# Agent Experience (AX) Status: Adopted project-wide design standard. The operator has selected **JSON inputs → YAML runtime-output metadata + unchanged authored text/Markdown** as the one presentation direction. Implementation is not yet uniform: Control/inspect and other projections still include Markdown-list records and JSON. Fresh ordinary source and normally built package completions use the minimal block-YAML core without compiler HTML tails; retained packets and inactive numbered-stream layouts keep their original encodings. Bounded actual-default outcome-carrier source/packed acceptance composes current-path observations with unchanged accepted components; full-spawn metadata and navigation have bounded source/compiled and source/packed acceptance; loaded-host acceptance remains separate. [BACKLOG.md](../BACKLOG.md) alone owns rollout and acceptance work. This document defines presentation, not a new machine protocol, Recipe schema, source permission or release claim. ## One first AX contract AX is one canonical Agent Experience being prepared for its first release, not a product family of numbered drafts or user/model-selectable formats. The selected target is YAML metadata plus optional opaque authored content; the former Markdown-list key/value grammar is an implemented pre-unification layout, not another target to preserve for new output. Ordinary source and normally built package Batch admission now capture ax_records/completion_yaml_core_v1, and fresh attention/steer use typed block-YAML metadata plus opaque raw body text. The inactive numbered-stream path and saved frontmatter_v1/v2 retain their older layouts. Bounded source/compiled/actual-default accepted-path evidence exists; it does not establish default-disk, global lifetime-policy or loaded-host acceptance. Remaining rollout is tracked in [BACKLOG.md](../BACKLOG.md). A completion group is the result sequence itself, not a container with members. Each result's YAML metadata begins index, run, state, then kind:primary for admitted primary text/final Actor response or kind:diagnostic for explicit diagnostics. The admitted Markdown follows from the left margin, outside metadata, with no #N heading, result:/preview: wrapper or whole-body literal fence. One blank separator distinguishes records. Known display loss appears only at the cut as [N characters omitted], counting Unicode scalar characters of the admitted retained source; no extra truncation ellipsis or body clipping flags/counters appear in YAML. Unknown upstream completeness/privacy remains explicit at the body boundary without inventing a count or claiming a known positive loss. Untracked fallback has no primary kind. Missing text stays explicit; a checkpoint retains its Actor-authored notification body. Successful automatic delivery has no extra receipt, routine outer counters, members wrapper, Batch caption, time window, status-summary copies or standing full-map instruction; real failures stay reportable. Exact source/generation/location references remain in complete model content, with whole-reference/result omission and non-done omitted states explicit. A group with one visible row stays a group. Fresh ordinary packets put minimal packet identity and relative body/marker lengths in YAML metadata, without compiler HTML tails. Older saved layouts retain their original compiler boundary/correlation framing; neither encoding grants authenticity, read permission or acceptance. Their compatibility boundary is governed separately below; never strip required historical framing. This is one new-capture contract, not a selectable AX product version. Illustrative compact completion shape (not actual Run data): ```text --- index: 0 run: check-config state: done kind: primary --- Configuration is **valid**. --- index: 1 run: build state: failed kind: diagnostic --- Module was not found. [120 characters omitted] ``` An only item uses the same first block, not a second format. Full text has no cut marker; an unavailable index is the YAML string "?", never a fabricated zero. The compact TUI renders compiler headers and markers as literal Text and each body as independent native Markdown, so an unfinished fence/list/quote cannot consume another block. Only whole compiler header reference/location rows and framing are hidden; expansion or invalid/missing hints reveals the full original text. Source bodies and retained structured coverage facts are not rewritten. Storage compatibility is separate: already-captured Batch snapshots need their original codec to reproduce exact delivery text, while steer envelopes replay their saved content directly. Do not relabel, migrate or reformat existing journals/session messages to make the interface look uniform. Retained encoding identifiers are internal replay data, not alternate AX products. See [retained capture compatibility](coordinator-delivery.md#retained-capture-compatibility). ## Purpose AX means **Agent Experience**: convey enough structured, visible context for an agent to understand what happened and choose its next step, while remaining immediately readable to a person. The same projection should serve both rather than forcing the agent to reconstruct meaning from raw dumps or giving the human decorative prose that hides important facts. The intended form uses actual YAML for runtime-authored metadata and preserves the producer's selected text as content. It is neither raw JSON with punctuation removed nor a YAML-like Markdown-list grammar. The serialization direction is about readable public output, not a demand to maximize nesting or convert an Actor's report into structured runtime data. Compact means selected meaning, not the fewest possible lines. UX also includes responsive navigation: reuse the current admitted snapshot on the hot path instead of repeated body reads. Keep explanatory context available in existing detail rather than filling the first screen with standing hints; real uncertainty/loss still needs truthful markers. Caching must retain the owning refresh/invalidation policy, not invent freshness or immutability. Inspector notifications belong in separate overlay chrome, not as inserted rows among source data: showing or dismissing feedback must not shift the document, selection or stripes. ## Project-Wide Scope Apply this standard when creating or changing: - Inspector lists, detail documents, diagnostics and actionable explanations. - Public tool launch, success, refusal and error text. - Agent-bound completion, attention, diagnostic and other contextual messages. - Human-facing examples of those surfaces and the checks that preserve their behavior. Keep facts, field meanings, ordering priorities, uncertainty and omission semantics consistent across surfaces. A terminal browser, tool result and phone need not have identical layout or byte-for-byte text. Source permissions and the recipient's ownership remain authoritative at every surface, including verbose/detail views. Machine JSON, canonical journals, SDK DTOs and parameter schemas remain machine contracts. Literal source text remains source text. Neither is rewritten into this presentation just because the default human/model-facing view changes. ## JSON Input, YAML Output, Opaque Content - **Structured inputs:** Tool arguments and SDK parameter schemas remain their JSON machine contracts. JSON Recipe definitions remain inputs; no Recipe schema, existing supported Markdown-Recipe source or container migration is authorized by this presentation rule. - **Runtime-authored outputs:** Launch/attachment receipts, registration, status, Control, inspect, notices, refusals, diagnostics and completion metadata use one YAML presentation for both agent and human. A verbose view is more admitted information in that presentation, not an exception that dumps internal JSON into readable text. Machine `details`/DTOs, journals, native-helper wire protocols and stored artifacts retain their own formats and authority boundaries. - **Authored content:** Preserve the selected Actor/producer text in its original format, often Markdown. Keep it outside metadata, unindented, without an `answer`/`output` YAML scalar, a universal body fence, JSON escaping or a structural minus added to each line. Existing privacy/source selection and admitted clipping still apply; this is not permission to recover discarded text or widen retention. - **Literal source:** An explicitly requested Recipe/file/code/JSON source may remain literal source content. Its JSON is not a runtime metadata serializer or a second public output mode. Do not disguise generated object dumps as source text to evade this rule. - **One metadata language:** Render structured runtime fields as native YAML nodes, never as a JSON object/array string inside YAML or a nested JSON code fence. Do not parse and reserialize authored bodies to make them conform. Exact historical packets keep their original formats. ## Document Envelope and YAML Syntax The metadata language is always YAML; its framing depends only on whether the output has a separate selected text body: - **Metadata only:** Emit bare YAML without an opening or closing `---`, a Markdown code fence or an empty frontmatter wrapper. Routine tool/spawn/attachment/registration receipts usually use this form; they report invocation/launch facts, not the Actor's eventual completion. - **Metadata plus authored/explanatory body:** Put exactly one `---` line above and below the YAML header, then preserve the selected text/Markdown at the left margin. The delimiters separate languages here; the body is not a YAML scalar or a whole-body fence. - Choose by actual body presence, not by whether a tool returns synchronously or its workload runs asynchronously. An asynchronous launch receipt can be metadata-only, and a synchronous tool can carry text. Do not invent filler prose, trim away selected content or infer the case by parsing that content. A completion sequence remains independent per-result documents, not a new Batch/results wrapper. This is one YAML presentation with body-dependent framing, not two selectable formats. These are target rules, not a claim that all current emitters already conform. Fences around the documentation examples below are explanatory only, never part of emitted receipt text. - One entity is a YAML mapping with descriptive `key: value` fields. Do not put `- ` before every mapping field; YAML sequence markers are only for actual sequences. - Use YAML 1.2 block mappings/sequences with two-space nesting, stable semantic ordering and safe scalar serialization. No custom pseudo-YAML grammar, nonempty flow collections, tags, anchors or implicit alternate document formats. Standard empty YAML collections `[]`/`{}` and quoted scalars retain their types; these are YAML syntax, not embedded JSON dumps. Do not replace an empty collection with null, absence or an invented status merely to avoid punctuation. - Nested fields such as model/thinking provenance, references and Run-file locations use YAML nesting. Strings, null/booleans/numbers and literal source references retain their selected meanings; quote ambiguous strings, including the unknown completion index `"?"`. Do not change opaque IDs, display ordering, field semantics or permission by changing syntax. - Runtime-owned multiline metadata strings use a proper YAML scalar with round-trippable line/chomping behavior. Actor reports and other opaque authored bodies stay outside that metadata rather than becoming such a scalar. Existing selected diagnostic/advice content must remain content, not be parsed into fields/actions. - Keep a real warning/uncertainty visible with its relevant record. Do not add empty fields, decorate a no-effects claim or hide safety information in service metadata. - Existing bounded omissions, whole-reference coverage and budgets include YAML indentation/escaping and service data. Formatting does not grant a larger budget, extra source reads, shortened paths or loss of generation/privacy facts. - Body-authored frontmatter, `next:`/tool labels, lists, code, YAML/JSON and HTML remain opaque content. The runtime's compiler boundaries, not text-shaped guesses, identify its metadata; independent rendering must prevent an unfinished body fence/list/quote from consuming a later header. Illustrative target spawn receipt, not actual Run data: ```yaml run: check-config state: running launch_kind: spawn recipe: swarm/subagent-prompt model: source: explicit value: example/model ``` The completion example above instead has an authored Markdown body, so its YAML header has the opening and closing `---` lines. `kind: primary`/`diagnostic` remains outcome-content classification, not a new launch kind; a launch receipt does not invent a completion index or final Actor output. All examples are selected display fields, not new API schemas or permission to invent a missing fact. ## Tool Invocation and Response Separation Every tool surface must show exactly one visual blank line between the host-owned invocation header/arguments and the first response line. This applies to spawn and registered tools, compact/verbose replies, YAML or selected text, success, refusal and error. It is independent of the YAML body/framing decision; do not add `---` merely to create spacing. The separation belongs to the runtime/host result boundary, not the YAML data or Actor's selected text. Do not trim/rewrite that text, duplicate tool names/options/private inputs in the response, add a filler body or accumulate extra blank lines on repeated wrapping. Preserve structured `details`, non-text blocks, error identity/handling and existing budgets. Current spacing helpers establish a text-prefix convention on their wired paths; actual host/UI and pre-facade-error coverage must be verified separately rather than assumed. Illustrative visual arrangement, not API invocation syntax or real Run data; the first line belongs to host chrome: ```text spawn recipe=swarm/subagent-prompt run: check-config state: running launch_kind: spawn ``` ## Service Framing Is Not Authored Content The target readable runtime output contains no pi-actors HTML-comment transport framing. Audit each service field against actual consumers first: remove unnecessary fresh data rather than relocating the whole existing payload. If content-carried service data is necessary, prefer its minimum in the response's block-YAML header metadata, not an HTML tail. Separately review the actual Pi storage/model/UI path and preserve the required functions; the current mechanism is not itself a requirement. This does not adopt a new kernel interface or assert that hidden `details` alone is sufficient. Prove persisted replay, model-context acceptance/recovery, full-content binding, independent header/body boundaries, fallback and fixed budgets before switching. The necessity audit identifies a smaller fresh target: one packet identity and only the relative body/marker segmentation needed to keep opaque content separate; absolute coordinates are derived. Do not carry a duplicate block table, derived compact-range table, prefix digest or default-inactive numbering payload into that new text format. Any optional native presentation digest must have a specific stale-hint/full-content consistency witness and stays outside the content it hashes. Preserve native delivery-envelope behavior and all saved numbering facts/decoders initially; these decisions do not activate S1. Inspected Pi 1.0 storage and native context preserve custom-message `details`. Provider conversion drops both details and customType only after the extension context hook; that does not strip the saved native entry or prove kernel correlation loss. Current details-stripped witnesses deliberately simulate degraded envelopes. Retain the admitted conservative fallback duties, but do not justify a full text-carried frame by claiming ordinary SDK storage loses metadata. Native content arrays also do not prove independent fallback Markdown rendering. HTML compiler frames/markers remain required for their saved layouts and may remain in older installed/loaded runtimes. Ordinary source and normally built packages use the minimal YAML core with bounded actual-default source/packed acceptance. Retained storage/renderer/reopen facts transfer only within the unchanged successful original-current-manager path, not as fresh default-disk, native-scope or loaded-host observations. Do not strip them by regex, infer authenticity from their hash, erase Actor-authored HTML, move warnings out of view, or rewrite historical messages to look uniform. If equivalent carriage cannot yet be established, keep the existing implementation and name the blocker; do not ship an apparently clean but uncorrelated/unverifiable replacement. Use `run: demo` as the labeled display value, not `run: run:demo`: the key already supplies the namespace. Canonical targets remain `run:demo` where required by machine fields, references or tool arguments. Presentation does not change identifier or target grammar. Avoid authored middle-dot separators and ornamental boilerplate. Preserve such characters if they belong to producer-authored literal data or immutable history; the rule is not permission to edit source content. ## Facts, Uncertainty and Next Actions Use precise stage vocabulary. A request is not actuation, delivery is not handling, a successful natural result is not whole-scope closure, and a legacy kill attempt is not proven full termination. A later error can coexist with admitted handling or committed filesystem effects. Do not merge the Run state with the state of one Control request. Preserve original refusal facts and private error causes without inventing missing correlation or exposing replacement-owner state. A visually cleaner answer must not claim readiness, completion, later delivery or no effects when that fact is unavailable. A next step is an instruction, not extra observed state. Name the tool and its actual arguments rather than hiding a command string inside a vaguely named `details` value. Show it only when it is relevant and permitted; do not attach a routine inspection command to every healthy response. Illustrative Control error projection, not an executed request: ```yaml run: demo action: pause result: request failed delivery: unconfirmed handling: unconfirmed warning: |- Effects may already exist. Do not repeat automatically. next: tool: inspect target: runtime view: runs ``` This example does not authorize publishing a saved Control id or generation. [Recipient-bound correlation](./run-supervision.md#recipient-bound-correlation-preparation) retains its separate host/adoption gate. A displayed next action is not evidence that it already ran or permission to execute it automatically. ## Text, Clipping and Omission Do not clip a complete short phrase merely to keep a record on one line. Two or more useful lines are normal. Respect genuine shared message, source, field and renderer budgets; do not silently widen retention or remove required safety information to make the layout look shorter. For non-completion derived previews whose existing owner supplies a known omission fact, use YAML metadata rather than a Markdown-list field. Illustrative selected display value: ```yaml omitted: "840 chars" ``` This is not a new completion-header clipping field. Fresh completion text retains the cut-local `[N characters omitted]` rule above, without an added ellipsis or body-count flags; saved messages retain their original codec. Inline annotations, where used, remain [omitted: N chars] or [omitted: unknown]. Saved packets retain their original spelling; this display change does not recapture source facts. An exact number counts Unicode code points removed from the already-authorized privacy-projected source at the declared stage. It does not count hidden secrets, recover discarded upstream lengths or turn UTF-16 units/UTF-8 bytes into characters. Keep a known local display count distinct from unknown upstream loss when both are relevant. A known complete value needs no new omission decoration; never manufacture an exact zero for unproven completeness. Where an existing non-completion preview owner already uses gap ellipses, preserve U+2026 (`…`) separately from its omission metadata or inline marker: - A retained prefix ends with an ellipsis when its tail is omitted. - A retained suffix starts with an ellipsis when its head is omitted. - A removed interior gap can be shown between an ellipsis after the prefix and one before the suffix, with the omission annotation identifying the gap. - A retained middle excerpt can have ellipses at both external boundaries. A combined known count must mean total omitted content, not the same count repeated for each end. These are presentation patterns, not permission to select a suffix/middle source that the existing owner does not admit. An authored ellipsis or replacement character is not a reliable loss/count flag. U+2026 is one code point but three UTF-8 bytes, the same byte size as three ASCII periods; budget calculations remain explicit. Indentation, fences, ellipses and annotations belong to the projection. Preserve the exact retained source/preview bytes and their range/hash metadata, keeping annotations outside literal content. Include rendering overhead in the shared output bound. Keep actionable paths and references complete or explicitly omit them; never cut a path to satisfy cosmetic width. ## Compatibility and Trust Boundaries Adoption of this AX standard is not a claim that old renderers already conform. Current source/compiled behavior and live client behavior must remain distinguishable from the target design. Do not rewrite saved completion/steer packets, historical messages or source journals. A fresh read-time projection over already admitted data is not a persisted capture version: it may update its current summary leaf without changing canonical fields, adding an aspect to source journals or regenerating saved text. A new capture presentation needs a distinct admitted compatibility path in its existing owner; do not reinterpret an existing formatting aspect such as `bracketed_omissions_v1` to silently change saved text. [Legacy completion source-loss evidence](./run-supervision.md#legacy-completion-disclosure-boundary) already explains why old strings cannot supply original counts or a new privacy certificate. Unknown-only display can use the newly approved presentation direction without broader retention; exact new counters still require their admitted source basis. Keep privacy, ownership, generation fencing, source selection and native/clock authority separate from formatting. A DTO, source path or readable old manager is not new permission. Structured/verbose output remains explicit and recipient-scoped, not an unrestricted raw-data escape hatch. Do not enable a new runtime policy, retry, source read, result refresh or operation merely to render a better record. ## Existing Implementation Owners The [runtime output projection map](output-projection-map.md) names the audited current functions, egress paths, source/machine/UI boundaries and existing test owners. It is source evidence for rollout, not proof that YAML migration or an alternate service carrier already works; remaining tasks stay in `BACKLOG.md`. The prepared `tools-response.ts` `renderYamlMetadata` foundation uses the directly declared `yaml@2.9.0` public API for selected own-data mappings/sequences. It emits bare YAML without invocation spacing or body processing, preserves scalar types/strings and refuses unsupported or over-budget whole values. Its execution ceiling is 49,152 bytes and supported nesting is at most 64 levels; these are not caller allowances or drop-in compatibility for larger existing budgets. Preflight bounds scalar/node traversal, not atomic key enumeration or arbitrary Proxy execution. Focused parser/property and shared response-owner tests cover this foundation; compact asynchronous launch receipts are the first production caller. Other surfaces and loaded-host acceptance remain separately staged; full spawn-verbose shares the final YAML style without inheriting this bounded emitter's limits. The following is the current pre-unification implementation inventory, not a set of alternate adopted output styles. Existing flat records, literal JSON fields, verbose JSON and retained-layout HTML compiler frames remain code facts until their owned rollout changes; the target above does not restyle or relabel stored text. This standard spans surfaces, not a new library domain. Control compact-result/public-error remains locally implemented and source/npm verified using flat records, no duplicated run namespace, stage/reuse distinctions, typed selective inspect next nodes and opaque multiline values. Launch model/thinking groups use the concise `model` and `thinking` labels and preserve their actual source/value relationship; compact launch navigation now remains one whole native YAML value or explicit whole-row omission within16KiB including invocation-response spacing. Full spawn-verbose in source and normally built packages uses the legacy once-only JSON selection followed by clone-only YAML, without a new fixed byte/depth cap. Absent selected JSON, malformed selected text or recoverable post-selection failures withhold the whole projection with an attributable no-auto-repeat warning; original selection throws and structured details remain unchanged. Source/unit and installed compiled response checks, the strict ordinary-metadata source/packed completion journey, and all three source/packed navigation owners are accepted within their bounded domains. Native assertions remain indirect proof, not current global absence. Owning Skill byte parity does not establish a loaded-host change. The older field/inspect-action primitives remain with their unmigrated consumers; compact launch serialization now uses the YAML metadata primitive. Structured/verbose results, exact dispatch/private error causes and old completion handoff text retain their contracts. Fresh ordinary source completion admission captures canonical AX with the private completion_yaml_core_v1 layout: index-first YAML, independently rendered raw Markdown and cut-local [N characters omitted]. The minimal ordinary hint binds whole content to the YAML core, whose relative lengths derive header/body/marker boundaries without fresh HTML tails. Retained completion_frontmatter_v1 hints keep their complete ranges and original compiler frames; neither hint name is a public selector. Only valid compiler headers can hide whole reference/location rows. Markers remain literal and body-authored labels never become metadata/actions. Expansion and invalid/missing hints reveal full original text. These checks establish display consistency, not authentication, source/read scope or acceptance; display line-ending/tab handling never rewrites saved content. Routine state-equivalent summaries remain in the journal, not the new model content; meaningful summaries, loss/redaction/unavailability and reference coverage remain visible. Exact source/generation/parent bindings, whole references and fresh48KiB/64row limits include hidden technical data; retained codecs keep16KiB. The postprivacy byte budget is divided equally between candidate rows: roughly48KiB for one,24KiB each for two,16KiB each for three, less encoded service overhead. Whole admitted text uses result only when it fits without known upstream clipping; otherwise preview uses the safe prefix with exact retained-source omissions. There is no fixed16KiB result/2KiB preview cap and no render-time source IO or reallocation. Already-retained packets keep their exact captured bytes; pre-record messages keep the host renderer and retained record messages keep their original verified view. The Pi boundary recognizes the strict whole YAML core for ordinary source records, or original closed markers/anchored headers for retained captures, after private details are stripped, preserving exact owned-context acceptance without interpreting authored body labels. Actual actors guidance describes this implemented fresh-capture route; this is not a claim that a loaded host was reloaded. Fresh source urgent-steer captures use typed YAML metadata and a separate raw selected body before saving immutable envelope.content: complete final-message fitting and whole reference sequences retain16KiB/eight-slot bounds. Ordinary attention remains unbounded; bounded source/compiled/actual-default acceptance does not establish loaded-host acceptance. Existing envelopes are not reinterpreted, and no older new-message default remains. Fresh ordinary notify/followup uses one AX formatter in the existing sink: the same opaque checkpoint/body and whole first-eight reference projection, without borrowing steer's shared byte cap or changing routing. Committed history keeps its exact text; the retired presentation selector is not a compatibility API. Fresh read-time agent Trace preview leaves now also use boundary U+2026, exact admitted normalized-retained-turn omissions and separately unknown upstream loss, without changing the160UTF-16 source allowance, identifiers/chronology, detail/source data or public JSON schema. Malformed text is unknown, not repaired; no journal capture aspect is minted for a derived current read. New urgent admission/send/recovery diagnostics now also use event/attention/stage AX records, opaque raw240-unit previews and unknown loss while their persisted message-only evidence stays unchanged. A failed send leaves delivery/presentation unconfirmed, and unknown/conflicting queued recovery does not force replay. Fresh non-runtime explicit inspection also uses AX records: unchanged Run/view headers, tool activation/argument sequences and Recipe registry/focused-doctor facts, whole portable source literals and one selected hint. Only the three existing closed read-only Recipe inspect literals become typed next; other advisory strings remain opaque instruction values with full next_actions retained in unchanged details/verbose JSON. Existing body/scope/budget/default-status contracts stay independent. Compact runtime status/runs/triage now also presents only its existing facts/counts as AX fields, with full owned inventory independent from bounded verbose navigation and bounded triage rows. Core callback/completion/recovery/teardown notices use opaque fields and explicit receipt/report stages without altering their source, errors, acceptance or native authority. Producer-owned watcher/retirement notices now also use AX: whole literal paths and opaque diagnostics preserve raw signature/dedup/rearm behavior, while returned stop/reported cancellation/skip/failure remain non-closure reports with exact existing optional-notifier/error observation semantics. Inspector document/detail rendering now uses flat semantic fields, real sequence lists and opaque literal terminal values, with ephemeral compiler-label provenance instead of parsing authored colon/bullet lines as metadata. Separator-preserving native-column wrapping keeps whole text/references, source values, root stripes and existing identity/chronology/navigation/source bounds. Empty containers remain typed values; terminal line-ending/tab display policy does not rewrite source. Ten locally authored inspect refusals now also use AX fields and true supported-value sequences, preserving their original guards and Error/dependency behavior. Only the two already-guided tool failures retain typed read-only next actions. New local error text shares16KiB including public spacing; variable fields/actions are whole or explicitly counted omitted without shortening targets, reading raw private lengths or wrapping unowned exceptions. Session/source/dependency errors keep their separate owners and old catches rather than being globally restyled. Inspector Kill confirmation now also uses captured run/state/action AX fields with whole-value paging, while both choices and closure: unconfirmed remain pinned at narrow/low viewports. Read-only PgUp/PgDn preserves original Cancel/choice/confirmation/generation behavior and adds no actuation or source permission. Inspector Kill cancellation only closes the dialog; successful actions use the selected Run's visible status without a second Notice. Failures/refusals/uncertainty remain visible, and notifications on other surfaces are not suppressed. Remaining Inspector feedback shows the complete selected opaque message directly in a modal popup over unchanged data rows, without i prefix/command or another reader. Esc dismisses; only physical overflow scrolls within that same popup. Kill uses the same centered rectangle compositor. Both use terminal-default backgrounds rather than a theme fill, two-column left content insets and top/bottom blank spacing, plus the Inspector's shared frame/key/description color grammar. On space-constrained heights, safety/choices/readable text take priority over decorative blanks. They keep the captured underlay stable through resize/invalidation and resume ordinary refresh on close, without fresh evidence/native authority. Action-port feedback pins closure uncertainty/no automatic retry without inferring native effects from message text. Fresh Kill producers now use a shared pure selected-value AX formatter: domain180-unit normalization/trim and overlay160-unit normalization/slice remain, while a cut pair retracts one unit and malformed selected text is unknown/unavailable. Dynamic legacy values state upstream completeness/privacy unproven, with unknown local clipping markers rather than private-tail counts; compiler refusals add no fake loss. ok/callback/getter/coercion/error semantics and old success suppression stay unchanged, and the popup's anchored header recognition affects color only. This does not recover discarded Markdown/causes or create a saved capture version. Trace table rows now mark actual column/line gaps with native ellipsis while preserving full selected item/detail, and compact warning captions keep incomplete-history/non-lifetime/unavailable-rank meaning visible at narrow widths. This is UI preview loss only, not new source/private character counts, rank/identity changes or a generic selector/fit rewrite. Four locally authored Control pre-dispatch guards now also use caller target/action/result and actual supported/available-action sequences: whole target/list groups fit16KiB including public spacing or carry field/entry omission counts, while malformed selected text is unavailable without repair. Original guard/getter/join/coercion observations, plain Error/host-error behavior and all unowned/dispatch exceptions stay separate; no input/status/correlation/retry/no-effects or new dispatch authority follows. Three local spawn pre-launch guards now use field/result and opaque selected caller value rather than inventing an admitted Run: unsupported state_dir, missing run: namespace and invalid id. Whole valid-scalar values fit16KiB or are omitted; malformed selections are unavailable, without repair or source/private-tail counts. Original input/method/coercion/launch behavior stays separate. The real host still rejects unsupported state_dir through its own unchanged schema before the facade, so this does not claim all SDK validation errors are AX. Namespace/id guard errors retain real host isError behavior. Successful normal registration/update-or-persisted receipts now use original tool/outcome/source/callable facts, actual required/optional argument and warning lists, a whole fenced non-template source and one prior hint. Invocation advice stays opaque instruction; only the producer-known unverified tool-status hint is typed next. Complete safety warnings have first budget priority; all variable fields/groups/actions fit16KiB including public spacing or show whole selected-field/entry omission, with malformed selections unavailable without repair. Original post-effect warning/argument/coercion/boundary observations and all transaction/details/notify/error behavior remain. This is not new callability, host activation, rollback or invocation authority. Registry current-name listing and deletion returns now also use AX: original sorted/captured names are a whole selected group with shown/omitted/total coverage, never a new page/work quota or active/callable/global registry claim. Overlarge groups are wholly omitted and malformed groups unavailable without raw-key re-coercion or repair. Deletion keeps original selected tool/result and the exact operator reload note as opaque instruction; current-map not found stays a returned result, not a new error or orphan-file cleanup. Lookup/file/deactivation/notify/errors/details remain unchanged, including post-effect failures. Draft promotion success now also uses only its prior selected name/new-update/source=draft/exact callable display/first hint as AX. It does not inherit ordinary-registration args/warnings/boundary facts or change its admission/rollback policy. Original template String conversions remain after notify, including zero/object/Symbol behavior and post-effect failures. Whole scalars/actions fit16KiB or are explicitly omitted/unavailable; only the closed producer-known read-only status hint is typed, and invocation advice is opaque. Machine details/bytes and later activation observations remain unchanged. Four local registration source-mode errors now use only compiler-owned field/result records and actual replacement/reference-form/source-mode/inherited-field sequences, with previous correction advice as opaque instruction. No supplied source values, new helper/wrapper or changed guard/descriptor/getter/trim order. The host still owns cloning, coercion and schema validation: rejected extra/object fields need not reach these AX guards, while numeric input may normalize and preserve a non-error unnamed list result. This is not new schema, no-effects or automatic retry authority. Three ordinary name/source refusals now also use AX: invalid normalized name without raw caller echo, reserved selected-name value whole or explicitly omitted/unavailable, and missing source only for a new registration with actual source choices/opaque prior advice. Original normalization/reserved-set/resolution/lookup/blocker/fault order stays unchanged; empty-name listing, existing-tool update with retained source and dependency blocker text are not reinterpreted. SDK clone/coercion/schema remains separate. Ordinary and draft duplicate-registration refusals now show their original selected name whole/omitted/unavailable plus the original update advice as opaque instruction; distinct authoritative-file/Map/exists/blocker/update predicates and original single display coercion stay unchanged. No overwrite/retry, body-read or no-effects authority follows. Template-shape helper errors now also use fixed template/result records for nested Recipe objects, empty sequences and unsupported types, with actual supported-kind lists/opaque old correction and no supplied value echo. Getter/Array/reference/key/expand semantics and external errors stay exact; null/undefined/deletion/retained-source behavior and SDK coercion remain separate. Authored-Recipe non-object defaults, missing command description, null-at-authoring and missing-final-template constants now also use fixed field/result, without new value echoes or changes to args/from/description/default/retained-source order. Front deletion, inheritance and Schema/dependency errors keep separate ownership. The delegated runtime-owned-default-key refusal now shows only its original first selected key, defaults/result and opaque old correction. Full copy/find order, eight-name membership and the delegated-only condition remain; no all-key/value disclosure, early rejection optimization or new retry authority. Two draft-path refusals now show only their old captured allowed root or resolved path as complete dynamically fenced literals, or explicit whole-reference omission/unavailability under16KiB. Refused caller path stays undisplayed in root refusal; existing containment/exists/getter/error behavior and opaque prior advice are unchanged, not new absence/native proof. Public from-normalization refusal now also uses only its old displayed source/reason/legacy summary/doctor advice as AX, preserving inner errors, catch/coercion/method order and source/hint disagreement. Source is a whole literal; reason/summary preserve opaque Markdown, and advice is instruction content. Monotone whole-field omission/unavailability fits16KiB without parsing old summary text, adding causes/counts or widening source/catch authority. Normal candidate-admission refusal now also projects only its old source-conditional displayed source/joined diagnostics/legacy summary/advice, preserving branch/coercion/join and pre-Error order. Existing4096-unit upstream admission diagnostic clipping is not widened or repaired; selected summary fields are whole/omitted/unavailable under16KiB, with fitting diagnostics first. This adds no admission policy, full diagnostics/source proof or rollback/readiness authority. Draft raw/candidate invalid-Recipe errors now likewise expose only old optional reason/joined diagnostics with fixed draft/result, preserving separate read/diagnose, truthiness/coercion, Error-before-join and legacy diagnostic bounds. No new path/body, cause, reader, policy or retry follows; whole opaque values fit16KiB or are explicitly omitted/unavailable. Outer registration transaction errors now also project only old post-cleanup stage/resolution-generation/legacy summary/error, preserving cleanup and fallible template order exactly. Resolution generation is not a Run epoch; fitting surfaced error has budget priority and opaque inner rollback/advice text is not a new guarantee. No replay, extra cause/source read or changed transaction policy follows. Registry activation/promotion/deletion notices now also use report/tool AX fields for only old compiler report identity/name, preserving callback order/info type/faults and real hasUI gate. Report wording is not callable/full-host-removal proof. UI text stays literal with native wrapping; no borrowed model16KiB cap, whole well-formed values retained and malformed selected name unavailable. RPC delivery remains fire-and-forget, and loaded UI acceptance stays separate. Recipe registry watcher warning/refresh messages now also use report and opaque instruction constants only, preserving their distinct direct ctx.ui.notify calls (no added hasUI gate), failure dedup/pending-load/callback fault order and old default-root report rather than new verified metadata. Runtime startup warnings now also preserve true category sequences/singletons and whole opaque selected entries through the existing shared field primitive. Original suppression/classification/map/push/join/coercion precedes new projection from compiler-known slots, not parsed authored labels. Trailing LF/no UI cap remain; malformed selected warning is unavailable and old doctor advice is opaque instruction. Native Inspector Run controls retain their selection grammar rather than forced Markdown: producer-specific column gaps now carry ellipses, and complete selected_run_id context uses existing Recipe/Control literal documents, separately from authored fields. Generic fit/composition, source reads, keys and action targets remain unchanged; loaded colored-terminal/phone acceptance stays gated. Other errors/notifications/public owners remain separately scoped, with live client acceptance independent. Reuse the cohesive owner of each projection: - `tools-message.ts`: Control receipts, refusals and conservative public error text. - `tools-response.ts`, `tools-spawn.ts`, `tools-local.ts`: shared response primitives and launch/runtime-tool presentation. - `tools-inspect.ts`, `inspector.ts`, `inspector-overlay.ts`: public inspection and Inspector list/detail/action presentation. Preserve ranks, ids, source order, selection, focus and navigation contracts. - `observability.ts`, `run-delivery.ts`, `run-ui-runtime.ts`: observed outcomes/attention, versioned saved packet projection and active-context delivery respectively. Formatting does not own scheduling or acceptance. - `trace-projection.ts` and the admitted source owners: truthful bounded observation summaries and their existing privacy/count basis. Do not add a generic presentation authority, lifetime registry or second status implementation. Earn a shared formatting primitive through actual reuse and keep typed source/admission contracts distinct. Agent operating Skills should describe implemented behavior as slices land; they must not promise this target layout is already deployed or depend on human docs as their normal operating protocol. ## Acceptance For each owned implementation slice: - Compare the same admitted facts in tool text, Inspector and agent context where the slice applies; differences in presentation must not change meaning or permission. - Cover flat records, justified nesting, opaque Markdown with its own lists/keys, literal code, long/empty values, absent optional facts and complete references. - Check exact/unknown omission classes, Unicode boundaries, unchanged source bytes and immutable old-format replay under the real output budget. - Preserve the owning scenarios/assertions/teardown and use source/npm replay of the same properties, not a duplicate assertion harness. - Verify applicable keys, indentation, table fallback, focus/scroll/selection and safety notices at narrow/medium/wide widths. Actual authorized terminal/phone observation remains separate from headless source checks; Markdown syntax does not prove every client renders it correctly. - Reconcile implementation memory, actual agent-facing guidance, human references and the canonical backlog without claiming design adoption is runtime delivery. Implementation work and external gates stay in [BACKLOG.md](../BACKLOG.md), not a second AX task list. [Run supervision](./run-supervision.md), [Inspector](./actor-inspector.md), [management inspection](./inspection.md) and [coordinator delivery](./coordinator-delivery.md) retain their own feature contracts and evidence.