive native enforcement or public snapshot acceptance. Ordinary detached-runner frozen timing, default coordinator lifetime and public acceptance remain open. In the ordinary launch, the original monotonic origin remains in the caller process while the natural-result producer is admitted inside the detached runner; the current handoff supplies no original-origin/first-natural-acceptance bridge. Healthy saved clocks/results, the diagnostics-only candidate token or a newly captured worker clock cannot fill that gap. The natural-only commit admission below distinguishes successful natural publication from pending captures and failed publication, but does not supply the original origin or a frozen sample. That remaining join is not supplied by a late readonly observation.

### Private First-Natural Timing Admission

`publishRunResult` optionally calls kernel-only `RunResultPublicationOptions.naturalResultTiming` synchronously after its first successful natural root-result write and before Trace. No observer means no new token or retention. Duplicate results, earlier source/prepare failure, invalid authority and post-stop captures never emit this event. A root replacement that physically occurred before an I/O error is still preserved, but a failed publication call does not backfill an observer from the now-readable file. This is neither rollback nor proof that no bytes committed.

The original opaque `RunNaturalResultTimingAdmission` works only in its same-module/runtime callback. `withRunNaturalResultTimingAdmission` requires the exact producer/root/token and freshly revalidates producer authority around a synchronous action under the already-held lifecycle lock. It exposes only frozen identity/code/recorded status/completed_at with natural acceptance and timing not_asserted, never origin, elapsed, diagnostics, values, private paths or body permission. Copies, serialization, prototypes, a diagnostic token and returned timing-shaped DTOs cannot create that admission. No model/work callback is awaited, no clock sampled and no controller, signal or public parameter enabled.

`readRunNaturalResultTimingAcceptance` is deliberately a pure passive historical receipt. It records successful kernel publication, not current file readability/status, immutable storage, native closure or lock release. Receipt data survives source loss and cannot reopen the expired active callback. The completed_at string is descriptive wall metadata, never a duration or permission to subtract wall timestamps. The separate retained-origin consumer below joins a sample captured in the active first-natural event with its own lifetime and freshly admitted canonical lifecycle; the passive receipt alone cannot authorize a new late sample or a healthy snapshot.

Active use is revoked on all observer/action returns and throws. Deferred/then-protocol returns refuse without custom then/catch execution; original errors and partial effects survive. Observer failure happens after acceptance, so the natural result/code remains committed and is never retried into a synthetic workload failure. Later Trace failure likewise cannot erase the recorded acceptance. Five owning properties cover original/copy/cross-scope admission, natural-versus-capture/duplicate/earlier failure, before/after-replacement I/O and Trace errors, callback/action refusal, and pure historical reads with terminal timing still unproven. These are isolated same-runtime producer fixtures, not a caller-to-worker origin bridge, public/default timing or native-scope acceptance.

### Private Original-Origin First-Natural Freeze

`RunSupervisionOwner.captureNaturalTime(expected, producer, admission, stateDir?)` is a separate synchronous kernel consumer. It requires this owner's original retained origin/root/identity/frame and the exact active postcommit first-natural token and producer. It samples through the existing original observeTime method under the already-held publication admission, with clock/lifetime/frame and producer fences around the sample. It never subtracts wall timestamps, reconstructs an origin or accepts a serialized timing candidate. No ordinary caller or detached runner is wired to it.

The first authorized attempt is final for participating owners sharing that exact original origin in this module/runtime. A provisional capturing slot prevents reentrant sampling; healthy elapsed is frozen once only after the action's producer and retained-source fences succeed. Failed clock/frame/lifetime proof stays unproven rather than being retried or repaired from a later healthy observation. Invalid copied/foreign/expired admission fails before consuming a sampling slot. A second call in the same original active event reuses the frozen fact without sampling; an expired token still cannot invoke capture. Same-origin logical handover preserves the frozen fact and original allowance, not a cross-process lease or durable recovery record.

`observeFrozenNaturalTime` consumes the original frozen fact with fresh owned clock/frame and local lifetime admission. Its first_natural_acceptance basis carries exact elapsed plus historical code/status/completed_at, not current lifecycle or native closure. It reads no current clock, process, result/role body, source/target body or directory discovery and performs no write, scheduling, controller claim/start, notification, signal or ACK. Later clock-provider faults cannot rewrite an earlier proven sample. Stop/release/close revoke this owner's consumption. The reading's unchanged fence observes its retained clock/frame/lifetime without resampling, not future storage immutability or source health.

A fifth optional kernel port on readRunSnapshotFacts must be that original retained-owner method, not actor JSON, a cached DTO or a fabricated callback. The existing single parsed canonical natural result must match the frozen identity/code/status/completed_at exactly before elapsed becomes terminal. Literal-true synchronous timing and file/owner fences remain required. Missing capture keeps timing_unproven; malformed or changed acceptance refuses the join. The three-argument metadata-only default still never supplies duration. The owner compositor supplies both original timing ports and captured privacy references, so same-runtime genuine natural0/7 can now yield private done/failed snapshots and literal text/JSON without fresh time/native probes.

Eight owning properties cover one sample across participating owners, logical handover, natural0/7 rendering, copied/foreign/late inputs and missed events, sticky failed attempts, recursive/revoked/replaced-frame sampling, readonly frozen reads and later clock faults, single-result canonical joining/mismatched acceptance, deferred/accessor/fence refusal, separate result/sample/observer/Trace failures and owner/generation/clock changes. They use genuine same-runtime result producers with controlled original clocks, not the ordinary caller-origin/detached-worker bridge or real SDK frozen-time acceptance. Ordinary bridge/lifetimes, public/default/manual/timed routes, visual acceptance and native enforcement remain gated. Accepted result, frozen observation and Trace are separate effects: later observer/Trace failure does not roll back accepted work or authorize a replacement sample.

Separate source/packed acceptance now executes four finite native commands through the real command executor and genuine same-runtime kernel producers, natural0/7 per layout. An actual monotonic provider retains T0 before work and samples T1 in the active postcommit callback; the two values bracket real work and their exact floored difference equals the frozen snapshot. Copied/late token calls and duplicate publication cannot resample. Original privacy references survive later metadata/cwd/secret changes; delayed terminal reads preserve elapsed, literal text/JSON and body exclusion, while default facts stay timing_unproven. Controller/deadline ports remain unused. This is privileged isolated metadata/reference/owner composition under the real lifecycle lock, not ordinary startRun, SDK reporting or a caller-to-worker bridge. Four producer hosts and four workload PIDs are captured before subsequent assertions/awaits. Native-close codes match actual commands; workload fresh ESRCH is recorded before completion, but the producer manifest explicitly leaves its own exit not_asserted. Only the parent's fresh ESRCH checks for both roles immediately before deletion admit cleanup, retaining exact primary/manifest/probe failures on uncertainty. No native membership/exhaustive closure, cross-process origin authority or public/visual acceptance follows.

### Caller/Worker Clock Boundary: Investigation, Not a Carrier

Source inspection establishes three separate boundaries. The default source in run-supervision.ts uses process-relative performance.now with a module-local object epoch and private WeakMap start/provider evidence; the origin's JSON contains only wall_ms. With the opt-in kernel handoff enabled, async-runs.ts retains that original caller object before spawning; the default path has no such handoff, while the ordinary detached runner has only ignore/stdout/stderr descriptors, no admitted IPC clock carrier, and prefers its compiled runtime modules. scripts/async-runner.mjs admits the result producer in its own process and does not wire naturalResultTiming. Both producer and natural-event authority are runtime-local: copying data or importing the same filename in another process cannot recreate their private maps.

A bounded disposable Linux/Node26 inquiry explicitly added an experimental IPC channel to one scratch-state producer; this was not an ordinary startRun/SDK route or a workload-enforcement witness. Its two process-relative performance clocks had distinct time origins: directly mixing caller T0 and child event values yielded about0.78ms, while the observed hrtime counter difference was about321.51ms. The caller deliberately held its event loop across the child event; its later original-origin observation read462ms, with about140.37ms observed channel delay. The child's original active natural admission worked inside its callback and was revoked before the caller handled the message. The child rejected the copied caller origin, and the caller rejected the copied timing token; the child's passive receipt remained historical timing not_asserted. The synchronization file supplied no lifecycle or time authority. One captured producer PID/frame was freshly ESRCH-probed immediately before scratch deletion; no signal or native policy change occurred.

These measurements falsify a direct mixed-performance subtraction and the assumption that parent notification/late sampling equals first-natural timing. They do not authenticate an OS-global clock domain or prove portable hrtime/boot/namespace/VM continuity. Installed Node type comments describe hrtime as relative to an arbitrary past and intended for interval measurement; they are not a cross-process epoch/issuer guarantee. performance.timeOrigin is an epoch timestamp, not this kernel's shared epoch/issuer capability; combining it with relative samples would still require separately admitted clock-domain/continuity proof. completedAt wall subtraction never supplies retained monotonic authority. An asynchronous RPC cannot keep the current synchronous callback/held lifecycle admission open without changing its contract; a sync wait for a busy caller introduces blocking/deadlock/controller-lifetime obligations, not a free bridge.

No production carrier is selected by this inquiry. A future live launcher-bound carrier needs an explicitly supported monotonic domain/epoch, the unchanged original T0, a genuine privileged issuer/bootstrap binding to exact root/generation/producer, retained/revocable lifetime, and a worker-local first-natural sampling point that does not await a model or caller under the lifecycle lock. Numerical correspondence, an inherited descriptor, a nonce, a saved clock or a decoded packet alone establishes none of that authority. Replacing the original T0 with a worker-current anchor would omit startup and renew allowance; the existing start mismatch must not be hidden by rewriting metadata. Moving canonical admission into another process instead would be an explicit lifecycle/clock-contract redesign, not a drop-in repair. Existing private same-runtime acceptance stays valid; ordinary bridge adoption still needs a reviewed approved contract and platform/authority evidence, without silently crossing C's credential/platform gate or claiming native membership/closure.

### Draft: Live Original-Clock Carrier — Not Adopted

**Status and scope.** This is a reviewable admission/proof proposal, not an accepted API, transport, clock backend or platform policy. No carrier exists in the implementation, and these conceptual roles authorize no new port, public input or default activation. The proposed first slice would be optional fresh-generation observational timing only, preserving the existing admission T0, startup/retry/nested-work allowance and natural0/7 truth. Strict enforcement, independent supervisor lifetime, restart recovery, work/native membership, body visibility and scope closure remain separately gated. Adoption requires explicit contract approval plus concrete domain/bootstrap/platform proof; the Linux inquiry above supplies neither.

**Recommendation for review.** Prefer a live kernel-origin delegation with worker-local T1 over parent-notification sampling, because only the former could preserve the accepted temporal boundary without a synchronous RPC. This is a direction to evaluate, not a claim that an inherited descriptor or Node hrtime implements it. Moving canonical admission into another process is a different lifecycle proposal requiring an explicit T0/launch-receipt contract change. Replacing T0 after worker startup, wall alignment and replaying saved packets are not candidate repairs.

**Ownership, not a new registry.** The existing clock owner would own physical domain/epoch evidence, original anchor capture, units/precision and sticky faults. The existing launch/bootstrap owners would own original issuer/receiver lifetime and exact fresh launch binding. The existing result owner would own local first-natural admission and publication/cleanup boundaries. The retained supervision owner would own accepting a previously frozen remote fact, local lifetime, canonical joins and captured reference privacy. No new module, wire format, registry or exported function name is selected here; earn any later boundary through actual implementation/dependency pressure, not these conceptual roles.

**Proposed flow and refusal contract:**

1. **Capture, never reanchor.** A clock provider with demonstrated shared-domain/epoch semantics must already be admitted at the existing fresh-generation T0. Derive any later export from that original retained anchor and frozen policy, not a new worker/caller sample or a later calibration against another clock. Old/default performance origins, saved metadata, singleton reuse and restarted runtimes cannot be upgraded by copying data. Exact monotonic correspondence, nonnegative safe-integer elapsed, floor/ceil rules and uncertainty must be preserved; an unproved conversion or rounding tolerance supplies no healthy duration. Channel creation/handoff must still follow complete fallible metadata preparation; a new carrier cannot reopen the capture/native/resource leaks guarded by launch preparation.
2. **Bind a live launch, not a packet.** A privileged original launcher must retain the exact root/marker frame, owner/generation/clock signature and one fresh launch attempt. Bootstrap must establish a genuine receiver and exact producer/birth correspondence before it can mint a receiver-local delegated clock capability. Actor arguments, environment values, marker shape, PID, nonce, descriptor, hash or decoded bytes alone do not authenticate that path. Unsupported identity/domain or ambiguous ingress refuses timing delegation. Payload receipt may occur outside lifecycle admission, but final local admission must synchronously revalidate the already-held fresh producer/frame. Do not await a child acknowledgement while holding the caller start lock or await RPC/model/work inside producer admission. A failed optional observation bootstrap must not fabricate a workload exit; any future stricter pre-work refusal policy requires separate approval.
3. **Sample locally at first-natural.** Only the genuine receiver-local original-anchor capability plus the existing original producer and active postcommit first-natural admission may select T1. The provider read must be synchronous and local to the sampling runtime, not a call to a busy caller. Recheck exact root/generation/owner/clock/domain/lifetime and producer around the sample. Preserve the first authorized attempt, including failed/unproven capture, without duplicate/reconnect/restart repair. Post-stop captures, failed result writes, earlier source failure and unavailable clock proof yield no terminal timing. Metadata or serialized diagnostic/natural tokens cannot substitute for either capability.
4. **Separate capture and dispatch.** Root acceptance, frozen time, Trace, lifecycle cleanup and transport are distinct effects. Later failures preserve the real accepted result/code and any already admitted historical frozen fact; no rollback, synthetic failure or replacement sample follows. Capture may only retain or synchronously enqueue a bounded immutable kernel return record, never await transport/model/work completion or invoke delivery callbacks. Later relay of an already admitted historical fact grants no new producer operation and must not imply that publication return/absence of a cleanup diagnostic proves lock release. Cleanup quarantine continues to fence fresh producer operations without erasing accepted facts. If a chosen transport requires a released lock, its adapter must establish that positive boundary or refuse; do not invent a generic post-lock capability for transports that do not need one. Concrete nonblocking relay/cleanup behavior remains a required reviewed mechanism, not an implicit retry or ACK.
5. **Admit a frozen return, not remote sampling permission.** A delayed return may carry only an already captured identity/code/status/completed_at/elapsed fact and its kernel-owned source binding, never body/private paths or an active token for the caller to replay. The original caller receiver must authenticate the live launch/delegation and sampling issuer, bind the fact to the retained original T0/domain/epoch and that exact authorized sampling point, admit its current local epoch/root/clock and match one fresh canonical natural result before retaining the fact. These are new proof obligations, not a decoder authenticating JSON. The current captureNaturalTime API cannot consume that remote packet. Losing or restoring a file, copied receipt, actor field or new same-id session cannot recreate return admission. Later observation consumes retained frozen evidence with existing source/lifetime fences and original captured cwd/index privacy; it never samples a late T1 or refreshes privacy.
6. **Name lifetime boundaries.** Before delegation admission, cancelled launch, replaced frame, stale issuer or lost/ambiguous bootstrap means no imported capability. After a fully admitted delegation, caller busy/idle or channel EOF cannot silently renew T0, stop work, erase a proven fact or imply global revocation: the worker's already delegated clock lifetime is distinct from the caller's local view lifetime. Worker sampling still requires its own original retained domain/producer/generation to remain valid. Caller replacement/disposal rejects late return consumption; no copied id or unknown invalidated wrapper adopts the old lease. Worker/provider/domain loss stays unproven and cannot be recovered from serialized state. No cross-process controller exclusivity, native closure, hung-worker independence or durable takeover is promised by this timing delegation.

**Proof obligations before adoption:**

- **Domain/provider:** Establish common counter scale/precision and the exact meaning of epoch for each explicitly agreed platform, including discontinuity/suspend/namespace/VM/provider-loss behavior or explicit bounded refusal. A one-host hrtime ordering witness, timeOrigin timestamp or unit fake proves no portable domain. Do not silently select Linux-only support, change credentials or adopt C's native mechanism to make a clock test pass.
- **Issuer/bootstrap/return:** Name the concrete trusted ingress and threat boundary, then reject copied packets/prototypes, actor-controlled environment/flags/paths, forged endpoint/nonce, wrong producer/owner/generation/root/clock, copied markers, duplicate imports, late/replayed bootstrap and same-id foreign managers. Demonstrate the original binding rather than a self-authenticating schema. This is not an arbitrary-JavaScript or same-UID security sandbox claim.
- **Temporal and synchronous:** Bracket actual finite work with the exact original T0 and worker-local natural T1, including startup/metadata/transport delay without wall subtraction. Exercise busy/unresponsive caller, return backpressure/loss and worker failure without waiting under a lifecycle lock. A stopped caller view must not authorize late sampling or resurrect retention.
- **First winner and separate effects:** Cover natural0/7, post-stop capture, duplicates, before/after-physical-replacement I/O failure, clock faults, reentrant revocation, Trace failure and cleanup quarantine. Demonstrate bounded nonblocking relay and cleanup behavior; any dependency on released locks needs real positive evidence, not an absent failure flag. Keep exact errors and partial/orphan effects, with no source repair, retry into authority or workload-code substitution.
- **Lifetime and composition:** Test loss before versus after admitted delegation, startup replacement races, source/compiled module instances, worker restart, session shutdown-before-invalidation, channel reconnect and conflicting original holders. Same-runtime cooperative claims do not prove global controller ownership. Unsupported historical generations keep timing_unproven.
- **Views and acceptance:** Require genuine source/packed journeys for bootstrap, frozen return and original-reference snapshot composition, not fixtures that directly mint a local capability or merely decode a marker. Retain complete bounds/privacy, disabled-reporting/no-wake behavior and shared literal budgets. Public/manual/timed activation, actual audit, visual acceptance and native enforcement still require their existing combined gates.

**Decision boundary.** Review must approve the delegation/worker-T1/frozen-return authority model before a prototype changes kernel interfaces. A concrete clock-domain/epoch provider, supported-platform decision, bootstrap/return issuer and bounded nonblocking relay/cleanup mechanism remain unselected; these are blocking proof obligations, not implementation placeholders that may be filled with raw hrtime/FD/nonce checks. No prototype, compatibility change or production activation is authorized by this draft. Independent A2 work may proceed without pretending this bridge or C is complete.

## Shared Run Snapshot

Manual Run inspection and timed diagnostics use one validated producer, payload schema, compact renderer, and output budget, not parallel status implementations.

The private [`projectRunSnapshot`](../lib/runs-snapshot.ts) is the initial data-only projection, not that complete producer or a public inspect route. It accepts already-admitted owner/generation, active or natural lifecycle, live or frozen-terminal elapsed facts, and curated authorized references; it does not read/admit files, measure clocks, redact/authorize paths, export evidence or acquire native authority. Unknown timing/lifecycle fails boundedly, mismatched/unavailable index facts yield `evidence: null`, and oversized output fails rather than clipping metadata or paths. Forced-stop states require later authoritative scope facts; raw legacy status is not an admitted lifecycle fact. The private owner compositor below joins active/frozen-time/reference admission; ordinary caller/worker timing continuity, default coordinator lifetime and public routing remain open.

Default `readRunSnapshotFacts(stateDir, expected, capturedAt)` in `runs-status.ts` supplies a narrow readonly canonical-fact join, not a second legacy status stack or public route. It admits exact owned generation/optional owner through `readRunContextIdentity`, bounded strictUTF8 canonical metadata/result under the independent1-MiB source allowance, and the shared context-index reader. One parsed regular-file natural outcome through the existing classifier yields done/failed only with the cooperating outcome protocol; legacy/absent/malformed/foreign/post-stop-captured/active observations stay lifecycle unproven even with live-looking PID, status/stopped/progress flags or wall timestamps. Accepted natural evidence does not require reading later stop/Trace evidence. No forced-stop/native-closure inference is added, and existing public getRunStatus compatibility is unchanged.

The caller supplies a canonical observation timestamp; the reader samples no current clock or process and ignores stored elapsed/age fields. Timing is always unproven in this default metadata-only join, including natural terminals: projectRunSnapshot consequently returns timing_unproven for accepted natural facts and lifecycle_unproven otherwise, never a fabricated complete card. This default opts into neither original timing port; ordinary runtime timing continuity still needs B1. CWD retains its captured operational spelling without target probes/normalization; valid index metadata supplies only its exact identity/path, while unavailable or malformed index omits that reference without erasing lifecycle. These cwd/index values are kernel-local metadata, not a privacy certificate, public visibility grant or role-body permission; compose the original captured-privacy reference owner before routing them to an operator/model.

The frozen fact shape excludes raw result/values/progress/tokens, uses the shared16-KiB encoded ceiling and rejects overflow rather than clipping paths. Default reads perform no writes, locks, exports, scans, artifact/session/role-body reads, process probes, scheduling or ACK. Shared index admission may open a regular role descriptor to check metadata/readability, never role bytes. Returned unchanged() fences owner/marker/canonical metadata/result/index file observations, not every future role change, a transaction or exhaustive race immunity. Following a role must freshly use its own reader. Six owning properties cover natural0/7 and late bad-stop priority, unknown/legacy/captured/foreign/malformed/over-budget outcomes, exact identity/time/path/output bounds, missing-index locality/change observations, no-side-effect/no-role-byte access and single-result-read replacement refusal. Canonical-data fixtures do not recreate producer/work/native authority.

**Explicit private active join.** A fourth kernel-only observeTime port now opts this same reader into active admission; normal callers remain on the probe-free default. Trusted in-process composition must supply the original retained-owner method on every read, not actor JSON, a cached/serialized timing DTO or a fabricated callback. This is a kernel port contract, not a sandbox proving arbitrary in-process JavaScript trustworthy. RunSupervisionOwner.observeTime also accepts an expected state directory and refuses a different retained root before sampling, so matching copied generation/owner/clock metadata in another directory cannot borrow its elapsed.

The opt-in uses the existing captured-process owner for fresh supported PID/start/command/cwd correspondence before and after timing. Nonpositive/unsafe PID, missing/mismatched/denied/dead/unsupported proof stays unproven, never legacy running-by-PID or forced closure. Only absent canonical result or exact matching post-stop capture can enter this active branch; malformed/foreign/legacy results cannot. A valid pending stop supplies phase stopping; stale claims are ignored and invalid claims remain unproven. Capture claim id must match its exact pending claim. Natural done/failed still wins without calling process or live-time ports; only the separate original frozen-time port can supply terminal duration.

Metadata/result/index plus active stop-claim stamps are checked around both sources. The original owner must admit the exact root/identity with since_admission timing and a synchronous unchanged fence before running is selected. Clock-fault inner unproven can retain independently admitted running but never supplies elapsed; missing/released/foreign timing binding leaves active lifecycle unproven as well. Healthy elapsed becomes live only after these joins. Observed natural/stop publication, late PID loss or retained-frame revocation rejects stale output. The returned unchanged() checks metadata/time-source fences, not future process liveness or refreshed elapsed, and rechecks canonical files after the timing fence callback. It does not re-probe/sample on use. Role bodies, work, exports, scheduler/controller state, ACKs and native scope authority remain untouched; all cwd/index values remain kernel-local until separate visibility admission.

Data/accessor/custom-thenable/deferred callback completions refuse without invoking getters/then; same-runtime native rejected Promise settlement uses its intrinsic handler without awaiting. Timing fences must synchronously return literal true; truthy data/thenables/Promises cannot authorize the join, and rejected native fence Promises are settled as well. Five added properties cover healthy running/stopping/matching capture, no-probe default and denied/corrupt proofs, natural priority/missing-or-foreign retained roots, publication/stop/time/native-loss races and serialized/accessor/deferred rejection. Positive unit witnesses use this harness's captured supported process identity plus retained test origins, not native owned-scope authority. The real admission fixture now uses a standalone gated Node script rather than inline JS braces that were mistaken for command-template expressions; it records its workload PID before assertions/awaits, publishes readiness atomically, and checks natural0 plus fresh runner/workload PID ESRCH before deleting state. The readiness marker synchronizes the test only: lifecycle and timing still come from their independent owners. This fixes fixture readiness blindness, not the template-expression grammar or production policy. Current supported captured platforms exercise actual gated active facts; unavailable process proof remains explicit on others. Source/packed public switching, default coordinator lifetime/final snapshot composition, ordinary detached-runner frozen timing and native/release acceptance remain gated.

**Private fixed reference admission.** `createRunSnapshotReferenceReader(stateDir, producer)` in `runs-context-exports.ts` requires the genuine runtime-local producer and reads its immutable, bounded admission metadata under synchronous evidence admission. Captured cwd/full privacy never refresh from later values/cwd/visibility flags. Full secret and known Recipe-origin masking precedes encoded bounds; the declared-artifact operational-origin exception does not apply to snapshots. Only an unchanged absolute scalar-safe, control-free path is disclosed, retaining its exact spelling. Changed/invalid cwd is null with cwd_reference_redacted/invalid; a private index path is null with index_reference_redacted/invalid, without probing that withheld index. No masked placeholder becomes a usable reference and no inspection-side export/relocation is attempted.

The original reader freshly admits exact owner/generation and the shared readable context-index metadata before returning its canonical pointer. It fixes the construction root/marker frame and fences current owner/metadata/index observations; index loss returns index_unavailable without erasing the separately captured cwd. Full encoded readings are bounded at16 KiB after privacy, with independent1-MiB admission-input refusal, not a workload/path/file quota. Reads take no lifecycle/work lock, read no result/role/target body, and sample no process/clock, schedule, signal, export, repair or ACK. Construction uses evidence admission, not work permission; reference readings do not establish lifecycle, timing, native closure or any role-body permission. Fences observe those files, not future role readability, global immutability or multi-file atomicity.

Six owning properties cover fixed literal launch cwd despite live metadata/flags, full secrets/known origins and pre-bound withholding, invalid scalar/control paths and encoded/input budgets, copied producer/state/frame and owner/generation/index loss, mutation during index admission versus unavailable IO, and metadata-only/no-target/no-body/no-process/no-clock reads. Unit producer admissions use the current harness, launch no native work, and do not prove producer-exit/cross-process recovery. The producer-local factory alone is not a cross-process carrier: its original closure is runtime-local, and serialized readings, flags or copied descriptors cannot recreate privacy permission in a coordinator. The separate kernel launch path below keeps an original reader in the caller process instead. Final reference/lifecycle/timing composition and public routing remain open; null cwd must not become a fabricated complete snapshot.

**Original launch reference carrier and retention.** Opt-in fresh ordinary startRun now mints snapshot_references from full prepared launch metadata through captureRunAdmissionSnapshotReferences before cleanup/publication/work. This is a privileged kernel issuer operation under the already-held lifecycle lock, not an API authenticating arbitrary saved metadata. Metadata shape, owned markers and the genuine origin check establish correspondence, not privacy authority by themselves; the actual original launch caller is the authority boundary, not an arbitrary-JavaScript sandbox. No actor/configuration/saved-JSON ingress calls this issuer. No-observer, prepare-only and reused generations emit no reference capability. The event carries the opaque reader, never full metadata, values or raw private references.

The owner snapshots complete own JSON data under the1-MiB encoded budget, refusing accessors, serialization hooks, cycles, unsafe prototypes/data and overflow without calling hooks or projecting a partial privacy subset. Existing full secret/Recipe-origin projection precedes reference bounds; capture loss stays privacy_capture_unavailable despite later healthy metadata. Both producer and launch issuers share the reader. A private class brand/constructor issuer, not a generic registry, admits only the original same-module/runtime reader for exact state/owner/generation/frame. JSON, spread/prototype copies, raw readings and read-shaped/deferred objects cannot recreate permission; rejected native Promise inputs are settled without awaiting or invoking custom getters/thenables. Serializing the reader exposes no private fields.

RunSupervisionOwner retains the optional original reader alongside the origin. First binding, including absence, is immutable: duplicates cannot add missing permission, replace even an equivalent reader or refresh privacy. Legacy captures return references_not_retained. Explicit observeReferences(expected, stateDir?) freshly reads the source owner's bounded owner/index metadata with retained-root and revocation fences before/after admission; it samples no process/time, takes no lifecycle/work lock, follows no body/target, starts/claims no controller, arms/cancels no timer, mutates/repairs/notifies/ACKs nothing. Reentrant stop/release/close or observed frame/canonical replacement discards stale data. Stop/release/close revoke this owner's consumption, not separately retained original readers or a global lease. Pure snapshot() stays no-IO/no-time and exposes no capability.

Four new properties cover full own-data/no-hook privacy, original-brand/root/owner admission and immutable first retention, no-clock/controller consumption with local revocation, and reentrant revocation/foreign frames. The real gated launch fixture retains cwd/readable index after natural0 and fresh runner/workload ESRCH, then refuses privacy refresh from live cwd/secret/visibility changes. A declared-but-unproduced artifact exercises the existing artifact-index publisher: this does not prove all ordinary Runs publish an index or that targets were produced/read. Unit index loss remains null. Canonical status admission now types only a minimal unknown-result kernel timing port, not the coordinator interface, keeping the DAG directed; the original observeTime contract and runtime checks are unchanged. Ordinary detached-runner frozen timing, default coordinator/supervisor lifetime and public switching remain open; the private compositor below joins the existing sources without widening them.

**Private owner-bound compositor.** RunSupervisionOwner.observeSnapshot(expected, capturedAt, stateDir?) now composes within the retained owner instead of accepting caller-authored timing/reference DTOs. It requires the exact retained identity/root/lifetime, consumes this owner's original admitted reference reader, then calls the shared readRunSnapshotFacts with this owner's original observeTime and observeFrozenNaturalTime methods. Missing reference permission or null cwd refuses a full snapshot before active process/time admission. The canonical fact owner retains its three-argument probe-free default; composition is an explicit active opt-in, not a second lifecycle classifier. Natural done/failed never calls live observation; only an original previously frozen first-natural fact may supply duration, otherwise timing_unproven remains explicit.

Both reference and canonical/time observations plus local owner retention are fenced before and after projectRunSnapshot. The pure projector receives an explicit allowlist: canonical identity/captured_at/lifecycle/timing, but cwd and optional index only from the original reference capability. Raw live metadata paths, actor visibility/elapsed/status flags and source-reading availability cannot bypass privacy or create a healthy card. Unavailable/redacted index remains evidence:null with index_unavailable, not a fabricated usable path; missing/withheld cwd fails boundedly. Final payload uses the existing16-KiB encoded snapshot bound with no path/identity clipping. Malformed canonical metadata can still refuse observation; original reference permission is not permission to repair or override corrupted evidence.

This observation is readonly, not pure: supported active captured-PID proof is checked around the original monotonic sample, which may advance shared clock/fault facts. It does not claim/start a controller, schedule, notify, mutate, follow a role/target body, export/repair, ACK or gain native closure/work authority. Reference withholding does not erase the canonical fact owner's separate bounded index-metadata read: the two admissions may each open readable role descriptors for metadata, never role bytes. One shared canonical natural-result snapshot supplies classification. A shared local revocation helper rechecks stop/release/close after frame IO so reentrancy cannot hide local revocation. Returned unchanged() fences retained/file/time-binding observations without resampling clocks or native liveness; a process may exit later while unchanged canonical files leave that fence true. Fresh liveness requires a fresh observation. No multi-file transaction, global immutability or whole-scope closure is asserted.

Five new properties cover literal running/stopping/matching-stop captures with original timing/references; available/lost/private index and denied cwd/legacy permission; unknown process proof/clock faults/natural timing refusal; interleaved natural/stop/index publication, local revocation and late native-loss rejection; and no-mutation/no-role-byte access with one natural-result read. Positive units use the captured supported harness PID, not native owned-scope membership. The existing real gated launch additionally gets a composed active snapshot while work is running, then timing_unproven after natural0 and fresh runner/workload ESRCH. Unsupported captured proof stays explicit. Ordinary detached-runner frozen timing, actual default coordinator/supervisor lifetime and public/source/packed snapshot acceptance remain open; no public/default switch is enabled. Shared pure rendering is described below.

**Shared pure snapshot renderer.** `renderRunSnapshot(value, format = "text")` in `tools-response.ts` now formats already-admitted payloads, without reading evidence, role/target bodies, clocks, processes, owner change callbacks or lifecycle/delivery state. Own allowlisted data fields and scalar/schema checks prevent getters, input serialization hooks, unknown statuses and malformed references from becoming output; they do not grant source privacy, timing, lifecycle or body authority. Extra result/values/visibility/toJSON fields are never copied or invoked. The caller must obtain its snapshot from the real admission/composition owners, not treat a valid DTO as a capability.

The text direction is status-first: Run, literal state/optional stopping phase and exact elapsed ms, followed by complete generation, canonical captured_at, launch cwd and index reference. Generation/cwd/evidence use separately labelled literal code blocks, protecting opaque multiline identities and full references rather than collapsing whitespace or rewriting backticks. The existing dynamic literal-block primitive is now shared with immutable completion rendering, preserving its byte output rather than creating a second escape policy. Unavailable evidence is visibly index_unavailable, never an invented path, scan instruction or unconditional Inspect next action. No health, progress, native closure or terminal-timing claim is added by formatting.

Explicit JSON format emits compact lossless JSON of the same curated fields, with no extra logs/body/detail map; every payload within the existing16-KiB JSON bound fits that format without a separate pretty-print allowance. Text output has its own complete UTF-8 encoded16-KiB row ceiling under the same shared delivery budget. Fence amplification or oversized data refuses the whole view rather than clipping tracked identities/paths or silently selecting another format. An explicit JSON request can recover a valid payload whose literal text fencing would overflow; there is no implicit fallback. Invalid scalar/control data refuses rather than normalizing it into a different identity/reference; ordinary CRLF/tab whitespace in generation, BOM, genuine U+FFFD, Unicode and backticks remain literal. Tool leading spacing, transport envelopes and combined packets still need their own shared-budget accounting, never an extra allowance.

Five properties cover status-first text/JSON parity, literal field boundaries/Unicode, explicit unavailable index and invalid shape/refusal, no getters/serialization/IO/process/time effects or input mutation, and exact UTF-8 limits including text-fence amplification and explicit JSON recovery. Synthetic done/failed fixtures exercise formatting only, not frozen-terminal timing acceptance. The real gated source launch formats its already admitted running snapshot in both modes; no public tool route or manual/timed delivery path is switched. Literal Markdown bytes and golden tests do not prove phone/TUI visual behavior: final narrow/wide host rendering and public/source/packed snapshot acceptance remain gated.

The planned payload contains only these fields, plus optional `phase: "stopping"` or the bounded `evidence_error` code under the conditions below:

```json
{
  "kind": "run_snapshot",
  "run": "review",
  "run_instance_id": "<opaque generation>",
  "captured_at": "<ISO timestamp>",
  "elapsed_ms": 250000,
  "status": "running",
  "cwd": "~/work/project",
  "evidence": "~/.pi/agent/tmp/pi-actors/runs/review/context-index.json"
}
```

`cwd` is the captured Run launch working directory, not the coordinator's later directory or a guessed current leaf-command directory. `evidence` points to the readable owned context index defined below, not merely a directory that the agent must scan. Both are curated operational references; prefer readable home-relative paths, preserve authorized exact references when needed, and do not disclose private Skill installation paths, secrets, environment dumps, or unrelated machine-local paths. Operational references must not bypass redaction: export evidence to an authorized readable location rather than revealing private provenance. Paths alone confer no authority.

`elapsed_ms` is nonnegative duration at `captured_at` while active and freezes at confirmed terminal duration after completion. Manual inspection can return any truthful current Run status; the timer admits only currently nonterminal snapshots. `running` describes verified execution state, not health or progress. Unknown identity fails boundedly rather than producing an invented healthy snapshot. If the generation is valid but its index is unavailable, return `evidence: null` with the bounded code `evidence_error: "index_unavailable"`; do not publish a nonexistent path or create exports as an inspection side effect.

### Compact Manual Inspect API

Add a Run-only `status` view and make it the default when `view` is omitted:

```json
{"target":"run:review"}
```

`inspect target=run:review view=status` is equivalent. Compact text is the default; `verbose: true` returns the same bounded snapshot as JSON, not extra logs or a complete raw Run dump in content/details. Snapshot view rejects inapplicable `lines`, `source`, `identity`, and runtime inventory `status` filters instead of silently ignoring them. Other target families still require their existing explicit views. Existing explicit expert Run views remain available in this increment; they are not the ordinary status path and must not be invoked automatically to expand a compact snapshot.

Snapshot inspection is read-only: it cannot reset clocks, change report eligibility, acknowledge a pending automatic diagnostic/completion, signal processes, scan directories, or load role bodies beyond bounded identity/index metadata. The payload is refreshed for the manual call; equality with a timed report means the same schema and authoritative facts at the same observation, not reuse of a stale cached heartbeat. Manual responses remain ordinary tool evidence; latest-only folding applies to the separate automatic diagnostic stream, not to arbitrary tool results.

### Readable Context Index

#### Same-session File Investigation

**Accepted owner decision; explicit verbose runtime inventory now implements a bounded read-side subset.** A2 is a navigation contract, not recovery of an original-producer capability. Kernel shows the owning logical Pi session where to start reading its Run files; the agent investigates selectively through ordinary file tools.

- **Session boundary:** Bind the actual active logical Pi session from trusted Pi context to Kernel Run ownership and exact generation/root. Resume of the same saved session after restart remains the same research scope, even with a new process/sessionManager. Another logical session, including new/forked/cloned sessions, does not inherit it from copied history or paths. Actor text, a supplied owner-id DTO, a session name/Telegram thread or a matching hash is not that binding.
- **Root-first priority:** Start with the owned root Run and its index/result; then offer relevant failed/child results and selected execution, Trace, Control, capture/log or published-session files. Use Kernel-known locations and existing admitted delivery lineage, not arbitrary actor-declared paths. A child link does not grant another session's scope. No recursive directory walk, global search or full transcript load is required.
- **Dual priority orders, adopted refinement:** Support both user-selected directions through existing inspection intent, not a new tool/schema or default route. Ordinary explicit verbose maps keep independent root groups latest-registration-first; known failed descendant subtrees precede other siblings inside each root. Existing status=failed verbose investigation additionally puts failure-containing root subtrees first. Stable peer recency breaks ties and every ancestor remains before its descendants. Inventory filtering never filters navigation or rewrites catalog order. Reuse only already observed failed inventory identities matching the independently admitted map's full owner/run/generation/directory; unknown, missing, foreign or unmatched observations remain unranked rather than certified successful. Propagate priority only through available exact same-session ancestors. Report priority.root_order=latest_registration|failed_subtrees_first and priority.basis=observed_failed_rows, not complete/current terminal or membership truth. No additional status/body/native observations, callbacks, catalog repair, new registry or default/automatic map activation are authorized for ranking.
- **Ordinary reads:** Same-session permission is sufficient for investigating those owned files. Missing original producer/publication keys, producer exit or a replaced manager do not block fresh detached or retained/legacy-file research in that same logical session. Do not require a per-file capability registry, custom role/range reader or mandatory derived export for every ordinary file read; use ordinary tool offset/range support.
- **Honest navigation:** Preserve exact usable locations and containment/symlink checks; show pending/missing/unavailable/compacted evidence and known format/size/coverage honestly. The explicit map labels file_inventory_scope=canonical_starting_locations and per-file format_hint=json/jsonl/text, including missing/unavailable locations. These are layout hints, never syntax/UTF-8 validation or complete primary-output proof, and shown/omitted/total count Run rows rather than all files. Unknown/foreign ownership cannot be repaired from a path/hash/label. Deliver compact starting points and prioritized links, not all bodies. A later file read is a current observation, not a frozen multi-file snapshot.
- **No hidden effects or transfer:** Map/read operations must not export/refresh/repair evidence, re-admit a producer, probe native liveness, start work, dispatch Control, reconstruct/sample timing or ACK delivery. New navigation deliveries recheck the actual current logical session. Preserve accepted history and immutable packet/acceptance semantics; do not replay them into another session.
- **Separate stronger claims:** Reading a raw file does not certify original privacy, primary completeness, historical issuer, terminal truth or native closure. Existing curated automatic previews, publishers and private five-role verifiers retain their original-data/privacy/binding contracts, but are not the access gateway for this research route. No global legacy fail-closed, durable original-admission recovery or mandatory original-capability handoff is adopted.
- **Scope:** This is navigation/read permission, not an OS filesystem sandbox, public sharing, work/native authority, clock continuity, controller takeover or automatic Run resumption. Existing user/tool filesystem permissions are unchanged. The original sessionManager epoch remains part of its live supervision contract, not logical-session research ownership.

This decision supersedes the former original ordinary-read/lifetime gate for file investigation. The explicit manual subset below has source/npm-packed SDK tool-adapter restart/read evidence using both controlled metadata and genuine producer-exit/new-process research. The explicit-manual detail/priority subset has representative acceptance; the approved compact/outcome request handoff below extends discovery of that same existing route, not original-capability recovery or an open-ended fixture matrix. **A2 status correction after owner feedback:** a request-only inspect command is a useful implemented discovery aid, not completion of integrated file-navigation handoff. The subsequent actual-reference implementation and joint source/npm SDK evidence below now satisfy A2's representative navigation exit: exact-generation launch/terminal locations, current-recipient/session admission, shared-budget omission and ordinary selective reads. This closes navigation only, not snapshot/timing, stronger curated publication/privacy, native authority or the release. Preserve the request-only feature and legacy text stability; do not promote its green tests to whole-A2 or release acceptance. No snapshot/reporting, clock/native authority or release activation follows.

#### Selected-Run Launch Locations

**Implemented; representative integrated A2 acceptance is recorded below.** Public spawn and async-tools now add `file_navigation` from the existing runs-index location owner, independently of catalog registration health. Only the actual current logical-session id can select the supplied Run/generation; foreign/missing session is rejected before filesystem observations, and tools-access rechecks the recipient after them. Exact owned directory/metadata/marker identity and final unchanged fences precede return. The row exposes the same nine canonical physical starting slots and format/size/mutability hints, not bodies, a complete tree, primary/privacy/terminal proof or a read capability. A changed generation, session or observation returns explicit unavailability; an ancillary navigation failure cannot undo or fail an already committed launch.

Compact receipts render one complete nested YAML location row inside the remaining 16-KiB card allowance including response spacing, or label whole-row omission. The earlier literal-JSON SDK evidence below is retained history; fresh compact-YAML SDK acceptance is not inferred from it. They never cut a path. If legacy optional receipt fields exhaust even the omission allowance, the card labels their omission and retains complete bounded core facts when they fit; expert details stay intact. This does not reformat old completion packets or alter their absent/current_session_request markers. The existing optional full-map request remains a separate research aid. No catalog read/repair, recursive scan, source-body read, producer reconstruction, clock sampling, work/Control/native actuation or periodic reporting is added. Source/npm public-launch SDK evidence checks actual exact-generation references through compact/verbose tool transport across existing workload cases. Two existing actual-entrypoint research journeys per layout now select a metadata path directly from saved launch ToolResult content, before their fresh map request, then perform an actual SDK read with offset=1/limit=2000. One receipt is the real public bare spawn; one is the real dynamic SDK async-tool from the existing controlled Kernel composition whose catalog registration was deliberately refused. Both are same-saved-session research in a new process after captured producer host/runner/workload absence, without original producer keys or catalog backfill. Parent checks the actual read arguments, full generation/directory/session/header and a parsed-JSON digest against independently retained strict-UTF8 metadata; the digest is JSON-semantic equality, not an original raw-body/privacy/publication certificate. Existing four fork/clone journeys preserve those location bytes as history, keep fresh maps empty and perform no metadata selection. No workload, host, journey or source-snapshot is added: genuine composition remains20Runs/42SDKjourneys across source/npm, now with4additional ordinary metadata reads alongside the prior28result/26capture/2bounded Actor-session-row reads and103known-file snapshots per layout. Terminal-packet reference composition is implemented below; joint selective research acceptance remains open. Unit tests mirror runs-index/tools-access and use the existing cross-tool contract exception for response wiring.

#### Terminal Location Snapshots

**Implemented; representative joint selective-read acceptance is recorded below.** Fresh UI completion admission reads the existing per-Run location observer before any journal lock, selects only the actual current logical session and exact member generation, rechecks that recipient before admission and before fresh delivery, and captures a whole-row prefix bounded by16KiB. It orders captured roots before descendants and observed failed child-subtrees before peer children, preserving root/input peer order rather than claiming catalog recency or complete/current failure truth. Only captured completion members participate, never a session-wide or native membership tree. Unavailable/foreign/changed ownership remains pathless; already observed full-tuple ownership is filtered before extra navigation identity/slot probes, including foreign-session children whose outcomes may legitimately reach the root. Delivery permission never broadens file-research ownership. A source observation failure records bounded unavailability. No evidence-body/native/time/Control/work/repair/export operation is introduced.

New batches with those rows use navigation_handoff=captured_file_locations and file_navigation entries keyed by immutable member indices. The existing runs-index owner supplies pure strict layout/path/schema decoding; this does not reconstruct ownership, source visibility, publication, privacy or controller authority. Run-delivery curates/copies/deep-freezes the rows, validates full member/run/generation/directory correspondence, fixed-role paths and the snapshot bound, and leaves source/result/catalog/delivery effects separate. Existing1MiBjournal limits and explicit admission failures remain, with no hidden trim/retry/rollback guarantee. Complete-member overflow inventories still exclude private locations; they are not a second navigation catalog.

Location snapshots retain their16KiB bound; fresh model messages now share48KiB/64outcome rows (retained formats keep16KiB): its terminal rows get precedence, then full literal navigation rows fit into the remaining shared allowance. Separate navigation shown/omitted/total counts are Run observations, including unavailable rows and uncaptured suffixes, not a file count or atomic multi-file snapshot. Paths/rows are never partially cut. Reload, pending/queued/presented transitions and rendering perform no source/native/time reads and never refresh availability. Old absent/current_session_request formatting versions keep their exact earlier text; no marker upgrade is inferred from a DTO or old journal. Source/npm completion-boundary SDK cases now see and verify actual terminal reference identity/counts alongside existing primary/artifact/diagnostic/overflow and frozen source-loss evidence. Unit tests mirror runs-index/run-delivery/run-ui-runtime, including source loss after admission, recipient replacement during observation, strict decoding, copied/frozen data, shared-byte omission and both older formats. The existing tools-mode SDK journey now makes one explicitly requested ordinary read of result.json selected directly from the terminal location block, not a guessed path or inspect reply. Actual tool_execution_start arguments are path/offset=1/limit=2000; the next model turn verifies canonical natural0/generation and byte-identical reuse of the frozen terminal message. Parent independently checks the captured Run tuple, metadata owner, strict-UTF8/size/line bounds and parsed-JSON digest, preserving raw Buffer/base64 stdout/stderr, actual close and a positive host frame before decode. Fresh captured host/runner ESRCH precedes successful cleanup; failures retain evidence and exact causes. No new workload/mode/host is added: only this existing mode gains one research tool round (requests2→3), while all others perform no read. Together with the launch metadata research, same-saved-session restart, four fork/clone histories, live replacement, actual Role/capture/session reads and bounded/unit legacy/source-loss evidence, this satisfies representative integrated A2 navigation acceptance. It is not a raw-body/original-publication/privacy, exhaustive native closure or integrated release certificate; reporting, clock/native authority and D remain separate.

#### Shared Run-directory Catalog

**Accepted refinement; shared writer and explicit verbose read-side navigation implemented.** Reuse the existing `<configured-run-root>/index.json` and its `runs-index.ts` owner (default `~/.pi/agent/tmp/pi-actors/runs/index.json`). Do not introduce a second registry or independently written mirror. This shared catalog locates Run directories; each Run's `context-index.json` separately maps its semantic evidence roles.

- **Logical contents:** Logical Pi session → concrete Run → ordered unique real directory entries, each with `state_dir` and `run_instance_id`. Use actual Kernel-admitted Run locations/generations, including already supported explicit state directories, not arbitrary artifact paths or unpublished prepare-only state. The compatible flat entries representation is retained; private registration is implemented without a new public tool/schema. Explicit runtime/runs verbose navigation selects one trusted session branch; common launch/compatible-attachment registration is wired, while automatic map handoffs remain open.
- **Ordered-set semantics:** The most recently registered directory is first. Re-registration updates/moves its one entry rather than duplicating the directory; reuse updates the actual generation rather than retaining two historical results at one overwritten location. Reuse existing admitted path-identity rules, not a new alias/normalization scheme. Reads and status observations do not touch registration order. Order follows serialized successful registrations, not wall clocks, progress timestamps or FIFO lock-wait fairness. Recency does not override root-first investigation.
- **Concurrent publication:** Every cooperative writer of this file, including rebuild/maintenance, participates in the same destination-path lock. Acquire → reread current JSON under lock → merge the affected session/Run registration while preserving unrelated data → atomic replace through a sibling temporary file → release. Never publish a stale in-memory whole-file/session snapshot. Reuse existing file-state lock/atomic-write primitives; keep the critical section to catalog I/O, never awaited work/model calls. This must also preserve different Run updates if two processes happen to use the same logical session.
- **Failure boundaries:** Locking prevents cooperative lost updates; atomic replacement prevents readers seeing half-written JSON. Do not turn corrupt/unreadable existing data into an empty catalog and erase other sessions. A genuinely absent first catalog may be initialized; failed reads/writes/releases retain their actual errors/committed effects. Catalog publication is separate from Run launch/result truth: no rollback, rerun or invented terminal result follows from index failure. No fsync/power-loss, multi-file transaction or safety against writers bypassing the lock is claimed.
- **Session-only projection:** Kernel reads the shared catalog and issues only the actual current logical session's eligible branch, rechecking existing ownership and exact Run/generation/root. Do not advertise the whole multi-session JSON as the agent's starting map. Keep compact output/omission truth, existing lineage and ordinary same-session file access; catalog rows themselves grant neither another session's scope nor work/native authority. Ordinary navigation remains readonly, without the legacy discovery/rebuild-on-read fallback.
- **No layout/history decision:** This contract does not move files, introduce session/generation subdirectories, change Run-id namespace/defaults or bypass existing lifecycle/replacement serialization. A shared JSON lock does not solve two Runs addressing the same physical directory. Register what really exists and refuse stale/mismatched observations; multiple retained generations require actually retained distinct directories. Latest-first is not automatic rotation, eviction, deletion or a promise of history that was overwritten or never saved.

**Implemented observed-failure ordering boundary.** runs-index.ts remains the sole topology/projection owner. Its optional RunNavigationPriority is internal ordering data, not an ownership/producer capability: readonly root_order and failed identity rows. Independently admit every catalog row as before, match failures only to available exact owner/run/generation/directory nodes, propagate through available parent nodes with a bounded visited-set queue, then stable-partition peers for DFS. Root order is conditional; child subtrees always honor matched known failures. Cycles still return unavailable/pathless rows and changed source frames refuse the map. Existing16-KiB whole-row clipping includes the immutable priority annotation. tools-inspect.ts composes this only for its existing explicit verbose map from successful current status-observer returns, copying failure identities before later metadata observation. A failed current observation may retain the pre-existing injected inventory fallback but cannot turn that cached row into a ranking fact. No extra status call is introduced, cached catalog status is never consumed and caller-supplied root_order has no tool input authority. A status-filtered observation set may be partial; unmatched/unknown nodes retain recency and no failure/terminal fact is fabricated. Standalone two-argument navigation keeps its existing data-only ordering, with no inferred failure facts or default activation.

**Real-entrypoint controlled priority and whole-row omission acceptance.** The existing source/npm SDK navigation fixture retains its initial/resumed controlled-preview hosts and isolated priority host, with no Actor workloads. The original six controlled directories still exercise parent→child→failed-grandchild, a newer healthy sibling, a newer independent root and a foreign owner; both five-row orders/depths and explicit latest-root versus failed-grandchild result selection remain checked. The same priority host now adds20controlled directories for a separately saved budget-owner session: parent/child/failed-grandchild/healthy plus16newer roots. Four real SDK entrypoint journeys create/reopen the two owning saved sessions. All-status budget inventory has20rows; failed inventory has only the grandchild, while both navigation maps retain total20 and honestly omit a whole-row suffix under16KiB. Ordinary root recency and failed-subtree-first order yield exact shown prefixes/depths, always ancestors before shown descendants. Every shown row retains all nine canonical file slots, exact generation/directory, complete usable paths and independently checked physical sizes. Parent reconstructs the first omitted row from declared layout and captured metadata/result bytes without calling the Kernel reader/budget implementation; appending that exact whole row with updated counts exceeds16KiB. Real read-start ledgers are exactly Skill/selected shown result for all four journeys, never omitted-result bodies; inventory metadata may still locate omitted Runs, so omission is not filesystem denial or erased history. Source/npm loader/tool ownership, no competing inspect, actual saved headers/startup/shutdown managers and errors after awaited disposal remain checked. All157declared catalog/metadata/result/absence snapshots per layout match after research and are independently rechecked by parent, including controlled foreign files outside model reads. pid0/running metadata and legacy code0/7 files remain controlled layout, not native births, canonical natural results or genuine Actor-child provenance. Three parent-captured hosts/layout retain complete raw Buffer/base64 stdout/stderr and actual close; final fresh ESRCH for all three immediately precedes successful deletion, and failures retain evidence. Across both layouts this controlled class has six hosts,16SDK journeys,14ordinary result reads and the preserved four catalog/four selected-preview reads. Counts are not added to genuine Run/private-publisher compositions. No new production owner/interface, budget change, default map delivery, primary/privacy or native/clock authority is introduced.

**Implemented private writer boundary.** registerRunStateDirectory in runs-index.ts admits the actual directory and exact Run/generation/optional owner through the existing bounded readRunContextIdentity observation, not a producer capability or String-coerced status DTO. It copies only index metadata, checks the source frame after lock acquisition and again immediately before atomic rename, and refuses source changes without rewriting the prior catalog. Rebuild prepares discovery/full-status observations outside the lock and publishes through that same fresh-merge owner. Explicit registrations move to the front; rebuild refreshes for the same generation preserve position. Reused directories replace their old generation/owner rather than manufacturing retained history. Unknown unrelated catalog data and external directory registrations survive the merge.

Legacy inventory treats either the shared catalog or fallback discovery as directory candidates, then asks the existing getRunStatus owner for current observations before display/filtering. Registration-time status cannot hide a newly done/failed Run or keep a no-longer-running Run active. Failed observations are omitted under the existing degraded-inventory convention, not replaced by cached status; healthy candidates remain independent. Full status callbacks stay outside the catalog lock and never write/reorder registrations. This existing legacy path may scan/probe; it is not the scan/probe-free navigation reader or new terminal/native authority.

Strict mutation reads require regular files and complete valid UTF-8/JSON with compatible entries. Only actual ENOENT initializes absence; malformed/unreadable data is not an empty catalog. Read/write errors and actually committed post-rename bytes survive; reported primary/release failures are retained together. Legacy listRuns fallback now computes inventory in memory without rebuilding or repairing the file. Its regression retains the inventory result but asserts the corrupt bytes remain unchanged. This does not remove the older expert discovery/completeness checks or turn that reader into the separate scan-free session-map route.

Archive/prune still mutate directories, not this index. Archived metadata may retain its original state_dir; new registration checks actual directory/marker/metadata correspondence rather than adopting that stale claim or repairing archived fields/first bindings. Layout, retention redesign and model delivery remain outside this writer owner; the separate common-launch caller below now invokes its registration contract.

Seven new writer property families in tests/runs-index.test.ts cover generation/identity/unpublished refusal, latest-first deduplication and reuse, same-generation status-order preservation, corrupt/invalid-UTF8/nonregular input, exact pre/post-rename and read errors, and source fences after fresh read/before rename. Four deterministic two-host cases exercise different-session and same-session/different-Run register/register and register/partial-rebuild contention through the real owner, preserving an external registration and a controlled parent edit made under lock after both contenders block. These are eight metadata-only fixture hosts and zero Actor workloads, not SDK/model delivery or terminal/native truth. Parent evidence captures upfront exact PID/frames, full stdio/actual close and saved identities; fresh captured-PID ESRCH precedes successful deletion, while failed/uncertain evidence is retained. Generic lock tests and the exact legacy inventory/archive/prune regressions remain separate supporting evidence.

**Implemented common launch-registration boundary.** Public spawn, registered async tools and automatic review share startRun. After the internal launch/attachment returns through successful lifecycle release, this wrapper invokes the existing metadata-only shared writer. Explicit compatible singleton attachment re-registers the same generation and may move its existing directory first, but creates no new work, clock anchor or generation. Prepare-only descendants call the internal path separately and remain excluded. Ordinary launch/preparation failure reaches no catalog publication.

Success keeps existing receipt fields. Catalog failure preserves the accepted launch/attachment and all prior or post-rename committed effects without retry, rollback, synthetic result or Trace rewrite. It adds only the safe launch-return observation catalog_registration={state:"unavailable",reason:"catalog_registration_failed"} and compact catalog=unavailable. The original error, including AggregateError identity/causes, remains on the direct Kernel return as a non-enumerable catalog_registration_error; it is not written into run.json or propagated into public tool details/JSON. Spawn already copies metadata; async-tool details now do so explicitly, preventing even a non-enumerable private cause from crossing that boundary. This is an incomplete attempt, not a claim that no bytes committed or that the catalog will remain unreadable. Flags/DTOs grant no navigation, producer or work authority.

Tests cover corruption, exact read/AggregateError, pre/post-rename failure, lifecycle-before-catalog ordering, no extra spawn/result/handled effects, source metadata immutability and private-cause nonserialization through a controlled no-native-birth port. Existing real singleton checks retain generation/clock and one registration; prepare-only tests retain unchanged catalog bytes.

Standard test/preservation/conformance processes preload a fresh default agent directory before product imports, overriding even an operator-configured agent path. Those directories are retained, not removed on test-runner exit alone. The existing real source/npm-packed coordinator fixture now saves an upfront fixture-host frame before Kernel imports, exact owner-bearing runner/workload frames at observation, and parent-captured host PID plus raw Buffer/base64 stdout/stderr and actual close before normalization. Parent checks saved frames against actual metadata, requires complete capture and fresh ESRCH for both the fixture host and all 23 controlled runner/workload PIDs per layout immediately before successful deletion, and retains any primary/persistence/closure failure. The actual source/npm-packed SDK spawn journey now verifies its exact session/Run/generation directory was registered. The registered async-tool journey explicitly corrupts the catalog before launch and verifies a safe warning, unchanged corrupt bytes and no private cause in public details, while the genuine workload still finishes naturally with code0. Explicit fixture restoration is not product repair/retry. A third finite public-spawn Run deliberately writes distinct stdout/stderr and exits with code7; canonical natural code7 and the single recorded attempt's native code7 are checked independently. It registers normally, without replacing either successful workload witness. A fourth public-spawn Run uses the established retry=2 command-leaf syntax: a real first workload exits7 and a second exits0, while canonical root acceptance remains natural0. Each workload writes its own PID/attempt readiness file before asynchronous work; the holder captures and persists that exact birth before releasing its per-attempt fixture gate. Parent checks both readiness files against captured Run/generation/owner/member frames and original stdout/stderr evidence. A fifth Run uses the existing two-command sequence template, not a child process hidden inside one leaf; each actual command workload emits its own PID/command/attempt readiness before asynchronous work, is captured before its fixture gate is released, and finishes native0. Both distinct recorded command IDs and natural root0 are checked. This is controlled finite command composition, not new native membership authority. A sixth public spawn uses the SDK-loaded real source/npm entrypoint rather than the private runtime wrapper: actual loaded metadata owns spawn/lifecycle without a competing provider, the active Actors Skill is ordinary-read before spawn, and both SDK tool start/end pairs are recorded. A transparent start-scoped native-birth observer captures/persists the actual runner before assertions/await and immediately restores the builtin spawn binding, never replacing the public tool or root event wiring. Receipt PID/generation/owner/root/launch-kind match the actual runner and automatic shared-catalog registration. Its distinct finite SDK entrypoint launch fixture stdout and natural/native0 are checked; no private supervision observer is installed. A seventh real public spawn uses the established parallel:true/two-command template through the same actual entrypoint. Before either fixture gate is released, both commands' actual PID/command/attempt readiness is captured/persisted, both gates are observed missing with ENOENT-only absence and both native PIDs return successful liveness probes. The saved overlap witness is historical controlled process evidence, not authenticated/exhaustive native membership. Both gates are then released and both recorded/native command exits and canonical root acceptance are0. Distinct stdout and first/second stderr markers prevent stream/command substitution. An eighth genuine public parallel Run uses existing default soft-quorum behavior with command1/native7 and empty stdout plus command2/native0 and nonempty stdout. It shares the same real entrypoint/Skill/public spawn and two-actual-birth/unreleased-gate/live-probe witness, not a new failure-policy API. Fixture command plans now separate per-command attempt codes from independently expected root code; all previous uniform plans stay unchanged. Both actual commands are captured before gate release, recorded command statuses remain failed/done and canonical root acceptance is natural0. Parent separately verifies command/native codes [7,0], root0, first-command stdout physically empty and peer stdout present; it never promotes branch failure into root failure. A ninth genuine public parallel Run explicitly uses the existing failure:"branch" syntax from the all-unusable execution contract. Both actual command/native codes are7, both stdout captures empty and both command statuses failed; canonical natural root7 separately records failure_reason all_branches_unusable and soft_quorum {coverage:0,degraded:true,done:0,expected:2,failed:2,usable:false}. Existing execution preserves the first failed branch code and the runner preserves error-details code; no synthetic root1 or default parallel failure policy is invented. Gate/birth/live-probe/receipt evidence is the same as for the other real parallel workloads, not fabricated metadata. Root acceptance and command/native codes remain distinct from detached-runner process exit. All four public launches retain separate actual loader/tool-event/receipt witnesses. A loader retaining a prior temporary spawn wrapper exposed fixture misattribution on the second launch; one stable delegate now captures only its current explicitly armed tool-start target, clears it before evidence reads and restores builtin exports after birth/end/finally. Retained unarmed references merely delegate; original wrong frames/errors are retained, not rewritten or promoted. Parent compares both positive receipts/PIDs/run/generation/owner/root with actual metadata and automatically registered catalog rows. Private context/snapshot counters describe only the original five opt-in journeys, and real-entrypoint errors are checked after disposal. These launch-side checks prove launch/error isolation and actual failure provenance, not by themselves process-restart file research, exhaustive native scope closure or a clock carrier.

**Genuine producer-exit research acceptance.** The same source/npm-packed coordinator journey is now followed by a second Node process using the existing session-navigation SDK fixture. Before spawning it, the parent validates actual owner/generation/directory metadata and requires fresh ESRCH for the coordinator host plus its nine genuine runners and fourteen finite workloads. The new process opens the same saved Pi session, loads/reads the active Actors Skill, obtains navigation through actual SDK inspect/model context and uses ordinary read on the cataloged genuine result. It checks actual code0/natural and code7/natural metadata against the selected genuine generation without an original producer key or old manager; no clock origin, original privacy or work authority is reconstructed.

Each layout's reader first selects the successful cataloged Run and reads actual result/execution/recorded stdout (27 UTF-8 bytes). Separate journeys select natural-code7 stderr, the retried natural0 Run's failed attempt-001 stderr with attempt/native codes [7,0], and the two-command natural0 sequence's second-command/attempt-001 stderr with distinct first/second streams. Recorded command selection and attempt selection are independent: actual command ID/ordinal, attempt/code/native code, root result and saved bytes all correspond, without first-command, last-tail, stdout or root-failure substitution. Actual SDK read-start ledgers are exactly Skill/result/execution/selected-capture per positive journey; other capture bodies are not requested. Fixture path/type checks do not create a custom body gateway, original privacy certificate or OS sandbox. Done/failed inventory filters preserve all eight cataloged registrations; ordinary root groups remain latest-first/root-first, while explicit failed investigation stable-partitions the two observed failed root subtrees first without filtering the map; the async-tool code0 Run remains uncataloged without backfill. A new logical session and actual SDK fork/default-before and clone-equivalent fork-at-leaf preserve earlier accepted maps as stored/model-visible history but receive empty fresh owned inventory/navigation and no new mapped reads. SDK-created IDs/files/parentSession and copied source message IDs/content are checked; final original-session reopen still reads successful result/stdout. Upfront child/parent frames retain saved-session file and selected success/failure/retry/composition Run IDs before imports/services. These descriptors grant no authority. Per layout, catalog plus 91 selected Run metadata/result/execution/native/Trace/context-index/capture files or absences match before/after; Pi history may append. Raw Buffer/base64 streams/actual close/frames are checked before successful cleanup requires fresh ESRCH for all 25 captured hosts/member PIDs; uncertainty retains state. The earlier nine-Run-per-layout capture checkpoint had, across source/npm-packed, 18 genuine Runs, 18 runners, 28 finite workloads, two original coordinators/two fresh readers; 40 research journeys (16 direct-adapter and 24 real-entrypoint), 26 actual mapped-result reads (22 natural0/four natural7), 12 stdout/fourteen stderr reads. Counts exclude intermediate/reused invocations and separate controlled/private-publisher compositions. This closes representative successful, failed, retried, sequential, overlapping-parallel, degraded-parallel and explicit-branch all-unusable command ordinary capture research, not broader real-entrypoint launch/outcome/default handoff, remaining partial-composition/coverage edges, semantic priority, primary publication, original privacy, timing or native closure.

Twelve additional prompted reader journeys per layout now load the real extension through SDK additionalExtensionPaths: source index.ts and the npm package's declared pi.extensions entry (dist/pi-actors/index.js re-exporting the compiled root). Normal discovery remains disabled in the isolated agent directory, while the real entrypoint and operating Actors Skill are explicit; no copy of root event wiring or replacement inspect tool is installed for these journeys. SDK-observed loaded/resolved path, registered inspect owner, all six lifecycle handler registrations and absence of another inspect provider are persisted and checked, separately from the upfront planned entry path. Each layout saves fourteen actual loader witnesses: twelve prompted SDK session instances and two unprompted owning-session instances replaced by real SDK fork/clone. Three prompted phases share one live SDK runtime wrapper; loader/session-instance count is not distinct runtime-wrapper count. Actual startup/before-agent/context/turn/settled/shutdown run normally with zero captured extension errors, checked again after runtime disposal so SDK-normalized shutdown errors cannot hide behind a completed prompt. Owning saved-session research reads both second-command stderr and the newly real-entrypoint-launched result/execution/unique stdout through the real core tool; the fixture's separate logical session reopens its own saved header and receives no original owned branch, with Skill-only reads. Actual read-start ledgers remain exact and selected Run/catalog byte/absence snapshots match across the entire reader, including real lifecycle; this does not claim all runtime/temp/config filesystem state is untouched. The active Skill is loaded and ordinary-read in every prompted case, and no old manager/producer key/default map/reporting adoption is introduced. The additional actual-entrypoint parallel research journey selects the seventh Run's second recorded command/attempt001 stderr (finite SDK parallel second stderr 😀), not first-command stderr, either stdout, merged output or a last-tail fallback. Parent derives and checks exact command ID/ordinal/attempt/path/UTF8 size from actual execution.json and canonical natural0; no new primary publication permission follows from ordinary reading. A further real-entrypoint ordinary journey reads the degraded Run's recorded command1/attempt001 stderr (finite SDK degraded branch stderr 😀). It validates complete actual execution command/native codes [[7],[0]], exact selected command/attempt/code7 and root0 independently; current done inventory and natural root0 are not a fabricated fully successful command set or a failed root. Actual tool-read paths stay Skill/result/execution/selected stderr, with no peer/stdout capture-file read or last-tail fallback. Parent physical stdout checks are independent fixture validation, not model tool exposure; ordinary whole result reading retains its existing body semantics rather than certifying absence of legacy merged display data. A further actual-entrypoint journey selects the all-unusable Run's exact recorded command2/attempt001 stderr with code7/root7. It checks canonical cause and soft-quorum data independently of execution [[7],[7]] and recorded stream selection; both identical failed-command literals require exact command-ID/path/read-event correspondence, not a unique-text inference. Existing direct single-failure research remains selected on its original Run. Failed inventory now truthfully includes both current failed roots, while navigation retains all eight owned catalog rows in latest-registration/root-first order. Both source/npm reader paths now assert priority.root_order and observed_failed_rows basis; failed-mode expected order is unusable,failure,degraded,parallel,entrypoint,composition,retry,spawn, while ordinary order retains registration recency. This bounded observed-failure ordering is not a complete/current failure classification, inventory-status filtering of navigation or expanded primary/failure-body publication.

This proves explicit SDK research after actual producer/holder loss through both direct adapter and actual source/npm entrypoint. Bare-command and two-command parallel public launch/registration/result-to-read loops now use actual entrypoints on both ends. Additional real-entrypoint fork/default-before and clone-equivalent fork-at-leaf journeys preserve original accepted navigation in both saved and actual model history while their SDK-created new IDs receive empty fresh owned inventory/map and Skill-only reads. Observer-only SDK startup/shutdown hooks record actual session/header owner and manager correspondence without calling/replacing root handlers. Before replacement the old manager matches; trusted shutdown is observed with reason fork while that context is valid, then old ctx.sessionManager throws stale and the new startup manager is distinct and matches the new SDK ID. Parent verifies each real branched header/parentSession and copied source message IDs/content, not planned identity fields. Final actual-entrypoint reopen of the original saved file still reads the newly entrypoint-launched result/execution/unique stdout. All four copies per layout (two old direct-adapter and two real-entrypoint) remain data-only isolation witnesses: not OS read denial, original privacy recertification or clock/native continuity. An additional live runtime performs actual switchSession A→B→A using the original and existing foreign saved files. The same fixture research helper subscribes to each current SDK session's real read events and unsubscribes after that phase; no replacement tools/root wiring or body gateway is added. Factory frames persist actual loaded manager IDs/files/cwd before assertions/services await. Observer startup/shutdown records match the active manager and real file header; each transition emits shutdown reason resume while the old context is valid, then that context rejects sessionManager as stale and the next manager differs. B restores its own stored/model history with no original A navigation, receives empty fresh owned replies and reads only the active Skill. Returning A restores its accepted model map and ordinary result/execution/unique stdout reads through a new manager; the first A manager differs and its old context is explicitly reprobed to remain stale after the same logical ID returns, not merely while B is active. Parent binds all three actual headers/owner/cwd and exact tool ledgers; catalog/selected-Run snapshots remain unchanged while Pi history appends. These are same-cwd, read-only session-replacement witnesses with no active workloads: they neither fix nor certify legacy active-Run shutdown owner lookup, parent-stop/native closure, platform compatibility or original clock continuity. This does not complete broader launch/outcome/automatic handoffs, interactive TUI acceptance, exhaustive native scope closure, clock continuity or retrospective original curated-body certification. Legacy inventory/status retains its separately documented body/probe behavior; the map remains metadata-only.

**Implemented explicit read-side boundary.** readRunSessionNavigation filters catalog rows by actual session before directory observations, reuses bounded readRunContextIdentity ownership/generation/root fences, reads bounded run.json lineage and stats eight canonical locations plus the known published-session catalog without evidence bodies, scans or native probes. Exact same-session parent links order roots before children; foreign parents are not followed, cycles expose no directory, and this is not a complete descendant tree. Current-source changes refuse the observation. Whole-row omission preserves complete paths and explicit counts under an independent 16-KiB map bound. No retained producer/publication key or old manager is consulted.

The published_sessions starting link uses observeRunContextExportLocation in the existing runs-context-index owner. It resolves only the fixed compiler role through runContextExportPath, independently admits exact Run/generation/root/owner, stats the real evidence directory and regular leaf without opening/reading the role body or semantic index, and retains owner/parent/leaf change checks through final map return. Missing parents/leaves are missing; symlinks/nonregular/unrepresentable locations stay unavailable without usable paths. A changed available role fence refuses the map. Semantic-index absence/corruption/foreign generation or pending/unavailable/publication flags cannot become an original-producer gate for ordinary physical-file research. Presence is not role-schema/body-generation, privacy, historical-publication or completeness certification. The private issuer/body/privacy/publication requirements remain separate and unchanged. Their shared directory-change predicate now also rechecks real-directory/non-symlink type rather than relying on dev/ino agreement alone; a deterministic reused-id/changed-type metadata counterexample failed before this correction. This is a checked-boundary witness, not a reproduced public OS escape. No raw-session scan, eager nested preview read or arbitrary reference follow is introduced.

Only inspect target=runtime view=runs verbose=true adds this map. The adapter obtains and rechecks the real current Pi session; caller owner fields do not select it. Missing/corrupt catalogs return explicit catalog_unavailable while preserving catalog bytes and independent legacy inventory. Compact/default/automatic map delivery remains unchanged; the separate launch-registration effect above is now active. Legacy inventory/status keeps its separate scans/probes; the new map itself performs neither. Source/npm-packed SDK tool-adapter fixtures load/read the active Actors Skill, receive the map in model context and use ordinary read on its first result. A second captured host opens the same saved session after the first host closes and is freshly ESRCH-confirmed; a new session sees only its own branch, and corruption remains unavailable without repair. Two layouts use four fixture hosts, eight SDK journeys, six ordinary mapped-result reads, four ordinary controlled session-catalog reads and four selected controlled-preview reads, with zero Actor workloads or original producer keys. The fixture catalog and two preview files follow the existing publication layouts but contain explicit controlled assistant-text markers; they are not real publisher/issuer output. Each positive journey selects only the first available preview through its known contained relative path, checks the saved Run/generation/command/id and partial coverage, compares exact UTF-8 byte count and Unicode point/count/omission data, and keeps primary_text=not_exported and history_complete=false as recorded labels rather than certification. Real SDK read-start events match the expected exact path sequence; no unselected preview/raw Actor transcript is requested, and its body marker stays out of model context. Parent validation reads both fixture preview files only to compare snapshots and metadata; catalog/selected/unselected bytes remain unchanged and the semantic index stays absent. This proves a controlled-layout ordinary selected-read journey, not original privacy/publication, source clipping behavior or a filesystem sandbox. The fixture deliberately retains running registration/metadata status while recording controlled code0/code7 results; done/failed inventory filters must use the current status owner in both indexed and corrupt-index fallback paths, without changing catalog bytes. Metadata directories/results are controlled fixtures, not genuine launched Runs or producer-exit/terminal/native truth. Parent/child frames, full stdio/actual close and fresh ESRCH before successful deletion are checked; failures retain state.

**Private-publication saved-session handoff and restart acceptance.** The existing source/npm-packed context-private-evidence fixture now creates a real saved SDK SessionManager identity before Kernel producer admission, persists its actual id/file/cwd before assertions/conversation writes, and stores one explicit controlled bootstrap user message. This is not an original prompted AgentSession/Actor workload. Its already exercised genuine private session writer publishes the existing controlled recorded-session preview; the fixture immediately retains catalog/preview id/path/byte/SHA-256 data bound to its captured producer frame and checks unchanged bytes after later privacy/index-refusal cases. Those data cannot recreate issuer/privacy/native authority. It explicitly registers that exact metadata root before exit with cached status=unknown (not work/native truth), and confirms one visible starting-map row even with the existing long generation. This is fixture preparation, not ordinary read backfill or a real public Run launch. Parent capture now writes the exact positive producer frame before assertions/await and stores Buffer/base64 stdout/stderr plus actual close/completeness as context-private-stdio-v2 before decoding. It checks parent/child/raw frames, real main/ten case metadata files, saved SDK header/message, catalog row and published file hashes before fresh captured-host ESRCH admits successful cleanup. Failures retain state and preserve primary/persistence/proof errors. Per layout there remain 15 genuine private issuer admissions, 10 controlled identity frames, 12 controlled session selections and zero Actor workloads; a saved session identity is not a native member. The fresh-process phase below now consumes this handoff after holder exit. Historical v1 stdio evidence is neither rewritten nor promoted to v2 proof.

The installed source/npm-packed parent now validates that publication/identity/raw evidence and requires fresh publisher-host ESRCH before launching a separate published_research SDK process. The existing session-navigation fixture persists the new host/frame/session-file/publication data before SDK/Kernel imports, opens the same saved session, reads the active Actors Skill and obtains the exact owned map through the real inspect adapter. Registration remains cached unknown while current legacy inventory reports exited; the root result stays missing, with zero result-tool reads and no invented natural result/closure. Ordinary read obtains only the mapped catalog and its one selected actual preview. Test assertions compare Run/generation/command/export id, coverage, UTF-8 size and original-writer byte hashes; these checks are evidence correspondence, not recovered issuer/privacy capability. A new logical-session journey gets no fresh owned branch or preview read. Actual SDK read-start ledgers contain exactly Skill/catalog/preview for the positive and source-loss owner journeys and Skill-only for the new-session negative. The source-loss journey preserves the earlier accepted actual preview in model history, then explicitly holds the selected fixture file after catalog selection. The next ordinary read returns a saved isError/ENOENT tool result without substituting old text or reading raw/alternate paths; the target is still absent after that error, so no product export/repair occurred. Only after the exact error and read ledger pass does the fixture verify held bytes and explicitly restore the file. Its hold_planned/held/restore_planned/restored journal is persisted separately; unexpected failure retains the current state rather than silently restoring. Shared catalog plus nine selected Run file/absence snapshots match after that declared fixture action; this is final byte/absence correspondence, not untouched filesystem metadata, product self-healing or renewed original publication. Coordinator session history may append normally. Parent checks raw bytes/actual close, child/parent/metadata frames and complete capture, then requires fresh ESRCH for both captured hosts immediately before successful cleanup; any uncertainty retains state. Across two layouts this is two genuine private-publisher hosts and two fresh reader hosts, six prompted research journeys, four actual catalog reads, two successful selected-preview reads and two selected-preview read errors, zero Actor workloads or original keys passed to the readers. Original sources are controlled recorded-session JSONL, not genuine Actor conversations/public launches; no restored clock/native authority, automatic route, retrospective privacy certification or exhaustive closure is claimed.

Source assessment keeps genuine Actor-session ordinary research independent from curated preview publication. recipes-context.ts already attaches a managed sessions/command-NNN directory to Pi print commands without an explicit session policy, and async-runner.mjs records actual session_files in execution.json. Those recorded references can guide selective ordinary reads; execution-sessions.ts's legacy rich-turn discovery scan is not the required research path. The real CLI/ordinary-read witness below is separate from controlled previews; managed-argument unit tests alone do not prove a conversation. The ordinary runner has no writeRunSessionContextExport/Index call site. Curated publication still needs the genuine original producer in its admitting runtime, not copied metadata or post-terminal producer re-admission. An already admitted producer's evidence-write lifetime is distinct from new-work admission; publication is not categorically restricted to pre-terminal writes. This missing ordinary publication composition must not become a gate for ordinary file reading or authorize a default publisher/hook.

**Genuine Actor-session recorded-source acceptance.** The existing source/npm coordinator fixture adds one public Run through the real package entrypoint and the SDK1.0 installed pi executable, not a renamed script. Its explicitly loaded finite deterministic provider emits one assistant response without network/model judgment or tools. The normal runner supplies the managed session directory and records the actual JSONL reference in execution.json; command/native/root code0 and natural acceptance are checked separately from process exit. A distinct real saved coordinator owns this Run, preserving the original eight-row research map: the first combined nine-row attempt exposed honest 16-KiB omission rather than a product failure. The CLI session has its own distinct v3 id; parent independently verifies header/cwd, actual startup session-file/PID frame, user prompt, assistant row and exact recorded path/UTF-8 bytes. Readiness is recorded by the controlled provider after CLI imports and before its gated response, not authenticated spawning-member evidence. After holder and all25captured runner/workload PIDs are freshly ESRCH-confirmed, a separate SDK host reopens that owning saved coordinator. Real entrypoint inspection yields only its owned Run; ordinary read paths are exactly Skill/result/execution/recorded-session, with the last read selecting one actual assistant JSONL line by offset/limit1. SDK read-start arguments and the independently captured raw line/hash correspond. Existing other-session/fork/clone/live-switch maps exclude this foreign-owned root. All103known catalog/Run/source/catalog-absence snapshots per layout match after research. No session preview catalog is created, and canonical primary text remains selection_not_supported. Fresh ESRCH for all27captured PIDs immediately precedes successful cleanup; failed evidence stays retained. The complete current two-layout composition has20Runs/20runners/30finite workloads/two holders/two fresh readers,42research journeys (16adapter/26actual-entrypoint),28mapped-result reads,26selected command captures and two bounded raw-session-row reads. Counts describe one accepted invocation, not sums across red/focused/final runs. This proves genuine Pi-recorded source investigation, not curated original privacy, authenticated membership, exhaustive closure or automatic publication.

**Earlier approved request-only navigation handoff (owner decision, 2026-10-25).** This remains the discovery aid and older formatting version; the actual-reference implementation and A2 exit above supersede treating this hint alone as completion. Compact spawn/async-tool receipts and newly admitted completion batches offer one optional current-session file-map command: inspect target=runtime view=runs verbose=true. This is the adopted minimal handoff, not an automatically embedded path map or a new mandatory reader. Existing expert launch next_actions remain and gain the same navigation request. A shared pure formatter emits compiler-owned text only; it reads no Run files, catalog, clock or Pi context and cannot grant another logical session's scope. Actual invocation remains the existing Kernel route, which rechecks the live logical session and exact admitted roots/generations. The request is not routine completion/status polling and does not auto-run. New completion batches record navigation_handoff=current_session_request as formatting data only, with strict decoding; legacy absence stays absent across pending/queued/presented reload and phases so prior accepted/proposed message text is not retrofitted or replayed. In those retained handoff packets, the one per-batch request consumes their original shared16KiB render budget and inventory/omission selection; no separate allowance, member-path disclosure or capability reconstruction is introduced. Current explicit-manual result/capture/recorded-session/published-preview, partial coverage/Unicode, containment/source-loss, dual-order/whole-row omission and restart/replacement/isolation evidence remains separate. Reference-only navigation needs no elapsed time/native authority; snapshot/status/timed joins still retain A1/B1's clock/lifetime gates, enforcement retains C and release retains D. Full-map embedding, body publication, periodic reporting and default snapshot switching are not adopted by this handoff.

#### Existing Derived Role Exports

The existing context-index design publishes `context-index.json` as a generation-fenced map of semantic evidence roles. A compact snapshot carries its pointer rather than every body. The derived schema below is useful for curated views, not the mandatory access gateway for all ordinary same-session research. Reuse existing index/location owners without silently redefining fixed export slots or adding a parallel capability registry.

Use deterministic role names and exported paths; materialize files only when their evidence exists:

```text
<run-state>/context-index.json
<run-state>/evidence/recipe.json       captured redacted Recipe/launch policy
<run-state>/evidence/result.json       semantic outcome, errors, source references
<run-state>/evidence/trace.jsonl       retained redacted observations
<run-state>/evidence/control.json      readiness, capacity, redacted Control outcomes
<run-state>/evidence/execution.json    stages, failures, captures, session provenance
<run-state>/evidence/artifacts.json    named authorized artifact references
<run-state>/evidence/sessions.json     index of readable owned-session exports
<run-state>/evidence/stdout.log        authorized retained stream view
<run-state>/evidence/stderr.log        authorized retained stream view
```

These are derived readable exports, not another canonical state store. Keep canonical files in place and reuse their owning projection/capture logic. Curated automatic Control/session/stream projections must not attach raw journals, private provider/session bodies or unredacted captures as a shortcut; published session previews still cover authorized visible turns, not hidden provider reasoning. That projection boundary does not make derived exports or producer-backed verifiers prerequisites for ordinary same-session file research. The sessions/artifacts indexes select exact sources without automatically opening bodies; declarations alone do not authorize arbitrary artifact targets.

Index shape, with two illustrative entries shown below; the actual map includes all listed roles with explicit availability:

```json
{
  "schema": "run-context-index-v1",
  "run": "review",
  "run_instance_id": "<opaque generation>",
  "updated_at": "<ISO timestamp>",
  "entries": {
    "result": { "availability": "pending", "path": null },
    "trace": {
      "availability": "available",
      "path": "evidence/trace.jsonl",
      "media_type": "application/x-ndjson",
      "bytes_total": 2048,
      "mutable": true,
      "coverage": { "truncated": false, "history_complete": false, "redacted": true }
    }
  }
}
```

Each role uses `availability: available | pending | not_applicable | unavailable`. `path` is null unless available; unavailable evidence includes a bounded reason code. An available entry has a verified regular-file path relative to this index's directory, a media type, nonnegative exported-file byte size, and explicit mutability. Reject path escapes and symlinks. Coverage describes export omissions/redaction and, for temporal evidence, whether history is complete; lost or unknown coverage cannot masquerade as complete history. Byte size refers to the readable export, not an undisclosed original. An available file is not automatically an immutable historical capture; embedded result excerpts still require the stronger source contract below.

The private [`readRunContextIndex`](../lib/runs-context-index.ts) admits index metadata for an exact owned Run/generation/optional owner. It caps marker/index metadata at 16 KiB each and canonical `run.json` input independently at 1 MiB, requires all nine role slots, validates deterministic export paths/formats/coverage, opens available regular exports only for readability/size metadata, and rejects symlinks and observed identity/view changes. It never reads role bodies, scans directories, probes processes or creates views. Pending roles need no empty files. A role size mismatch, including mutable-view drift, conservatively makes this observation unavailable until metadata is refreshed. These checks are not a multi-file atomic snapshot, proof of immutable contents or certification of declared redaction/history; the export owner still owns those facts. Returned `local_path` metadata does not itself grant exposure permission. Planned research navigation obtains it from actual logical-session/Run ownership, not an original producer key or mere presence of this field. Broader runtime navigation and public role/inspection routes remain unwired; narrow artifact/primary/diagnostic integrations do not imply a complete root-first map.

**A2 implementation inventory and privacy boundary.** The nine-role schema is not nine production publishers. Private writer/index primitives exist for Control, Recipe, Trace, Result, Execution, artifact metadata and explicitly selected session previews. Outside their owner definitions/re-exports, the maintained lib/scripts call-site inspection finds no direct ordinary calls to the Control/Recipe/Trace/Result/Execution/session Context writer wrappers. The async runner does invoke admission-bound artifact preparation before work and primary/diagnostic first-result binding, but the latter sources do not automatically publish Result role views/indexes. No generic role-refresh registry or controller-after-loss authority is implemented by those narrow integrations.

Canonical stdout/stderr have bounded strict-UTF8 kernel input and metadata-reference readers, not authorized model-facing role publishers. readRunStreamSource explicitly reports canonical_runner_stream, kernel_only and capture completeness not_asserted; those labels describe its result, not a portable visibility capability. No derived stdout/stderr export writer or original model-visibility admission was found in this closure. Neither a readable path, formatted runner output nor applying a redactor can authorize a merged/provider/session stream. The separately selected successful bare-command primary source has its own narrower original-attempt permission and cannot silently stand in for either canonical runner-stream role.

Curated saved-source verification remains role-specific: retained primary text, declaration inventories, diagnostic fields/ranges and published assistant-session previews have dedicated admission. Execution capture/session selection is a recorded-reference metadata boundary, not an Execution-role verifier. Recipe, Trace, Control, Execution and Result have the producer-backed whole-view verification below; expert Inspector projections are not those verifiers. Session preview publication still requires explicit recorded selection, never discovery. These stronger claims are separate from same-session navigation plus ordinary file tools; A2 no longer requires custom per-role range APIs or controller-owned producer-capability recovery merely to investigate an owned file.

A disposable one-producer/no-workload inquiry exposed a prerequisite defect in the then-current private Recipe publisher. writeRunRecipeContextExport read live run.json through captureRecipe/readContextMetadata for projectRunRecipe even though readRunProducerCapturedMetadata retained the original admission snapshot. Initially a known Recipe-origin literal was withheld in the view. Changing only live same-generation values.skill_dir left the original template unchanged but caused the next Recipe view to disclose that literal; the index stayed available and continued advertising the role. The captured producer snapshot still pinned the original origin. The parent captured the exact producer PID/frame before awaiting and freshly proved ESRCH immediately before deleting scratch state. This is a private publisher counterexample, not evidence about public-route behavior, a general same-UID sandbox test or proof that all role families drift.

The result establishes why available/redacted index fields and stable generation are not privacy certificates. The private Recipe correction now fixes definition/launch/privacy/stored policy to the original genuine producer capture, with no fallback to later healthy metadata. Current canonical metadata still owes identity, source-size and observation fences, not renewed selection/privacy authority. Trace and Execution have independent in-process drift regressions as well: live privacy edits previously unmasked recorded origins despite available/redacted role metadata. Both private exporters now use original Recipe privacy while their journals/manifests remain current; these tests do not prove public routes, authenticated issuers or scope closure. The separate selected-session inquiry below confirms raw-input/writer privacy drift despite surviving original producer capture; the saved-preview follower does not refresh privacy and cannot certify the writer's original redaction. The private writer now has its own original-capture correction below; raw three-argument original-privacy support remains unestablished and saved-follow semantics stay separate. Existing immutable primary/diagnostic/artifact-inventory captures remain a distinct implemented path. High-level writer wrappers reacquire producer evidence admission around capture/publication/index commits: future composition must not invoke them recursively under an already-held lifecycle lock or turn ordinary evidence I/O into an invented workload failure.

Private [`writeRunControlContextExport`](../lib/runs-context-exports.ts) now materializes `evidence/control.json` from the real canonical Control journal through original producer privacy and the existing bounded `control-projection.ts` owner. It requires the genuine runtime producer before capture and again before publication; copied/serialized producer data cannot authorize it. The JSON view has `schema: "run-context-control-v1"`, exact Run/generation/capture time, captured logical Run status, current-generation capacity, at most 40 recent projected records and explicit omitted-row/foreign-generation counts, within 64 KiB. Body and returned role metadata conservatively disclose `truncated: true`, `history_complete: false`, and `redacted: true`; retained-journal completeness is not invented. Missing/invalid source creates no pretend empty view. Existing views require the same schema/generation binding, and observed root/target changes reject atomic replacement. Write errors preserve their cause and any already-committed effects; only a later explicit call captures fresh evidence. Root results/clocks/journals remain unchanged, including while stopping or after natural acceptance. This one-file producer does not itself assemble the index, publish other roles, grant native authority, or make inspection create exports.

Private `writeRunControlContextIndex` now joins that Control view with all nine declared role slots through `writeRunContextIndexUnderLock`. It reacquires genuine producer evidence admission after view creation; the low-level writer is trusted persistence, not another authorization port. Absent Control source becomes pending metadata without an empty view; invalid/unreadable source becomes explicit unavailability while retaining previous files. New indexes mark unpublished roles unavailable. Existing same-generation role metadata is preserved, but unreadable or size-changed exports become unavailable instead of advertised paths. Corrupt, foreign-generation and nonregular index targets are preserved and refused. The writer bounds the complete index and rechecks owner, index target and admitted references before atomic replacement. View and index commits are separate: failures retain their actual partial effects, never roll back or retry the observation internally, and later explicit calls capture fresh evidence. Index metadata still does not certify body redaction, immutable history, scope closure or model exposure permission. Remaining role owners, ordinary/controller refresh and public inspection remain open.

**Control original-privacy and source boundary assessment.** A source-only one-producer/no-workload inquiry now distinguishes generic Control masking from original Recipe privacy. The pre-correction private writer required a genuine producer but captureControl/projectRunControl never consumed its captured Recipe metadata. Two current-generation controls admitted/claimed/marked failed through the real journal APIs (controlled records, not workload or handler failures) preserve a known original Recipe-origin literal in input.note and error from the first export onward. Generic api_key and token text still redact correctly; the index remains available with redacted coverage. Editing only live values.skill_dir neither fixes this initial omission nor changes the retained original producer capture. A copied producer still refuses. The existing pure original Recipe redactor would withhold that known origin, but this counterfactual is projection data, not a new permission carrier or proof about ordinary/public Control routes.

The same inquiry uses the actual INSPECTOR_BODY_PREVIEW_CHARS limit (320): a known complete origin spanning that error boundary becomes an unrecognizable partial prefix after generic clipping. Applying original privacy afterward leaves the prefix unchanged, while whole-field privacy before the existing bounded projection produces different protected data. The correction therefore belongs before input/error clipping, not in an index flag, saved-reader repair or second pass over the clipped view. The assessment alone supplied no correction, port or runtime wiring; the separate private correction below leaves existing Inspector projection semantics separate.

A controlled own-journal append during temporary view preparation also makes the current observation boundary explicit. The writer commits the two-row/zero-pending snapshot captured earlier even though the valid journal now has three rows/one queued input; the next explicit observation includes that row and reports pending=1. captureControl checks the journal around its read but returns no retained unchanged fence. This establishes absence of latest-at-commit source proof, not that the earlier captured snapshot/capacity was false, a multi-file atomicity promise, stale public actuation or a native closure result. Any stronger freshness/refusal policy must preserve recorded-snapshot semantics and avoid silent authority/atomicity expansion.

The corrected inquiry retains the child PID/frame before kernel imports and parent assertions/await, persists full stdout/stderr/actual close before child-failure normalization, leaves the child's own exit not_asserted and freshly ESRCH-probes immediately before successful deletion. An initial scratch used an incorrect assumed 4000-character error limit, so both variants clipped the origin away before comparison and its assertion failed. That root is intentionally retained with exact child stderr/close and a failure note; the distinct fresh-root run imports the owning 320-character constant and passes. Neither assessment attempt changed product code/tests/dist, created a root result, delegated work or established source-packed/public/ordinary privacy support.

**Private Control original-privacy correction.** captureControl now admits bounded original metadata through the existing genuine readRunProducerCapturedMetadata before opening the canonical journal body. It derives complete input/error privacy with createRunRecipeEvidenceRedactor before handing those fields to the unchanged one-argument projectRunControl; action/timestamp/status projection and raw-journal capacity semantics stay with their existing owners; private identity references follow the whole-reference policy below. Known original origins are withheld before the 320-character body limit can split them; generic sensitive-key/text masking remains intact. Caller/live values cannot renew original presence or absence on first export or refresh. Over-budget original metadata yields control_admission_unavailable without opening the journal or falling back to later healthy values. Current owned run.json retains an independent 1 MiB UTF8 input observation and root/marker/metadata fence through view commit; missing/invalid/over-budget current input yields control_metadata_unavailable, observed changes control_metadata_changed. These observation ceilings are not launch/workload quotas and do not reinterpret ordinary producer admission itself.

The shared local captureContextMetadataFence now serves Control as well as Recipe/Trace/Execution, without a new module, edge or authority port. It protects the admitted metadata/owner observation across capture/publication, not journal freshness after the recorded snapshot: the measured post-capture append still permits the earlier captured count/capacity, and the next explicit refresh observes the new row. Three additional owning properties cover original present/absent × caller/live before-first/refresh drift, whole-field privacy at the actual split-origin limit, unchanged generic Inspector projection, independent original/current exact UTF8 budgets and zero journal opens on original refusal, metadata/marker/copied-root replacement, and earlier-snapshot versus fresh-journal counts. Existing publication/error/partial-commit tests remain intact. The corrected source-only one-producer/no-workload witness now reports both initial origin disclosures false and fixedBodyMatchesWholeFieldPrivacy true; source append/explicit refresh semantics and fresh parent ESRCH cleanup remain unchanged. This is private writer proof, not a saved Control reader, ordinary/public/packed privacy acceptance, model body permission, runtime refresh or native authority.

Private `writeRunRecipeContextExport` materializes `evidence/recipe.json` (`run-context-recipe-v1`) from the bounded original genuine producer-admission snapshot, never from later same-generation selection/privacy or by reopening live Recipe/source files. The current owned canonical metadata remains separately bounded and fenced; it cannot replace original definition/launch/stored policy, reveal an admission-hidden origin or backfill an originally absent capture/legacy clock. Over-budget original metadata yields recipe_admission_unavailable; missing/copied producer admission is rejected by the existing runtime-local producer guard. Malformed or absent original Recipe captures remain unavailable even after current metadata becomes healthy. It shares the pure `recipe-projection.ts` with Actor Inspector without changing that existing Inspector source contract: private origin fields and known absolute runtime-origin tokens in definitions, launch data and keys are removed/redacted without corrupting canonical logical references. Secret redaction and bounded string projection remain owned by the existing evidence redactor. The body binds Run/generation/capture time, distinguishes definition-and-launch from launch-only capture, and includes only a strictly decoded `stored_clock` when captured clock metadata exists; legacy absence is not backfilled. Stored policy/clocks are not live elapsed-time or enforcement proof, and actor values never override them. Source capture shares the independent 1 MiB canonical-metadata observation budget, not the 16 KiB index/marker limit; the encoded JSON view remains at most 64 KiB, otherwise explicitly unavailable rather than sliced. The source ceiling is an observational bound, never a new launch/input policy: larger canonical metadata remains unmodified and yields unavailable evidence. The readonly index reader refuses known over-budget metadata before source opening/allocation. Recipe's bounded source capture applies this limit after the existing producer-admission path; this does not claim a new bound on that authority path's own metadata reads. Exact-byte UTF-8 boundaries, including large captured values above the compact-output limit, remain independently tested. Conservative `truncated: true`/`redacted: true` coverage discloses that this is not a complete original Recipe source. `writeRunRecipeContextIndex` separately reacquires producer admission and joins that actual view while preserving the Control role and other admitted metadata. Control and Recipe use the same publication rechecks and partial-write/error semantics. Recipe additionally carries its captured owner/root/marker/metadata fence through view publication, so same-generation source or copied-frame changes between admissions refuse retargeting rather than refresh authority. Three added properties cover original selection/privacy/policy before first export and on refresh, exact/current source limits and malformed UTF-8, and source/marker/root substitution. Existing invalid/legacy/large/UTF-8 fixtures now prepare their intended metadata before genuine admission, not by editing a different live capture afterward. An isolated source-only producer repeats the earlier origin witness with the later disclosure now false and fresh parent ESRCH before cleanup; this is not ordinary/public/source-packed role acceptance. These remain private primitives: other role owners, producer/controller refresh and public observation routing are still open.

**Private Control whole-reference correction.** The generic Inspector projector's 160-character text policy previously also shortened private context-row ids/generations. A genuine producer/property demonstrates that unsafe origin/secret ids were kept as rewritten/preview references and safe long ids/generations were not literal full references. captureControl now checks full header run/generation against the original unbounded privacy redactor before opening the journal; any privacy change yields control_identity_redacted without a fabricated masked header or source read. For each selected current-generation row, it similarly checks the complete id/generation pair before projection. Only unchanged safe references replace the generic projector's preview fields with their exact original strings. A privacy-changed id omits the entire row; raw private values are never restored from a masked preview. Input/error still undergo original privacy before clipping; standalone projectRunControl and its callers remain unchanged.

The 40-record source selection window, foreign-generation count and raw canonical capacity remain independent of visible safe rows. controls_omitted includes privacy omissions, window omissions and any complete rows removed to satisfy the actual UTF8 encoded 64 KiB view ceiling. Large safe references therefore consume their real bytes; a single safe row too large for the view is omitted as a whole, never shortened. An oversized owned identity can refuse earlier at the existing identity-observer boundary; this is not a new launch/generation quota. Metadata/root fences, recorded-snapshot source semantics, exact I/O/partial effects and no-root-result behavior remain unchanged.

Three new owning properties cover long literal Unicode/BOM/U+FFFD/backtick/CRLF identifiers plus complete generation, original-origin and generic secret-sensitive row omissions across live metadata edits, exact counts/capacity/foreign omission with byte-preserved canonical storage, large multi-row and single-row whole-reference overflow, independent owned-identity refusal, and zero journal opens for a privacy-changed header. The existing source/packed context hosts now assert full per-row generation instead of relying only on the full header. Those projection/fixture proofs alone supplied no saved reader, dispatch authority, native enforcement, ordinary/restart transport or public integration; the separate historical reader below does not widen those live authorities.

**Private historical Control whole-view admission.** writeRunControlContextExport now retains the bounded originally admitted canonical JSON and owned root in its own Control-only WeakMap, keyed by the genuine original producer after successful view publication returns (including lifecycle release). Missing/unavailable capture or a thrown before/after-replacement write/release error mints no new binding; prior admitted data remains only if the file still matches it. Explicit successful publication may replace that role's binding. Index publication is a separate effect: even a later index error does not undo a committed view/binding. Trace admission, saved DTOs, flags, schema, path/hash or another genuine producer/module cannot supply the missing Control binding.

Private readRunControlContextView(stateDir, producer) requires both the bounded original runtime producer and its original successful Control publication before probing for rejected admission. It uses the shared private checked-source observer for current owned identity/index/Control/evidence/view, compares the entire canonical JSON encoding to that original admitted data, then returns frozen view/header fields, safe complete ids, projected input/error, run_status, capacity and omission counts with basis original_control_publication_match. The original/current metadata observation remains 1 MiB; selected source and complete encoded response each have independent 64 KiB limits, with whole-response refusal rather than clipped rows/identities. Returned change checks retain the same per-Control publication identity and metadata/source observations. No Control journal, root outcome, private session/capture/other-role body, target, native/time or directory scan is read, and no work/evidence lifecycle lock, repair/export, dispatch, ACK or scheduling effect is admitted.

The saved status/readiness/capacity/pending counts describe their earlier capture, not fresh Control admission or dispatch permission: queued→claimed→failed journal changes, append or journal loss leave an otherwise matching historical view readable until explicit successful republishing. Live privacy metadata cannot reproject the original view. Seven role-specific properties prove these semantics, same-size input/id/status/capacity tampering refusal under an available index, exact long safe ids and privacy omissions, missing/copied/getter/foreign/alias/reloaded/over-budget admission before probes, before/after-replacement and separate index partial effects, selected-body-only/no-effect reads, post-body owner/root/marker/metadata/index/view substitution, corrupt/denied/symlink/failed-close refusal and independent response/source limits. Existing Recipe/Trace properties remain distinct and green.

The same source/packed context hosts now also read original frozen Control publication, reject tampering and selected-view loss without a retained-data fallback, refuse unrecorded/copied/foreign/reloaded keys, follow historical counts through later journal append/loss, and observe new counts only after explicit publication. Their complete original-generation/reference checks and exact PID/frame/stdio/close/fresh-ESRCH cleanup remain intact with no new hosts/workloads. This is private same-runtime admitted-data correspondence, not physical file-issuer authentication, ordinary/producer-loss/restart transport, public SDK/tool routing, range permission, native closure or Control actuation authority.

**Saved Recipe admission and private correspondence reader.** The existing export is bounded JSON with schema/run/generation/capture-time/coverage, capture kind, normalized recipe (composition, optional definition, diagnostics, identity, launch) and optional stored clock. It does not carry a separate original-privacy read capability or canonical first-result publication binding. A controlled source-only inquiry edits only its own retained view, preserves encoded byte length and all envelope identity/time/coverage fields, and inserts a previously withheld origin into a launch string. Fresh context-index metadata stays identical and available with zero Recipe body-byte reads; the index file and canonical metadata do not change. This is expected metadata-only behavior, not an index defect. RunContextIndexReading has no retained unchanged callback: its source fences cover that one observation only.

Recipe projection is deliberately lossy: two different private-origin inputs produce identical sanitized recipe data, and projecting a metadata DTO reconstructed from the modified view cannot restore the erased origin policy. The genuine retained producer snapshot still reproduces the original expected recipe and rejects the changed body; a copied producer key fails the existing runtime-local guard. That supplies a narrow same-runtime verification path using existing authority, not a reason to trust a schema/coverage marker or adopt a new serialized carrier. Private readRunRecipeContextView(stateDir, producer) now performs that bounded same-runtime verification. The producer must be its original runtime-local key; copied/missing keys, foreign roots/aliases and unavailable/over-budget original metadata refuse before filesystem probing. It shares pure projectCapturedRecipe shaping with the writer, preserving original definition/launch/capture kind and optional stored-clock absence or data, never refreshing from live metadata. Current owned identity/index/Recipe-role metadata and the selected strict-UTF8 regular view are separately admitted; the closed envelope and complete recipe/stored-policy fields must match original projection data. JSON key ordering is immaterial but literal string values are not rewritten. Source input and the complete encoded response each have an independent 64 KiB ceiling; whole-response overflow refuses rather than clipping. Canonical metadata and original capture retain their independent 1 MiB budgets. The parsed retained view is recursively frozen only after correspondence; no recomputed replacement is returned. Returned basis is original_producer_projection_match, with curated relative path/size/mutability and a fresh owner/marker/metadata/index/evidence/view observation fence. The recorded captured_at is checked as ISO file metadata, not authenticated publication time. Other roles may be metadata-opened by index admission but their bodies are not read; no root result, raw history, process/time sampling, work/evidence lifecycle lock, source discovery, export, repair, ACK or scheduling effect is admitted. This proves correspondence to allowed original projection, not who physically issued the file or durable immutability. No ordinary caller, producer-loss/restart recovery, range scheme or public route is established here. Existing primary/diagnostic source-specific canonical bindings and the saved-session reader's selected-body scope remain distinct, not blanket body permission for Recipe. The inquiry uses one self-bound child producer and zero workloads/public routes; parent captures the exact PID/frame before awaiting and freshly proves ESRCH immediately before deleting its successful scratch root. The source-only producer witness now invokes the private reader: original data succeeds, the same-sized edited body is view_mismatch despite a fresh available index, the prior readonly fence refuses, and the modified file remains unaltered. Seven owning properties cover original/copy/foreign/budget refusal before probing, live-metadata non-renewal and legacy clock absence, literals/frozen data and key-order equivalence, whole-body/policy mismatch, selected-body-only/no-effect reads, post-body root/marker/metadata/index/view substitution, malformed/denied/symlink and close-error refusal, and source/whole-response bounds. That witness is source-only private kernel proof; the separate source/packed proof below does not widen ordinary/public authority.

**Saved Result authority assessment — partial bindings are not whole-view correspondence.** A source-only privileged same-runtime inquiry published each original root result and Result view/index once, using five upfront controlled metadata frames/keys in one host: natural 0/7, request-only post-stop capture 0/7, and natural 7 without diagnostic fields. These are controlled canonical records and stop requests, not actual command exits or native actuation/closure. Natural cases also retained the genuine original optional first-natural acceptance receipt without terminal-elapsed sampling; capture-only cases minted none. Copied producer metadata keys were rejected. The inquiry then made forty-four explicit same-size edits to the saved view only, preserving the index, canonical result, diagnostic sources, metadata, journals/stop records and original receipt/capture. There was no re-export or reader repair; padding is JSON whitespace, not changed source bytes or relaxed index size validation.

Fresh index metadata remained available while independent changes to captured_at, outcome.recorded_at, reported flag values, a nonzero code and the natural/capture_only class continued to allow diagnostic field reads whenever fields existed. The changed saved acceptance label was returned as recorded_acceptance even when the unchanged canonical result and separate eligible-outcome reader retained the opposite classification. That is a saved label under the selective contract, not a new public/canonical terminal-truth claim. Positive controls changed the diagnostic hash/count/preview/path or generation header at the same byte size: the existing readers refused source_invalid/view_invalid as appropriate. No-field views correctly stayed diagnostics_unavailable, which plainly cannot verify their complete metadata. All non-view bytes and all original producer/first-natural data stayed unchanged; reads left the exact candidate view untouched. Actual child close was 0/null; full parent/child frames, stdout/stderr/close were saved before normalization, and successful scratch deletion followed exact frame validation and a fresh ESRCH-only check. The single host/five keys are not five workloads or new native memberships. This assessment is source-only, not a fresh packed/SDK/public/default/lifetime journey.

The separation is intentional: readRunResultDiagnosticsSource admits the complete allowlisted retained source plus all preview/count/reference correspondence, not canonical root or arbitrary whole-view data. readRunResultDiagnosticOutcome independently admits eligible natural canonical first-result diagnostic metadata without reading view/index. Neither result, nor their conjunction, proves the historical entire saved view. Original pre-result producer metadata cannot reproduce later code/flags/completed data; the optional first-natural receipt freezes only code/status/completed date and covers neither the complete view nor capture-only records. The assessment therefore required Result's own original complete-data/successful-publication basis and independent field privacy, not an inferred binding from partial hashes or a different role. That assessment implemented no reader/map/carrier; the private historical admission below now supplies the separate basis without changing either partial reader. The original typed fact/reference risks identified by source inspection now have the narrower context-only publication guard below, not a promoted whole-view reader. Existing selective recovery, root 0/7/capture truth and the separate DTO-only lifetime/emission contract gate remain unchanged. The genuine shared complete-text assessment below now confirms the opaque-scalar gap in capturedTextPrivacy; selected-role body guards do not automatically certify the eligible primary/diagnostic source pipeline. Correct metadata correspondence and private fact/ref refusal remain distinct from this newly falsified complete-text privacy claim.

**Original Result context fact/reference privacy, separate from first-result bindings.** captureResult now reuses one fixed original complete metadata matcher for the full header, canonical completedAt copied into recorded_at, and actually emitted diagnostic source path/generation/hash. A private recorded fact refuses result_metadata_redacted after canonical schema/current-frame validation but before diagnostic projection. Diagnostic refs require the same exact-safe decision after complete source-text projection/source budget and before preview counts, source retention, encoded view limits or replacement. Nothing is masked or dropped from a usable ref; the entire new Result context view is unavailable. No-field not_recorded views do not emit a source descriptor, so unused prospective private path/hash must not spuriously refuse; the recorded fact still needs privacy even in that case. Generated captured_at and protocol words retain their own provenance classification rather than a blanket scrub.

Three maintained properties cover forty-four configurations: original sensitive presence/absence against opposite live values; genuine normal/capture-only canonical0/7; exact predeclared data path/hash versus actual issued binding; no-field source absence; and earlier view/index/source history with independent index refusal and explicit healthy refresh. The real-issued fact overlap uses the complete captured credential ':' (not a guessed prefix of a larger credential); complete ISO values stay exact or wholly unavailable. Deterministic expected references are verified as data against actual source publication, never treated as reconstructed capability/issuer. Original keys are admitted before result/stop. A separate history matrix makes explicit controlled canonical date/text edits after the first result, preserves code/acceptance/stop/immutable first diagnostic binding, and verifies the exporter changes none of that selected input. These are not new actual first-result dates/native times. An independent open/lstat counter proves original-private context refusal performs zero diagnostic-source retention probes; full source bytes, original optional first-natural receipt and root facts remain unchanged. No-field first unavailability is not repaired when an explicitly edited context later supplies diagnostic metadata. Direct refusal preserves old context source/view/index bytes; independent index publication changes follow availability. Fixture restoration and safe explicit refresh can restore supported absence, while orphan sources are left untouched rather than silently erased.

The existing source/packed hosts reuse the two safe logical/absent-owner frames with their pre-admission private report-time credential. After genuine canonical0/7 and diagnostic publication, an explicit reported-date edit produces context refusal without source probes or prior view/index/source replacement; independent index refuses a new diagnostic follow, and explicit fixture restoration/safe refresh succeeds with original first binding. No frame/key/host/selection/canonical result/workload was added. This is bounded metadata/privacy/effect proof, not original source-completeness, whole Result correspondence, renewed legacy source privacy, ordinary lifetime/public/SDK/native/restart admission or altered first-result binding. The selective readers and first-result publisher remain unchanged; privacy guards in one new context path cannot certify their earlier/orphan/DTO-only sources.

**Complete-text opaque-scalar assessment — genuine source gap, not a public-delivery claim.** One isolated source host with eight upfront controlled metadata frames/genuine keys and zero workloads crosses formatted array, BOM-prefixed array, nested opaque scalar and structured sensitive-key control with original secret presence/absence. Keys are admitted before work; live values become the opposite before publisher factories, eligible selection and canonical first publication. Primary is a privileged synthetic one-bare-command/one-attempt/non-session complete-UTF8 selection with exact memory/file correspondence, not an executed command/OS exit. The same original producer actually publishes its first canonical0 result with trusted primary/diagnostic callbacks, then the Result context/index. No copied metadata recreates producer authority. All input/meta/canonical/source bytes, actual source hashes/counts, readonly change fences, original admission and immutable first binding/duplicate callback count are verified independently.

When the original private credential equals the complete formatted or BOM-prefixed JSON array spelling, both retained primary and diagnostic field bytes keep that credential exactly. Primary redacted is false, while diagnostic coverage.redacted is true and privacy_scope is producer_admission. In the nested case generic projection changes the original formatted spelling before literal masking: raw credential absence coexists with identical decoded private scalar content in both sources; primary redacted is true there, not a safety certificate. Separate original-absence/opposite-live controls correctly stay public, and structured sensitive-key controls always hide the sensitive-key value while hiding the ordinary note only when originally private and retaining public siblings. This isolates the raw opaque/normalization class rather than blaming all structured-key handling or live non-renewal. The three original-present opaque cases fail in both source pipelines; four absence controls and the original-present structured control behave as expected. These short complete sources do not cross preview limits, so clipping/canonical Trace preloss is not an alternative cause.

Actual readonly primary, selected diagnostic field and eligible canonical diagnostic-outcome reads all remain available with those source bytes; Result view/index metadata is likewise available with redacted labels. Readonly consumption and duplicate first-result publication perform no source/input repair or replacement. Source inspection shows the eligible completion collector forwards the accepted diagnostic excerpt into member data and the literal formatter adds its scoped diagnostic label, not another original privacy projection; no fresh collector/packet/model/Telegram/TUI delivery was invoked in this inquiry. This is a private same-runtime genuine source/returned-data counterexample, not a fresh ordinary/public/SDK leak or original read/emission-lifetime proof. Parent captured the exact positive PID/all frames before await/assertions; child persisted the full frame before imports/await; complete stdio/actual close0/null was retained before normalization. Successful scratch deletion required exact actual saved identities and a fresh ESRCH-only check immediately beforehand; child exit remains not_asserted. Eight keys/frames are not workloads/native memberships.

The former private capturedTextPrivacy adapter parsed encoded strings before matching their original raw span, then could return the original spelling when parsed projection was unchanged. Whole original credential literals therefore survived unchanged; nested generic normalization defeated later matching. No product/test/dist implementation changed during that assessment; the bounded repair below now reuses the existing pure raw-span policy instead of that adapter. Source-specific primary/diagnostic permission, original key decisions, literal public/BOM/whitespace behavior and complete-source counts/limits/first bindings/partial errors remain separate preservation duties. Fixed old sources cannot be silently reprojected or overwritten: first-winner and legacy DTO-only authority/lifetime contracts remain separate. New correct writer behavior could not retroactively certify these older unsafe sources, nor would matching publication bytes certify complete privacy or native/root closure.

**Shared complete-source raw-span repair, no new permission.** recipe-projection now owns one private capturedBodyPolicy for original origin/generic/complete-literal handling and raw encoded-span preparation. Existing createRunRecipeBodyRedactor still consumes the same full-data projection plus its generic/display-limit tail; its callers/defaults are unchanged. New pure createRunRecipeTextRedactor instead consumes protected encoded text directly, or the unbounded full plain-text policy when no JSON encoding exists. Public encoded text whose parsed projection is unchanged retains its exact original scalar/whitespace/BOM spelling. Changed structured data retains original sensitive-key decisions, public fields and valid JSON/BOM syntax. Raw private quote/escape/numeric/whole opaque spans that cannot survive safe decoded projection withhold the whole encoded scalar as [REDACTED], never masked JSON syntax. The text path must not run generic masking again over already protected serialized JSON: an attempted body adapter did so and a focused BOM/quoted-scalar witness caught its syntax corruption before retention. That adapter was removed, not accepted as a weaker representation contract.

The former private text adapter is deleted, not wrapped or reexported. Eligible primary, genuine first-result diagnostics, context diagnostic projection and existing inventory scalar-path privacy import the pure text factory; it grants no source/body/producer permission and adds no module/registry/runtime callback or protocol flag. Three maintained properties cover complete formatted/BOM/nested/escaped/numeric/string/private-key/ambiguous quote sources, original present/absent with opposite live values before factories, public scalar/Unicode/BOM/whitespace and structured syntax, and fixed unsafe orphan source conflicts. Complete source bytes and source SHA/length/code-point counts precede exact primary160, diagnostic4000 and eligible1000 previews. First root result/source bindings, duplicate callback count, typed Result metadata guards, readonly views and independent encoded limits remain consistent. The earlier Primary JSON regression now distinguishes ordinary per-field literal/origin filtering from a complete credential equal to raw quote syntax: the latter whole encoded scalar is withheld, while the ordinary case still verifies hidden sensitive value, escaped origin and masked note. This is explicit raw-span privacy, not silently clipped refs or relaxed assertions.

The same two safe source/packed metadata frames reuse their pre-admission formatted/BOM opaque credentials as actual first diagnostic error input; the eligible bare code0 selection also uses that opaque primary input. Result/source/readonly text now shows only [REDACTED], primary reports actual changed bytes, and a separate public formatted failure_reason scalar stays byte-for-byte unchanged. Code7 remains unsupported for primary as before. Source hashes, first bindings, context/index publication and existing reported-date refusal/explicit recovery all use matching protected bytes. No host/frame/key/canonical result/selection/workload was added. Controlled privileged selection/records are not actual command exits or new SDK/model delivery. New policy does not rewrite older fixed source bytes: explicit unsafe orphan sources still throw the exact identity-already-fixes-different-bytes refusal without overwriting sources, minting a root outcome or creating view/index. New source safety and original publication correspondence do not certify older unsafe bodies, reconstruct post-producer lifetime or substitute for the separate complete saved Result historical read basis below.

**Known cleanup report versus successful historical publication admission.** A view commit and the lifecycle wrapper's return are separate from its retained cleanup outcome. withRunProducerEvidence intentionally preserves its factory's actual result while recording release errors through the original producer's runtime-local cleanup fact. Therefore written alone could previously renew Trace/Control/Execution publication admission even when that fact already said release_unproven. Each role's setter now checks readRunProducerCleanupFailure after publishContextView returns; a known report prevents a new binding/renewal without changing the actual committed bytes or writer return, and without inventing a throw/rollback. Existing synchronous write exceptions still propagate exactly. An earlier successful binding is not deleted: if its exact body and owned frames remain, it is historical evidence, not permission for active work or proof that cleanup recovered. Future producer operations stay fenced by the report. No report is not proof of a global/cross-process lease or exhaustive native closure.

One maintained six-class property crosses all three roles with absent/prior successful binding. After an actual view rename, a controlled trusted-kernel cleanup report marks the genuine original key with EIO. The writer still returns written; separate fixture-controlled index metadata reflects its actual entry and is freshly available. No prior successful role publication now refuses publication_unavailable, while prior binding plus changed committed body refuses view_mismatch. Explicit fixture restoration of the prior body/size restores the historical read but neither clears the report nor permits a later export. Another role's successful publication cannot substitute for the absent target binding. These are controlled runtime fact reports through the real original-key API, not injected physical lock-release failure, actor claims, actual native work or proof of release/closure. The original failed witness reached available despite the known report and healthy index; the guard resolves that exact admission gap.

The existing source/packed fixture reuses its original previously unrecorded baseline key after all earlier assertions. A single controlled cleanup report after the real Trace rename yields written but no new Trace binding, with refusal before metadata/view/index source probes; a later export stays fenced. The expected kernel diagnostic is counted and captured locally rather than leaked into transport stderr, and no unexpected exception is suppressed. Physical fixture locks release normally; host/frames/keys/workload and parent ESRCH cleanup contract remain unchanged. That prerequisite itself added no Result reader/map. The private Result admission below now uses the same normal-return/known-report distinction and remains separate from historical body, current outcome/cleanup and ordinary read-lifetime authority.

**Private historical Result whole-view admission, not a partial-reader promotion.** writeRunResultContextExport now retains at most the latest bounded canonical Result JSON and owned root in its separate Result-only WeakMap, keyed by the original genuine producer after normal view publication/wrapper return and only if no known cleanup failure is retained. Unavailable capture, thrown capture/write/release errors including after replacement, or a separately reported cleanup failure mint no new admission. Actual committed effects and an earlier successful binding remain separate; index errors do not roll back a valid new view/binding. No Result data is reconstructed from first-result diagnostic hashes, canonical outcome snapshots, optional natural-time receipt, pre-result metadata, saved protocol/redacted flags or another role/module/key.

Private readRunResultContextView requires original bounded producer metadata, exact original state/run/generation/optional-owner and original full header privacy before filesystem observation, then that same module/key/root's successful Result publication. It reads only owned index/evidence/selected Result-view frames and strict UTF8, comparing complete canonical bytes before parsing and recursively freezing all outcome/diagnostic/count/flag data. Returned basis is original_result_publication_match, with exact relative evidence/result.json path, application/json/bytes/mutability and a fresh source-plus-publication observation fence. Source and complete encoded response each independently cap64KiB; overflow refuses the whole response, never clips references. An absent selected file cannot fall back to retained expected bytes. No root result, diagnostic/primary/other-role bodies, journal/target discovery, process/time sampling, work/lifecycle locks, native result or repair is admitted.

The saved natural/capture-only/code/producer flags/recorded_at and diagnostic refs/counts describe the earlier publication, not current root terminal status, natural elapsed/native close, body permission or successful cleanup. Canonical result/source mutation or loss can coexist with the authentic historical view; safe live metadata edits do not renew original privacy. Explicit successful republishing refreshes admission and invalidates older publication observations. A new known cleanup report cannot mint/renew data, but an earlier exact successful view may remain historical while active producer operations stay fenced. captured_at remains an original recorded file observation, not authenticated wall-clock issuance. Correspondence/owned index/source facts are not physical file-issuer, durable immutability, complete privacy or ordinary/producer-loss/restart/range authority.

Eight role-specific properties cover natural0/7, capture-only/no-field states, first/copy/getter/prototype/unrecorded/foreign/root/module/original-budget admission before probes, complete same-size header/outcome/descriptor/count/preview changes under an available index, separate same-frame genuine keys, private fact/invalid text capture refusals, before/after-replacement exact errors, independent post-index errors, reported cleanup/old-history behavior, source/input loss and explicit refresh. Independent no-read/effect counters cover selected-body-only reads, no root/diagnostic/primary source consumption and no native/time/work effects even if production normalizes exceptions. Post-body root/marker/meta/index/view replacement, malformed/denied/symlink/failed-close and missing-view/index cases refuse without repair; source and whole-response budgets remain independent.

The existing source/packed identity fixture reuses its two safe controlled original keys/frames and canonical0/7 records. It reads frozen whole Result metadata, rejects an exact-size saved recorded_at edit despite healthy index, leaves the tampered file untouched, then reads the explicitly restored original. Loss of canonical root and diagnostic source does not disable the matching historical whole view; direct result_absent export creates no new admission and explicit fixture restoration/republishing refreshes it. Unsafe original header and copied/foreign-module keys refuse through their own original boundary. No key/frame/host/canonical result/selection/workload was added and no ordinary SDK/model delivery was demonstrated. Existing first bindings, exact source bytes, primary/diagnostic selective contracts and the controlled Trace cleanup-report witness remain distinct and unchanged.

**Exact output provenance assessment — fixed namespace accepted, other field contracts remain separate.** A source-only inquiry uses one isolated host/four upfront controlled metadata frames/genuine keys and no workloads. Each key is admitted before its canonical0 no-diagnostic-field result. Public Recipe/Trace/Control/Execution/Result and an explicit synthetic recorded-session selection are then published through actual original producers, with opposite live credentials before factories. Supported legacy stored-clock absence isolates newly generated capture metadata from original stored-time policy. All original header identities are safe. The inquiry verifies actual fixed role outputs, fresh available index, readonly byte integrity and original snapshot continuity; raw comparison is evidence, never new permission.

- **Original source-derived data:** Existing origin/generic/complete-literal rules govern recorded text, ids, timestamps and variable refs under their owners. Exact safe data or explicit whole refusal/omission with honest counts remains the rule; no inference from a successful body/publication or redacted label. In the ':' case, Control capacity time, Execution update time, Result recorded time and selected Session source metadata correctly refuse their separately guarded recorded-source classes.
- **Compiled vocabulary:** schema, basis, media, coverage/reason/type labels and JSON syntax are fixed program vocabulary, not actor-supplied credential payload. With original credential equal to original_producer_projection_match, the available Recipe reply's basis byte-for-byte matches the credential but is identical to the baseline compiled basis. Pure original matcher false here is not proof of actor credential flow and grants no blanket label scrub or disguised authority.
- **Generated observations:** Recipe/Trace captured_at contains ':' despite original credential ':', while their supported original source facts remain separate. That is an independent generated file observation, not a captured input secret, historical issuer or measured worker clock/domain. It does not prove whole-envelope literal absence. Any new exact/unavailable policy must be explicit; never mask/fabricate a typed timestamp or infer permission to remove existing stricter guards.
- **Fixed operational locators:** With original credential evidence and healthy later values, all five private readers and their available index entries still contain fixed evidence/<role> paths. runContextExportPath constructs those bytes entirely from a closed compiler-owned table; baseline with opposite live evidence returns the same paths. They are not observed actor credential injection, but unlike a basis label they are also promised usable locators. Applying the current full original matcher to each path returns false. Constant code or index visibility alone did not establish permission; the explicit owner decision below now admits exactly this closed fixed namespace. Neither the original raw comparison nor the new exception supplies body/lifetime authority or changes variable-reference policy.
- **Existing dynamic locator boundary:** For the same evidence credential, explicit Session export returns session_metadata_redacted because its original matcher includes the actual evidence/sessions/session-<hash>.json path. No private selection time/body or mutated identity explains that difference. The canary overlaps a fixed prefix of a generated operational ref, not a hash credential-flow claim. The accepted fixed-namespace exception does not cover that variable preview path or remove its whole-reference check, even where the collision is confined to its fixed prefix. Existing Session refusal/healthy refresh and peer partial-effect behavior are unchanged.

All matching original definitions/recorded facts and complete successful view bytes remain as already proved; this assessment changes no product/test/dist implementation and demonstrates no new public/SDK/model delivery. Four metadata frames/keys and one host are not workloads or native memberships. The parent records the exact positive PID/all frames before assert/await, child full frame before imports/await, and complete stdout/stderr/actual close0/null before normalization. Exact actual saved identities plus fresh ESRCH-only absence immediately precede successful scratch deletion; child exit remains not_asserted. An initial copied-parent syntax error was caught by node--check before launch, so it created no failed host or missing child frames.

**Accepted A2 public fixed namespace (owner decision, 2026-10-24).** The owner selected option2: an explicitly closed set of entirely compiler-owned fixed relative role/index-entry locators is public protocol namespace. No original-literal refusal/masking is required merely because a captured credential happens to spell one of these locators or a substring. The authoritative constructor remains runs-context-index.ts EXPORTS/runContextExportPath, with exactly these role-path pairs:

```text
recipe     evidence/recipe.json
result     evidence/result.json
trace      evidence/trace.jsonl
control    evidence/control.json
execution  evidence/execution.json
artifacts  evidence/artifacts.json
sessions   evidence/sessions.json
stdout     evidence/stdout.log
stderr     evidence/stderr.log
```

The same admitted role-owned value may appear in the export's returned entry, index.entries[role].path and private whole-view response.path without gaining a new privacy or authority meaning. Closed role/schema/path matching and all existing genuine producer/original identity/owned source/fence/budget checks still apply. Adding a role/path needs explicit namespace contract review, not automatic prefix widening. This is a field/provenance exception: an arbitrary user/Recipe/original body/declaration value equal to one of these strings is not converted into compiler vocabulary or exempted from its original owner policy. No runtime whitelist, visibility flag, permission carrier or helper is introduced.

The exception is not a blanket evidence/ prefix rule, path-suffix rule, normalization permission or basename exception. It never applies to a variable absolute root, index local_path/publication path, hash/selection ref or original source data. A constant context-index.json filename does not make its assembled absolute path public. A variable ref remains under its whole original policy even when its colliding portion is a fixed prefix: evidence/sessions/session-<hash>.json and primary/diagnostic/declaration/source/snapshot refs retain existing checks. Do not split off public-looking syntax to bypass those checks, change exact refs into masked/shortened locators, or silently omit mandatory peers. Existing source/view/catalog/index/cleanup effects, earlier historical bindings, exact errors, source-time/typed-fact and dynamic Session guards stay unchanged. Knowing any fixed address grants no body/read capability, original issuance, work/native/scope authority, ordinary caller/producer-loss/restart lifetime or default/public/range routing. This contract does not promise that every output byte avoids every original credential spelling.

The fixed-locator decision gate is closed; the existing fixed-path writer/read behavior already conforms, so no product/test/dist behavior change or reissuance/repair of old data is necessary. The retained one-host4frame inquiry now supports the approved fixed-path collision behavior without being rerun or promoted into a complete envelope certificate. The separately accepted variable captured_at privacy rule below does not authorize masked clocks, reconstructed issuer/domain or a public exception for other generated data. Remaining source-derived/variable-reference/emission/read-lifetime and legacy-source contracts, canonical Trace preloss, carrier/native and integrated release gates are not approved or closed by this decision.

**Pre-repair wrapper assessment — variable file observation is not fixed namespace.** The five producer-backed whole-role replies share a closed envelope: state/basis/media/mutable are program vocabulary, returned identity is complete original-privacy checked before source probes, path is an exact approved fixed role locator, bytes_total is the admitted saved size, view is the role-owned historical/current-file projection, and unchanged is a local observation fence rather than a serialized capability. Unavailable reasons are closed codes, not an arbitrary caught error payload. Control run_status is selected from running/stopping/done/failed by withRunProducerEvidence/readProducerEvidenceStatus, not a caller string passed through its private capture helper; Trace journal summary is bounded aggregate counts/booleans. Execution reported state/semantic/capture-persistence tokens have closed enumerations, while its free strings/ids/times/signal retain their separate body/fact rules. These classifications do not certify all data from another role or turn a runtime-selected report into native truth.

A new source-only inquiry uses one captured host/three upfront controlled metadata frames/genuine keys and zero workloads. Original present/absent full ISO timestamp canaries have opposite live values before first natural code0 no-field canonical acceptance in privileged same-runtime composition and actual five-role publication. Supported original stored-clock absence isolates saved captured_at. Every untouched baseline is available with original-safe capture metadata; no factory, key, first-result binding or original metadata is recreated after publication.

Twenty-two same-byte-length saved-view-only edits cross the two timestamp frames: public valid ISO, the complete predeclared private ISO and Recipe-only invalid24-character controls. The complete original snapshots/canonical result/journals/manifest/session/index and every non-selected-view byte remain unchanged, the index remains freshly available, prior observation fences become false, and readonly probes leave the edited bytes untouched. Explicit test restoration of the original view restores each supported historical read; it is neither publisher rollback nor a genuine new issuance.

- Before the repair below, Recipe removed captured_at from the fields compared against projectCapturedRecipe(original) and required canonical ISO syntax, but not original successful timestamp binding or original privacy of that field. Both public dates remain available. In the original-present case, replacing only captured_at with 2001-01-01T00:00:00.000Z returns available/original_producer_projection_match with the entire original private literal and a fresh unchanged fence. Original full matcher on that returned field is false. The same saved date under original absence/opposite-live presence remains available and full matcher true. Invalid ISO refuses view_invalid. This is mutable current-file data in a deliberately semantic reader, not merely a colon colliding with independent clock syntax or a proof of original writer/time authenticity.
- Trace/Control/Execution/Result reject both valid-date edits as view_mismatch because each has its own complete successful publication-byte binding. That does not supply Recipe's missing field disclosure policy, certify a private timestamp that was present at first publication, or authorize weakening those stronger historical bindings.
- In a third upfront root-reference frame, a complete private directory segment is present in actual index read/publication local_path; full original comparison is false. All five actual whole-view responses and a selected saved Session response omit that absolute segment and return their own admitted relative paths. The fixed namespace is not broadened to that internal path. readRunContextIndex explicitly documents kernel-only metadata/no local_path exposure permission. readRunSnapshotFacts can likewise retain raw cwd/index references internally; existing original reference admission and the compositor, not a fixed basename or fact DTO, own curated exposure. This proves the inspected private response boundaries, not universal safety of raw helper callers/default/public paths or body/lifetime permission.

Parent/child exact PID/frame/Run/generation/owner/state and full stdout/stderr/actual close0/null are retained before normalization and validated; fresh captured-host ESRCH-only absence immediately precedes successful scratch deletion. All three frames are metadata, not native memberships; child exit remains not_asserted. No failed host/root, new workload, real command exit, external-model, packed/SDK delivery or original issuer/clock/native proof is asserted. This assessment changes no implementation/test/dist and preserves the accepted closed fixed namespace and existing Session/source/fact/known-cleanup/partial-effect contracts.

**Accepted captured_at privacy and bounded implementation (2026-10-24).** The owner approved complete original privacy for variable captured_at in all five producer-backed private role views before writer emission and saved-reader return: exact safe time or whole-view refusal, without masking/fabrication/repair, a new Recipe publication carrier or stronger issuer/time authority. Each existing runs-context-exports.ts capture owner now reuses its original complete pure matcher immediately after the existing file-time sample, before view encoding/publication; Result also checks before diagnostic-source retention. No privileged timing anchor moves and no new sample/clock/carrier/registry/module/default/public route is introduced.

Writer refusal is recipe_metadata_redacted, trace_metadata_redacted, control_metadata_redacted, execution_metadata_redacted or result_metadata_redacted. It creates/renews no source/view/publication binding, preserving canonical code/result/first bindings, prior successful bytes/binding and independent index effects. Explicit index publication may record unavailability and disable an old follow without deleting the old view/source; explicit safe refresh remains valid. Known cleanup reports and original admission/identity fences stay unchanged.

All five saved readers independently check original captured_at privacy before freeze/return/response counts. Recipe keeps canonical ISO validation and original semantic fields, then refuses a private saved capture time as view_metadata_redacted; public safe ISO file-time edits remain available, never authenticated original issuance. The other four require their own complete successful publication bytes first, then check decoded captured_at before freeze/return. Saved tamper therefore retains view_mismatch precedence; the matcher cannot mint publication authority or borrow another role's binding. Older unsafe data is not certified through success, a saved flag or new writer behavior.

Two maintained properties cross original time presence/absence versus opposite live policy and absent/prior publication over all five roles (twenty writer configurations). A controlled constructor-only file-observation driver leaves explicit-date parsing and Date.now unchanged; it is not an original/native clock. Refusal precedes first view/diagnostic-source creation and preserves history/index/canonical bytes, while original absence remains public despite live presence. Independent index refusal and healthy refresh retain their actual effects. Same-size saved-date edits retain a healthy index: Recipe private time refuses readonly without repair, public time stays semantic (including a fixed namespace collision control), and the other four retain byte mismatch refusal. Forbidden mutation/discovery/current-time/process counters are checked outside production catches. A new matched private-time publication cannot be minted through the corrected writer; the four post-match privacy checks are source-reviewed defense, not a fabricated old issuer test or relaxed binding.

The existing source/packed fixture reuses its two safe original keys/frames and already predeclared complete time canary. All five direct writers refuse that capture time while historical bindings and old view/index/source/root/metadata bytes survive. Same-size saved private-time edits yield Recipe view_metadata_redacted versus four view_mismatch results; explicit restoration is not reader repair/new first issuance. Public Recipe file time remains available. No host/key/frame/result/selection/workload is added, no ordinary SDK/model delivery or native time/closure is certified, and complete stdio/actual close/exact-frame/fresh-ESRCH cleanup remains required.

This closes only captured_at disclosure and its bounded implementation. The accepted nine-path fixed namespace and all variable absolute-root/hash/selection/source-time/dynamic Session guards are unchanged. Internal index updated_at/local_path and raw snapshot reference metadata is not automatically exposed/certified by this field rule. Curated automatic Session/legacy excerpt certification remains separate from the accepted same-session ordinary file-research route; canonical Trace preloss, live timing carrier/trusted shutdown, native membership/closure and integrated default/public/release gates stay open. No complete-envelope/issuer/global immutability claim follows.

**Private source/packed context acceptance.** The installed-package test `source and packed private context preserve Recipe correspondence and Control/Trace/Execution publication without authority reconstruction` now reuses the existing fixture hosts in tests/fixtures/context-private-evidence.mjs (renamed from recipe-private-reading.mjs). It imports actual source TypeScript or npm-packed compiled modules and keeps role contracts distinct: Recipe complete original metadata/stored-policy correspondence, Control original input/error privacy plus historical publication, Trace historical publication and Execution historical metadata publication without target/body authority. Result now has its own complete historical publication-byte correspondence, separate from immutable first-result source bindings and selective diagnostic reads. Each layout still has one captured producer host and zero workloads. Five baseline issuer admissions remain deliberately separate in the original exact Run/generation/frame: baseline, genuine foreign ES-module-instance issuer, genuine same-module key without a Trace publication, oversized original capture and large Recipe response. The ten additional predeclared controlled identity frames below add ten genuine keys in that same host, bringing each layout to fifteen keys, not fifteen newly born processes or workloads.

Recipe retains its literal/frozen data, same-size origin edit, live policy non-renewal, source loss/explicit restoration and independent original/source/response budget assertions. Control uses real journal admission/claim/failed-status APIs for controlled records, not workload or handler failures; known origins and sensitive input/error strings are withheld on first export and after live metadata drift, including the actual 320-character split-origin boundary. Current queued count/capacity remains dynamic; exact header generation and canonical control ids are checked. The strengthened fixture now also requires the entire 8036-character generation in every visible Control row before and after metadata drift. Additional private owner properties below cover long Unicode ids and unsafe/oversized row omission; standalone Inspector previews remain a separate unchanged contract.

Trace requires the original publication key/module: copied/serialized/foreign issuer keys, a genuine unrecorded key and a reloaded exports module cannot adopt healthy saved data. Same-size known-origin and privacy-safe invented summaries refuse despite available index metadata. After explicit fixture restoration, genuine journal append and temporary journal loss leave the original historical view readable with frozen data, without source replay. Selected view loss refuses rather than returning private retained expected data; explicit successful publication replaces the binding and invalidates the prior fence. Independent original-admission refusal, a bounded authentic Trace view whose complete response exceeds 64 KiB, and one-byte source overflow are exercised in both layouts. Oversized original metadata cannot borrow healthy live metadata for Recipe, Trace read or Control publication. All source restorations are explicit fixture acts, never reader repair.

The existing parent harness captures exact PID/frame before assertion/await, persists stdout/stderr/actual close evidence before child-failure normalization, validates the one-row context-private-fixture-v1 manifest with producer exit not_asserted, and freshly ESRCH-probes immediately before successful state removal. Primary/frame/probe/persistence errors retain state and exact causes. No root result or new host/workload is introduced; no parent capability reconstruction, public SDK/tool route, ordinary/restart body transport, historical file-issuer authentication, range or native closure proof is established.

Private `writeRunTraceContextExport` writes `evidence/trace.jsonl` from one admitted canonical-journal read, not the unified Trace merger. Its first JSONL record has `schema: "run-context-trace-v1"`, exact Run/generation/capture time, `source_scope: "canonical_journal"`, newest-first order, conservative partial/redacted coverage, journal summary, known read-event omissions and exact shown/omitted preview-row counts. At most 40 projected rows follow; the complete file stays within 64 KiB by dropping oldest preview rows, never slicing JSON. `projectRunTraceJournal` is a data-only port over that same parsed snapshot, preserving source IDs/order and shared summary/detail secret redaction; Recipe provenance supplies the existing runtime-origin privacy rules from the genuine original producer-admission snapshot, not later metadata or caller-object changes. This complete privacy input is admitted before opening the journal; over-budget original metadata yields trace_admission_unavailable without reading a journal body or borrowing healthy live metadata. Missing/copied producer admission remains rejected by the existing runtime-local guard. Original privacy presence or absence stays fixed, not renewed on first export/refresh, while event contents and counts follow the current admitted journal. The independent current metadata budget accepts an exact 1 MiB source, refuses one extra byte or malformed UTF-8, and never replaces prior view bytes on refusal. The captured ownership/root/marker/metadata and journal stamps remain fenced through view commit; observed same-generation substitutions refuse retargeting without internal recapture. These are observations, not immutable storage or exhaustive filesystem-race immunity. It does not read Control, process streams, execution, artifacts or private session bodies. Missing source stays pending without an invented file; malformed/incomplete/oversized/unreadable or observed-changing source stays unavailable. The source journal is capped at its existing 4 MiB bound, while privacy metadata retains the independent 1 MiB observation bound after producer admission. Journal compaction, bounded-reader event omissions and view omissions are separate evidence; diagnostics/read omissions never mean complete history. A generation-bound view is an owned-state observation, not authenticated per-event spawner membership, whole-scope closure or native authority. `writeRunTraceContextIndex` joins the actual JSONL role through the same separate producer-admitted index commit, preserving canonical storage, accepted natural results, partial effects and exact write failures. No ordinary refresh or public routing is wired.

**Saved Trace authority/format assessment.** A disposable source-only genuine-producer inquiry materializes two canonical events and their real JSONL view/index, then independently edits only one own-view summary. Both a known-original-origin edit and a privacy-safe invented summary preserve the exact encoded size, full header/capture/coverage and every other item field. The owned metadata index remains identical and available while reading zero selected-role body bytes; canonical metadata/journal/index bytes stay unchanged. Original Recipe privacy can detect the known-origin violation, but the privacy-safe forged summary is already a redaction fixed point. Both fail complete correspondence to the original-privacy projection of the unchanged canonical journal. Thus neither available/redacted metadata, schema/format checks nor reapplying original privacy alone establish saved event/header correspondence. The pure projection is also lossy: changing a private password to another same-sized private value yields identical projected items; sanitized DTOs cannot recover original source or issuer authority.

After explicit fixture restoration, a genuine third journal event leaves the earlier two-event view and index unchanged/available. Reprojecting the entire latest journal now disagrees with that authentic earlier view; an explicit writer refresh produces three matching rows. Latest-journal correspondence is therefore a possible distinct fresh-source check, not a verifier of arbitrary historical saved snapshots. It must not label the earlier publication forged, silently export/repair it during a read, or present current counts as its captured history. The existing original producer metadata pins Recipe privacy, not the dynamic journal contents/summary at every past publication.

The narrow historical path identified by this assessment is to retain the original producer's admitted Trace publication projection in the existing role owner only after successful view commit, then compare the complete selected saved header/items to that runtime-local original data. Failed/uncertain publication must mint no new binding, even if a file was replaced before an error; no later index, readable view, path/hash or DTO can reconstruct it. This is planned same-runtime admitted-data correspondence, not authentication of who physically wrote the file, an ordinary/restart transport or a generic registry. No Trace publication binding or saved reader is implemented by this assessment. Reader result/query/range schema remains unchosen; the existing 64 KiB JSONL view bound, independent 4 MiB journal writer-input bound and 1 MiB original/current metadata bounds do not themselves implement or authorize a reader response. A later whole-response bound must apply independently, without clipping rows or identities.

One successful source host/zero workloads performed the inquiry; the parent captured positive exact PID/frame before assertions/await, the child retained its frame before kernel imports, stdout/stderr/actual close were persisted before failure normalization, and fresh parent ESRCH immediately preceded successful scratch deletion. Only controlled own view edits and normal journal APIs were used; no target/session/Control/execution/stream body, root result, work delegation, new kernel interface or public/source-packed route was exercised. Existing genuine key copy refusal remains intact. This is evidence for the private next slice, not a new clock/native/ordinary read authority gate being crossed.

**Private publication-bound saved Trace verification.** writeRunTraceContextExport now retains its already admitted canonical JSONL string and owned root in a per-Trace WeakMap keyed only by the genuine original producer, after publishContextView returns successfully. Capture unavailability or a thrown write/lifecycle-release error mints no new binding, including errors after physical replacement. A prior binding remains only for its original data; an explicit later successful publication may replace it. View and index are separate effects: a later index failure does not undo the committed view or its admitted binding. No binding is persisted, serialized, reconstructed from a path/hash/flag, keyed by actor id, or shared across producer objects/modules/restart.

Private readRunTraceContextView(stateDir, producer) first requires its original runtime-local producer metadata and this exact module's publication binding, before filesystem probing for missing/copied/foreign/lost admission. It independently admits current owned identity/index/Trace role/evidence and a strict regular UTF8 saved view, compares the entire canonical JSONL encoding with the retained admitted publication, then returns recursively frozen {header,items} with basis original_trace_publication_match. Metadata is an independent 1 MiB observation; selected source and complete encoded response each have independent 64 KiB limits. Whole-response overflow refuses rather than dropping rows or clipping identities. JSON object reordering/whitespace is not a Trace byte-binding renewal even when decoded values match; Recipe's pure original-data correspondence remains a different contract. Same-size original-origin, privacy-safe summary and header edits all refuse despite a fresh available index. Current metadata/privacy changes cannot reproject the saved data, and journal append, compaction or loss does not invalidate an otherwise matching historical view. Only an explicit successful writer updates the retained publication.

The private readSavedContextViewSource shares owned index/evidence/selected-view observation mechanics with Recipe inside the existing owner; it supplies no producer/body authority and exposes no override. Recipe keeps its prior complete original-projection/stored-policy checks, semantic key-order equivalence and literal values. Trace's returned fence additionally checks that the same original publication binding remains retained, alongside owner/marker/metadata/index/evidence/view observations. Neither reader probes native/time, reads root outcomes, discovers sources, opens another role body, acquires work/evidence lifecycle locks, exports/repairs, ACKs or schedules. These are cooperative runtime-local admitted-data comparisons, not authenticated physical file issuance, durable immutability or exhaustive race immunity.

Eight Trace properties cover historical frozen data after append/loss/live policy change, original optional-owner absence, missing/copied/foreign/alias/reloaded-module/original-budget admission before probing, both same-size edits and full header correspondence, failed pre/post-replacement writes and separate committed index errors, selected-body-only/no-effect reads, post-body root/marker/metadata/index/view substitution, corrupt/denied/symlink/failed-close refusal, and exact 64 KiB source versus independently oversized response/one-byte overflow. The seven owning Recipe properties remain green on the shared observation helper. A separate source-only genuine producer witness now reads the authentic earlier two-event view after journal growth, rejects both controlled edits, refuses a genuine but unrecorded producer, and observes explicit three-event publication replacement; its one host/zero workloads uses exact frame/full stdio/close evidence and fresh parent ESRCH cleanup. This does not implement ordinary/producer-loss/restart transport, a public/packed role journey, Control/Execution reader, range schema or native/timing/visibility authority.

Private `writeRunResultContextExport` now materializes `evidence/result.json` (`run-context-result-v1`) as explicitly limited `content_scope: "canonical_outcome_metadata"` with `primary_text: "not_included"`. The view does not assert that no primary source exists elsewhere; the initial primary publisher below retains its separate source and canonical binding. The normal async runner records code/command/flags/errors in canonical `result.json`; its formatted text goes to stdout and can already be clipped. This view therefore never treats result metadata, arbitrary `output`/provider fields or stream tails as complete primary text. It uses `readRunNaturalOutcomeSnapshot` for one admitted source classification: accepted natural data yields only `done`/`failed`, while post-stop capture remains `capture_only` without a terminal status or stop-cause claim. Producer-reported killed/truncated flags are separately labeled, never promoted to forced-stop/scope proof. Only safe typed code/time plus allowlisted command/error/failure-reason strings are projected through shared Recipe-provenance/secret privacy fixed to genuine producer admission, not live values or Recipe refresh. Canonical source and metadata capture are independently limited to 1 MiB; the encoded view stays at 64 KiB with conservative partial/redacted coverage, without clipping generation identity. Existing genuine evidence admission still rejects malformed, stale, unbound or coercible root results before export; that authority refusal is not caught or weakened. Later source changes, source-size limits and partial publication retain prior evidence and exact errors without implicit retry/rollback. `writeRunResultContextIndex` separately admits its actual role while preserving other entries. Metadata-source identity/stability checks are shared by the captured-metadata exporters. Broader primary selection and ordinary diagnostic-source delivery remain mandatory A3 integrations, not satisfied by this metadata-only role.

**Original Result publication identity correction — full raw-scalar literal policy.** captureResult now admits bounded genuine original metadata and requires full run/generation/optional owner identity unchanged under that original privacy before its outcome projection or diagnostic source retention. A changed identity yields result_identity_redacted with no new view/source and no rewrite of prior/orphan evidence. Its independent index publication may record that refusal; it cannot modify canonical result/binding. Existing lifecycle admission still validates real root authority before invoking captureResult, so this is not a promise of zero canonical-result admission reads or a bypass for malformed/stale outcomes.

createRunResultDiagnosticsPublisher separately captures that full original identity decision before work alongside fixed text privacy. Only in its genuine active first-result callback, after one-shot attempt admission, does a changed identity return diagnostic unavailability identity_redacted, before field projection/source I/O. Missing/over-budget original privacy retains privacy_capture_unavailable instead. This is metadata unavailability, not an I/O failure: readFailure stays undefined, canonical code 0/7 and natural acceptance remain unchanged, and post-stop capture remains nonterminal. Duplicate results invoke no callback/repair and cannot replace first unavailability after a healthy live edit. Source/view/index/root effects remain separate, existing errors stay exact, and a later context export cannot renew the first canonical binding.

Seven owning property families partition original absolute-origin/secret run/generation/owner, captured literal/JSON-escape identity with canonical code0/7, legacy context projection and independent index refusal, safe/absent/logical/newly-added-live-origin identities, immutable first unavailability and untouched source/view orphans with zero selected-source probes, copied/getter/missing/original-budget failures, and capture-only nonpromotion. The source/packed private context hosts reuse their ten predeclared metadata frames for controlled canonical code0/7 result records and actual original publishers. Unsafe frames create no diagnostic source/view, preserve explicit first unavailability and root code, and reject duplicate replacement; logical/absent-owner frames recover projected diagnostic metadata. These ten records are controlled canonical metadata, not executed commands/OS-exit or native-closure witnesses; host count remains one per layout, zero workloads. The original baseline frame still has no root result, labeled baselineRootResultAbsent rather than implying that all controlled frames lack results.

**Result readonly reply privacy is not closed by new publication.** The saved-role and eligible-outcome readers still accept only expected identity DTOs plus owned saved/canonical files, not a genuine original producer privacy capability. A readonly follow of two retained pre-correction genuine sources confirms that both readers return private generation or owner identity with available index and matching source/view/root fences, while selected diagnostic fields remain correctly redacted and live Recipe origin is already different. All checked marker/metadata/root/index/view/source bytes remain unchanged; no producer is reconstructed and no retained failed state is modified/deleted. This is a precise legacy/DTO-only reply boundary, not a demonstrated new public-tool leak or permission to infer original privacy from privacy_scope, hashes or file readability. New publication refusals prevent these newly produced unsafe descriptors but cannot certify an older/orphan source or a separately added reply identity. Actual consumer/emission requirements and original read lifetime must be resolved before widening or claiming that path safe; no new carrier, protocol flag, body permission or silent reference truncation is adopted here.

**Curated Result consumer/emission boundary — historical assessment, not an ordinary file-access gate.** Maintained lib/scripts call sites use readRunResultDiagnosticOutcome only from eligible collectRunCompletionBatchMembers; readRunResultDiagnosticsSource has no ordinary runtime caller there. Collection does not copy reading.identity or ownerId into a completion member. It copies the admitted binding and excerpt, while the transition separately supplies full member run_instance_id. The renderer emits the complete diagnostic source descriptor including generation, and completionInventoryText captures full member generation/binding for omitted-row recovery. Thus removing an unused standalone reply owner/identity does not solve descriptor/member identity emission. Owner is absent from this model-card/inventory path, not proved absent from every kernel DTO or consumer.

A bounded source-only probe builds controlled eligible transitions from two retained pre-correction genuine canonical natural records and invokes the actual collector, pending packet admission, reload and pure model formatter. It never recreates a producer, launches work, uses a public watcher/SDK event, sends to a model/operator session, marks acceptance or mutates/deletes the original retained state. Both selected diagnostic texts remain correctly redacted. The private generation survives through member/descriptor into inline model-message projection; the private owner is omitted by that path. A separate packet containing the one genuine retained member plus 64 explicitly synthetic metadata-only companions (not 65 born Runs or workloads) forces a captured inventory: it likewise preserves raw member generation/descriptor, not owner. Exact marker/metadata/root/index/view/source hashes remain unchanged; packet journals/inventories exist only in isolated temporary consumer storage.

The shared diagnostic label now says admission privacy for recorded fields, rather than a blanket admission privacy applied statement. Literal previews, complete references, generation/hash/counts, byte omission and immutable packet behavior are unchanged. The owning literal/reload/phase/no-source-I/O property enforces the scoped wording; no new read permission, identity masking, source repair or source/protocol format is implied. This is factual field-scope correction, not legacy reply privacy remediation or visual/public delivery acceptance.

**Source authority, observation, recipient lifetime — pre-descriptor-repair assessment.** Three separate obligations meet at ordinary delivery. Original source authority covers the captured selection/privacy and role-specific data basis; file observation covers current owned generation/schema/UTF8/size/hash/source fences; recipient authority covers which original caller/session lifetime may receive a new emission. The private Recipe reader uses original semantic data, while Trace/Control/Execution/Result use their own complete successful publication bytes. All five additionally retain the original identity/captured_at policies. A current observation or recipient owner string cannot recreate those original source bases, and a source capability does not authenticate a new recipient.

- admitRunResultProducer requires self-PID, native noncontradiction and work admission before the target first result/stop. Its original snapshot and the four separate publication maps are module/runtime-local. Re-admitting from healthy saved metadata after terminal state is both refused and the wrong original authority. A still-live worker in another process does not give its caller a genuine key. Same-runtime historical reads after canonical/source loss or known cleanup failure do not demonstrate a capability surviving actual issuer-process exit in another runtime.
- async-runner creates primary/diagnostic/inventory publishers from its own original key before work. The parent fresh-launch onSupervisionClockCaptured handoff retains an original clock and private curated cwd/index reference reader only; this is not role-body/read/publication permission. The opt-in coordinator binds readiness plus the original sessionManager object and owner, not wrapper/string identity. Default collection does not acquire that source-body authority merely because the private epoch tests pass. Bare-dispose/trusted shutdown and delayed same-owner lifetime limits remain as already gated.
- Ordinary eligible diagnostic collection takes identity/status DTOs and current owned result/source data through readRunResultDiagnosticOutcome. It does not require the original key or a fresh producer-PID proof and reads no role view/index. readRunResultDiagnosticsSource is a distinct DTO-only saved-source port with no ordinary maintained caller in this closure; neither is promoted into a complete private whole-view verifier. collectRunCompletionBatchMembers copies binding/excerpt plus transition generation, not reader identity/owner. Later parse/freeze/journal reload and literal formatting preserve data but cannot supply original issuer/privacy or recipient transfer authority. Model/session acceptance remains a separate existing delivery phase, not a source/privacy certificate.

A fresh source-only witness on the current post-captured_at candidate narrows the issue beyond retained legacy cases. One captured child host/two upfront metadata frames/genuine keys and zero workloads publish natural code7 diagnostic metadata through the actual first-result callback (one callback per frame). All original header identities are safe; the controlled variable absolute root contains a complete predeclared credential in original-present versus opposite-live absence control. Both diagnostic bodies are public text with matching complete source hash/bytes; the original matcher on the issued source descriptor is false only for original presence. At that assessment checkpoint the first-result callback checked original header/text privacy, but not the full generated source descriptor. The later Result context guard did not run on this ordinary first-result path and supplied no certificate for it. The original-issuer repair below closes that narrow new-publication gap, not the separate DTO/lifetime gate.

After full child stdout/stderr/actual close0/null, the separate parent verifies exact frames/owned metadata and fresh child ESRCH before any consumer read. It has received zero original keys and never calls a producer constructor or repairs source/state. Its ordinary DTO eligible reader is available; a controlled transition built from the exact new canonical natural result reaches the actual collector, pending packet admission, journal reload and model-message formatter. The original-private absolute root segment remains in the complete source descriptor and message projection, while the error excerpt remains public and reader identity/owner are omitted. The absence control yields the same path spelling as public data despite opposite live privacy. No source/view/index/root/marker bytes change. This is current source/reference disclosure evidence and actual post-host-exit file/packet behavior, not actual public watcher/SDK/model delivery, original permission handoff, terminal OS-exit authority or native scope closure.

The parent retains exact positive PID/Run/generation/owner/state/full upfront child frames before assertions/await, then actual saved identities/full stdio/close before normalization. Its final fresh ESRCH immediately precedes deleting successful scratch state, not a timeout/denied probe or guessed PID. Child exit remains not_asserted; keys/controlled code7records are not born workloads. Only isolated parent consumer journals are new delivery effects; packets stay pending, with no send/ACK or handled markers. Prior failed roots remain untouched.

**First-result diagnostic descriptor repair, not transport-authority adoption.** After explicit scoped implementation authorization, createRunResultDiagnosticsPublisher now retains its complete original pure matcher next to its original text redactor. Once actual allowlisted fields exist and current metadata is admitted, it constructs the exact source path/generation/SHA256 descriptor and compares all its raw strings under that original policy before descriptor counts/budget, decode, retained source I/O or canonical first binding. Private refs return whole diagnostic unavailability source_reference_redacted; no masked locator, new capability/flag/API, workload code/acceptance change or readFailure is introduced. Header/privacy-capture/body-budget/quiet not_recorded precedence and exact I/O/source-conflict effects remain intact. Original absence stays public despite a later live secret. No-field outcomes do not inspect a prospective unused private path/hash. Duplicate roots invoke no callback, renew no first binding and repair no source, including accepted unavailability.

Two maintained properties use pre-admission exact planned path/hash canaries and verify actual healthy publication bytes/hash/fields. Sixteen configurations cross path/hash original presence/absence versus opposite live values, canonical0/7 and natural/post-stop capture: private refs bind null/unavailability before target probes, keep real codes/acceptance and original metadata; public refs remain complete and recoverable. Four further path/hash versus present/no-field cases retain existing source/view/index orphans without probing/overwriting them. Source conflicts/EIO/authority/partial writes retain their existing owning properties, not a normalized privacy error. The original producer is never re-admitted after terminal publication to create a canary or hash proof.

A separate source/compiled-dist validation reuses the exact captured-child/separate-parent topology of the pre-repair witness, with fresh scratch state per layout. In both layouts the new original-private descriptor becomes immutable unavailability with no source directory, so after full child close/exact-frame/fresh-ESRCH proof the parent DTO reader/actual collector/pending packet project that refusal with no source ref, excerpt or legacy fallback. The original-absence/opposite-live control retains the complete public path/body/hash and frozen reload text. No original key crosses runtimes, no actual SDK/model delivery/ACK/workload occurs, and this does not turn ordinary DTO observation into original source/emission/lifetime authority. Existing source/npm-packed SDK/private fixtures retain their own separate positive/error/identity coverage; no negative issuer is fabricated from a saved flag, and no repository .mjs fixture or live registry is changed.

This implements only the existing original-issuer exact-variable-reference rule. Older curated sources and packet replay remain outside its original-privacy proof. The subsequently accepted same-session research decision supplies ordinary map/read permission, not a retrospective privacy certificate or a change to packet replay.

**Owner decision supersedes the ordinary read/lifetime gate.** Missing original source/producer/publication keys do not make owned Run files unreadable to their actual owning logical Pi session, including fresh detached sources and retained/legacy files after resume. Kernel establishes the current logical-session ownership and exact Run/generation/root before issuing navigation; caller same-id claims or saved phase/hash/privacy labels are not that binding. No original-capability carrier, global legacy fail-closed or old sessionManager lifetime is required for research.

Accepted history and first bindings remain data to preserve, not repair/replay targets. This decision does not recertify automatically embedded older excerpts, promote partial diagnostic readers into whole Result verifiers, change pending/accepted packet phases or infer terminal/clock/native facts from readability. Stronger curated publication/privacy contracts remain separate and must not be reinstated as ordinary file-access prerequisites. A2's actual-reference acceptance follows the [same-session research integration boundary](#same-session-file-investigation); it never certifies older curated content or activates stronger automatic body publishers.

**Remaining source identity assessment and captured-literal gap.** A source-only inquiry uses one captured private host with nine predeclared controlled metadata frames: baseline, original absolute-origin and generic-secret generation, original private owner, safe logical/absent owner, and generation/owner equal to a non-token-prefixed literal credential captured under values.api_key. Genuine runtime producers and each owning API are used, not copied DTO admission. The primary witness is privileged kernel selection of one synthetic full-memory command/attempt whose complete file exactly matches its in-memory text, not an executor/native workload or ordinary actor publication permission. Selected sessions are explicitly recorded synthetic Pi v3 assistant previews, not a live SDK session. Canonical code0 is controlled metadata; no real workload/OS-exit or public/packed acceptance is claimed.

Primary publication correctly projects the full selected text before preview/counts, removing Recipe origins, token-pattern secrets and the captured literal credential. Nevertheless, its original publisher creates an available source descriptor containing private generation, and the readonly source response returns private generation/owner identity. The declaration-inventory publisher likewise creates source/header/view/reference metadata with private generation; its readonly source/result follows expose private identity. The declared Recipe-origin target path intentionally remains an operational reference, while a different declaration path containing the captured literal credential is withheld. Both declarations remain metadata-only, not_observed/not_read/not_asserted, and instrumentation records zero target stat/open/read/discovery calls. This positive artifact exception does not authorize private header identity.

The original selected-session writer correctly withholds origin/token-sensitive assistant text and user/thinking/provider data, yet publishes raw private generation in both catalog and selected preview headers; the saved-preview reader returns private owner/generation. Refresh after changing only live Recipe origin keeps the originally projected assistant body unchanged. The standalone raw three-argument preview then differs because its already documented per-call privacy changed; that distinction is not a new writer body leak or an adoption of original privacy in the raw API. Safe logical-suffix and absent-owner cases remain available under their respective current contracts.

The extra literal cases expose a narrower root defect in the earlier shared identity comparison. A credential value captured under a sensitive key is masked by primary text privacy and withheld from an artifact path, but not by Recipe-origin/generic-pattern identity comparison when it lacks a recognizable token assignment. It therefore remains in primary/inventory generation references and selected-session headers; a comparative genuine Recipe publication/read and Result context export also accept and echo that literal in their header/reply identity. An available index, successful original publication, correctly projected text, generic secret test or previous origin-only regression does not prove captured-literal identity privacy. The comparison must use the owning complete original literal policy on raw scalar references, not JSON-encoded strings where quoting/escaping can hide a literal. This assessment does not silently widen session body policy or the artifact operational-path exception.

That assessment itself changed no implementation/tests/distributive. It motivated the shared original identity captured-literal correction below (including Control row references); the subsequent own-boundary primary/inventory/session correction is recorded below, not supplied by that assessment. Existing source/body/byte limits, accepted result codes, first bindings and separate source/view/catalog/index effects must remain unchanged. Post-producer/DTO-only identity authority remains the separate contract gate above; new writer guards will not certify earlier sources. Both native inquiry runs use immediate positive host/frame capture, complete stdout/stderr/close persistence before normalization and fresh captured-PID ESRCH immediately before successful scratch deletion; the first seven-frame positive matrix and the expanded nine-frame matrix are distinct observations, not added acceptance counts. The child never certifies its own exit. These are bounded private source counterexamples, not proof of an ordinary public leak, producer-loss authority, new visibility permission, native closure or release readiness.

**Implemented captured-literal identity repair.** The nine-frame source assessment above remains pre-repair evidence for its comparative Recipe/Result guard cases. The shared original-backed guard derives one pure createContextIdentityPrivacyCheck from bounded genuine original metadata; its matcher remains private to each admitted caller. It first checks existing unbounded Recipe-origin/generic projection, then compares every raw string value against the same capturedSecretMask already used by full text/inventory privacy. It does not stringify first, invoke caller hooks, mint authority or refresh from live metadata. Quotes, literal backslash-u spellings, CRLF/BOM/U+FFFD/astral text and a one-character captured credential therefore cannot evade exact scalar matching. Presence uses empty removal privately, not equality with a display-mask result: a credential literally equal to [REDACTED] must also refuse. The existing body replacement default remains unchanged and no removed/masked identity is emitted. A secret substring in an otherwise logical id remains private even though a non-secret logical origin suffix is permitted.

Recipe/Trace/Execution headers, all four private whole-view returned identities, Result context and first-result diagnostic publication use the corrected check after their existing original-admission/budget/root guards. Control also checks its full header and each id/generation row through one retained matcher per capture; private rows disappear wholly with exact controls_omitted while raw capacity and foreign counts stay independent. Its standalone one-argument Inspector projector and input/error body policy are unchanged. No masked reference, source repair, new protocol/visibility flag, registry, module or producer/work permission is introduced; Result first code/acceptance/unavailability stays immutable and DTO-only old-source emission remains contract-gated.

Owning property families add plain/embedded/nested sensitive-key credentials and raw escaped/Unicode values across run/generation/owner, no filesystem probes in private response refusal even if an internal catch hides an assertion, unchanged original privacy after healthy live edits and newly introduced live secrets, safe/logical/absent owner preservation, Control whole-row literal omission with unchanged canonical journal and raw capacity, and captured literal Result code0/7 refusal before retained-source probes. Two older source-overflow witnesses used credential a inside generation-a/owner-a, so the new earlier identity refusal correctly preempted their quota assertion; the witnesses now use x outside those identities with the same 450000-character expansion, preserving independent source-budget proof rather than weakening privacy.

The existing source/packed metadata frames now include four captured-literal cases (plain and raw JSON-escaped generation/owner), increasing controlled frames/results from six to ten and genuine issuer keys from eleven to fifteen per layout without new hosts/workloads. Both implementations refuse private header/reply/source projection while preserving canonical code/first unavailability. A controlled literal Control row is omitted with pending capacity still counting both raw rows. The parent validates each upfront captured frame and saved run identity before fresh host ESRCH permits deletion; literal strings in these synthetic fixtures are not live credentials. This closes the shared original identity literal omission, distinct from the primary/inventory/session publisher integration below and still-gated post-producer identity authority.

**Implemented remaining original source-publication identity guards.** Primary, declaration-only inventory and selected-session publication now each require full original run/generation/optional-owner privacy at their own genuine producer boundary. The previously context-local createContextIdentityPrivacyCheck and capturedSecretMask moved unchanged into the existing recipe-projection.ts pure privacy owner; both publishers already depend on that owner. No new module, local graph edge, orchestration cycle, generic registry, saved flag, producer/privacy carrier, public route or body permission is introduced. The factory accepts only data for comparison, not evidence of a genuine admission; callers still authenticate their own original key/root/budget first. Full reference safety is not full body privacy.

createRunPrimaryTextPublisher captures its original identity decision alongside original full-text privacy before work. select still requires its exact single supported ordinary successful command/attempt; quiet not_selected and selection_not_supported keep precedence, with no failure/session/retry/composition widening. Once a supported selection is admitted, unsafe identity binds output:null/output_unavailable:identity_redacted before capture open/body reads or retained-source probes. Missing/over-budget original privacy remains privacy_capture_unavailable. This metadata refusal leaves readFailure undefined, canonical code/acceptance and the first binding unchanged, and never inspects/repairs earlier sources.

prepareRunArtifactInventoryPublication preserves absent/empty original declarations as not_declared, while nonempty private identity binds artifact_inventory:null/artifact_inventory_unavailable:identity_redacted before source/view/index I/O or target observations, without an evidence failure. The private retained-inventory helper independently checks full original identity before its selected source path, including legacy overflow fallback. For valid nonempty legacy artifact references, captureArtifacts also requires bounded original identity before per-target observations: artifact_admission_unavailable or artifact_identity_redacted. Declaration absence/malformed input and independent input budgets retain their own refusals. The normal legacy observed-reference policy is not redefined as declaration-only source permission. Original captured declaration/cwd correspondence, operational Recipe-origin path exception, withheld captured-secret paths, source/view/response limits, exclusive persistence and partial effects are unchanged; original targets are not probed to retain/follow an inventory.

writeRunSessionContextExport first validates its explicit selection and genuine bounded original metadata, then checks full identity before readRunExecutionReference or any session manifest/body read. A changed identity yields session_identity_redacted without preview/catalog/source replacement; the independent index may record that refusal. Missing original privacy remains session_admission_unavailable, malformed query request_invalid. The unchanged raw three-argument readRunSessionPreview remains per-call; it accepts no original privacy override or new authorization. Saved selected follows still validate stored bytes without live re-projection; old DTO-only bodies/references do not gain original admission from the new writer guard.

Four owning property families use genuine original producers plus controlled input metadata: all three identities (Run names only where format-valid), original origin/token/plain/escaped/display-marker secrets, exact safe logical/long-Unicode/absent owners, healthy/new-secret live edits, independent original capture budgets and copied producers. They count actual attempted selected capture/manifest/session/source/target probes even when a production catch normalizes an assertion; private cases make none. Retained/orphan primary/inventory/overflow-view/catalog bytes remain untouched, including 1800 controlled declarations. Controlled canonical code0/7 and duplicate replacement preserve their actual first metadata result/unavailability, not executed workload/OS-exit evidence. Positive source recovery keeps complete UTF8 text projection, no-target declaration recovery and original assistant preview policy without treating identity checks as body authority. An absent-owner positive witness omits ownerId in its request: own ownerId:undefined is already invalid to the shared owner reader, not a new product restriction.

The same ten predeclared source/packed metadata frames and fifteen issuer keys per layout now include nine privileged synthetic successful-command selection attempts, ten recorded synthetic v3 session selections and declaration metadata in the existing hosts, still zero executed workloads. Eight private frames refuse source/header/catalog publication before selected-body probes. Safe logical and absent-owner frames recover inventory/session metadata; the safe code7 frame deliberately keeps primary not_selected, while the safe code0 frame recovers primary text. No failed/session body permission or executor/public acceptance follows. Inventory snapshot fences include its captured index observation: a later independent session-index write invalidated the first expanded fixture's earlier binding. The corrected order captures inventory last, without renewing its source or weakening a product fence. Complete stderr/actual close1/null and the first failed host/frame are retained before normalization; successful fresh hosts require exact manifest/saved identities and fresh ESRCH before deletion. Earlier failed fixture state is not silently removed.

**Pre-correction usable-path display-mask inquiry — pure only.** The original reference-identity predicate detected presence with private removal, while inventory-entry/snapshot path classifiers still compared a display-mask result to the original path. A pure capturedSecretMask check with values.api_key equal to [REDACTED] left /work/[REDACTED]-output.txt unchanged, while empty removal changed it. That fixed point is not secret absence; unlike a display string, such a value cannot be promised as a usable reference. The pure check alone supplied no genuine original source/reference publication or public-leak proof. The separate owning correction below addresses those path classifiers; full identity checks alone never supplied it.

**Implemented raw captured-literal path presence.** Genuine original producer witnesses now demonstrate the pre-correction inventory entry path and snapshot cwd disclosures with safe run/generation/owner. A non-sensitive declaration name avoids accidentally treating the entire declaration value as a sensitive-key literal. With original values.api_key:[REDACTED], declaration path /work/[REDACTED]-output.txt previously survived display masking as a usable reference; the same original credential in snapshot cwd survived its classifier. These are private source metadata/reference witnesses, not public routing, native workload or closure evidence.

The retained declaration-inventory owner now derives private withoutSecrets removal alongside its unchanged display mask from the bounded genuine original capture. Every declared target path requires both raw sensitive-literal absence and unchanged generic display projection; otherwise the entire path is null with artifact_reference_redacted. Names/kinds/media text keep their existing display policy. Explicit operational Recipe-origin outputs remain exact when they contain no captured secret; the artifact origin exception is not transferred to snapshots. No declaration target stat/open/hash/read/discovery is introduced, and declaration counts, unavailable-path counts, immutable source/view/index partial effects and code0/7 binding rules remain with their existing owners.

The shared original snapshot-reference constructor likewise derives one raw sensitive-literal removal policy from captured metadata. Its private snapshotReference first retains existing absolute/scalar/control-character validation, then requires no raw literal occurrence and unchanged full origin/generic/text projection for cwd/index. Private cwd becomes null/cwd_reference_redacted; a private index becomes null/index_reference_redacted before its file is probed. The rule is presence, not a blanket ban on marker spelling: an originally public marker path stays exact even if live metadata later adds that secret. Later healthy metadata cannot remove original privacy. This serves both existing original-producer and fresh-launch reference construction through their shared private owner without a new issuer, port, module, registry, API or policy carrier. Body projections and saved/DTO-only read-emission authority are not certified by these path decisions.

Two owning property families partition original secret presence/absence and opposite later live edits. The inventory family preserves a usable Recipe-origin target, withholds only the sensitive marker path without target probes, reads the actual saved source and preserves a controlled natural code7 first binding. The snapshot family separately partitions ordinary/private index locations, raw quote/backslash/BOM/U+FFFD/astral cwd, old versus newly constructed readers from the same genuine original key, and unchanged checks. Actual private-index/cwd probe counters stay zero even when a production catch could normalize an assertion. Original/public spelling, invalid-scalar precedence, original budgets, full encoded-response limits and existing source/frame fences remain unchanged.

The same source/packed hosts and ten predeclared controlled metadata frames/fifteen keys now use the absent-owner safe frame for the display-marker credential, a non-sensitive declaration path and controlled cwd containing that marker. Both real source and compiled modules withhold the declaration path and snapshot cwd before target/cwd observations, while preserving the operational-origin path and safe index. No extra host, workload, metadata frame or runtime key is added. The first expanded source fixture reused the 8036-character baseline generation in this new snapshot response; a pure exact reconstruction of its maximum envelope measured 16448 UTF8 bytes against the unchanged 16384-byte ceiling. The child reported unavailable rather than the expected available, so its complete stderr/close1/null and failed frame remain retained. The corrected fixture predeclares a separate short synthetic generation-owner-absent before spawning/admission, not clipping or rebinding an existing reference; the original long baseline Control/reference witness remains. Fresh successful roots still require exact saved identity/manifest and fresh captured-host ESRCH before deletion. This closes the demonstrated declaration-entry/snapshot path classifier gap, not general body literal completeness, old-source privacy, index identity emission, native closure or release readiness.

**Preceding captured-literal body-policy inquiry — pure only.** A no-producer/no-file-write pure check supplied safe identity plus values.api_key containing a synthetic literal. projectRunRecipe hid the sensitive-key value but preserved that literal in a non-sensitive template/declaration string; createRunRecipeEvidenceRedactor preserved it in recorded command text; projectSessionAssistantPreview preserved it in assistant text outside a sensitive key. That check established pure reachability only, not actual publication or public leakage. The distinct genuine producer inquiry below establishes the private publication boundary; the later recorded-content repair does not certify unrelated envelope fields or lost canonical source. Current primary/diagnostic whole text and declaration inventory use their separate full captured-literal projection and do not certify these roles; post-producer legacy identity authority remains separately contract-gated.

**Pre-repair genuine original body privacy assessment — source only.** One captured private host predeclares four exact metadata frames before imports/await: original literal present/absent crossed with a plain non-token-prefixed credential and raw quote/backslash/CRLF/BOM/U+FFFD/astral/backtick text. Each frame admits one genuine runtime producer with safe run/generation/owner. Later current metadata removes the original credential or introduces it into an originally public capture. The inquiry invokes actual Recipe/Trace/Control/Execution writers and their corresponding original-backed saved readers, then actual selected-session preview/catalog/index publication and saved follow. All five roles remain available under available index metadata, and original data/publication correspondence succeeds despite the body gap. Four keys/frames in one host are not four newly born workloads; no command, SDK/model session, root result or native closure is produced.

In both originally private cases the actual Recipe definition/launch/template/declaration, canonical Trace summary/data, Control input/error, Execution command/label/interruption and assistant preview expose the captured literal outside its sensitive key. Raw scalar keys/values are inspected directly; decoded embedded JSON is inspected separately, rather than searching JSON.stringify output and missing escaped literal matches. Originally absent cases deliberately preserve the same text despite a later live secret: this is an original-policy preservation control, not a leak witness or permission for live renewal. Sensitive-key value masking and fixed private-role omission still work; neither certifies other strings or non-sensitive keys. User/thinking blocks remain absent from the actual assistant preview.

The same inquiry splits privacy loss at export from loss before a source is recorded. Whole Control errors are recorded before the 320-character display limit; Recipe/Execution text and Trace data are available before their export projections clip them. An assistant string begins with 3994 public code points, then the full known credential and a suffix. Its current saved preview shows 4000 code points and omits 26 for the plain case or 13 for the escaped case. The full credential is no longer present in that clipped field but its known prefix remains. Absence of a complete-token match after clipping therefore cannot certify privacy. Raw canonical metadata/journal/manifest/session bytes are unchanged by these exports, and later explicit session publication still does not renew original privacy; the raw three-argument per-call preview ignores a fourth privacy-shaped argument as before.

**Separate canonical Trace pre-recording loss contract gate.** Actual appendRunTraceEvent slices summary to 1000 code units before recording the journal event. A controlled input of 990 public code units followed by the credential/suffix is 1022 code units in the plain case and 1010 in the escaped case, but the actual canonical summary is 1000. Its full credential is absent and its prefix survives into the published summary. Even an unbounded original evidence projection followed by the complete captured-literal matcher leaves that canonical fragment unchanged: the missing suffix is no longer source data. This is not merely another export-clipping bug and cannot be closed by redacting a later DTO.

No new completeness/privacy flag, source receipt, runtime carrier, generic registry, callback interface or changed canonical journal/schema/limit is adopted by the assessment. Complete pre-recording privacy requires an accepted source/admission versus unavailable/lossy-summary policy, including old already-clipped records. Do not guess credential prefixes, treat exact-bound length as an authority certificate, borrow another field/body to reconstruct lost input, or claim original byte recovery. This gate is independent of locally actionable privacy repair for complete recorded fields; it does not block those fields or authorize a global change to standalone Inspector/raw per-call defaults.

The assessment motivated the recorded-content correction below, not a late clipped-view repair, live fallback, source overwrite or implicit retry. General envelope completeness and canonical pre-recording summary privacy remain open, rather than turning a green old suite or an available index into a privacy certificate.

The parent immediately captures positive host PID/full four-frame plan, and the child persists its complete frame before kernel imports. Complete stdout/stderr/actual close is retained before normalization; original parent/child frames and every actual saved run/generation/owner/PID/state directory must agree before fresh captured-PID ESRCH immediately permits successful scratch deletion. The child leaves its own exit not_asserted. This source-only host completes naturally with no workload and no failed-root cleanup shortcut; it is not packed/ordinary/public acceptance or independent review. Product/tests/dist remain unchanged during this assessment; exact prior broad validation can be reused for that unchanged code, but does not establish the newly falsified body privacy property.

**Implemented original recorded-content literal privacy — not a whole-envelope certificate.** The existing recipe-projection.ts owner now provides a pure createRunRecipeBodyRedactor for already-admitted original publication data. It prepares encoded strings recursively (including leading BOM and nested JSON), preserving raw spelling when decoded data is unchanged; applies the existing unbounded origin/generic projection with sensitive-key decisions intact; masks captured literals in content strings/keys; only then applies the existing requested text limit. A JSON-looking credential such as 123/null/an encoded array still masks as a raw scalar when appropriate. An arbitrary caller supplying metadata or this pure function gains no original producer/body/source-completeness authority.

Private original Recipe shaping explicitly supplies that policy before selected definition/launch/composition projection, and both writer/read correspondence consume the same shaping. Private Control replaces only its existing original input/error preprojection, leaving the one-argument Inspector projector and exact-reference row filter unchanged. Trace context supplies the policy to its canonical-journal data projector for summary/detail content; Execution context supplies it for the existing allowlisted text fields. Session publication supplies an unbounded original policy before assistant code-point counts/4000-point clipping. Original/current metadata and source fences, per-role successful publication bindings, budgets and separate exact partial errors remain unchanged. Actual canonical inputs are not rewritten, read/export never repairs earlier unsafe views, and only explicit successful publication refreshes data.

Recipe/Trace/Execution/assistant data projectors accept a synchronous pure redaction function from their kernel caller, with the previous origin/generic policy as their unchanged default. No actor/Recipe flag, metadata callback, read/range/public route, new module/registry or runtime admission port is added. Raw three-argument readRunSessionPreview still supplies no original override and ignores extra privacy-shaped arguments; standalone per-call projections retain their source/privacy contract. The context and session orchestration owners share pure policy below them instead of importing each other. This explicit path separates original-admission data privacy from ordinary per-call metadata; the function argument itself is not a capability or historical source certificate.

Two owning property families cover actual five-role original producer writes/reads and pure adversarial data. They partition original literal presence/absence versus opposite live first/refresh metadata, raw quote/backslash/CRLF/BOM/U+FFFD/astral/backtick values, dynamic content keys, BOM/nested encoded JSON, JSON-looking credentials and another sensitive-key value not known as the original literal. Sensitive-key privacy must survive content-key masking. The actual boundary fields are checked against whole-privacy-before-limit results, not full-token absence after clipping: Recipe/Trace data/Execution text retain the existing 4000-code-unit display semantics, Control keeps its existing 320-character preview, and assistant output retains exact observed/shown/omitted code-point counts. Original metadata/journals/manifest/session bytes remain unchanged; generic projectors/raw preview still show their prior per-call data and do not acquire original policy.

The same source/packed hosts and ten predeclared identity frames/fifteen issuer keys now reuse their two safe frames for plain and escaped body literals captured under a sensitive nested key before admission. No new host, frame, key or workload is added. Actual original role publications/reads and explicit refresh after healthy live edits mask scalar/key/encoded body content; actual saved assistant preview verifies the projected 3994-public-point boundary/counts. Privileged synthetic primary/declaration/session inputs and controlled code0/7 records retain their previous distinct permissions. This is private source/compiled recorded-content proof, not ordinary SDK/public integration or native closure.

The correction covers the listed selected content fields only, and its initially tested spellings are not an exhaustive content-privacy certificate. Focused exact-schema closure review used one source-only captured host, eight upfront controlled metadata frames/eight genuine keys and zero workloads. Actual writers/readers returned available under available indexes and safe full Run/generation/owner headers. Canonical metadata/journals/manifest/session bytes remained unchanged and root result files absent. Complete stdio/actual close0-null, exact saved identities and fresh ESRCH preceded scratch deletion; child exit remains not_asserted. No product/test change or source/packed/public acceptance came from this review.

- **Complete opaque scalar ordering is now corrected:** the genuine review showed complete original credential `[ "envelope_json_67" ]` normalized to unmasked `["envelope_json_67"]` in six selected fields across all five roles. The pure body policy now checks raw literal presence while the original encoded spelling remains held. A raw private span that cannot be preserved by JSON string decoding, or whose masked spelling fails JSON syntax validation, withholds that whole encoded scalar as `[REDACTED]` before generic normalization/counts. Masked JSON is a discarded validity probe, never emitted or used for sensitive-key decisions: those still use original parsed keys. Public object siblings outside an opaque string remain, ordinary encoded data keeps structured per-field masking, and copied decoded occurrences cannot excuse a separate raw private span. Maintained properties cover formatted/BOM/escaped/numeric JSON-shaped credentials, composite/duplicate spans and escape loss; actual five-role writes/reads plus explicit refresh exercise original presence/absence versus opposite live values. Canonical inputs remain untouched and raw per-call contracts unchanged. This repairs available recorded content only, not missing canonical bytes or whole-envelope privacy.
- **Dynamic actor routing metadata is now guarded:** Trace item kinds and Control row actions are compared as complete unmodified reference/routing strings against fixed original privacy. Safe values remain exact; unsafe whole items/rows are omitted within the existing bounded selection before final visible counts/byte eviction. Trace total/journal counts and Control raw capacity/foreign counts keep their own truth; there is no older-row backfill, masked id/kind/action or default Inspector change. Tests retain a full 411-character safe kind and 64-character safe action, distinguish original sensitive presence/absence from live edits, preserve canonical bytes and verify real saved-reader publication correspondence.

The existing two safe source/packed frames also retain both ordinary escaped body and opaque JSON credentials plus routing canaries before original admission. They add only controlled journal/message metadata, no host/frame/key/workload. Safe routing rows remain exact or are wholly omitted with raw counts retained; the subsequent fact-gate row/count extension is detailed below. Actual opaque Recipe/Trace/Control/Execution/session content is the standard marker, including assistant observed count10. Source/compiled private proof remains distinct from executor/SDK/public/native acceptance.
- **Issued/reported overlap witnesses:** real Trace API-generated id/time, recorded `command-001`, original `stored_clock.started_at`, manifest updated/start times and saved session `source_updated_at` survive when those exact observed values are subsequently captured as sensitive metadata before genuine producer admission. No ids/times were injected into the Trace API or forged into its journal; these are controlled issued-reference/report overlaps, not proof of actor credential injection into every such field. Fixed enums/protocol constants, current writer timestamps and derived selection SHA/reference paths are separate classes; raw matching alone cannot decide their visibility/exactness contract. Execution native_signal is a typed reported token admitted by an open pattern, not an authenticated OS fact or immutable protocol constant. A subsequent genuine original producer/publication/read witness exposed captured sensitive SIGPRIVATE69 through an available index and original publication-byte match. The writer now compares complete validated signal spellings against the same original full privacy as the header. Safe tokens remain exact; any changed/private token refuses the whole new view as execution_metadata_redacted before view construction/publication, rather than masking/removing a cause field or changing root outcome. Original absence remains public after live secret introduction, including both open-pattern and ordinary SIGTERM spellings; these are controlled metadata reports, not delivered signals. Generic/per-call projection remains unchanged. Failed direct privacy publication preserves earlier authentic saved bytes/binding under an unchanged index; independent index replacement can make that older view unavailable, and only explicit successful safe publication replaces its binding. With no successful earlier publication, the private reader reports publication_unavailable, not a newly minted privacy flag. This writer correction does not retroactively certify old unsafe publications; a reported signal never proves actuation, actual OS cause or closure.
- **Recipe logical_reference is projected provenance display data:** the original `suite/envelope_recipe_67` → `suite/[REDACTED]` observation is faithful to the intentionally lossy Recipe data projection, not an exact operational locator guarantee. The actual buildRecipeContextRecords producer uses qualified name when available, otherwise explicit-file basename while retaining its real source_file separately; registered launch metadata can likewise substitute a display name. In the inspected maintained lib/scripts closure, logical_reference is produced/selected for context projection, not consumed for resolution/dispatch, and no ordinary runtime caller consumes the private saved Recipe reader as an action locator. A maintained actual-resolver→genuine original-producer→saved-read property now verifies explicit-file basename, original present/absent versus opposite live privacy, label masking, unchanged source/metadata and no source_file exposure. Canonical reading.path and complete returned identity keep their own exact-reference contracts. No code shape or field changed: never restore a private label to make it resolvable or infer read/work/locator permission from display text. This makes no guarantee about arbitrary external or human use, future consumers or a real dispatch/misresolution vulnerability.

The existing source/packed baseline now captures a synthetic signal credential before admission, removes it from live metadata, then verifies whole-view signal refusal, unchanged manifest/metadata/prior view, historical reader availability before independent index replacement, no new binding on refusal and explicit safe refresh. The same ten predeclared metadata frames/fifteen keys also verify a masked Recipe display label under original data correspondence. No new host/frame/key/workload or actual signal is added.

**Original source fact/reference metadata now has a bounded exact-or-unavailable gate in the context-export owner.** A complete unmodified original stored-clock started_at is required in the shared Recipe shaping; original privacy collision returns recipe_metadata_redacted with no masked clock. Because the original reader uses the same shaping, it refuses admission_unavailable before filesystem observations. Missing legacy clock remains its existing supported absence. Trace now checks full source id/ts/kind before visible counts within the existing selected window, omitting whole unsafe items without backfill or altering raw journal totals. Private Control includes all present queued_at/delivered_at/claimed_at/handled_at/failed_at alongside exact id/generation/action; unsafe whole rows are omitted, safe full timestamps overwrite generic previews, while raw pending/foreign counts stay independent. Genuine canonical Control append/claim/delivered/handled/failed metadata transitions supplied all five actual timestamp witnesses before the guard, not forged timestamps or a worker-delivery claim. Solo closure review then falsified row-only coverage: the same private queued time was still emitted by raw capacity.oldest_pending_at. That derived header fact now has its own original comparison; a private value refuses the whole new view as control_metadata_redacted instead of masking/nulling the time or recomputing counts from shown rows. Maintained properties preserve previous authentic bytes/binding before independent index replacement and explicit safe refresh; with a public oldest timestamp, a private non-oldest row is omitted while raw pending remains two and shown remains one. Controlled report-time edits in the latter history/count tests are not new issued timestamps or real handler/workload events. Execution validates full updated_at and each command id/optional started_at/completed_at as well as reported native_signal; a private typed fact/reference refuses the whole new view with execution_metadata_redacted. Source manifests, journals, original clocks, root outcomes and generic/per-call projections are unchanged. These are recorded/issued data visibility checks, never authenticated event issuance, measured duration, actual native cause or closure proof.

Maintained properties cross original presence/absence with opposite live edits and explicit refresh. They retain exact safe facts, truthful raw/visible counts, strict source/metadata limits, canonical bytes and absent controlled root outcomes. The same source/packed hosts/fifteen keys/ten upfront metadata frames reuse their formerly unrecorded key for original-clock refusal without replacing the earlier Recipe view, add a genuine pre-admission Trace seed whose captured private id is wholly omitted, and check direct Execution fact refusals without replacing earlier authentic history. Safe-frame Trace now has five raw events/three shown/two omitted. A separately labeled controlled failed-time metadata row is omitted in the packed test; it is not an actual handler/signal/workload. The same baseline also temporarily records a controlled private pending time to verify whole-view derived-capacity refusal and unchanged earlier Control history; fixture source restoration is explicit, not publisher rollback. Control pending stays three or two, while four/three raw recorded rows show one and omit three/two respectively. The earlier budget witness used secret command-002 inside its twelve otherwise valid command ids; correct privacy preempted response overflow, so the independent budget witness now uses private command-999 outside that positive set, not a weakened guard.

**Original Session selection and peer metadata now share a fixed publication policy, not a body certificate.** After valid query/genuine bounded original capture and full header privacy, selected command_id is checked before manifest/session observation. Admitted source_updated_at is checked after the existing metadata frame checks but before assistant body bytes/projection/counts; the existing body-free reference admission may open/fstat the file. Current export_id, captured_at and its selection-specific preview path must stay exact under original privacy before preview encoding/limits. The raw three-argument preview has no new override and retains its per-call contract; its metadata-only descriptor observation is not a body read.

The private later publication stage retains only that capture's pure original-data matcher alongside existing fences. Existing catalog binding contradictions still throw first. Bound peer command_id/export_id are checked before selected preview commit, including missing/unavailable peers: those fields necessarily survive every catalog observation. Old peer captured_at/path cannot be blindly pre-refused, because actual inspectPreview observation may replace stale time or convert a missing path to null. After the selected preview writes and peers are observed, all actually emitted BaseEntry/available-path strings are compared before catalog counts/encoding. Any private metadata refuses the whole new catalog as session_metadata_redacted, not a masked ref, truncated value or silently missing mandatory peer. A selected preview may already remain committed/orphan; old catalog and unselected peer bytes stay untouched. Independent index publication may mark the role unavailable. Earlier exact I/O/binding errors remain errors, with no rollback, retry or fabricated unavailable peer; explicit healthy metadata observation and safe refresh remain supported. This does not apply the new original policy to older saved assistant bodies or certify their issuer/redaction/lifetime.

Four maintained property families cross current command/source-time/hash/path and peer command/hash/time/path with original presence/absence versus opposite live metadata. Actual peer publications cover available/missing/unavailable records, actual saved follows, known stale/observed header differences and an independent forbidden-body-read counter (production may catch a thrown probe). A post-preview refusal retains the new selected file and old catalog; a missing private path that is no longer emitted remains valid recovery. An exact EIO thrown after preview rename stays the identical error and committed bytes survive; binding contradictions remain unnormalized. The existing source/packed baseline reuses the already-admitted private large-response key, whose original snapshot lacks the tested command credential, to publish a genuine command-999 peer, then the original private key refuses command/source-time and peer re-emission without replacing its catalog/body. Raw per-call preview stays available; independent index refusal prevents a fresh saved follow. It adds two distinct explicitly recorded baseline selections, for twelve selection identities per layout, but no host/frame/key/workload: fifteen keys/ten upfront frames remain. Fixture input restoration is explicit setup, not publisher rollback or actual SDK/model-session evidence.

Whole-envelope privacy remains unverified. Generated observations, protocol constants and other residual field provenance still need explicit interpretation; old peer body privacy is not renewed. The listed content/metadata policy, original publication/data correspondence and available index do not supply legacy post-producer identity/lifetime, ordinary/public/restart permission or complete Result-role authority. The whole saved Result role needs its own complete-data/publication admission; the source-only assessment below establishes why the existing partial readers cannot supply it. Preserve exact admitted usable references or whole refusal/omission; no blanket envelope scrub, new carrier/registry/module or public/range route is adopted by review. Canonical Trace summary already sliced at admission remains behind the separate source-loss policy gate above; complete recorded-field literal masking does not reconstruct its missing suffix or infer completeness from a display length. Primary/diagnostic text, declaration inventory and snapshot reference policies remain separate, not implicitly widened by the new content function.

**Retained diagnostic metadata, before preview clipping.** For the allowlisted strings only, the Result exporter now retains complete privacy-projected JSON at `evidence/result-diagnostics-<generation-owner-key>.json` before publishing its bounded view. `run-result-diagnostics-v1` carries exact Run/generation, `content_scope: "canonical_outcome_diagnostic_strings"`, `privacy_scope: "producer_admission"`, `primary_text: "not_included"`, complete/redacted coverage and only recorded `fields.command`, `fields.error`, `fields.failure_reason`. Missing fields are not invented. There is no stdout/stderr/capture/execution/session/artifact-body read, authored-summary/body selection, result visibility flag or forced-stop/terminal claim; both naturally accepted and capture-only metadata retain their existing distinct view classification.

The view's `diagnostics` descriptor records full source path/generation/SHA-256/UTF-8 byte size and per-field total UTF-8 bytes, half-open `shown_bytes`, exact Unicode code-point total/shown/omitted counts and clipping boolean. `outcome.<field>` is the literal first at most 4000 code points of that field **after complete fixed privacy projection**, preserving whitespace, CRLF, BOM, genuine U+FFFD, backticks and scalar boundaries without appending an uncounted ellipsis. Per-field byte ranges refer to decoded field text, not offsets into the encoded JSON source. With no recorded strings, `diagnostics.state: "not_recorded"` creates no empty source. This is a complete projected metadata-string set, not complete task output, raw original error text or a new primary permission for failures/compositions/sessions.

Canonical result and privacy input keep the independent 1-MiB observation allowance. The complete encoded projected source must fit 4 MiB before preview/count construction; the encoded view independently fits 64 KiB before any source creation. Invalid scalar strings and either overflow refuse the whole export without changing real workload codes/inputs or clipping an opaque identity. Source creation is exclusive at mode 0600, repeated explicit calls may reuse only exact checked bytes, and contradictory/partial/foreign/nonregular sources refuse without overwrite. The private checked-retention I/O primitive is shared with artifact inventories but admits no producer/privacy/body policy by itself. The exporter rechecks canonical result and retained source through view replacement; observed changes leave truthful unpublished effects, never a repaired view.

Ordinary source/view/index I/O retains its exact local error and committed/partial/orphan effects, not generic result-unavailable fallback or rollback; lifecycle authority refusals stay outside workload-failure conversion. Owning tests cover long multilingual literal metadata/full-source recovery through the written descriptor, redaction-before-counts and escaped structured secrets, immutable admission privacy despite live metadata edits, exact-byte reuse/contradiction, three separately failing publication effects, malformed scalars, privacy-expansion/source and opaque-generation/view ceilings, capture-only nonpromotion and result/source loss before view commit. Readonly post-producer admission is now implemented below; kernel first-result binding, ordinary packet/model delivery and broader summary retention remain open.

**Readonly retained diagnostic follows.** `readRunResultDiagnosticsSource(stateDir, expected, query)` now follows this saved metadata projection without a live producer. Query is a closed own-data `{field}` or `{field,start,end}` with `field: "command" | "error" | "failure_reason"`; both byte endpoints must be supplied together as safe ordered nonnegative integers. Byte offsets are half-open in the selected **decoded field's UTF-8 text**, not the JSON source file. Absent range returns the exact recorded <=4000-code-point preview, never a synthesized summary or another field. Missing recorded fields are explicitly unavailable; valid empty scalar-aligned ranges are allowed.

Admission checks exact owned Run/generation/optional owner, bounded canonical index, available mutable Result metadata role, regular bounded view and deterministic generation/owner diagnostic source path. It validates the complete closed view/outcome/descriptor and source schemas, Run/generation/content/privacy scope, code/time/recorded natural-versus-capture-only classification, all coverage/producer-flag shapes, entire strict-UTF8 source hash/byte length and every recorded field's well-formed scalar text/preview/byte/code-point/omission counts, including unselected fields. Legacy views, absent/unpublished indexes, `not_recorded` and foreign/malformed descriptors refuse before any retained-source follow. An available file or copied DTO is not producer/body/terminal authority. A recorded capture-only classification remains metadata and gains no terminal status or primary permission.

Results curate/deep-freeze identity, source descriptor and the selected excerpt, reporting `content_scope: "canonical_outcome_diagnostic_strings"`, `privacy_scope: "producer_admission"`, `primary_text: "not_included"`, redacted policy, selected field/range/counts and `recorded_acceptance`. The latter is saved-view metadata, not a new read of current root outcome/closure. The reader never opens raw `result.json`, runner/capture/session/artifact bodies, original Recipe paths or sibling diagnostics; it never probes processes, reprojects live privacy, reconstructs a producer, writes/exports/repairs, ACKs or takes a lifecycle/work lock. Source input remains 4 MiB, view/complete encoded response 64 KiB, index 16 KiB and owned metadata 1 MiB. Split-scalar, out-of-bounds and oversized selections refuse the whole response, not silently clip or clamp it.

Identity/marker/metadata/index/evidence/view/source observations are fenced through reading and returned `unchanged()`. A fresh read may follow the same saved source after live values change, but never changes its privacy projection; the earlier observation becomes changed. This is neither a durable-immutability/authenticity certificate nor a multi-file atomic snapshot. Partial reads, failed close, corrupt/nonregular/symlinked/oversized sources and observed replacements stay unavailable without repair. Owning tests cover zero forbidden body/process/write effects, exact literal Unicode ranges and deep freeze, pre-follow identity/publication refusals, complete unselected-field validation, hash/schema/count corruption, every relevant file replacement, encoded-response amplification and unchanged saved privacy. A real isolated publisher exits before recovery; parent captures PID/state/generation immediately and requires fresh ESRCH-only absence before cleanup, preserving state/primary error on uncertainty. Recovery succeeds even after raw canonical result removal, without producer reconstruction. This remains private saved-metadata evidence; the runtime first-result binding below is now separate implemented machinery, with separate eligible canonical admission and automatic packet/model exposure implemented below.

**Runtime first-result diagnostic binding.** `createRunResultDiagnosticsPublisher` captures genuine producer-admission privacy before work without source/view/index I/O. The async runner passes its `publish` method through `RunResultPublicationOptions.resultDiagnostics` on success and workload failure. Only after exact producer and first-result admission does `publishRunResult` open one synchronous `RunResultDiagnosticsAdmission` window. Its original object is bound in a runtime-local weak map to state/producer and a frozen allowlisted candidate snapshot. `withRunResultDiagnosticsAdmission` lets the source owner inspect that exact candidate and revalidate authority before/after I/O under the existing lifecycle lock, never nested lock acquisition, work or root-outcome authority. Copies, serialized markers and expired keys cannot publish a source, and validation precedes one-shot attempt consumption. Callback completion must be synchronous; native rejected Promises are settled without awaiting and accessor/custom/inherited thenables are rejected without invocation. The window is revoked in finally even on refusal.

Publication now requires the genuine admitted producer, not a copied PID/generation DTO. Root input is snapshotted from own enumerable data properties before evidence callbacks; code stays an exact safe integer, getters and root serialization hooks cannot change the accepted metadata underneath its source. Original caller mutations from prepare/binding callbacks cannot change that captured result. Actor `result_diagnostics`, `result_diagnostics_unavailable` and `result_diagnostics_protocol` fields are stripped regardless of trusted callback presence. Owner/generation/native contradictions are rechecked immediately after each successful prepare, primary, artifact and diagnostic callback, before another source callback and again before root publication. All four ports refuse native Promise and own/inherited/callable then-protocol returns without awaiting or reading custom then/catch hooks; native rejection is settled intrinsically. Ordinary synchronous prepare return values remain ignored. A throwing callback preserves its exact original error and earlier separate effects without invoking a later source or inventing a fallback result. Deferred refusal cannot cancel side effects already initiated by the callback. Controlled native-absence injections exercise authority fencing, not actual producer death or owned-scope closure. This correction adds no terminal-timing sample or permission. The former contention fixture's serialized producer has been replaced with a child that genuinely admits itself before waiting on the lock; immediate PID/state/generation capture and fresh ESRCH-only exit proof guard isolated-root cleanup.

The pure shared `decodeRunResultDiagnosticsBinding` data schema curates a normalized evidence-local `result-diagnostics-<64hex>.json` reference, exact generation/SHA-256/positive source bytes and a unique canonical-order nonempty subset of command/error/failure_reason names. It freezes copied reference/field data within 16 KiB and does not admit a source, producer, work or body permission. The first atomic root result joins either `result_diagnostics: {source:{path,run_instance_id,sha256},bytes_total,fields}` or null plus `result_diagnostics_unavailable`, with `result_diagnostics_protocol: "run-result-diagnostics-v1"`. Preview/count data is not copied into this descriptor. Duplicate publication invokes no late diagnostic callback and cannot repair a lost source or change first unavailability. Accepted result/binding survives later Trace failure; a post-stop result remains capture-only, never terminal because metadata exists.

The source owner shares the existing full diagnostic projection/fixed-source retention with explicit Result exports. Complete fixed privacy precedes counts/any later display. No strings yields not_recorded; absent captured privacy, invalid scalar text, source/descriptor observation overflow or unavailable metadata stays explicit without changing the real workload code or becoming an input quota. Descriptor size is checked before source creation. Ordinary I/O retains its exact local failure through readFailure and returns publication_failed; partial files remain. If authority also changes, preserve the source failure first in AggregateError and refuse publication. Contradictory source bytes, typed binding refusals and lost producer authority fail closed outside workload-failure fallback. Source and root result are separate commits: failed root publication may leave an unpublished source, never an inferred terminal or automatic retry. No Result role view/index is published before its canonical outcome exists, and a later explicit export cannot revise the canonical first binding.

Owning tests cover genuine/copy/expired admissions, fixed kernel candidate despite caller mutation, first-winner-only callbacks, data/accessor/thenable/schema refusal, owner/generation/native contradiction, exact EIO plus authority errors, fixed admission privacy including long multilingual metadata, source/descriptor/privacy/scalar observation limits, actor-field stripping, accepted Trace faults and capture-only nonpromotion. The real runner covers nine modes including diagnostic EIO at real codes 0 and 7, foreign diagnostic refusal before any result commit, existing artifact/primary EIO, workload failure and one-attempt result EIO. The source/packed public SDK first checked the diagnostic reference from the canonical result; the integration below now follows it from actual model context. None of this establishes native scope closure or release readiness.

**Eligible canonical diagnostic outcomes and immutable transport.** `readRunResultDiagnosticOutcome(stateDir, expected, status)` admits one exact owned canonical natural outcome, cooperating result_diagnostics protocol and expected done/failed status before any retained-source follow. A saved null/unavailability is preserved without reads/repair. Captures, wrong owners/generations/statuses, foreign derived paths or malformed bindings refuse explicitly. Available bindings require the full bounded strict-UTF8 source/hash/bytes/closed schema/scalar-valid field set to match the canonical descriptor. It shares pure full-source decoding with readonly saved-role follows but neither reads nor requires/creates a Result role view/index. Metadata/current-result/evidence/source fences and unchanged() do not claim cross-file atomicity or durable authenticity/immutability. It performs no process probe, producer/work reconstruction, raw stream/session/artifact body read, export, ACK or repair.

Only eligible packet collection invokes that source admission; ambient summaries and candidate checks retain marker hints without complete source reads. Diagnostic-aware semantic results retain no raw error/stdout body. The collector freezes exact descriptor/unavailability and one literal prefix chosen by error > failure_reason > command, at most 1000 code points, with full decoded-field UTF-8/count/clipping data. Other recorded fields are explicitly not shown but remain in the full referenced JSON. The shared data-only excerpt schema lives beside the binding schemas; it rejects malformed/non-prefix/count-conflicting/oversized snippets without granting source or primary permission. Packets deep-freeze references, field lists, excerpt and byte range, reject detached excerpts and all competing legacy output for diagnostic-aware members, and stay quiet for not_recorded. Reload, phases and literal shared operator/model rendering never reread sources, refresh availability or invent ACK. Metadata-only/not-primary scope appears before the literal excerpt; source/generation/SHA/UTF-8 bytes/field names remain complete and dynamically fenced.

Whole-row overflow retains only captured diagnostic references/unavailability, not excerpts, via a conditional result_diagnostics captured_bindings_only inventory tag; older packets without the field preserve their source payload/hash. Source/packed SDK tools/final modes parse the exact diagnostic reference from actual model context and ordinary bounded file reads recover its complete projected metadata alongside primary/artifact evidence. The six-composition witness now uses long Unicode command metadata rather than an unsafe legacy stdout fallback, recovering refs for every captured/omitted member without primary permission widening. Owning tests prove zero ambient source opens, first unavailable/status/capture/foreign refusal before source reads, whole-source/unselected-field/schema/hash/fence validation, source loss before capture without fallback and after capture without packet repair, deep freeze/literal counts/backticks, quiet absence/conflicting data and 80-member overflow metadata-only references. Actual failed runner7 and diagnostic EIO also produce the respective metadata excerpt/unavailability without raw body fallback. Omitted available primary references now have the bounded public witness below; the separate bounded row-cap witness is below; broader failure/summary/primary selection, public selective routes, manual visual/external-model/native and integrated release acceptance remain open.

Private `writeRunArtifactContextExport` writes `evidence/artifacts.json` (`run-context-artifacts-v1`) only from captured declarations and cwd through the `runs-artifacts.ts` reference/metadata owner. It never scans directories or reads/hashes artifact bodies. Explicit targets may be outside Run state; anchoring a relative path preserves its filesystem spelling rather than lexically retargeting `symlink/..` references. The owner checks leaf regularity, readability and observed descriptor/path identity, distinguishing available, missing and unavailable; directories/leaf symlinks are unavailable rather than pretend missing files. Caller-declared outputs are operational references even beneath Recipe directories. Secret redaction never clips/substitutes a usable path: a changed reference becomes null/unavailable with an explicit privacy reason. The manifest includes every validated declaration, exact availability counts, `contents: "not_read"`, `production_provenance: "not_asserted"` and mutable observations without hashes or immutable-content promises. A declaration/file existing now does not prove this Run produced it. No declarations is not-applicable, not a directory inventory. The ordinary observed metadata manifest must fit 64 KiB; preflight known overflow avoids filesystem probing. When producer-admission declarations/cwd are unavailable or disagree with live metadata, overflow still refuses the whole refresh, preserves prior files and updates the index to explicit unavailability rather than publishing partial lists. The private exporter now has the admission-bound retained-inventory path below for the matching case. These limits are not file-content or workload quotas. `writeRunArtifactContextIndex` uses the same producer re-admission, generation/source rechecks and separate atomic-file/error semantics as the other exporters. Trace artifact-row projection now uses bounded-count metadata observations rather than hashing files; this does not claim that every legacy status/inspection path is body-free. Full hash manifests remain available to their existing explicit consumers. These are read observations, not a sandbox, production receipt, native permission or cross-file snapshot.

**Admission-bound artifact inventory overflow.**

For declarations/cwd still matching the genuine producer's privately captured admission metadata, `writeRunArtifactContextExport` now handles 64-KiB manifest overflow by retaining a complete `evidence/artifact-inventory-<generation-owner-key>.json` source and publishing a bounded `run-context-artifacts-v1` reference variant. That view declares `content_scope: "captured_artifact_inventory_reference"`, zero embedded artifact rows, exact `artifacts_omitted`, and `inventory` with full path/generation/SHA-256/UTF-8 bytes/declaration count. View/index coverage is explicitly truncated/redacted; ordinary authorized file reads can recover the complete referenced JSON rather than a partial list.

The source schema is `run-artifact-inventory-v1`, with `capture_scope: "producer_admission"`, `content_scope: "captured_artifact_declarations"` and `inventory_complete: true`. Complete here means every validated captured declaration, including privacy-withheld null references, not all files, produced outputs or filesystem availability. It declares `contents: "not_read"`, `availability: "not_observed"` and `production_provenance: "not_asserted"`; summary counts distinguish disclosed/withheld references, not available/missing files. No target stat/open/hash, body read, directory scan or native/work action occurs. Binary/large files are declarations only and gain no existence, creation, body-visibility or complete-result proof.

Secret policy and literal secret values come from immutable producer-admission metadata, never live Recipe/values refresh or a copied producer DTO. Explicit operational output paths may remain beneath Recipe origins; share secret masking, not generic origin stripping. Preserve cwd anchoring and `symlink/..` spelling. If masking changes a path, store null plus `artifact_reference_redacted`, not a substituted readable path. Changed live declarations/cwd keep the older bounded-refusal behavior; a later producer admission cannot overwrite a different retained source for the same generation/owner identity.

Canonical metadata input keeps its separate 1-MiB bound. Raw cwd-anchored reference expansion is checked against 4 MiB before construction/projection, avoiding multiplicative expansion from a large cwd and many relative declarations. The complete encoded inventory must independently fit 4 MiB, while the reference view remains within 64 KiB. Any refusal preserves source metadata/workload policy and does not create a partial manifest. Source creation is exclusive; repeated explicit publication may reuse only exact checked bytes. Failed writes can retain unpublished partial files, and later binding contradiction refuses rather than overwrites them. Source, bounded view and index have separate admission/publication effects: preserve original errors and actual partial commits without synthetic workload failure, implicit retry/rollback, fsync or power-loss claims. Accepted root outcomes remain unchanged.

Owning tests cover 1800 declarations, exact source/hash/counts, indexed truncated coverage, no target probes, captured-secret privacy, operational path spelling, immutable bytes, source/view failure effects and generation replacement. These are private exporter/index properties. The readonly follow below now covers recovery without a producer; the runner first-binding integration below now publishes declaration metadata before work, while broader runtime refresh, ordinary artifact packet/rendering joins and public source/packed artifact-overflow delivery remain open. The existing public primary/member-inventory SDK cases remain separate evidence.

**Readonly retained artifact inventory.** Private `readRunArtifactInventorySource(stateDir, expected, query?)` now admits exact owned Run/generation/optional owner, the canonical context index, its available truncated/redacted artifact reference view and only the deterministic generation/owner-derived inventory filename. Metadata paths, `inventory_complete`, a source hash, actor flags or an unindexed/orphan file alone grant no permission. This port defines a fixed retained-declaration projection policy, not permission to follow raw artifact paths. Unknown/non-reference view forms and foreign/malformed/over-budget source bindings refuse before retained-source probes.

The selected source is checked as a bounded regular non-symlink descriptor with strict complete UTF-8/full reads, exact SHA-256/bytes and closed `run-artifact-inventory-v1` schema. Every declaration and disclosed/withheld count is verified, even for a one-row request; producer-admission scope, not-read/not-observed/not-asserted provenance, privacy-null reasons and source/view summary counts must agree. Unknown payload fields, alleged observed availability and contradictory references are not projected. All returned records, ranges and descriptors are curated/frozen. Missing, malformed, premature-EOF, failed-close or observed-changing sources stay unavailable, without raw/sibling fallback or source repair.

`query` is exactly `{ start, end }`, a half-open range of **declaration entries**, not UTF-8 byte offsets. Omission selects the first `DEFAULT_INSPECT_LINES` entries. Empty valid ranges are allowed; out-of-range selections refuse. The response carries the full retained source reference/counts, selected entries, exact omissions and partial/redacted coverage. Its encoded allowance is 64 KiB; an oversized selection is `range_too_large`, never silently sliced. The complete source input stays at 4 MiB, index metadata at 16 KiB and canonical identity metadata at 1 MiB. These are observation/response budgets, not launch/declaration/file quotas or a public role/range tool API.

Owner/marker/canonical metadata, index file, evidence directory, bounded view and source are fenced through returned `unchanged()` observations. This does not make the files immutable, certify past redaction through metadata alone, prove exhaustive filesystem-race immunity or create a multi-file atomic snapshot. Later live declarations/secret values never refresh the saved projection; a stale observation becomes false, and a fresh read follows the same published snapshot if its bindings still admit. No original artifact target is statted/opened/read, no directory scanned, producer capability reconstructed or process probed, and no lifecycle/work lock, status/clock mutation, export/index write or ACK occurs. A separate real publisher process exits before recovery in the owning tests; fresh ESRCH permits fixture cleanup and is not whole-scope native closure proof.

**Runtime artifact first-result binding.** `prepareRunArtifactInventoryPublication(stateDir, producer)` is now a kernel-only one-shot preparation used by the ordinary async runner before workload execution. It retains the same admission-bound metadata-only source/reference-view/index even for small declared inventories, never original artifact targets. No declarations yields `not_declared`; unavailable/over-budget capture remains explicit. Its frozen `snapshot`/`readFailure` ports neither schedule work nor form a registry. Ordinary source/view/index I/O preserves the exact local error and actual partial effects, then supplies `publication_failed` while work may continue under unchanged admission policy. Typed source/view binding refusals or lost genuine producer authority still fail closed, outside the workload-failure fallback. A stale captured observation can supply `observation_changed` before first binding, without recapture or availability repair.

The runner passes `artifactInventory: snapshot` in both natural-success and workload-failure `publishRunResult` calls. The existing lifecycle lock admits the first result before evaluating any callback; that first atomic canonical record includes curated `artifact_inventory` or null plus `artifact_inventory_unavailable`, and `artifact_inventory_protocol: "run-artifact-inventory-v1"`. Actor-supplied versions of all three fields are removed regardless of exit code. Duplicate publication invokes no late callback and cannot repair an accepted unavailable binding. Producer owner/generation/native contradiction checks run again after both primary/artifact callbacks. The callback stays synchronous: native rejected Promises are settled but not awaited, and own/inherited/custom thenables/accessors refuse without invocation.

Shared `RunArtifactInventoryReference`/`RunArtifactInventoryBinding` and pure `decodeRunArtifactInventoryBinding` live with `runs-outcomes.ts`, not publication authority. The decoder curates/freezes source/path/generation/hash/byte/declaration metadata and enforces a bounded descriptor; decoding never admits a body, producer, work or delivery. Success/failure/after-stop capture classification is independent: declaration references still assert no file availability, creation or complete failure/composition output. Result EIO/authority failures do not retry into a synthetic failure, and ancillary Trace failure cannot replace an accepted binding.

Owning tests cover first-result fencing, immutable descriptor/unavailability, actor-field refusal, synchronous callback boundaries, post-callback generation replacement, exact preparation errors with continuing work, stale snapshots, natural priority/post-stop captures and committed Trace faults. The real runner preserves `code: 0` after artifact source EIO and the real `code: 7` after workload failure, with one result attempt. Source/installed-tarball public SDK tools mode supplies five declarations and verifies their canonical descriptor/source after producer exit. Artifact references now also pass through eligible readonly verification, immutable packet capture and literal operator/model rendering as described below. Broader runtime refresh, shared inventory/summary/error overflow, manual visual/native acceptance and release gates remain open.

Private `writeRunExecutionContextExport` writes `evidence/execution.json` (`run-context-execution-v1`) from a generation-bound version-1 canonical execution manifest through the data-only `projectRunExecutionManifest` contract in `runs-execution-evidence.ts`. Selected command/attempt fields use the existing Recipe-provenance/secret redactor with only the genuine original producer-admission snapshot. This bounded privacy input is admitted before opening the manifest body; over-budget original metadata yields execution_admission_unavailable without borrowing healthy live metadata or reading the manifest. Missing/copied producer admission remains rejected by the existing runtime-local guard. Original privacy presence/absence stays fixed before first export and on refresh, while current manifest counts, status, codes and killed reports remain current. Unknown manifest payloads are not projected; prompt files, session/capture bodies and discovery are not read. Command/manifest status, active counts, executor killed flags and session-file counts are explicitly producer reports, not admitted live membership or root terminal authority. Native code/signal stays separate from normalized attempt code; null native exit is not success. Capture metadata distinguishes reported saved bytes (null if unknown), observed bytes and incomplete/reported-complete/unproven persistence without claiming current readable storage. Missing session-file metadata never invents a zero count. The header declares `source_scope: "execution_manifest"`, `capture_references: "not_exported"`, unread session/capture bodies and `scope_closure: "not_asserted"`; selected command strings are bounded/redacted metadata, not primary text or authorized readable references. Canonical manifest input is independently capped at 1 MiB, with strict UTF-8 admission and known oversize refusal before opening; the selected complete command/attempt arrays must fit a 64 KiB view or the refresh is unavailable without publishing partial arrays. Empty real manifests remain history-incomplete; absent source stays pending, and malformed, foreign, legacy-unbound or observed-changing data preserves prior views. Current canonical metadata has its own exact 1 MiB input ceiling and strict UTF-8/frame admission. Captured root/marker/metadata and manifest stamps stay fenced through view commit; observed same-generation substitutions refuse retargeting without implicit recapture. Recipe, Trace, Control and Execution reuse one local readonly metadata-frame observer inside the existing export owner, not a new permission or registry. These stat observations are not immutable storage or exhaustive filesystem-race immunity. Existing root-outcome admission refusals are never caught merely to return unavailable metadata. `writeRunExecutionContextIndex` re-admits the real producer for separate index publication with the same foreign-target, generation and exact partial-write/error semantics. Ordinary role/reference refresh, broader role/range contracts and public routing remain open; the separate private historical Execution reader below and existing recorded-reference/primary ports do not grant capture/session body permission. No reported settlement count proves whole-scope closure.

**Private historical Execution whole-view admission.** writeRunExecutionContextExport now retains its bounded admitted canonical JSON/root after successful view publication (including lifecycle release) in a separate Execution-only WeakMap under the genuine original producer. Missing/unavailable capture and thrown pre/post-replacement publication/release errors mint no new binding; prior data stays authorized only while selected source matches. Index errors remain separate effects and do not undo a committed view/binding. No other role, saved schema/flag/path/hash, reloaded module, copied or newly admitted producer supplies the missing original Execution publication.

Private readRunExecutionContextView(stateDir, producer) requires original bounded runtime metadata plus that exact publication before filesystem admission. The private checked-source observer admits current owned identity/index/Execution/evidence/view; exact canonical JSON correspondence precedes parse/deep freeze. The available basis is original_execution_publication_match, returning complete saved header/coverage and execution projection under independent 1 MiB metadata and 64 KiB source/whole-response bounds. Its change fence also retains the same original Execution binding. A demonstrated raw header-generation counterexample also required the writer to check the complete header identity under full original privacy before manifest body reading: any changed identity now yields execution_identity_redacted without a masked/raw reference or publication binding. The existing redactor's logical-suffix rule is preserved: generation-/x/private is a logical reference, not the absolute origin token /x/private; the rejection witness uses that exact absolute token and a separate positive case preserves the logical spelling. It never opens the live manifest/root result, another role body, declared capture/session/prompt target, native process/time source or directory inventory, and takes no work/evidence lock or export/repair/dispatch/ACK/scheduling effect.

Manifest status/counts/native exits/killed/persistence/session counts remain earlier producer reports. A manifest update, reported failure, killed flag or later source loss does not renew the view, grant body/target access or confirm root terminal/scope closure; capture_references:not_exported, capture_bodies:not_read, session_bodies:not_read and scope_closure:not_asserted remain literal. Only explicit successful publication replaces the binding. Eight owning properties cover full-header original privacy before manifest body/publication, historical changes/loss/live privacy edits and literal/frozen data, complete same-size command/count/native-exit/closure tampering, missing/copied/getter/foreign/alias/reloaded/original-budget rejection before probes, exact publication/index partial errors, selected saved metadata only with no target stat/open/body, owner/index/source substitutions/corruption/denial/symlink/failed close, and independent response/source overflow without clipping arrays or identities.

The existing source/packed context hosts now include controlled Execution manifests, not actual workloads: original privacy/frozen reports, genuine-but-unrecorded/copied/foreign/reloaded key refusal, same-size count forgery, historical manifest changes/loss, selected-view loss with no private-data fallback, explicit refresh and independent whole-response overflow are exercised in actual source and compiled modules. Reported killed/count changes still leave scope_closure:not_asserted and no root result. Original frame/stdio/close/fresh parent ESRCH cleanup remains unchanged, with one host per layout and zero workloads. This proves private same-runtime admitted metadata correspondence, not physical file issuer, public/ordinary/restart transport, source-target body permission, native closure or live clock authority. The complete-header Execution privacy refusal has its separate owning source property. Recipe/Trace headers and all four original-backed response identities now have the correction below; Result retains its separate boundary.

**Identity-envelope privacy — original-backed roles/publication corrected; Result DTO-only replies remain open.** A pre-correction source-only inquiry exercised nine controlled metadata frames in one captured original-producer host with zero workloads. Each valid frame used genuine runtime producer admission, fixed original Recipe-origin/secret privacy, real role publishers and private readers; Result code 7 was controlled canonical metadata, not an executed command or OS-exit witness. The inquiry did not modify production/tests, add public routing or adopt new privacy policy. Its local validation receipt retains the complete report/stdio/close/frame, not a new transferable source authority.

In the pre-correction inquiry, with a format-valid Run name and original absolute Recipe-origin or synthetic secret in generation, Recipe and Trace publish the raw run_instance_id and their original-data/publication readers return it both in the saved header and response identity. Result view and retained diagnostic source also echo the generation; readRunResultDiagnosticsSource and readRunResultDiagnosticOutcome return it through identity/descriptor metadata. All six valid-Run cases retain an available owned index, so index availability is not envelope privacy. Existing Control and Execution complete-header guards refuse these generation cases without a view/publication binding. A generation containing the allowed logical suffix generation-/x/private remains unchanged and readable across all roles; an origin-looking logical suffix is not the absolute token /x/private under the existing redactor.

In the pre-correction inquiry, with safe run/generation but original private origin or secret in ownerId, all four Recipe/Trace/Control/Execution whole-view readers return the raw identity.ownerId. Both Result diagnostic readers do likewise. The four saved role headers themselves contain no owner field, and diagnostic source fields remain correctly projected: safe stored headers or allowlisted diagnostic text do not certify a separately added response envelope. Source diagnostics contain no owner field in these witnesses, so do not mislabel the response-owner issue as an owner disclosure in the source body. Every admitted diagnostic field set in the nine-frame inquiry remains free of the original private tokens. Changing only live Recipe privacy after publication changes neither these saved bytes nor the observed admission/disclosure results; live repair is neither implemented nor a remedy.

Absolute/secret/logical-suffix Run names containing characters rejected by the fixed Run-name format are a different boundary. Their index publication throws the exact Run context index publication input is invalid error; the saved/eligible readonly selections refuse. A Result view/source may already exist as a separate partial effect with an unsafe raw run header, but the inquiry establishes no available read path or public leakage for those invalid names. Format rejection must not be presented as a complete original-privacy certificate or used to infer that Result publication rolled back. Keep format refusal separate from original-privacy refusal and preserve exact partial effects.

The demonstrated Recipe/Trace header and four producer-backed returned-identity cases now have an implemented correction; Result's original publication identity has origin/generic-pattern protection above, including the raw captured-literal repair below; DTO-only reply identity still requires a separate readonly authority/lifetime boundary. Byte/data correspondence remains necessary but is not proof that an unguarded identity field satisfies original privacy. Preserve whole exact references or refuse, with no masked usable identity, live redaction renewal, changed diagnostic/body permission, synthetic workload failure, source retry or original-key reconstruction. Result whole-view authority/format design follows these repairs, not another per-role map by analogy. This inquiry is private same-runtime source evidence only: not packed/ordinary/controller/restart read lifetime, a demonstrated public leak, independent review, native closure or release acceptance.

**Implemented four-role original identity correction — full raw-scalar literal policy.** Recipe and Trace writers now compare their complete run/generation headers under bounded genuine original privacy before Recipe projection or journal body reading. Changed values yield recipe_identity_redacted or trace_identity_redacted without publishing a masked reference or new Trace binding. Control/Execution keep their separate established header checks. All four private whole-view readers first require genuine bounded original metadata and exact original root/producer identity, then check the complete identity they would return, including optional ownerId. A changed identity yields identity_redacted before filesystem/index/body probes, projection/publication recovery or any repair. Missing/copied/foreign keys and original-budget failures retain their earlier admission refusals. The pure createContextIdentityPrivacyCheck compares admitted values only, combining Recipe origins/generic patterns with the existing captured sensitive-key literal mask on each raw scalar. It and capturedSecretMask now belong to the existing recipe-projection.ts privacy owner for context/session reuse, not a peer orchestration import or wrapper. These data functions grant no authority and create no generic registry, producer/body capability export or new module; Control reuses one matcher across the captured row window. The captured-literal counterexample and correction below explain why a generic-redactor fixed point alone was insufficient.

Four owning properties exercise original absolute-origin/secret generations before Recipe projection/Trace body, originally private owner/generation responses under genuine publication and later healthy live metadata with zero filesystem probes/effects, exact safe long/literal/logical and absent owners with frozen identities, and originally safe privacy not replaced by a newly added live origin. Copied/getter/missing/over-budget originals remain unavailable before probes. Existing role properties still cover complete publication/data matching, source substitutions/loss, separate commit errors and independent response/source budgets. This correction adds no new body permission, live scrub, reference normalization, current Control capacity, root outcome/time/native sampling or public route. Safe stored views need not be rewritten merely because an unsafe response owner is refused.

The existing context-private-evidence source/packed hosts additionally declare ten controlled metadata frames before imports/admission: absolute-origin and secret generation, absolute-origin and secret owner, a safe logical generation/owner, absent owner, and ordinary/quote-backslash-CRLF-BOM-replacement-astral literal generation/owner. Their exact host PID/run/generation/optional owner/state directories are persisted upfront, and the parent validates the manifest and actual saved identity for each frame before fresh captured-host ESRCH admits deletion. They are metadata frames, not ten newly born processes or workloads. Each layout now uses fifteen issuer keys across the baseline and these frames, still one captured host and zero workloads. Both actual source and compiled modules verify no unsafe generation view/binding, whole-response refusal for private identity before any repair, safe/absent owner recovery and nonrenewal after live edits. The child still leaves its own exit not_asserted. Result DTO-only reply privacy, ordinary/producer-loss/restart original-read lifetime, clock carrier, public/default and native closure remain separate gates; the pre-correction inquiry is not a claim that those unresolved paths are now safe.

The shared kernel-local `observeExecutionFileReference` in `execution-files.ts` now observes standard capture paths and legacy/nested session JSONL paths beneath a caller-admitted state root. It rejects lexical escapes, control/backslash/absolute aliases, wrong namespaces and root/namespace/intermediate/leaf symlinks; it never normalizes an unsafe relative spelling into a promised reference. The opened regular file, path and parent identities are checked without reading/hashing its body or discovering directories, with safe byte sizes and no file-content quota (including large sparse captures). Missing, nonregular, denied, substituted or unrepresentable references stay unavailable; descriptor cleanup failure cannot advertise success or cause an implicit retry. Available local paths and the `unchanged()` callback are metadata observations only, not model-exposure permission, a retained descriptor, native capability, generation admission, immutable historical source or security sandbox. The lower observer still requires caller root admission; use `readRunExecutionReference` for exact owned-generation and recorded-manifest binding before any separately authorized body export. Legacy `readExecutionTurns` now shares this reference boundary, avoids scanning known symlinked namespaces and discards observed-changing files after its existing body read. Previously a symlinked `sessions` root could redefine the apparent ownership boundary and expose a foreign session; the before/after fixture reproduces and blocks that case. Raw references still do not appear in the public context index or grant private-body visibility; source/packed body-export journeys and native platform acceptance are not established by these filesystem observations.

Private readonly `readRunExecutionReference` now selects one explicitly requested capture or session from an exact owned Run/generation manifest. It reuses `readRunContextIdentity` over the context-index owner, without needing an index, producer capability, process probe or lifecycle lock: only published canonical metadata with the exact optional owner is admitted; preparation alone is unavailable. Marker metadata retains its 16 KiB bound, while canonical Run and execution-manifest inputs are each independently capped at 1 MiB. The manifest uses the shared strict version/generation/command/attempt normalization. Wrong or unbound identities, malformed metadata and unknown requests cannot authorize a private-file probe. A capture must match the standard recorded command/attempt/stream path; a session must be explicitly recorded on that selected command, never discovered or inferred from `session_dir`. Only the selected regular/readable file is metadata-opened; raw capture/session bodies and directory inventories are not read, unrelated source files are not opened, and parsed unknown/provider metadata is not projected. Both Execution manifest export and reference admission select the resilient JSON reader's opt-in strict UTF-8 mode: malformed bytes cannot normalize into admitted replacement text, while a valid encoded replacement character remains valid. Default legacy JSON/JSONL degradation is unchanged. A known saved-size disagreement is unavailable, while unknown saved bytes remain null even when a current file size is observed. Source limits are observational, not workload/file quotas; exact UTF-8 metadata boundaries and large sparse captures stay independent. Root/marker/metadata, manifest and file changes invalidate the observation, including through its returned `unchanged()` callback; rejected or missing evidence is never repaired. All paths/callbacks remain kernel-local, mutable observations: not retained descriptors, immutable historical contents, privacy/body-exposure permission, native membership/closure or reconstructed producer/work authority. Legacy-unbound data gains no fresh authority. This port writes no view/index/status/ACK/clock and does not switch public inspection. Authorized stream exports, stable retained primary sources, role/range journeys and ordinary/controller refresh remain required; private session preview publication is described below.

Private readonly `readRunSessionPreview` now defines one fixed visibility policy above recorded-reference admission, not a body permission inferred from a metadata DTO. It independently validates the exact owner/generation and selected session record, reads current canonical Recipe privacy metadata captured for that call within its 1 MiB bound, and uses the explicit kernel-only `readExecutionSessionText` port. This three-argument readonly port accepts no original producer/privacy capability: fixed assistant-only content policy is not immutable producer-admission privacy across calls. Original privacy support is unestablished here; current metadata, reference DTOs and unchanged callbacks cannot reconstruct it. Metadata observation remains body-free and unbounded by file-content size; the separate text port reads at most the existing 4 MiB session-evidence input allowance through one checked regular-file descriptor, rejects known oversize before allocation/body read, strictly decodes UTF-8 and rejects observed file/root/manifest changes or failed cleanup without retries. This is a preview observation budget, never a workload/file quota. Pure `projectSessionAssistantPreview` accepts recorded Pi v3 JSONL with unambiguous ids/parent ancestry, sharing `selectLastRecordedSessionBranch` with the legacy evidence owner. It rejects malformed/unsupported/ambiguous or incomplete branch provenance rather than guessing. `source_scope: "last_recorded_branch"` means the physical last recorded leaf, not a live SessionManager selection or current model context; raw-history exports do not replay context edits. Only assistant text blocks are projected. User/system/tool/custom content, thinking, signatures, usage, diagnostics and provider payload fields are omitted; raw header/session identity and physical-reference metadata are not copied. Literal assistant strings still require correct Recipe-origin privacy: this is not a generic path-suppression rule. Per-call captured-origin/secret redaction runs before code-point preview counts and the 4,000-character per-message ceiling; default Recipe redaction remains unchanged. This ordering does not make later calls use the original launch privacy. At most 40 recent visible messages fit a separate 64 KiB encoded bound by dropping whole oldest preview rows with exact observation omission counts. Coverage remains explicitly partial/redacted/history-incomplete, even for an empty valid session. The response binds Run/generation/command, exposes no raw local path and labels `primary_text: "not_exported"`; no full authorised text is retained and no recoverable source/range is invented, so A3 is still required. This port creates no views/index/status/ACK/clock, probes no process and reconstructs no native/work authority. Ordinary producer/controller refresh, stream views and public role/range journeys remain open; private session preview publication is described below.

Private `writeRunSessionContextExport` and `writeRunSessionContextIndex` now materialize those assistant-only previews through `runs-session-exports.ts`, re-exported by the context-export facade. A genuine runtime producer is required for capture, publication and later index admission; copied producer data and malformed root-outcome evidence still refuse before publication. The writer now reads its genuine original producer metadata within an independent 1 MiB UTF-8 budget under the already-held capture evidence admission, before reading the selected raw body. Over-budget original data yields session_admission_unavailable without borrowing a healthy per-call preview or opening raw sessions. Missing/copied producer admission remains rejected by the existing guard. A private shared selected-input path applies that original Recipe data before projection/count/clipping while current metadata still owes identity/budget/frame checks and the recorded session supplies current branch/content. It is not an additional exported input capability: public readRunSessionPreview remains three-argument/per-call, even if a JavaScript caller supplies an extra privacy object, and the saved follower never reprojects. Original privacy presence/absence is fixed across caller mutation, first export and refresh. No clipped-preview repair, new generic carrier, body permission or public route is introduced. One explicit recorded selection produces `evidence/sessions/session-<selection-sha256>.json` (`run-context-session-preview-v1`), binding Run/generation, command, capture time and the fixed partial preview. The hash identifies command/path selection, not content, immutable provenance or raw-session permission; private physical/native filenames stay out of the published body/catalog. `evidence/sessions.json` (`run-context-sessions-v1`) merges only known published previews with `inventory_scope: "published_previews"` and `inventory_complete: false`, never discovering raw session folders. Both each encoded preview and the complete catalog are capped independently at 64 KiB. Existing catalog/header/entry/body bindings use strict UTF-8/schema/count validation; an export-id/command contradiction or corrupt/foreign catalog/selected target is preserved and refused, not repaired. Missing, denied, malformed or foreign cached peer previews become null/unavailable references without deleting their files. The original source and generation are rechecked before preview/catalog replacement; source changes reject refresh and preserve prior bytes. Preview and catalog share a synchronous evidence admission but are separate atomic-file effects; the context index uses a later producer admission and fresh catalog/reference checks. Exact before/after-commit errors escape without internal write retry or rollback. Catalog overflow refuses the whole metadata update rather than publishing partial lists, but a new preview may already have committed and remains retained; A3 must still deliver recoverable complete overflow/primary sources. The catalog/index and nested files are not one atomic snapshot, privacy certificate or immutable historical archive: later selective follows must revalidate each nested reference/body generation and coverage. These private writers preserve canonical Run/result/clocks/raw sessions, including after natural acceptance, and do not switch public inspection or claim native scope closure. Ordinary/controller refresh and public source/packed role/range journeys remain open.

Private readonly `readRunSessionContextPreview(stateDir, expected, exportId)` now follows one published session preview through that owner. It accepts only a selected 64-hex catalog id, admits the exact owned Run/generation/optional owner, verifies context-index/session-role metadata (including the fixed partial coverage and mutability), then parses the bounded strict-UTF8 catalog and selected nested file. Stored paths must match the canonical hashed layout; body Run/generation/command/export identity, capture time, byte size, allowed fields and Unicode/row omission counts must agree. Missing, unlisted, unavailable, malformed, stale, contradictory or symlinked evidence is bounded unavailability, never a newer generation, repair, automatic export or an invented empty preview. An unavailable catalog slot stays unavailable even if its file exists. Metadata admission may open other context roles for regular/readability/size checks, but among exported bodies only this catalog and selected preview are read; raw sessions, sibling previews and unrelated role bodies remain unopened for content. Root/marker/metadata, context index, catalog, nested directories and selected file are rechecked across the observation and through its returned `unchanged()` callback. Returned preview data is independently frozen; the path is a curated relative export path, not a raw/local session path. The complete response is independently capped at 64 KiB without clipping identity or relabeling partial preview text as complete primary output. Shared read-only binding types carry just identity data, never a reconstructed producer/work capability. This read performs no writes, directory discovery, process probes, lifecycle/scheduling/ACK effects or availability refresh. It is not an atomic multi-file snapshot, immutable archive, body authenticity certificate, native closure proof or a public role/range route; A1 integration, remaining selective readers, source/packed public journeys and A3 completion/source routing remain required.

**Selected-session boundary evidence and bounded writer correction.** A source-only scratch inquiry uses one genuine self-bound child producer, one explicitly recorded synthetic Pi v3 session and zero workloads/public routes/live-registry writes. Initial raw and published previews withhold the original Recipe origin. Changing only live same-generation values.skill_dir leaves the raw session and execution manifest byte-identical but makes the next raw preview disclose the origin and changes its projected observed/omitted counts while still showing exactly 4,000 points. Before republishing, a fresh saved-preview follow returns the unchanged original preview with zero raw-session opens. Before the correction, producer republishing overwrote the same selection id with the unsafe per-call preview; catalog/index remained available/redacted and the selected saved reader returned those validated stored bytes. User/thinking/provider fields remain excluded. The old raw observation's fence refuses after metadata change, which does not supply original privacy for a fresh call. Parent-captured exact PID/frame and fresh ESRCH immediately before deletion settle only this isolated host; the child leaves its own exit unasserted. This establishes distinct private boundary behavior, not public leakage/absence, a native/sandbox proof or a new visibility permission. The corrected source-only witness repeats the same inquiry: the raw per-call preview still changes as before, but producer republishing retains exactly the original projected preview and counts under the same selection id; its saved follow no longer discloses the original origin. Fifteen owning checks include current-branch appends, effectful live privacy edits in both presence/absence cases, an ignored extra public raw-reader argument, independent original/current UTF-8 budgets and source/manifest/metadata/marker/root refusal through commit. Source/catalog/index and exact partial errors remain separate, including natural outcomes and catalog overflow. This is bounded private acceptance, not ordinary/public/source-packed role acceptance or support for original privacy on the standalone raw reader. No new readonly privacy carrier, kernel interface or default policy is adopted.

Private `readRunStreamSource(stateDir, expected, stream)` now admits one fixed canonical runner `stdout` or `stderr` as **kernel-only projection input**, not a readable/model-facing context view. It freshly admits exact published Run/generation/optional owner through the context-identity owner, then uses `readExecutionRunnerStreamText` over the same checked regular-file descriptor machinery as session input. The lower layout owner accepts only root `stdout.log`/`stderr.log` for `runner_stream`, never a capture/session/evidence path; metadata observation stays body-free and file-size-quota-free. The separate text input is capped at 4 MiB, refuses known oversize before opening/allocation/body read, strictly rejects malformed UTF-8, preserves an actual runner-stream BOM and closes the descriptor before returning. Existing session decoding remains unchanged. Empty existing text is distinguishable from missing/unreadable/nonregular source; denied or failed cleanup never yields success or a read retry. Root/marker/Run metadata and source descriptor/path changes invalidate the entire input, including through its returned `unchanged()` callback, without adopting a newer generation. Returned `bytes_total` is current physical source size, not saved/observed command-capture agreement or completeness proof. The raw text is deliberately labeled `visibility: "kernel_only"`, `source_scope: "canonical_runner_stream"`, `capture_completeness: "not_asserted"`; these labels are not visibility permissions or body-authenticity certificates. Do not serialize this input as model/tool evidence: a separately owned fixed privacy/visibility projection must precede any view publication. The canonical runner stdout is already formatted by `executeRegisteredTool` and may be clipped; stderr also carries runner error/log text. Neither is an authoritative complete accepted answer or primary-result capture, nor a safe shortcut to raw Pi JSONL/provider payloads. This input port performs no export/index/status/ACK/clock mutation, directory discovery, process probe, producer reconstruction or native actuation. The input allowance is observational, not a workload/file-content quota or a model-output budget. Stronger curated stream privacy/view/index publication and runtime refresh remain separate unadopted integration work, not prerequisites for accepted A2 ordinary research or a mandatory custom reader. A3 must independently retain authorized complete primary sources before formatting.

The runtime/export owner prepares authorized views and atomically replaces each file and the bounded index independently of inspection; publish a reference only after its export is readable. This is not a cross-file atomic snapshot: mutable live views can advance between index and file reads, and historical excerpts still require stable captures. A missing view is marked unavailable/pending/not-applicable, not fabricated as an empty file. Before following a role, verify the index and evidence generation against the snapshot; replacement/pruning is unavailable evidence, never permission to inspect a newer generation. Context means retained authorized evidence, not a promise to reconstruct discarded history. Manual reads select a role and a bounded range using its format/size/coverage metadata; they do not require `inspect` to return the value or load every role.

## Latest-Only Delivery and Context

Use the existing root-coordinator boundary/idle scheduling and acceptance authority, not a stream of native steering messages. Periodic runtime diagnostics are a distinct typed delivery class; they do not synthesize actor-authored `attention: "steer"`, promote generic Trace, or alter urgent semantic checkpoints.

- Keep at most one latest unadmitted diagnostic per exact generation. A due snapshot is refreshed from current evidence immediately before admission.
- Freeze admitted packets and their identities. Newer observations wait separately; never mutate a packet whose Pi acceptance is pending or assume that returning a boundary draft accepted it.
- Coalesce eligible generations into one root-owned update, following existing owner/lineage and stale-context rules and the shared one-minute routine-diagnostic cooldown. Descendant Pi sessions and staggered Run timers do not gain separate wakeup or frequency allowances.
- Active updates wait until a completed safe boundary after the full tool batch. Already-idle delivery may request one debounced model wakeup for an explicitly configured due diagnostic batch; it must not request one turn per Run.
- Share the existing centralized model-output budget with completion delivery. Terminal outcomes take priority; diagnostics use stable fair ordering, disclose overflow, and retain only the latest deferred snapshot. Do not create a second unbounded journal or a separate full allowance per Run.
- In model-context projection, retain only the newest accepted diagnostic for each generation and remove obsolete diagnostic payloads after its terminal result. Do not rewrite native Pi entries, Trace, ordinary messages, foreign metadata, or accepted terminal outcomes.
- A mixed packet must preserve terminal members when older diagnostics are folded. Diagnostic replacement cannot acknowledge, erase, or redeliver a completion; completion acceptance remains generation-fenced and immutable.
- A terminal/replacement transition invalidates queued old diagnostics. Revalidate at delivery/context projection so a delayed `running` row cannot appear after that generation's outcome. Recovery follows existing proof-of-presence/absence rules and cannot replay already accepted snapshots.

Snapshot production, packet acceptance, and model projection are separate responsibilities. Bounded Trace may retain operational history, but a history of every heartbeat is neither required model input nor an audit-log promise.

## Generation-Fenced Manual Kill

Extend the public `message` envelope with top-level `run_instance_id`. It is required for `action: "kill"`; the launch response, compact inspection, or diagnostic supplies it:

```json
{
  "target": "run:review",
  "action": "kill",
  "run_instance_id": "<generation observed by the caller>"
}
```

The field is a nonempty opaque string and an exact precondition, not part of the logical Run id and not actor-local `input`. Other Run actions may supply it and must honor it; `target: "runtime"` rejects it. This increment requires it only for `kill` and does not invent a new actor-local action or consume Control capacity.

A missing kill generation fails as `run_generation_required`; a replacement generation fails as `run_generation_mismatch`. Both reject before signaling or Control admission. Never read the newest generation and silently substitute it for the caller's stale expectation. These are planned bounded machine-readable error codes, not assertions about current tool errors.

Inside the lifecycle lock, check the current coordinator owner, expected generation, process identity, and terminal state again. An exact already-terminal generation with retained authoritative proof returns an idempotent `already_terminal` acknowledgement without signals or another terminal event. If its logical id has been reused, an old request still fails generation matching rather than applying to the replacement.

A winning manual stop claim produces terminal status `killed` with reason `manual_kill`, distinct from `timed_out` with reason `max_runtime`. A pending stop request is nonterminal (`status: "running"`, `phase: "stopping"`, `stopped: false`), not a successful-kill claim. A synchronously confirmed terminal acknowledgement follows the existing stop-handled policy; a request-only acknowledgement cannot suppress the eventual automatic outcome. Concurrent manual/deadline claims serialize; the first accepted stop reason wins, with one final outcome.

## Self-Contained Automatic Outcomes

Normal finite roots deliver their outcome through the existing active/idle completion path without an `inspect` round trip. Services need not terminate to stay usable; periodic diagnostics are optional, and normal service Control semantics remain unchanged. Existing silent policies, exact root ownership, and containing-tree eligibility remain authoritative.

Keep generation, terminal status, compact summary, and declared artifacts. Add the distinct `timed_out` reason/deadline evidence and label output from interrupted work `partial: true`. Display clipping is not task partiality. Compact public-spawn and asynchronous registered-tool launch receipts now omit the three generic `inspect` calls while preserving launch facts. Explicit verbose public spawn retains existing full JSON metadata, including expert `next_actions`; meaningful diagnosis may still recommend the appropriate public inspection route. Quiet compact text adds no unconditional completion/readiness promise and does not change silent or service policy.

### Private Kernel Contract: Primary Command Text Publication

Status: Initial kernel publication/result binding and readonly saved-source admission are implemented for a bare ordinary command, one successful attempt and complete captured stdout, either equal to the complete memory result or bound to its privately observed stream digest when memory is only a tail. Initial immutable completion transport and literal operator/model projections are also implemented. The linked real public-spawn no-polling journey is exercised in source and packed SDK layouts for that initial case. This is bounded initial-case acceptance, not a public evidence-role/range API, broader selection or complete UX/AX release acceptance. The contract adds no capability registry, public permission flag, native authority or release shortcut.

#### Initial Scope and Owners

The first supported case is one ordinary command, one attempt, successful completion and its complete valid UTF-8 stdout selected as primary text before formatting. Do not implicitly extend this permission to parallel/merged output, retry selection, failure stderr, review markers or assistant-session streams.

- `execution.ts` owns primary selection in the successful `executeRegisteredTool()` branch before `formatOutput()`, not Run ownership or storage publication.
- The async runner supplies a narrow invocation-local kernel port retaining the genuine admitted producer, captured Run metadata and the binding between its `observedExec` result and the exact command/attempt. Keep the producer out of generic executor arguments and model-facing details; the port must not accept arbitrary text or paths unrelated to that binding.
- The existing context-export owner applies the fixed privacy projection and publishes the retained source. `runs-results.ts` supplies producer revalidation and lifecycle serialization; no new library domain or global capability registry is required.

#### Executor-Selected Final Response

The operator separately adopted result-first completion content: a completion reports the work's outcome, not its launch command. The complete raw-stdout contract above is unchanged. A distinct kernel-only final-response port now selects the successful executor's actual returned stdout before tool-display clipping, including composition/retry results and direct Pi text-print answers. It does not read arbitrary session histories, raw stderr, other attempts or mutable logs. Direct Pi JSON/RPC/interactive output is withheld. The runner supplies the original producer; the source owner applies its captured privacy and unchanged4MiB input bound through the existing exclusive immutable publication path.

An exported response carries text_basis:actor_response and upstream_truncated. Its exact counts cover the retained projected response, not necessarily the original complete stdout/Actor answer. Observed upstream clipping remains a separate unknown-count warning; reported killed flags on a successful degraded result do not become native closure or prohibit its response text. Failed roots gain no successful-response publication. This path cannot replace complete output, repair privacy/capture/source refusal, renew ownership or replay selection. Canonical/result/source/packet effects remain separate. New result-first captures do not expose command excerpts; all old captured layouts replay exactly.

Fresh presentation additionally follows the adopted [shared result/preview budget](coordinator-delivery.md#result-first-completion-content):48KiB including service data, equal candidate shares and a frozen prefix allocation. The source owner selects up to48KiB from the same original admitted read; publisher binding previews remain160code points and the source input remains4MiB. result denotes a whole admitted text fitting its share without observed upstream clipping, not universal Actor output or native closure; preview carries exact local loss and separate unknown upstream loss. Old headings_outcomes and earlier packets retain their original16KiB/text/hints, without reallocation or source rereads. The following earlier result-record evidence retains its historical budgets and encodings; the delivery contract owns current display behavior.

Local source/npm SDK witnesses exercise genuine Pi print replies, original retry/sequence/parallel/degraded output and byte-overflow recovery. This admits the bounded final response only, not the broader complete-raw-stream proposal below, public selectors, default streams/supervision, native truth, loaded UI or release readiness.

#### A3 Owner Reconciliation and Unadopted Selection Proposal

The A3 source inspection separates implemented retention from new publication permission. `execution.ts` selects only a successful bare string template; even a single wrapped leaf currently does not call the primary port. `createRunPrimaryTextPublisher` in `runs-context-exports.ts` independently requires one observed non-session command and exactly attempt1, binding its complete capture before privacy/export. The separate final-response path above may capture the actual retained response of a successful composition/retry/Pi text-print execution; it does not make that response a complete raw stream. Unsupported selections and failures remain explicit. Neither actor-supplied fields, formatted display nor canonical metadata can bypass the respective selection owner.

Existing acceptance already covers complete authorized primary input through4MiB, including digest-bound memory tails, omitted-primary recovery, full fixed diagnostic metadata fields and complete1800-declaration metadata recovery beside large/binary outputs. Those witnesses do not need another implementation to begin A3. Complete diagnostic `error` means the recorded field, potentially already formatted/clipped upstream, not permission for complete native stderr. Genuine retry/composition/failure/Actor-session research proves readable evidence and natural codes separately from primary eligibility.

`observability.ts` currently synthesizes ordinary terminal summaries such as `Run completed.`; it does not preserve a substantive answer as a summary source. Its member collector caps supplied summaries at1000 UTF-16 code units, and `run-delivery.ts` normalizes/caps the displayed summary at200; these collector/display cuts can still split a surrogate pair. The independent `runs-trace.ts` source-side repair now keeps the longest prefix within the unchanged1000 UTF-16-unit allowance without splitting an original surrogate pair at that boundary. It applies only to new event input, retains no additional raw text and adds no fields, normalization or original-length/clipping metadata. Previously ill-formed input is not retrospectively repaired. Reader/append/compaction preserve retained legacy event bytes, including old split-pair and longer summaries; admitted packets and their renderers are unchanged.

Downstream exporters still cannot reconstruct discarded text or certify original counts. Captured-member overflow inventories deliberately exclude summaries/legacy bodies. Richer summary/original Trace retention needs its own admitted source/privacy and compatibility decision, not a longer slice, a mutable-journal reference or retrospective full-source claim. Existing packets must retain their admitted text; a formatter correction must not silently retrofit them. Mirrored Trace owner tests verify boundary classes with an independent scalar-iteration oracle, exact returned/read/serialized text, unchanged optional fields and legacy-byte compatibility through actual compaction. The existing installed-dist boundary test also exercises the repaired writer/reader; these are source/compiled persistence checks, not new summary-source publication or rendered phone/TUI acceptance.

**Unadopted minimal next selection proposal — owner approval required.** Permit the final successful settled attempt of exactly one ordinary non-session string command, including a single retry wrapper, as the primary stdout source. Require contiguous original attempt receipts starting at1, earlier attempts unsuccessful, the exact executor-selected final result, code0/not killed and complete capture/digest binding to that attempt's own stdout file. Export only that final attempt through the existing captured privacy,4MiB input allowance and immutable source/result/packet paths; never concatenate attempts. This proposal grants no additional complete-raw-stream permission for arrays, parallel/repeat/recovery/acceptance-policy output, failure stderr or Actor-session streams; the separately adopted bounded final-response contract above is not such permission. Stop captures remain captures, not terminal/closure proof. This proposal authorizes no implementation until accepted; broader selection, richer summaries and any source-budget increase remain separate decisions.

The earlier owner reconciliation used existing executor-selection and diagnostic-source tests without changing executable inputs. The subsequent Trace scalar repair is separately validated on its retained source/compiled candidate. Neither admits retry publication, richer summary recovery or integrated release acceptance.

##### Legacy Completion Disclosure Boundary

The tracked excerpt aspect `excerpt_format: bracketed_omissions_v1` applies only to admitted primary/diagnostic counters; it neither versions legacy summary/body rendering nor certifies their original privacy. Extending that already-saved aspect to legacy text would change admitted packets. A separate explicitly admitted new-capture format is required before changing those fields, with the A3 privacy/retained-stage and packet-compatibility decision kept explicit; the approved bracketed display rule is not broader source retention or permission to reconstruct counts.

The existing owners have distinct loss stages:

- **Production summary:** observability synthesizes short status text, not an authored answer. Its collector additionally caps externally supplied summaries at1000 UTF-16 units; delivery normalizes whitespace/backticks and caps the displayed summary at200. The old owner reconciliation already identifies these cuts and the separate source/compatibility gate; this preparation does not repeat it as new behavior.
- **Legacy stdout:** observability reads at most8192bytes, decodes UTF8 non-strictly, trims, and then clips at4000 UTF-16 units before removing an optional review marker. Collector body handling caps at4000 again. Raw captured lengths and a private upstream tail are not admitted exact-count/privacy evidence. A short retained body or a missing ellipsis does not establish complete input.
- **Packet/renderer:** the closed member schema retains only bounded summary/output strings, without a legacy loss flag, original range/count or source-privacy binding. Captured overflow inventories deliberately omit both. Packet formatting/phases reload saved values without consulting stdout, result or journals for richer text.

The owning observability property `Legacy completion admission cannot recover upstream counts or privacy from tracked excerpt format` uses data-only on-disk snapshots, not new runners/native truth. Two different4/4000-character tails after an over-budget common prefix produce identical members. An authored literal4000-unit body ending in an ellipsis produces the same member as a longer clipped ASCII source, so neither the glyph nor the saved length proves loss or zero loss. A valid CJK source hits the8192byte limit mid-codepoint and becomes2730CJK characters plus U+FFFD, below4000units and without an ellipsis; the original bytes/counts are not repaired or inferred. A caller-authored fixture-private prefix remains in legacy text, demonstrating the tracked flag is not its privacy projection. Actual source/npm replay verifies frozen member/render bytes through queued/presented phases after deleting the observed stdout fixture; no refresh or privacy certificate is created.

The first AX contract now has one creation path. All new completion admission captures ax_records without an excerpt_format or presentation selector, including direct helper and ordinary UI callers after unchanged owner/location checks. Existing batches are resolved before any new capture. Internal numbered markers and absent/tracked/navigation aspects remain only for exact retained-snapshot replay, not public product versions or alternate new-message defaults. Journals do not retain complete Batch content, so their private codecs cannot be deleted or relabeled without breaking delivery equality. Steer envelopes already store content and need no alternate formatter. See [retained capture compatibility](coordinator-delivery.md#retained-capture-compatibility). This changes neither source selection nor forward-readability guarantees for older binaries.

Retained result_layout:headings captures preserve the earlier contract: every shown item starts with #0:, #1: and so on, even an only item at #0. Fields stay at root depth; successive blocks have one blank separator line. There is no result suffix or extra TUI heading. Each block has the same per-result fields, without members, a Batch caption, outer routine counters, time windows, repeated runtime summaries or an unconditional full-map hint in model content. The minimum closed terminal delivery marker preserves details-stripped correlation without turning authored labels into metadata or acknowledging identical bodies across epochs. Required source/generation/technical/location facts stay with their result. Only real omission/inventory and recorded non-done omitted states remain outside the list. Valid compact ranges can hide whole compiler JSON reference/detail blocks and the marker, never authored text or warnings. The own-data layout aspect is captured once and is not a public AX selector/version; older indexed, single_result:true and result_layout:records/run_headers canonical captures and numbered codecs keep exact bytes/hints and phase recovery. Inherited/accessor/mixed aspects cannot restyle saved data. A group with one visible row remains indexed, and whole-result omission stays explicit. Both shapes use the same record owner and a compact two-column native TUI over the same full model content; this preserves embedded Markdown/backticks/CRLF as opaque values, keeps selective file investigation explicit rather than adding a standing instruction, and renders tracked previews/source references literally. It emits [omitted: N chars] only from the admitted primary/diagnostic counters, never raw legacy tails. Ellipses sit outside literal previews at admitted head/tail byte gaps; range/hash/source/preview data stays identical. A complete admitted tracked excerpt has no synthetic zero-omission decoration. Summary display keeps the existing200UTF-16 allowance with pair-aligned prefix clipping instead of whitespace/backtick normalization; local loss is [omitted: unknown]. A separate visible legacy basis/upstream marker means original completeness/privacy is unproven, not that a particular hidden tail or positive loss was discovered. Recorded output is neither refreshed nor promoted to a complete primary source.

Whole outcome rows are admitted before lower-priority location references under their retained16KiB/64member limits (fresh shared-result captures now use48KiB); new references render inside their matching record and wholly omitted rows remain covered by omission/inventory. Exact refs fit whole or the entire member/reference row is omitted, without shortened paths or an extra budget. Overflow uses the existing content-bound metadata-only member inventory, with unchanged exclusions, hash and first-write/phase effects. Earlier source/npm replay ran the complete32declaration delivery owner: all28original scenarios/fingerprints and the3version-one properties remain, plus retained draft-codec/frozen-fingerprint properties covering original encoding markers, frozen phases, literal/exact/unknown excerpts, synthetic admitted range boundaries, no source/native/time refresh, whole refs, exact byte boundary/one-byte overflow, independent65/64row witness and metadata recovery after source loss. Synthetic range layouts do not adopt suffix/middle primary selection. The ordinary producer integration additionally replays the complete28declaration UI owner and4declaration Pi owner, including27old-format/navigation/phase recovery partitions followed by fresh canonical AX admission. Those retained forms keep anchored-header identity; fresh records use their closed terminal marker, never an authored body Batch label or Unicode line separator; existing detailed-envelope precedence, journal equality and recipient checks remain. The original source/packed public SDK eight-mode/eighteen-runner journey now consumes exact deindented AX literals without source normalization. All modes, native frames/stdout/close/fresh-ESRCH cleanup and selective reads remain, including1800declarations/one withheld path, source-loss replay and the independent65/64/1row-cap witness before lower-priority location rows. An earlier draft experiment co-exhausted the byte limit; that evidence motivated coalesced routine uncertainty rather than weaker assertions, a larger allowance or rewriting retained text. Those experiments did not establish separate public AX standards. These checks do not prove loaded-phone/terminal rendering.

The preceding result-records implementation was locally verified: full source validation1572tests/49suites,1567pass/0fail/5skip, including actual npm-installed delivery/UI/Pi owner replays and source/packed public SDK eight-mode journeys. These overlapping profiles are nonadditive. A frozen11-snapshot probe reproduces exact old content/hints across33pending/queued/presented partitions. New properties cover root records, per-result references/generations, missing/broken correlation without automatic replay, details-stripped committed-entry recovery, same-body distinct epochs, opaque text, exact16KiB/one-byte overflow and a nonfitting partial prefix whose complete result list fits. Types/build/parity,55Recipe QA and the87file/395edge acyclic graph pass; context has0errors/9existing wide-table warnings. No separate conformance run, loaded visual/native acceptance, reload, operator Run operation, commit or publication is claimed. That scoped Grow Loop stopped there; loaded acceptance remained separate.

The subsequent flat-heading refinement is locally verified with the same1572tests/49suites,1567pass/0fail/5skip, including actual installed-owner replays and source/packed SDK journeys. New content/TUI uses bare #N: headings, flat fields and blank separators, without duplicated Run/result/Batch titles. A15-snapshot frozen probe preserves old bytes/hints across45phase partitions, including prior flat/indexed records and Run-prefixed headings; permanent source/installed properties retain their captured hashes/ranges. Debounce coverage now uses controlled timers to prove reset/no early send/exact500ms delivery rather than assuming a real callback completes within600ms under host load; production timing is unchanged. Limits, sources, generations, opacity, whole omissions and details-stripped/uncertain recovery remain covered. No Grow Loop, reload, subagent, operator Run action, commit, publication or loaded-visual acceptance follows.

Richer privacy/retained-stage admission remains separate. Do not count hidden tails, reinterpret old flags, repair source text or retain new bodies by implication. New presentation is not source selection or privacy authority. This does not resolve broader A3 summary-source/retry selection, live/native/release gates or the remaining attention/inspection rollout owned by BACKLOG.md.

#### Publication Admission

Permission follows a legitimate call through that kernel-owned port under its fixed source policy, not merely a zero exit code. Admission must establish all of the following:

- The selected result belongs to this invocation's observed command and attempt, with stdout as the selected stream.
- The executor chose that result as the ordinary primary response, rather than an arbitrary recorded capture or neighboring result.
- A kernel-owned publication/privacy policy applies to this source kind; actor values cannot widen it.
- The complete selected text is available before display clipping, and the privacy projection applies to that complete input.
- The original producer, owner and exact Run generation remain valid at publication.

Retain that relationship in the invocation context. Serialized `run_instance_id`, execution references, manifest records, paths, marker acceptance or `visible: true` flags cannot manufacture it. A readable capture proves neither exposure permission nor a complete primary result.

#### Complete Export Before Clipping

Process the selected complete input in this order: fixed privacy projection without display clipping, full retained export, byte/Unicode/range metadata, then bounded preview. The existing Recipe/session privacy machinery may be reused, but its default 4000-character evidence clipping must not silently truncate the full export. Completeness and all descriptor counts refer to the authorized exported text, not an undisclosed private original; disclose redaction as specified below.

The standard 1 MiB memory capture limit is not a workload quota or permission to treat every `result.stdout` as complete. Complete memory input still requires exact full-file agreement. For a truncated memory tail, `command-templates.ts` now hashes the actually observed stdout buffers before clipping and supplies optional kernel-only `stdoutSha256` through the existing frozen settled-attempt receipt only when canonical capture persistence completed. The runner already retains that exact callback receipt in its invocation-local primary context; no new registry, producer reconstruction or actor-facing result field is introduced. The raw digest is not serialized into execution manifests or canonical actor results, and it is not UTF-8/privacy/native/publication authority by itself.

Tail publication additionally requires exactly one successful selected attempt, complete persistence, safe observed bytes greater than memory bytes, matching saved/physical length, the exact memory suffix and SHA-256 agreement for the entire checked source. File length and tail equality alone cannot bind an unseen prefix. Decode the full bounded capture with strict UTF-8, then apply the existing captured privacy projection before export/counts/preview. The digest binds raw observed bytes, whereas the exported source digest/counts describe the privacy-projected bytes. Missing/malformed callback digest, partial storage, invalid text or source-input overflow stays explicit unavailability; contradictory source binding remains an authority refusal, not a synthetic workload failure. Existing 4 MiB source-input allowance, descriptor/view limits and workload capture behavior remain unchanged. Larger work output is not forbidden, but its complete publication remains unavailable rather than silently substituting the tail. Formatted runner stdout, actor/result digest flags, session previews and generic temp-output paths cannot substitute for the admitted original.

The port returns either a curated generation-bound source descriptor or explicit source unavailability with a reason. The initial private descriptor also records SHA-256 of the exported UTF-8 bytes; that digest identifies bytes, not privacy permission or native authority. Do not expose raw capture paths, private input, producer references or the port itself. Keep full source bodies separate from bounded metadata views; do not increase compact-view or delivery budgets merely to inline a long source.

#### Publication Ordering and Failure Truth

Prepare text/projection outside any lock spanning awaited work. Revalidate producer, generation and source binding for final synchronous publication under the existing lifecycle admission; never await workload, model or asynchronous preparation callbacks under that lock. A result may promise a source only after that source is successfully committed.

A returned source descriptor is a candidate, not terminal acceptance. The result writer stamps `primary_text_protocol: "run-primary-text-v1"` only through its kernel publication port and strips actor-supplied output/protocol fields. Recovery must admit the saved canonical record and source, not treat that marker by itself as a capability or privacy certificate. At first-result publication, persist the selected descriptor or explicit source-unavailability in the same atomic canonical result record as the corresponding result. Natural acceptance fixes that outcome's binding; `after_stop_claim` publication binds capture evidence only. An existing admitted winning record and its binding remain unchanged, including when the winner records unavailability. A later candidate must not attach its source to that winner. Return values or exceptions alone do not prove acceptance; use canonical result classification, never treating malformed or unproven state as a winner.

A source committed without a corresponding canonical result binding remains unreferenced evidence, not a reconstructed primary outcome. After result commit, recovery reads the saved binding and canonical acceptance classification, then admits the existing source without reconstructing producer/publication capability, scanning for a substitute, republishing or promoting a stop capture to a terminal outcome. An unavailable or changed source stays explicit; never repair the historical binding by silently selecting different bytes.

Give each published source identity fixed exported bytes, including within one generation. An identical repeated publication reuses the committed source identity and full-source metadata; a contradictory publication refuses without overwriting that source. Presentation may derive a smaller preview from those same bytes under the clipping rules below, not mutate the accepted outcome binding. Old references must never resolve to replacement-generation bytes; after retention ends or proof is lost, report unavailable instead. Source, result metadata, index and delivery writes remain separate effects, not one transaction. Preserve actual committed/partial effects and exact errors without implicit retry or rollback.

Classify failures by authority and actual commit stage:

- Export failure: Record explicit `output_unavailable`; do not fabricate a workload exit code or claim complete capture. A live error handler must not turn a failed text export into an invented command failure.
- Admission refusal: Preserve producer/generation/source-binding authority errors; never downgrade them into ordinary source-unavailable metadata or write into replacement state.
- Failure before canonical result commit: Preserve the exact error and any already committed source effects; no natural outcome or accepted binding follows merely from source existence. Do not infer successful rollback or retry implicitly.
- Failure after canonical result commit: Preserve the admitted result and its binding even if Trace, delivery or lifecycle cleanup later fails. Cleanup uncertainty remains uncertainty, not proof of lock release or permission for another producer operation.

Preserve existing natural-result/stop-claim precedence: a source file alone cannot authorize natural terminal acceptance, stop finalization or work resumption.

#### Readonly Saved Source Admission

Private `readRunPrimaryTextSource(stateDir, expected, query?)` now reads a saved publication without the original producer, including after its process exits. It admits the published owned Run, exact generation/optional owner and cooperating outcome protocol, then uses one bounded strict canonical result snapshot for both classification and binding. The shared `runs-outcomes.ts` decoder curates only data; a decoded descriptor, protocol marker, cached index, path or digest alone grants neither body nor producer authority. An orphan export, legacy/unknown publication, malformed/foreign result or changed binding cannot substitute for that admission. Saved explicit unavailability stays explicit, and stop captures remain `capture_only`, never terminal proof; accepted natural sources do not depend on later stop records.

The reader follows only the generation/owner-derived primary filename fixed by that canonical binding. It checks a regular non-symlink evidence directory, bounded strict-UTF8 source descriptor, full SHA-256/byte/code-point agreement and the exact recorded preview/range. Root, marker, metadata, result, directory and source observations are fenced; observed change or failed read/close yields unavailability, not a partial success or implicit retry. Source input remains capped at 4 MiB and canonical JSON inputs at 1 MiB; these are observation allowances, not workload quotas. Available nofollow/nonblocking flags and regular opened-descriptor checks also protect bounded strict ownership/identity metadata reads. Legacy best-effort JSON defaults are unchanged. This does not establish exhaustive filesystem-race immunity, body authenticity, durable immutability or native scope closure.

Without a query, the response preserves the recorded descriptor. An explicit `{ start, end }` selects a half-open UTF-8 byte range; both ends must be scalar boundaries, even for an empty range. It derives the exact excerpt and shown/total/omitted code-point counts without changing the canonical binding, preserves a real BOM/U+FFFD and refuses an encoded response over 64 KiB instead of silently clipping. Its returned `unchanged()` callback is a fresh mutable-file observation, not a capability or archive certificate. The reader neither reapplies live metadata privacy nor opens raw captures/sessions, discovers substitute sources, reconstructs producers, acquires lifecycle/work admission, writes sources/indexes/results, probes processes nor acknowledges delivery. Controller/public routing and linked public-launch acceptance remain separate integrations.

#### Delivery Obligation and Acceptance Boundary

Completion delivery carries the admitted descriptor rather than reconstructing it from root stdout. Operator and model projections must retain the corresponding preview, visible clipping notice, counts and source/generation reference. Renderers must not silently rewrite the excerpt to which the descriptor's ranges and counts apply. Source reads neither refresh publication nor acknowledge or repeat delivery.

Completion members now carry an optional `primary_text` binding captured through the admitted readonly source port, not by copying raw `result.output` or promoting its protocol marker to body permission. Owner/generation follow the exact transition, and only an accepted natural source may become a primary excerpt. Ambient terminal observation and the shared ready-forest candidate check do not read full primary bodies; eligible member collection performs the bounded source verification once before packet admission. A pending existing packet is reused without source reobservation.

Packet admission curates and copies the binding, freezes its nested source/range plus member/artifact records and member arrays, then persists that immutable membership independently of mutable delivery phases. Serialization/reload and pending/queued/presented transitions retain the same descriptor or unavailability. Rendering performs no source/index/result I/O, availability refresh or producer reconstruction. A later missing source does not change an already captured packet; the reference is labeled retained **at capture**, not promised perpetually readable. Missing or changed sources before capture become explicit unavailability without substituting formatted runner stdout. Existing unsupported session/composition/failure displays remain separately labeled legacy diagnostics, never a complete primary source; this does not extend full-source permission to those cases.

The shared operator/model Markdown projection uses literal dynamically fenced previews without whitespace, CRLF, BOM or backtick normalization. It keeps exact shown/total/omitted code-point counts, the half-open UTF-8 range, redaction/clipping distinction and full source/generation/digest reference. Markup delimiters are presentation, not source code points. Existing 64-row/16-KiB model and 256-member/1-MiB journal bounds remain; overflow omits whole rendered rows with explicit retained-member counts, not untracked edits inside excerpts or source paths. Newly admitted row-overflow packets also retain a [scoped captured-member inventory](coordinator-delivery.md#captured-member-inventory) and budget its complete reference before rows. That source lists all captured identities/statuses/lineage and existing primary bindings only; private locations, diagnostics and artifact inventories are not included. Source/journal publication remain separate effects, and phase transitions/rendering never reread or repair the source. Legacy missing references are explicit. Owning properties and a bounded linked source/packed six-composition byte-overflow witness are verified; broader omitted-available-primary/row-limit journeys and artifact/summary/error inventories remain open. Schema parsing and rendering rely only on admitted packet data; they do not authorize new publication or raw/sibling discovery.

The source and installed-tarball SDK fixture now joins the initial case in one chain: a model-issued public `spawn` launches a real bare Node command, the runner publishes its first canonical binding, the root coordinator supplies one automatic batch to the next model context, and ordinary bounded file reads recover the complete exported 128-KiB memory-input or 2-MiB capture-input source from the **reference parsed from that model context**. Tools mode proves actual `stdout_truncated` execution metadata, complete source recovery and redaction in the prefix no longer held in memory; final-answer mode retains complete-memory coverage. It checks the source/generation/hash against the accepted binding, exact preview/range/count agreement, strict UTF-8 and redaction. The fixture uses no private kernel publication, producer admission, source-reader or SDK helper API and invokes no status-polling tool or native completion-send queue.

Both layouts exercise a complete tool batch and completion during a final-answer request. Tools mode uses a fixture-only producer-exit barrier before returning the unchanged public reply; final mode returns that reply immediately, holds the command behind a bounded fixture gate until the next model request, and then verifies the completion continuation after that final answer. Both retain one agent run/one accepted batch; requests are respectively two and three. Capture the public receipt's PID/state/generation immediately, require fresh ESRCH for producer exit before cleanup, and retain durable launch/capture uncertainty if exit cannot be proved. These fixture gates/waits are not product deadlines, independent supervision or whole-scope closure proof.

A third source/packed SDK mode proves bounded captured-member overflow recovery through six real public `spawn` calls, one per model request. A shared fixture gate holds output until all PID/state/generation receipts are durably captured; release on the final-answer request produces one automatic batch and one continuation in the same agent run, without status-tool polling or native send queues. Six literal Unicode command-metadata rows exceed 16 KiB, so the model context carries the exact inventory reference and omission count. Ordinary bounded file reads verify the inventory's full hash/bytes, all six natural Run identities/generations/statuses, captured order and exclusion of private locations/diagnostic excerpts/bodies. Captured diagnostic references are retained separately and recovered in full, even for omitted rows. These compositions keep explicit `not_selected` primary bindings: this is not primary-source authorization for composition outputs. Each layout uses eight model requests, six public spawn calls and one accepted batch; fresh producer ESRCH remains mandatory before fixture cleanup. Completion order is not launch order. This witness covers byte-budget member omission with composition primary explicitly unavailable, not all row-limit/primary/artifact/summary/error cases.

A fourth source/packed SDK mode now proves **omitted available primary** recovery with six real bare one-attempt command launches, eight model requests, one accepted automatic batch and no status-polling tools/native send queue. Each emits >2 MiB of strictly valid UTF-8; actual execution metadata confirms memory-tail truncation, while the genuine observed-stream/durable-capture path retains the complete fixed-privacy source within the unchanged 4-MiB allowance. Long Unicode positional command metadata forces the shared projected-row byte budget independently of full-output size; compact primary previews stay 160 code points. One inventory reference parsed from actual model context fixes all six captured identities/generations/statuses/primary bindings. Ordinary <=8192-byte reads validate full source SHA-256/UTF-8 bytes/code-point totals/preview ranges/shown-omitted counts, BOM/CRLF/backticks/Unicode tail and full prefix/tail secret redaction. Every source is recovered, including positively counted omitted members; displayed primary refs agree with displayed rows. Identical content hashes across Runs do not collapse source/generation identity. Metadata references remain separately verified and no unsupported composition scope is added. Those four modes cover eight layout scenarios/28 real public producers with the same immediate durable PID/state/generation capture and fresh ESRCH cleanup proof. This closes that bounded byte-overflow witness only, not all selection/failure/summary/artifact cases, manual visual/external-model/native or integrated release acceptance.

A fifth source/packed mode now isolates the **64-row cap** rather than byte overflow. It launches one real public bare Run and creates 64 explicitly synthetic legacy metadata companions, with controlled fixture timestamps after the genuine outcome. They have no real native producers or primary/diagnostic/artifact bindings and grant no body/OS/clock authority. The actual automatic model batch captures65 exact identities/generations/statuses, shows64 and omits one synthetic companion. An upper bound retaining current header/inventory/footer plus the omitted minimal row still fits below16KiB; therefore byte capacity cannot explain this omission. The inventory reference parsed from actual model context recovers all65 entries, verifies visible captured order and the omitted identity, and preserves the genuine canonical primary reference/full source. All65 handled markers are checked against captured generations, not just shown rows. Delivery remains three model requests/one actual public spawn/one batch/one agent run/zero status-tool polling/native sends, with immediate real PID/state/generation capture and fresh ESRCH cleanup proof. Those five modes cover ten scenarios/30 real public producers; synthetic companions are never counted as extra launches, native fan-out capacity, authenticated membership, budget enforcement or whole-scope closure. Broader failure/summary/selection/artifact, manual visual/external-model/native and integrated release acceptance remain open.

A sixth source/packed SDK mode now proves a **real failed-natural diagnostic outcome** through actual model context, with no synthetic companion. One gated command emits long multilingual stderr and exits7; execution exit evidence and first canonical natural result both retain code7, while primary stays null/primary_not_selected_for_failure. The third model request receives one automatic failed batch and exactly its diagnostic reference. Ordinary bounded strictUTF8/hash/byte reads recover complete projected metadata; error equals the canonical result.error after full prefix/tail Bearer and immutable admission-literal masking, not an authorized raw stderr/full-task source. The literal1000-code-point error excerpt, total/shown/omitted counts, decoded-field byte range, BOM/CRLF/U+FFFD/backticks/Unicode tail and unshown failure_reason are checked. A separate canary injected only into raw runner stdout after proven exit never becomes metadata or a legacy fallback. The fake literal already present in model-owned spawn args is not treated as a whole-history redaction obligation: assertions cover the delivered batch/source. This remains one agent run/three requests/one actual public spawn/one accepted batch/zero status-tool polls/native sends with immediate receipt capture and fresh ESRCH cleanup. Those six modes cover twelve scenarios/32 real public producers; row-limit synthetic companions remain explicitly separate. This does not extend failure-primary permission, cover all failure/summary/selection/artifact cases or establish native closure/release readiness.

A seventh source/packed mode now proves **large declaration recovery alongside real large/binary outputs**: one gated public command/no synthetic companion writes an8-MiB binary and6-MiB UTF8 file while declaring1800 artifacts. Fixture-only lstat verifies regular-file sizes, not body content, inventory provenance or target-body permission; these workloads exceed the independent4-MiB source budget without becoming launch/file quotas. The third actual model request receives one automatic done batch and its exact canonical inventory reference. Ordinary bounded strictUTF8/hash/byte reads recover the entire >64-KiB source under4MiB, all ordered names/references/optional fields and exact1799 disclosed/1 withheld privacy counts. The masked path remains null/artifact_reference_redacted. The <=64-KiB reference view shows0/1800 declarations and the <=16-KiB batch keeps the full reference/count without raw path slices. All inventory entries remain not_observed; contents not_read/production not_asserted is unchanged despite the two real files. No artifact target body is followed/read/hashed by fixture recovery; separate owner tests prove target-probe refusal. Fake literals in prior model-owned args are not whole-history redaction claims.

This public case exposed raw meta.artifacts duplication in command.done: the unchanged65536-byte Trace limit falsely converted successful work into code1. The runner now retains only its already prepared bounded inventory binding/unavailability, no declaration list, without quota increases or catch-and-ignore. The witness checks natural0 plus bounded nonattention command.done and its exact first-result inventory descriptor; generic command/capture/session/level evidence remains. A Trace reference still grants no canonical acceptance, production or target-body authority. Those seven modes cover fourteen scenarios/34 real public producers, with synthetic companions separately labeled and immediate receipt capture preserved. Parent cleanup now validates the durable frame then requires fresh ESRCH for every captured positive safe PID immediately before deletion; live/denied/unknown probes retain state and preserve primary/exact probe causes. A focused mocked-probe property covers absent/live/denied, not native scope closure. Broader source-loss/summary/selection/artifact acceptance and native/release gates remain.

An eighth source/packed SDK mode proves **public source loss and reuse of the visible unavailable capture**. One real gated bare Run/no synthetic companion first has natural0 plus healthy canonical primary/artifact/diagnostic bindings after producer ESRCH. The fixture checks all exact generation-bound sources with bounded strictUTF8/hash/byte reads and explicitly parks the three original files outside evidence, leaving result/view/index untouched plus a separate raw stdout canary. At actual model request3 one automatic done batch reports three exact source_unavailable reasons, no available source refs, primary tail/legacy body/path/canary and unchanged canonical result bytes. A fixture-only restoration tool verifies absent paths have not been repaired and moves the same originals back, checking their full hashes/bytes; it creates no producer/work/publication capability. Actual request4 reuses byte-identical unavailable batch content/identity, equal to the single saved public SDK custom-message entry, with canonical result still unchanged. Explicit fixture restoration is not implicit product repair or a restart/durable-journal reload/global-immutability/independent IO-instrumentation proof. Owner packet tests separately prove reload/phase source-free immutability. The mode remains one agent run/four requests/one public spawn/two tools including restoration/one accepted batch/zero status-tool polls/native sends with immediate durable capture and fresh parent ESRCH cleanup. The fixture now covers eight modes per layout/sixteen scenarios/36 real public producers. Broader summary/selection/artifact and native/release joins remain.

The real running interval also exposed headless SDK status rendering that accessed an uninitialized TUI theme and stopped completion callbacks. Terminal-only coloring is now guarded by `ctx.mode === "tui"`; JSON/print/RPC continue without theme initialization, with a focused regression and the actual SDK flow. Literal Markdown/context assertions still do not constitute manual TUI/phone visual acceptance.

This linked initial-case witness complements the existing kernel source/result/packet fault and recovery families. Missing export, unavailable or foreign-generation source and duplicate delivery must remain explicit and safe. This witness covers only the relevant outcome/evidence path; it does not prove independent supervision, native scope closure, all overflow/composition cases or release readiness. Existing native gates, the full acceptance matrix and the single integrated release gate remain unchanged.

**Artifact bindings in ordinary outcomes.** `readRunResultArtifactInventory` now admits one exact canonical natural outcome, cooperating protocol, generation/owner and its shared-schema descriptor. Explicit first-result unavailability is returned without source-body reads and cannot be repaired from a healthy later source. Available descriptors are compared in full with the admitted retained artifact index/view/source, including source identity/hash/bytes/declaration count. Accepted natural failures may carry declaration metadata, but post-stop captures and canonical/transition status disagreement cannot gain terminal/body authority. Ambient observation and candidate checks inspect markers only; complete inventory body reads occur only for eligible packet members.

Eligible members copy the flat `artifact_inventory`/`artifact_inventory_unavailable` data into the frozen packet. Every inventory-aware member suppresses legacy target paths, including missing/invalid sources; packet parsing rejects conflicting old path maps rather than silently accepting a fallback. Literal operator/model projection emits complete source/generation/SHA-256/UTF-8 bytes/declaration count, labels target availability/production not asserted and bodies not read, and stays quiet for `not_declared`. Rendering/reload/phase transitions do no source/result/index reads, availability refresh or ACK. Whole-row overflow retains admitted artifact descriptors in the scoped captured-member inventory, with an optional captured-bindings-only tag that leaves older payload hashes unchanged.

The public source/packed SDK tools case now reads both primary and artifact references parsed from actual model context, comparing the latter to the canonical first binding and recovering all five declarations with bounded ordinary file reads. No clipped legacy artifact path list appears in the batch. Owning tests cover zero ambient source opens, exact descriptor/availability/status matching, failed-natural versus post-stop capture, preserved first unavailability, pre-capture source loss without raw fallback, post-capture source loss without packet repair, deep freezing, literal backtick-containing references, quiet absence and bounded many-member recovery. This does not complete broader summary/error, all artifact/row-limit/omitted-primary, manual visual/native or integrated release acceptance.

#### Minimal Independent Validation Properties

These are required properties, not a declaration of complete acceptance. Owning suites now exercise complete projected retention, immutable source/result binding, metadata capture, live export/result-commit faults and readonly source admission. Real detached-runner coverage recovers the complete 128 KiB source through bounded ranges after proven producer exit, without its runtime-local capability. Capture properties now verify raw-byte digest agreement across chunk/UTF-8 boundaries, omission after persistence failure, non-exposure of the raw digest, full-prefix privacy before clipping and refusal of same-length/same-tail prefix substitution. Reader properties cover orphan/foreign/sibling refusal, late malformed stop independence, capture-only classification, same-length tail replacement, exact BOM/scalar/count behavior, bounded encoded views and read/close/result-replacement faults. Transport properties cover immutable packet reload/phases, literal rendering and shared forest budgets. The source/tarball SDK journey now uses a real model-issued public spawn and recovers complete authorized bytes from the delivered model reference without status polling or native send queues. Broader selection/overflow and public evidence-role/range journeys remain required. Extend existing suites rather than multiplying equivalent schedules:

- Durable join: Cut after source commit and after result commit, discard invocation-local state, then verify that only the latter restores the accepted binding without publisher/work capability. Test source unavailability once in its reader cohort, not at every crash point.
- First-result binding: Extend `tests/runs-results.test.ts` first-result and post-commit Trace checks with descriptor/unavailability immutability; do not duplicate their existing arbitration coverage.
- Stop precedence: Extend the durable stop-claims group in `tests/runs-control.test.ts` with binding assertions for natural-first and stop-first, including source publication before/after the claim. A late result remains capture evidence, never natural or forced-stop terminal proof.
- Stable source bytes: Check identical repetition, refusal of contradictory bytes and no cross-generation substitution. Different equal-length texts must not pass merely because byte counts match.
- Live failure classification: Inject export I/O failure, admission refusal and failures before/after outcome commit through the owning publication paths. Assert exact errors/committed effects, no invented workload code and no overwritten winner. Reuse the existing post-commit Trace witness; a crash cut cannot replace these live-handler checks.
- Descriptor transport: Check serialization/reload fidelity and independence from later mutation of the caller's descriptor. Reuse `tests/run-delivery.test.ts` and `tests/run-ui-runtime.test.ts` acceptance-state coverage instead of copying the present/absent/unknown matrix.

Use production writers/readers with controlled ordering and faults, not a test-only state machine that restates expected answers. Protocol cut points prove neither native crash/lock behavior nor power-loss durability. The linked public-launch fixture proves its initial bare-command primary cases and bounded six-composition captured-member byte-overflow recovery; UTF-8/privacy/count/rendering fault properties, broader selection, native acceptance and release gates remain distinct obligations.

### Source and Truncation Shape

For an embedded primary text result, use this planned `output` descriptor instead of an ambiguous clipped string:

```json
{
  "source": {
    "path": "<readable retained exported result>",
    "run_instance_id": "<same generation>"
  },
  "bytes_total": 8192,
  "shown_bytes": { "start": 0, "end": 3 },
  "chars_total": 6000,
  "chars_shown": 3,
  "chars_omitted": 5997,
  "preview": "ok\n",
  "truncated": true,
  "redacted": false
}
```

The source must exist and retain the complete exported result before clipping. It must be generation-bound or immutable, regular-file verified, and authorized for exposure. Applicable redaction precedes export: counts, ranges, and preview refer to that exact exported source, not an undisclosed private original. `redacted` discloses that distinction. A retained source is not an invitation to expose raw Control journals, private captures, secrets, or arbitrary repository files.

`bytes_total` is the exported source's nonnegative UTF-8 byte length. `shown_bytes` is one half-open range `[start, end)` aligned to UTF-8 boundaries; `preview` is its exact decoded text. `chars_total`, `chars_shown`, and `chars_omitted` are nonnegative Unicode code-point counts of the complete exported text, the exact preview, and the omitted source text. They are not byte counts, UTF-16 code-unit counts, rendered markup lengths, or grapheme-cluster counts. Require `chars_shown + chars_omitted = chars_total`; `truncated` is true exactly when source text is omitted. Capture or stream these counts without loading an entire large document just to measure it. Do not append an untracked ellipsis or cut a source path to fit. No primary result is represented as `output: null`, not fabricated empty content; capture loss produces explicit `output_unavailable` diagnostics, not a pretend complete source. Sources are only promised within declared retention; later replacement/pruning must report unavailable rather than silently reading different bytes.

Artifact bodies are not automatically all inlined. Export a bounded manifest of names, authorized source references, media types, availability, and byte sizes where known; optional text previews use the same descriptor. Binary files remain references. Reuse existing digests when available rather than requiring an implicit full scan of every large artifact. Any mutable external artifact reference must be identified as mutable and cannot serve as the retained original of an embedded excerpt without an owned stable capture.

The shared packet budget covers metadata and previews together. If artifact entries, summaries/errors, or terminal rows are omitted, disclose counts and a readable generation-bound manifest/result-index source for the omitted evidence. Summary/error clipping must likewise retain a source. Every overflow path must be usable with normal authorized file-reading tools; `inspect` cannot be the only way to recover an automatically omitted result.

### Visible Truncation Contract (UX/AX)

This requirement applies to ordinary automatic completion batches, including a subagent's final answer, report, or document excerpt, not only to periodic diagnostics or manual inspection. A truncated text result must carry an immediately readable notice alongside its preview in both the operator card and model-bound content; structured fields hidden only in details are insufficient.

For the descriptor above, a visible rendering can be:

```text
review — result excerpt
ok
[Truncated: shown 3 of 6000 Unicode characters; omitted 5997.]
Full text: <readable retained exported result>
```

- Bind the notice, counts, full-source reference, and generation to each individual result. A merged batch must not replace them with one vague footer such as "some outputs were truncated" or an ambiguous link shared across unrelated reports.
- Preserve attribution and the same complete-source metadata in human and model projections. Reserve budget for the notice and readable full-text reference before filling the preview. If a first-party projection clips further, recompute shown/omitted counts against the same complete source; never silently remove the notice or cut its path.
- Count from the original exported source, not an already-clipped intermediate string. Across several clipping stages, report the final excerpt's actual shown count and total omitted count once, without adding overlapping omissions or resetting the source total.
- Keep presentation clipping separate from interrupted-task partiality. A full retained report may have a truncated preview; an unfinished task may have a complete capture of its partial report. The notice must not imply either that work failed because display was shortened or that the task finished because its preview is readable.
- An authored/paraphrased summary is not a literal excerpt. Label it as a summary and link its source; do not manufacture an omission count by subtracting the summary's length from the original report. If the summary text itself is clipped, its own complete text is the counted source.
- If legacy or lost capture evidence cannot prove the complete text or its length, state that the full source/total length is unavailable. Do not invent a total, omitted count, complete document, or source path. New exports must preserve the complete authorized source before presentation clipping.
- Reference-only artifacts are not silently clipped previews. Label them as references; binary artifacts keep byte/format metadata. When entire results cannot fit, the batch's explicit omission count and readable result index must retain their per-result source/count metadata instead of dropping recoverability.

## Ownership and Implementation Scope

- Recipe resolution owns literal-field validation, direct-delegation inheritance, normalization, and effective-policy capture. Run creation owns the start anchor and singleton comparison.
- Runtime lifecycle supervision owns due times, exact-generation stop claims, process/tree proof, and terminal truth. Presentation code must not signal processes directly.
- Observation owns the shared manual/timed snapshot and declared result/capture evidence. The export owner publishes the readable context index through existing privacy/ownership projections; `inspect` only reads it. Delivery owns frozen packets, bounds, acceptance, and recovery; context projection owns automatic diagnostic supersession only.
- `index.ts` remains wiring. Reuse canonical locks, process verification, journal/capture authorities, and public Pi ports; keep the local module graph acyclic.
- Implementation must update owning Skills, current API references, source/packed contracts, and error guidance when the new behavior actually exists. Do not present unsupported additions as current behavior or use live stores as validation fixtures.

## Acceptance Scenarios

These are required future witnesses for the complete supervision feature, not tests claimed to exist or pass today. Each assertion, witness and publication blocker below belongs to that candidate's source, tracked dist, installed package and declared conditions. The separately scoped AX/navigation/existing-runtime release in BACKLOG.md does not claim the complete matrix: excluded features stay inactive, while applicable privacy, ownership, generation, replay, navigation and included-behavior obligations remain mandatory. Scoping a release never excuses a safety regression.

Evidence classes: **U** is deterministic unit/property coverage, controlled clocks and injected failures; **I** is integration through the real runtime/public paths; **N** is the real native backend on the explicitly agreed platform set; **P** is the installed package through public SDK/tool paths, not private-helper calls. Controlled providers may model missing LLM responses, but mocks, injected platforms and skipped native cases never establish native containment, controller independence or closure.

Expected legacy/unsupported refusal or `unproven` can pass its negative scenario. It cannot replace a positive supported-backend `max_runtime` witness or silently narrow the agreed platform/credential contract. All-known-member settlement and empty resources with uncontrolled egress remain insufficient. One blocked mandatory assertion or missing applicable proof blocks publication of the supervision feature; a privacy/authority violation in the retained candidate also blocks the selective release.

The [canonical backlog](../BACKLOG.md) keeps A/B/C independently actionable where their inputs permit, with A4 depending on B1 and real enforcement depending on B plus C. D joins the complete future supervision matrix into one candidate; branch completion alone is not release authority. The operator-confirmed selective AX release has its own bounded candidate checkpoint there, without accepting or weakening the deferred supervision feature. Package/audit/authority checks still apply before publication, and exact npm/GitHub identity verification closes release execution afterward; this matrix does not replace the [release contract](./releasing.md).

- **SUP-01 — Policy matrix:** Prove all four combinations, independent Recipe/launch precedence, explicit null disabling, and unchanged no-policy jobs/services. Reject malformed/overflowing values and `report_every < 60000ms` before workload launch; accept equivalent one-minute literals without rounding and keep short positive `max_runtime` values valid. Actor arguments cannot override runtime policy accidentally.
  - Evidence: U boundary/invalid-value properties plus I/P literal-field admission, including explicit null and unchanged actor arguments.
  - Publication blocker: Coercion, invalid lower-layer acceptance, hidden defaults, policy loss or a silently weakened launch.
- **SUP-02 — Scope and reuse:** Prove direct specialization and async registered-tool inheritance, no import/branch timer resets, synchronous-path rejection, equivalent normalized singleton reuse without clock reset, conflicting-policy rejection, and fresh clocks for a new generation.
  - Evidence: U/I/P direct specialization, async-tool/import/sync paths and same-generation singleton attachment/replacement.
  - Publication blocker: Wrong inheritance/scope, incompatible singleton acceptance or a refreshed allowance on attachment/nested work.
- **SUP-03 — Time and recovery:** Count startup/retries/delays in elapsed time; retain anchors across reattachment, act on overdue deadlines without a fresh allowance, disclose lost clock proof, and avoid long-duration timer clamping or missed-tick replay.
  - Evidence: U clock jumps, arithmetic bounds and long-timer scheduling plus I reattachment/restart/recovery.
  - Publication blocker: Invented age/deadline, refreshed budget, missed overdue enforcement or uncertainty presented as known timing.
- **SUP-04 — Independent supervision:** Keep reporting/termination operative with an idle/busy coordinator, a silent actor, and a hung workload. Neither missing Trace nor blocked model delivery may extend the deadline.
  - Evidence: U eligibility plus I/N hung workload/provider and busy/idle controller independence; a controlled provider may model missing LLM responses.
  - Publication blocker: Enforcement waits for model delivery, inspect, a workload callback or routine reporting; no positive supported-native path.
- **SUP-05 — Minimal snapshots:** Check exact generation, elapsed/status, launch cwd versus the readable context-index pointer, explicit index unavailability, bounded shape, and no invented health/progress or leaked unrelated content.
  - Evidence: U/I running, accepted-natural, stopping, legacy, unavailable-index and generation-replacement observations.
  - Publication blocker: Contradictory/unbounded payload, fabricated timing/health/scope proof, unrelated content or read-side state changes.
- **SUP-06 — Latest-only delivery:** Many ticks produce one latest pending snapshot; many Runs produce bounded fair batches and one debounced idle wakeup. Exercise budget pressure without duplicate ticks or silent loss of deferred state.
  - Evidence: U/I/P busy/idle, many-Run fairness, unresolved acceptance and shared-budget pressure.
  - Publication blocker: Polling required for delivery, mutable admitted packets, duplicate/catch-up ticks, starvation, silent loss or synthetic steer.
- **SUP-07 — Context isolation:** Repeated accepted snapshots leave one current diagnostic per generation. Preserve native history, foreign entries, and terminal members of mixed packets; supersession cannot finalize unaccepted packets.
  - Evidence: U/I/P real model-context/session projections containing foreign/native/manual entries and mixed terminal packets.
  - Publication blocker: Foreign/history deletion, lost terminal members or supersession that finalizes an unaccepted packet.
- **SUP-08 — Terminal/restart races:** Completion or replacement suppresses stale queued/in-flight diagnostics; old timers cannot kill a new generation. Prove crash/recovery and session-switch handling without accepting a proposal as delivery.
  - Evidence: U/I/P completion/proposal/acceptance/replacement orderings and crash/session-switch recovery; N verifies native dispatch boundaries.
  - Publication blocker: Old-generation delivery/actuation, stale running after terminal, lost final outcome or proposal treated as acceptance.
- **SUP-09 — Kill intent:** Missing/stale generations, foreign owners, PID reuse, and unavailable process proof fail before signals or Control admission. Exact already-terminal calls are idempotent; saturated actor-local Control cannot block runtime kill.
  - Evidence: U/I/P public generation/owner preconditions plus N replacement/PID-reuse/dispatch witnesses.
  - Publication blocker: Signals or Control before validation, substitution of the newest generation, foreign authority or kill blocked by actor Control saturation.
- **SUP-10 — Stop races and truth:** Natural completion, deadline, and manual kill serialize to one outcome. Distinguish manual kill from timeout; unresolved death stays nonterminal; stop only proven owned descendants and retain partial evidence/accepted effects.
  - Evidence: N sealed native/child admission, membership/egress, producer loss and recursive closure, supported by the mechanism's completeness argument.
  - Publication blocker: Signal/runner/group exit, elapsed wait, uncontrolled-resource emptiness or all-known-member settlement substituted for whole-scope proof; legacy optimistic finalization.
- **SUP-11 — Honest excerpts:** Verify UTF-8 ranges, full/empty/large results, byte and Unicode code-point counts, redaction-relative metadata, missing/incomplete captures, unavailable old generations, and independent task partiality. Never substitute newer bytes or invent source availability.
  - Evidence: U/I/P UTF-8/Unicode/redaction properties, full/empty/large inputs, multistage previews and unavailable generations/captures.
  - Publication blocker: Wrong accounting, newer-byte substitution, an unreadable/unretained promised source or incomplete capture presented as complete.
- **SUP-12 — Recoverable overflow:** Large/binary/many artifacts and omitted terminal rows retain a readable manifest/index with omission counts under the shared context budget. Reading published evidence does not require `inspect` or raw-registry access.
  - Evidence: U/I/P many outcomes/artifacts, large/binary references and bounded packet overflow with selective readable recovery.
  - Publication blocker: Silent omissions, unrecoverable entries, raw-registry dependence or unbounded/binary bodies in model context.
- **SUP-13 — Public delivery journey:** Real source and packed SDK fixtures prove one active-boundary update after the entire tool batch, idle batching, root/child lineage, silent-policy preservation, no periodic wakeup when disabled, no native-steer synthesis, and independent urgent semantic attention. Assertions must witness provider callback completion outside the callback.
  - Evidence: I/P public SDK lifecycle, full-tool-batch active boundaries, idle batching, lineage and attention; fixture registries stay isolated.
  - Publication blocker: Only private-helper success, source/package drift, public-port bypass, live-registry mutation or assertions completed only inside provider callbacks.
- **SUP-14 — Compact inspect parity:** Prove Run default/status equivalence, one shared timed/manual producer, equivalent bounded JSON/text scope, terminal elapsed freezing, rejected inapplicable options, and retained explicit management/expert routes. Manual inspection must not change clocks, delivery eligibility/acceptance, lifecycle state, or export files; ordinary manual tool evidence remains intact.
  - Evidence: U/I/P same-observation manual/timed JSON/text parity, expert routes, invalid-option rejection and no-side-effect checks.
  - Publication blocker: Divergent status truth, raw dumps/scans, manual ACK/cooldown/budget/lifecycle changes or exports created by inspection.
- **SUP-15 — Same-session selective file investigation:** Kernel gives the owning logical Pi session a root-first prioritized map from the existing shared Run-directory index owner, not a second registry. Session → Run → unique real directory/generation entries are latest-registration-first; each Run's role index remains separate. Same saved-session restart/resume after producer exit works with ordinary tools and no original producer/publication keys or old sessionManager. Preserve exact ownership/generation, known coverage/size/format, containment and curated automatic preview privacy; do not promise unsaved generation history or change physical layout.
  - Evidence: U/I/P root-first ordinary reads and actual same-logical-session restart/resume without original keys; independent-process different-session and same-session/different-Run writers; locked fresh merge including maintenance, duplicate/reused directories, registration order independent of read/status/clock touches, atomic readable JSON and corrupt-state preservation; foreign/forked/cloned/supplied-owner/stale/path-substitution rejection; no eager load/read-triggered rebuild/export/repair/work/native/timing effects.
  - Publication blocker: Lost unrelated registrations, unlocked/stale-snapshot writes, cross-session catalog projection, capability loss blocking valid same-session research, wrong-generation/unreadable promised sources, path escape, fictitious retained history/completeness or raw private bodies substituted into automatic curated projections.
- **SUP-16 — Visible ordinary-result clipping:** In both operator and model views, exercise final answers/reports/documents, multiple merged results, Unicode astral/combining sequences, empty/full/zero-preview cases, multistage clipping, and packet overflow. Assert exact per-source shown/total/omitted character counts, adjacent full-text references, preserved generation attribution, notice-first budgeting, summary-versus-excerpt distinction, and honest unknown-length/source failures. Verify actual ordinary completion delivery, not just descriptor construction.
  - Evidence: U/I/P actual ordinary operator/model completions, merged results, Unicode, zero/full previews, multistage clipping and overflow.
  - Publication blocker: Silent ordinary-result clipping, missing notice/reference, reset/double-counted accounting or display truncation confused with task partiality.
- **SUP-17 — Root-session diagnostic cadence:** Stagger many Runs' due times across one top-level session and prove at least `60000ms` between accepted routine batches, with latest-only fair merging rather than per-Run wakeups or catch-up bursts. Exercise the exact boundary, unresolved proposal/acceptance, busy/idle and recovery, independent owner sessions, and manual inspection without changing the gate. Terminal outcomes, short execution deadlines, and explicit urgent `steer` must bypass the cooldown; absent/null reporting must produce no periodic wakeups.
  - Evidence: U/I/P staggered due times, exact floor, unresolved acceptance, busy/idle/recovery, independent roots and bypass neutrality.
  - Publication blocker: Per-Run frequency bypass, cooldown from proposals, manual/terminal/urgent gate changes, catch-up bursts or diagnostic wakeups while disabled.

Use existing Recipe/reference, tool/Control, async-run, observability, delivery, session-evidence, inspect/security, and agent-journey test families. Runtime implementation closes only after focused witnesses plus the normal product validation, source/packed parity, and canonical ABCd context checks. Version preparation and external publication belong to the applicable scoped candidate checkpoint in BACKLOG.md, not implementation progress alone; follow the [release contract](./releasing.md). Removing `inspect` and implementing MPRIS remain outside the authorized scope.