# Single-owner model interface

## Status and boundary

M2 participation/control is complete within the [functional scope boundary](scope-selection-contract.md#m2-functional-acceptance-boundary). M3.1's installed-SDK/local-provider serialization decision is independently **VERIFIED / APPROVE** within the mechanical boundary below. **Native patch roots follow captured wanted arity:** five built-in writable planes plus compatible registered mutable external roots, flat for one owner or in explicit owner dictionaries for multiple owners. Public external-root admission is owned by the [public module contract](public-module-contract.md). Both real tools consume the accepted translator only after M2 admission. Native mutation binding and the [deterministic FUNCTIONAL M3 checkpoint](#deterministic-m3-checkpoint) are independently **VERIFIED / APPROVE** within their stated evidence boundaries, not live-model quality. The SDK capability probes themselves publish no memory and confer no private acquisition. The native-read slice below is independently **VERIFIED / APPROVE** within its bounded evidence; neither that historical slice nor accepted mutation binding alone is whole-M3 model-surface acceptance. M4/M5's historical decisions and later internal/public module work also shipped in 0.27.0; [BACKLOG.md](../BACKLOG.md) owns only outstanding work, including separately gated real-model evidence.

The task is to remove mandatory scope knowledge from ordinary single-owner model operations without losing canonical ownership, history, cancellation or multi-owner atomicity. Mode, owner participation and model presentation remain separate. A flat declaration is not an authoring grant. The implementation-slice sections below retain their original then-current gates, counts and verdicts; statements about later M3 slices being pending describe those historical checkpoints, not the current released interface.

## Schema decision

Choose **same-name declaration replacement at captured policy arity changes**, using the installed SDK's `registerTool` refresh path. Retain the two existing names only. Cache the applicable flat-versus-multi interface shape; do not register per inference, ordinary patch, mode-only toggle or same-arity owner change. No new registry, holder, epoch, provider framework or parallel API is earned.

This is a refinement of the preferred stable disjoint grammar based on an actual serializer constraint, not an assumption that a union is unsupported everywhere. OpenAI Responses and Google preserve the tested alternatives. Ordinary non-strict Anthropic serialization in the pinned stack does not preserve root exclusivity; a top-level object-union loses its field vocabulary altogether. Shape-specific flat/scoped objects preserve the applicable advertised family across all three adapters. They **do not** magically restore root closure/nonempty constraints where the adapter discards those, so native validation and runtime admission remain authoritative.

### Tested candidates

`tests/schema-probe-fixture.ts` defines SDK-only candidates with five semantic plane fields (`intents`, `strategy`, `tactics`, `artifacts`, `lazy`) and three owner fields. Each semantic plane is an ordinary object with task-specific JSON values; whole-plane null is not introduced as a new public operation. Nested null deletion values remain possible. `response`, retired roots and arbitrary whole-input escape hatches are absent.

- **Stable closed object:** Eight explicit root properties plus nonempty and mutually exclusive flat/scoped family constraints. The actual native validator accepts either family and rejects mixed/empty/unknown inputs. A separate labeled prototype runtime arity gate determines which family the test policy permits.
- **Object-root union:** Two closed flat/scoped branches. A pure native-validator/JSON-roundtrip witness checks it, and all three actual serializers are exercised. It is not the installed production grammar.
- **Shape-specific replacement:** Flat object has five plane properties; multi-owner object has three owner properties whose values use the plane object. Actual native wrong-family validation can reject before handler entry when a request begins with the applicable schema.

The read tool in the native capability probe deliberately uses the same candidate schema as the patch tool to test **two-name refresh/dispatch**, not real read syntax. Production `read_state` still has its path/list/projection grammar. M3 integration must bind its actual descriptions, paths, envelopes and schema; this generic acknowledgement probe does not settle those semantics.

### Installed native SDK evidence

The SDK-only schema-probe group in `tests/pi-compatibility.test.ts` supplies six SDK-only properties: three cohorts for each stable/replacement option. It uses the real installed session/tool loop with State Flow factory disabled and a clearly labeled test extension, whose handlers only acknowledge validated arguments. No lower canonical seeds, copied State Flow factory, hidden feature flag or memory grant occurs.

- All three sole-owner representatives share declaration digests, while two/three-owner transitions expose the selected candidate schemas for both existing tool names.
- Replacement refresh reaches the next native continuation, not just a later independent request. Mode-only and same-arity controls do not register again; stable has two initial registrations, replacement six across flat→multi→flat. Both retain unrelated `read`/foreign tools and the host allowlist.
- Empty/mixed/retired/response payloads fail before handler entry. Stable wrong-arity calls require its explicitly labeled prototype runtime gate; replacement can reject those through its applicable native schema.
- **Current-response snapshot counterexample:** Re-registering mid-response does not replace that response's executing wrapper. An old flat call still enters the old wrapper after flat→multi or Off; prototype runtime gates reject it. A following request after Off cannot enter an absent tool, but schema withdrawal alone is not cancellation of an already issued wrapper.
- **Same-flat owner counterexample:** An in-flight flat Global-shaped call can acknowledge under CWD in this deliberately receipt-free prototype. Both schema options allow it. Schema replacement is not an owner receipt and cannot replace the existing M2 original-ID/physical-owner/policy/signal fences.

All decisive declarations/results/counts/errors are asserted outside faux provider callbacks. Stable's fewer registrations remain a real simplicity advantage; native SDK mechanics alone do not force replacement. The bounded wire constraint below is the deciding difference.

### Actual local provider serialization

The local serializer group in `tests/pi-compatibility.test.ts` supplies twelve cases: three installed public API stream adapters × four candidates. They construct requests using actual OpenAI Responses, Anthropic Messages and Google Generative AI adapters, with an explicit noncredential dummy key and local fetch capture. Global fallback is blocked; Google uses the same guarded global/custom function required by that adapter. No HTTP delegates to a real network. Each case captures exactly one actual Request JSON body at `schema-probe.invalid`, then returns local HTTP 400 `LOCAL_SCHEMA_PROBE_STOP`. The expected error is a fixture stop, not a model failure or server acceptance.

Observed wire bodies:

- **OpenAI Responses:** All four parameter schemas exactly equal their JSON-roundtripped source schemas, including root constraints and nested vocabulary.
- **Google:** All four `parametersJsonSchema` declarations exactly equal their JSON-roundtripped source schemas.
- **Anthropic, ordinary non-strict:** `input_schema` is reconstructed from `type`, `properties`, `required` only. Stable retains eight properties but loses `oneOf`, nonempty and root closure. Object-union becomes an empty-property object: both branches/vocabulary disappear. Flat retains five properties and scoped retains three/nested plane objects, but both still lose root closure/nonempty constraints.

The assertions encode these known counterexamples explicitly; green test output does not mean all serializers preserve alternatives. Provider-specific strict-sampling changes were not used as a product workaround. Remote server acceptance, constrained sampling, model confusion/error/retry rates, latency, costs and cache effects were not tested. No model-quality superiority is claimed for replacement.

The schema-validator group in `tests/pi-compatibility.test.ts` retains two pure actual-validator properties, before/after JSON roundtrip, checking closed candidate families, runtime-owned response/retired-root rejection, mixed/empty/invalid-type refusal and nested-null preservation. SDK optional-null normalization cannot manufacture a valid patch from a whole null plane. The coordinator aligned the preliminary nullable plane probe with the existing object-only `validateScopePatch` contract before integrated validation; this does not change production semantics.

## Runtime context presentation

The context domain keeps canonical effective state, reference values, diffs and accepted-write prediction internally. Only known model-output fields are rendered with the admitted captured WANTED choice (`ContextView.modelScopes`, detached DATA, not a memory/operation grant). Omitted lower-library choice preserves legacy all-three presentation. Native context captures it after original-context/physical-owner admission and revalidation; patch updates use the original admitted tool receipt. Available-only CWD under wanted CWD+Session remains multi and does not acquire Session.

- **Heads:** The existing effective `state` overlay is not flattened a second time. Eligible same-owner current `$ref` values render relatively in Active/Passive; historical/effective/cross-owner/resource refs and ordinary text/source paths remain unchanged. Lazy bodies/hashes stay hidden; the catalog locator becomes `lazy` only for one wanted owner. Canonical provenance fields are not extra flat namespaces.
- **Recent DTOs:** Select owner headers before cloning patch payloads, retain accepted `id` and branch-local `at`, omit lazy-only/empty presentation records and render a sole `{id,at,patch}`; multi retains explicit transitions. No history/replay/query format changes, reconstructed positions or private proof. Passive does not gain Active recent history.
- **Updates:** Compare canonical values first, then render structured-ref objects and split scalar `$ref` leaves at the typed serialization edge. Predictable direct writes still need no echo. Effective delta path segments remain exact, including special keys; selected sole-owner cascade paths are relative. Projection IDs attach notices to heads, not stores/publishers. Changed wanted choice rebases presentation identity; equal normalized choice does not. A receipt with another interface is not attached to an existing replacement head.

Finite accepted-cohort evidence: new source **32/32 =18 genuine installed-SDK+14 DATA/presentation** properties, full **1563/1563** without failed/cancelled/skipped tests, strict typecheck/build/import/package inventory **129**. Whole-body import-only new compiled mirrors **32/32**, inherited compiled **226/226** (prior202+normative24), unchanged mixed compatibility **36/36**. Counts overlap, not summed. A complete retained pre62 compiled context module with import-only reanchoring proves **8 raw Active/Passive multi-head contents** equal; **4 receipt /4 notice** DTO comparisons equal after removing independently random projection IDs. This is not whole-provider-request/clock/UUID/cache/cognition equality or independent historical capture.

Native fixtures use public mode choices, original-ID SDK tools, current flat writes, actual reload heads, owner-canonical storage, genuine intent→owned-target deletion cascades and reads. Wanted-multi/sparse-CWD proves no private file creation or fixture-byte mutation, not universal nonaccess. Context DTOs cannot grant source/private/lifetime/publication authority. Lower getter/special-key/fresh-ID cases are DATA tests, not provider JavaScript or SDK interleaving proof. Previous mutation/read/source/private/lifetime checks remain in full1563. The complete actual terminal independent review is **VERIFIED / APPROVE for M3.3b1 only**, with no blocking finding or requested remediation. Independent **85/85** affected source (14 new DATA+18 SDK+53 existing mixed context), **23/23** authority closure (11 SDK+11 raw+1 pure; one SDK sparse case uses a disclosed lower canonical seed), compiled **32/32**, mixed compatibility **36/36** and noEmit typecheck passed. The reviewer established four complete import-specifier-only body equalities (two new mirrors, raw harness, argument helper), reran raw heads8/receipt4/notice4 comparison, and checked frozen **38/38 before/after**. Counts overlap. It audited all1563/inherited226 pass rows and full129 inventory as inspected coordinator evidence, not independent full execution/rebuild. It distinguished exact lower ID/position preservation from native ID/position-kind assertions, inspected mismatch/cold-receipt behavior without claiming a separate native stale-receipt interleaving property, and did not use the truncated old extension as baseline. No removable complexity was identified within this closure. Report consumed after ROOT terminal before unfreeze; closure changes review/decision docs and BACKLOG only. That b1 verdict does not cover the b2 output boundary below or complete M3/M3.4 acceptance.

Initial new-native run14/18 had three incorrect reverse-cascade fixture oracles (deleting a target does not delete the owning intent) and one assumed optional config file. Only new fixtures changed: delete the intent to genuinely cascade lazy/tactics; assert absent defaults stay absent. No ownership/source/private oracle or implementation weakened. Author initial typecheck failures were new-test getter/cast annotations only, fixed before final clean run. First new compiled native mirror failed /tmp bare pi-ai resolution before any native body; only that import reanchored to the actual installed package, final32 pass. No failure body/helper/validator/factory fallback suppressed. Pre62 extension reader capture was limited to871/2206 lines by byte cap; it is not a complete/executable baseline or proof. The pre62 context capture is complete.

## Remaining runtime output boundary

Current runtime Skill acquisition targets use `projectModelArtifactTarget`: captured wanted arity, selected owner only, exact JSON-string source key with no path normalization. Sole `artifacts[exact key]` is compilation-target syntax, not a query parser extension. Native original tool/physical/policy eligibility still precedes source tracking and hint rendering; excluded native file reads get no acquisition hint or relocation grant. Ordinary source-change hints already name no owner namespace and remain unchanged.

Deletion acknowledgement text projects only the known `MissingDeletion` JSON-pointer fields, removing an exact selected sole-owner first segment. RFC6901 source-key escapes, indices and owner-shaped child names stay literal; multi stays canonical. `details.scopes` and `details.missingDeletions` remain canonical operator DATA. Neither a relative pointer nor a report is publication permission or a newly admitted read locator.

Fresh Stop/reload/bootstrap continuations capture wanted choice using existing native callers. `createPassiveContinuation` keeps its detached canonical response-free `.state` for comparisons/trajectory, renders only the new user-data handoff through the existing current-ref translator, and preserves start/anchor/preserveContext fields and native history identity. The helper does not newly sanitize lazy bodies: native callers already supply existing model-projected state. Historical/cross-owner/effective/resource/text refs and physical source paths stay unchanged. No trace erasure, source/cache/private grant or old-handoff rewriting.

Compiler errors remain canonical provenance diagnostics, not tool-argument examples. Removing foreign owner names could falsely invite relocation of excluded Skills. No error class/parser/string-rewriter was earned: actual sole-owner Skill and ordinary compiler failures recover with fresh flat `artifacts` arguments that do not contain an owner wrapper. Skill compilation still needs its optional exact read/hash/provenance and output fields; ordinary compilation retains stat/fingerprint evidence rather than invented content hashes. This is finite mechanical recovery, not model comprehension or retry-quality evidence.

Accepted-cohort validation: new **41/41 =17 genuine SDK+24 DATA** source properties; full **1604/1604**, strict typecheck/build/import/package129, zero failed/cancelled/skipped tests. Actual new/current facility compiled **48/48** (17 new SDK+24 DATA+7 existing SDK); current maintained compiled cohort **299/299** and unchanged mixed compatibility **36/36**, overlapping counts not additive. All seven native choices cover Skill targets/excluded-read suppression, invalid-compiler byte preservation/valid declared retry, no-op escaped deletion pointers/canonical details and real stored Skill hash; all7 cover fresh Stop/reload/bootstrap refs/canonical storage; 3 sole-owner ordinary compiler cases prove failed/no-publication then flat recovery with exact fingerprint. DATA properties cover all7/opaque source keys/pointer boundaries/clone/native trajectory and malformed-before-body capture, not SDK/source authority.

Complete current facility body differs from immutable60 only by import specifiers and the selected-reread expected-target assertion conditional flat/multi; all source IO, provenance/hash, exclusions, relocation and negative oracles retained. Original inherited258 honestly passes255/258 with the3 obsolete sole-hint expectations; immutable60 is not edited. Current compiled299 substitutes the exact current7 facility mirror and includes the41 new tests. Two new mirrors and current facility retain complete import-only bodies. A complete actual pre63 context module proves8 raw multi-handoff content equalities;9 targets/9 deletion DTOs match the legacy literal/data rules, not independently captured old native hooks. Historical capture is coordinator provenance; no whole-request/clock/cache/cognition equivalence.

Preserved failures: initial adjacent source70/73 had only3 obsolete sole-hint expectations, fixed only that existing assertion. Initial ordinary3 fixtures incorrectly demanded `sourceHash` where the established contract uses exact stat fingerprint: focused38/41 and full1601/1604 failed, then new fixture assertions corrected to exact size/mtime plus absent content hash, final41/full1604 clean. Full validation was accidentally allowed after the already-failed focused check; it reproduced the same3 bad assertions, not a new code defect or passing aggregate. Author initial17/24 plus2 annotations included an unsupported lower-helper lazy-sanitization expectation; removed that expectation and corrected typing, preserving native automatic lazy omission and all required ref/detachment/response oracles. Reports/logs retained. Complete actual terminal integrated review is **VERIFIED / APPROVE for M3.3b2 only**, without blocking finding or requested shared remediation. Independently passed **101/101** source (new41+facility7+mixed context53), compiled **48/48**, compatibility **36/36**, noEmit typecheck, raw multi-handoff8/literal-target9/pointer9 comparisons and **39/39** additional authority checks (26 SDK, including one disclosed lower-seeded sparse case, plus13 source-harness cases). Its retained additional actual-DIST/SDK **1/1** foreign-provenance witness proves sole CWD can read a Global Skill without a State Flow hint but cannot compile it locally: canonical foreign-owner rejection, unchanged bytes and absent local card. This supports retaining provenance diagnostics, not universal access safety or model comprehension. All three mirrors/raw harness/argument helper whole bodies are import-specifier-only; old/current facility differs only one expected-target assertion. Frozen **46/46 before/after**. Counts overlap. Reviewer audited all full1604/current299 pass rows, exact added41 names and inventory129 as coordinator evidence, not independent full/rebuild/package execution. Complete prior context capture is coordinator historical provenance. Reviewer-local first parity omitted side-effect imports and first foreign-witness oracle demanded an unelided temporary error path; owned helpers/oracles corrected, actual diagnostics/logs retained, no shared source changed. No removable complexity identified. Complete report consumed after ROOT terminal before unfreeze; closure only decision/review docs and BACKLOG. BACKLOG alone owns later M3.4 work; no whole-M3/model-quality approval.

## Deterministic M3 checkpoint

The accepted M3.4 deterministic functional checkpoint adds no production module, API, schema, parser, policy or storage change. Existing accepted boundaries above supply atomicity, source/private/request lifetime, historical refs and typed output proof; a bounded independent inspection-only inventory identifies only two compositional evidence seams: exact native scalar-patch ID value and a whole linked handoff/revision/closure across reload. It does not reclassify lower/host-getter/prototype/local-wire properties as native authority. Existing tests are reused, not duplicated into another engine or evaluation framework.

The linked-checkpoint group in `tests/extension.test.ts` supplies **7 real installed-SDK** cases across all nonempty public choices. It stores fixture-supplied requirements/accepted approach/separate unaccepted proposal/prerequisites/dependencies, reloads, reads those facts, applies a supplied contradiction/reasoned partial revision with retained binding requirements/dependency/failed-prerequisite/rejection evidence, reads the old accepted method, then closes the intent and reconciles owned tactics/lazy memory while preserving durable consequences. All ordinary JSON labels/verification/acceptance/closure are supplied by the fixture, not inferred truth, user approval, external publication or model decision quality. Shared negative/source/atomic tests remain with their existing owners.

The actual native scalar `read_state` patch result's `details.transitionId` equals this fixture's own accepted stream boundary ID. A current native root read matches replay of that fixture's real canonical checkpoint/tail through the existing merge algebra (before final answer publication). IDs are not compared across independent stores. Known read windows preserve fixture bytes, response is automatically Session-only when selected, excluded owner reads reject, and intent closure emits real cascade receipts. No new hidden shape converter, old sole-wrapper alias, fake runtime/receipt or lower provenance seed. Assertions run outside faux callbacks.

Within each of the seed and post-reload inference phases, actual State Flow declarations, owned wrapped protocol section and frozen head content stay byte-identical across semantic writes/reads/closure. Lifecycle boundaries are separate: this is not head equality across reload/new-run boundaries, nor whole provider-request/token/cache equivalence. Flat declarations are identical across sole owners and multi declarations across two/three owners. Seven byte rows reproduce exactly across focused Source, full Source and complete import-only actual-DIST executions.

| Wanted | Declarations (B) | Section (B) | Head (B) |
| --- | ---: | ---: | ---: |
| Global | 2591 | 5281 | 2141 |
| CWD | 2591 | 5252 | 2141 |
| Global+CWD | 2466 | 4556 | 2205 |
| Session | 2591 | 5234 | 2282 |
| Global+Session | 2466 | 4554 | 2408 |
| CWD+Session | 2466 | 4511 | 2408 |
| Global+CWD+Session | 2466 | 4425 | 2408 |

These are `getCurrentTools`' two actual `{name,description,parameters}` definitions, SDK owned section including its wrapper, and owned user-head content array. Not provider wire serialization, full messages, tokenization, latency, cost, cache-hit rate or observed model errors/retries. UUID values are not equal across fixtures; only byte counts are reproduced. Scope choices differ in participation/response policy, so not identical-policy causal A/B. **Flat declarations are125 bytes larger here; flat protocol is also larger. Scope-free required arguments do not imply a smaller prompt or better cognition.** Default-all3 raw Active/bootstrap body SHA guards remain unchanged; the wrapped all3 section4425 is not the raw4398-byte body.

Reused obligation owners/evidence (not new execution claims):

- **Schema/normalization/native caller:** Actual flat-patch7×modes, registration/stale-wrapper/host-denied cases; detached normalizer/ref/path and local serializer probes keep separate proof levels.
- **Canonical temporal/source/private atomicity:** Selected replay7×retention0/1/7/100, excluded-only no-op versus folded refusal; native seven core/facility/cancellation/private cases and late invalid-compiler lower atomic refusal.
- **Guidance/trust/model output:** Protocol raw SHA and multi-body equivalence, actual packaged Skill examples; native guidance/context/output cases and original source callback/foreign-provenance witnesses.
- **New compositional delta:** Exact native own-boundary forwarding, canonical replay/current read and linked JSON continuation across reload; new7 close the two bounded pre64 inventory seams.
- **Quality and external reality:** M0.4b owns gated real-model comparison; memory labels are not verified effects, accepted commitments inferred by a model, or comprehension proof.

Final full **1611/1611**, typecheck/build/import/package129, zero failed/cancelled/skipped. New Source7/7 and complete import-specifier-only compiled7/7 overlap full. Accepted63's complete46-entry certificate is unchanged **46/46 before and after rebuild**, binding unchanged production/test/helper/probe inputs: prior current compiled299/299 and compatibility36/36 are **reused**, not rerun/relabeled as new64 executions. Fresh metrics repeat all7 rows in three executions. Initial native7 passed but first typecheck failed only new fixture annotations (boundary mistakenly typed with `at` rather than its actual native type shape, Node deepEqual narrowing JsonValue); corrected ID-only capture and record guards, no oracle/production change. Final corpus adds explicit failed-prerequisite/dependency fields; initial earlier byte rows are not the final corpus baseline. Bounded inventory author executed no tests and did not inspect/claim the coordinator's new fixture. Complete actual terminal review is **APPROVE / VERIFIED for the deterministic FUNCTIONAL M3 checkpoint only**, with no blocking finding or shared remediation. Independently passed new Source7/7, actual DIST7/7, noEmit typecheck, protocol/selected-protocol19/19 and existing native seven-core14/14; these overlap. The latter grounds native Session-excluded response nonpublication, excluded calls/bytes and atomic rejection beyond new runtime-inspector refusals. It proved complete new mirror and argument-helper import-only bodies, inspected actual DIST-only wrapper/no Source fallback, and verified frozen135/135 before/after. Full1611/build/package129 remain inspected coordinator evidence, not independent execution; final-doc sizes/tarball hash are not freshly repacked. Prior299/36 remain reused, not new runs or a passing306 aggregate. Current accepted63 digest matches43/46, only3 declared docs changed after historical pre/postbuild46 passes. All7 metric row objects match across five executions (coordinator focused/full/DIST and independent Source/DIST); fixture labels remain supplied data, replay uses accepted algebra and captures before final response, stable bytes apply within phases not across reloads. The reviewer accepted closing exactly the two bounded inventory seams, not model decisions/external truth, universal safety or finality. No removable production complexity identified. Actual report consumed after ROOT terminal before unfreeze; closure changes only decision/review docs and BACKLOG. Deterministic M3 is functionally accepted; real-model flat-versus-scoped task errors/retries/quality/cost evidence remains explicitly M0.4b-gated, not supplied by these SDK bytes or automatic live evaluation.

## Required integration invariants

These are interface obligations, not another open-work list or a new permission subsystem:

- Use **captured wanted participation**, not whichever shared owners happen to be observable, to determine single versus multi model interface. Requested Session can remain unacquired; an available CWD view is not permission to reinterpret a multi-owner request as single-owner CWD.
- Carry the accepted M2 native request/caller/original-ID/signal authority through normalization before staging/publication. A current schema or current sole-owner value must never rebind old flat arguments to a different owner. Same-arity changes still revoke stale requests and reset projection identity even though no schema registration is needed.
- Normalize a detached flat patch into its exact captured sole canonical owner before the existing staging/commit engine. Two/three owners remain explicit atomic cohorts. Do not add another engine, root ownership convention or storage conversion.
- Advertise every ordinary input accurately. The SDK `prepareArguments` hook must return the declared parameter shape; it is not a way to turn advertised flat input secretly into a scoped shape before flat-schema validation. Canonical wrapping belongs at the admitted semantic boundary.
- Persist structured semantic references with exact canonical owners, and flatten only eligible same-owner presentation. Resource paths/textual nonownership remain unchanged; different-owner references cannot become local through prefix stripping.
- Current unscoped paths, existing `effective[N]` history and any narrowly validated sole-owner `patches[N]` alias must preserve retained history meaning. Never reinterpret an ordinary array index as temporal history.
- Heads, results, receipts, lazy hints, recent patches, acquisition/cascade diagnostics, instructions and packaged Skills must agree with the actual model interface. Operator/internal provenance may remain explicitly scoped. This probe does not claim that surface integration is installed.

## Detached canonical boundary

`lib/model-interface.ts` owns only detached model/canonical translation; no SDK, runtime, storage, source acquisition or publication authority. It uses existing query grammar and canonical types, not another reference resolver or semantic engine. It is not exported from the root API. Production `read_state` now calls its path/reference functions, and `patch_state` normalizes admitted arguments into exact canonical owners so a read/write round-trip cannot lose canonical ownership. The former still-scoped reference bridge was the accepted read-slice prerequisite; full normalization now subsumes it. M3.2 is deliberately split at this validation seam before native binding, because a pure DATA transform cannot safely decide whether a native caller is stale.

For one captured wanted owner, the closed nonempty flat patch accepts the five object-valued planes; nested null deletion values remain data. It wraps exactly that owner and anchors eligible structured current semantic `$ref` paths before staging. Two/three-owner inputs remain explicit selected-owner cohorts; mixed/wrong-family/excluded roots reject before supplied excluded payload getters. Every input/result is detached, own special JSON keys survive, invalid finite/dense JSON refuses, and downstream artifact/compiler/target admission stays with the existing engine. Empty plane objects remain legal no-op candidates; empty input/scope branches are not a new authoring operation.

Examples for captured CWD (not evidence of acquisition or native admission):

| Model value/locator | Canonical translation |
| --- | --- |
| `{ tactics: { ready: true } }` | `{ cwd: { tactics: { ready: true } } }` |
| Structured `{ $ref: "lazy.plan" }` | `{ $ref: "cwd.lazy.plan" }` |
| `tactics.items[1]` read | `cwd.tactics.items[1]` — ordinary array index |
| `effective[1].tactics.items[0]` read | `cwd[1].tactics.items[0]` — temporal offset plus array index |
| Sole-owner `patches[0]` read | `cwd.patches[0]` — latest retained owner patch, never invented history |

Reference projection strips only validated same-owner **current** semantic prefixes and can recapture them into the same exact canonical owner. Cross-owner references, file/resource paths, ordinary strings/textual `$` mentions and nonsemantic/malformed reference strings are unchanged. Explicit `effective` or historical structured references remain unchanged: they are not ownership targets, and rewriting a persisted owner-history reference as `effective[N]` would lose its exact owner after expansion. Ephemeral **read locators**, unlike persisted references, may render owner history as `effective[N]`, since recapture immediately binds the exact captured sole owner. Multi-owner grammar/overlay semantics remain unchanged. Aliases do not resolve values or authorize scans, private recovery, hydration or a current schema's rebinding of old arguments.

Integrated evidence: `tests/model-interface.test.ts` supplies direct shape/reference/path/JSON/detachment and pre-payload refusal properties; the independently authored roundtrip groups now consolidated in `tests/integration.test.ts` use actual lower canonical staging/ownership cascades/query across all sole owners and multi-owner controls; their pure special-key/reference detachment property belongs to `tests/model-interface.test.ts`. The selected boundary groups in `tests/integration.test.ts` feed the same existing selected stage/commit/replay across all seven selections × retention0/1/7/100, retaining canonical refs/current/history, folded-delta refusal versus proven excluded-only no-op, and downstream atomic artifact rejection. These are lower pure/semantic/temporal fixtures, not native operations or filesystem/private acquisition proof. The explicitly retained DATA-only counterexample maps identical flat arguments to whichever sole owner a caller supplies: **M2 original-ID/physical/policy/signal admission must precede normalization**. No normalization function is a capability.

M3.2a's actual terminal independent integrated review is **VERIFIED / APPROVE** for this pure boundary only; the complete report was consumed before closure/unfreezing. It independently passed **47/47** affected source properties (including the 26 new), **26/26** exact compiled mirrors and strict typecheck; verified all three complete source/mirror bodies equal after import-only substitution and frozen **29/29** plus unchanged M2 **26/26** before/after. No remediation was requested. The reviewer preserved the high-impact DATA-only owner-rebinding counterexample and persistent-reference versus ephemeral-history distinction; it did not independently rerun full1459/rebuild/package129 or certify native dispatch/private publication. At M3.2a closure production factory/bindings remained unchanged. The later native-read use below has separate evidence; full flat mutation/M3.3/M3.4 acceptance is not supplied by those pure tests.

## Native read boundary

The existing `read_state` declaration retains its real `path`/`paths`/`projection` parameter object; only conditional one/multi-owner guidance changes. Its grammar does not need re-registration or another tool name. Captured **wanted** scopes, never available-view arity, select translation after original native receipt and physical session/CWD/storage identity checks. Arguments are detached once, the same receipt/signal/physical owner is revalidated after capture, around materialization and before output, and requested locators remain in result details. Scalar scope-patch reads keep their existing value-only envelope and exact transition ID. Ordered semantic batches stay all-or-error; `patches[N]` is a narrow sole-owner root alias, not a new mixed patch-history batch API. `keys`/`patch` projections retain existing canonical query semantics. Different-owner/resource/textual/historical/effective structured references remain unchanged. Canonical hints/other model surfaces still await their own M3.3 audit.

At native-read acceptance, a necessary compatibility bridge in the then-**scoped-root** patch handler anchored eligible current structured refs for an exact sole participating owner, only after the existing native admission/check and before compilation/staging. No new patch root, schema, engine or private grant is added. This is required for coherent read output: without it, a scope-free ref read from an intent and written back in the old scoped envelope would persist unanchored and stop protecting its lazy target from the same-owner intent cascade. Three actual native read→scoped-write→cascade counterexamples (Global/CWD/Session) were reproduced against the intermediate candidate, then fixed by the bridge; they are not described as an old M2 defect. A separate pre-integration source-harness reentrant argument getter changed the sole owner during a read and incorrectly returned the old body; one-time argument capture plus repeated existing-lease checks now reject that fault. This is a source-harness fault, not a provider sending JavaScript getters.

At native-read acceptance, the flat-read group in `tests/extension.test.ts` retains fourteen independently authored real factory-enabled installed-SDK cases: seven public selections × Active/Passive, actual then-scoped patches before reads (legitimate arguments later migrated to the actual flat/multi grammar without relaxing assertions), scalar/batch/keys/owner patch/current/history results and reference projection, canonical/excluded/default bytes, actual Off withdrawal and host-tool availability. The flat-read-lifetime group in `tests/extension.test.ts` supplies eight actual SDK cases for same-flat/arity/Off ABA, equal-choice continuation, unrelated read execution, fresh recovery, wanted-multi/available-CWD observation without Session acquisition, and real folded-tail refusal. The flat-read-roundtrip group in `tests/extension.test.ts` adds three actual SDK ref/cascade round-trips through unchanged scoped mutation grammar. The flat-read-owner group in `tests/extension.test.ts` has six explicitly source-harness reentrancy faults/controls for capture, scope ABA, Off, Abort, physical movement and equality. All decisive SDK assertions are outside provider callbacks. These **31 new =25 SDK+6 source-harness** properties are not remote-model, Telegram, universal filesystem nonaccess or exhaustive-interleaving proof. The actual terminal independent integrated review is **VERIFIED / APPROVE** for native READ+scoped-write round-trip only, without requested remediation. Its complete report was consumed before closure/unfreezing. It independently passed **256/256** affected source properties, **31/31** exact compiled mirrors and strict typecheck; proved complete test/raw-harness import-only equivalence and frozen **22/22** before/after, and confirmed the expected old M2 **24/26** (only source/compiled extension changed). It inspected the real unchanged structural read schema, preserved both negative counterexamples and explicitly justified the necessary write-ref bridge rather than treating it as formatting. These sets overlap; it did not independently rerun full1490/rebuild/package129/inherited148/36 or certify full flat mutation/model quality. Code inspection confirms exact patch transition ID forwarding; the new native cases do not separately assert its exact value. At native-read closure, flat patch declaration/binding remained open; the later candidate below has separate evidence.

## Native mutation boundary

`patch_state` now advertises the applicable grammar under the same name: a nonempty closed flat object with optional object-valued `intents`, `strategy`, `tactics`, `artifacts`, `lazy` planes for one captured wanted owner; explicit Global/CWD/Session dictionaries for multiple owners. Multi-owner dictionary bodies retain the accepted M2 open-object **schema**, with the same closed semantic plane/compiler admission in the runtime. Repeating closed nested plane schemas needlessly enlarged the default provider context and rejected previously runtime-admitted diagnostic fixtures before execution; retaining the existing multi-body declaration preserves both those contracts without weakening canonical validation. SDK/provider probe grammars remain clearly experiments, not a mandate to replace every nested production declaration. Response/retired/unknown/mixed/disabled input still cannot publish.

Only captured wanted **flat versus multi** shape controls declaration refresh. The extension's unregistered tool-definition template caches its desired parameters (two constant alternatives), and every SDK registration receives a fresh copy. No old response's tool definition is mutated. `getAllTools()` is public observational metadata but **host filtering can omit a registered denied tool entirely**; treating absence as a cache miss caused repeated flat registrations in the real counterexample. The template's shape-only cache avoids that without a registry, selector epoch or additional lifetime. Host filtering remains authoritative; denied tools do not become callable. Same-arity owner changes and mode-only actions do not re-register, Off choice stays native-only/withdrawn and the next enabled shape is captured correctly. The read declaration needs no arity refresh because its parameter grammar is structurally stable.

Original-ID receipt, physical caller/runtime/CWD/storage identity and signals are checked before input normalization. The captured request's wanted owners feed `normalizeModelPatches`; no SDK `prepareArguments` shape trick, available-view arity, current schema or guessed owner grants authority. The same existing selected author/stage/commit/source/compiler/first-acquisition/fork ports publish canonical replay, including current refs and cascades. Correct no-ops, material revisions and multi-owner atomicity remain engine-owned. Failure diagnostics use the same detached argument snapshot as publication, not a caller-mutated object sampled after a wait; unadmitted callers cannot force diagnostic-input getters. Model heads/acknowledgements/recent patches/hints/protocol/Skills still need the separate complete-surface audit, not silently supplied by a flat schema.

The native-flat-patch group in `tests/extension.test.ts` and its pure fixture-adapter property in `tests/invariants.test.ts` retain these 23 properties: fourteen actual public seven-selection × Active/Passive native mutation/query/canonical-reference cases, an actual factory registration observer, five old executing-wrapper/same-flat/arity/Off-ABA native refusals followed by fresh recovery, one actual host-denied metadata/permission control, one raw caller/getter diagnostic refusal and one pure fixture adapter property. **21 SDK+1raw+1pure**, not23SDK. The adapter unwraps only a legitimate exact sole target; foreign/mixed negative cohorts remain unchanged and reject. Sixteen inherited native/control suites were retargeted by two disjoint bounded authors without replacing factories/selectors or deleting assertions; the additional configured-owner source fixture now authors the actual declared shape. Both actual author reports were consumed. Both actual independent terminal reviews accept this bounded native normalization/binding cohort; no full M3 or model-quality claim.

## Normative flat interface guidance

M3.3 is split at a validation boundary: normative protocol/packaged guidance first, runtime heads/results/receipts/hints second. The latter is not certified by correct tool parameters or instructions alone. For exactly one captured wanted owner, Active/bootstrap protocol now explicitly requires direct object planes without an owner wrapper, flat current refs and read locators, distinct `effective[N]` temporal versus nested array indexing, narrow scalar retained patch alias, and direct `artifacts[exact path]` compilation. Optional provenance-qualified/cross-owner/effective/historical refs and source/resource/text strings keep their meanings. A one-owner interface cannot perform a two-owner transfer by fabricating or widening a destination. The same interface grammar is added to Passive without Active reconciliation pressure or inferred private acquisition.

Two/three-owner Active/bootstrap/Passive raw protocol strings remain unchanged: before rebuild, twelve exact Source-versus-prior-dist comparisons passed (four multi selections × Active/bootstrap/Passive). Default-all3 Active/bootstrap retain their accepted SHA256 bodies `c61511a1d0a8d650034f735e1c83721dd04288be5424d2232aec6b0ddf9d26b0` / `6491e6abf18e8e8604b9aae824346b921b93dee4d0c30d5aeeec8e75e8f16cad`. This is raw-body equality, not whole provider request/XML/message-array equality or a model-cache/cognition claim.

Packaged Guide and Memory now teach conditional wanted-arity grammar with real scope-free read/write/ref examples; the Guide's opening/closing example is valid for any sole owner, not an unconditional Session-wrapped input. Reported source scope remains provenance, not a second flat input namespace. Multi-owner examples require actual participation. Passive access, explicit-request-only curation, no finalization patch, canonical/null/index/closure semantics, exact-path optional Skill compilation, acquired-source/provenance rules, unavailable-owner transfer blockers and reference nonauthority remain intact. New tests discover the actual packaged files, parse the JSON examples and feed the existing normalizer/cascade engine; they do not introduce a converter or new parser.

Actual installed SDK tests cover all7 public choices × Active/Passive, cold protocol eligibility, genuine flat/multi patch→read continuation and native reload after defaults change. Cold Passive without a validated view still contributes no invented memory/protocol; later admitted authoring supplies the actual view. A wanted CWD+Session / available-CWD control retains multi guidance with no private acquisition. Decisive assertions run outside scripted callbacks. These fifteen SDK cases plus three discovery/example/semantic properties are finite mechanics, not live-model compliance or complete M3.3 runtime-surface evidence. Fresh final full validation is **1531/1531**, zero fail/cancel/skip, typecheck/build/import/package129; focused source47 passes and final compiled24 passes (15SDK+9 non-SDK properties, including one raw harness case). Actual built Skill Markdown is copied byte-for-byte into a deterministic compiled discovery fixture; complete three test bodies change only imports, not their discovery/semantic or native oracles. The existing compiled202 mutation/control cohort also passes. Original immutable compatibility60 is honestly35/36 under the new single-owner instructions; new compatibility61 changes only that pure selected-protocol assertion to the actual flat single branch (and retains scoped multi), with all other35/full remainder identical, and passes36/36. No new feature/API/state/owner/selector or canonical engine change. The complete actual terminal independent review is **VERIFIED / APPROVE** for normative M3.3a only, with no blocking finding/requested remediation. It independently passed **47/47** affected source properties, **24/24** compiled (15SDK+9 non-SDK, one raw), mixed compatibility **36/36** and strict typecheck; proved whole three import-only test bodies, source/dist/discovery-copy Skill equality, raw multi12 equality and the whole one-assertion compatibility clone; frozen **38/38** before/after. Counts overlap. It inspected, but did not independently reproduce, full1531/build/package129/inherited202. Prebuild historical capture is coordinator provenance; the retained complete module artifact and current comparisons are independently checked, not a newly observed past event. An initial reviewer compatibility call omitted its parent-resolution runtime flag and failed before any test body; the unchanged probe passed with the required flag. Identity-free flat arguments still need original receipts; runtime surfaces/M3.3b are not approved by this review. The report was consumed after terminal before shared unfreeze/closure; closure changes only review/decision docs and BACKLOG.

## Validation and limits

### M3.1 mechanical evidence

At M3.1 closure, integrated focused candidate checks passed **20/20**: six native SDK prototype properties, twelve local HTTP serializer properties and two pure validation properties. Fresh integrated `npm run validate` passes **1433/1433**, zero failed/cancelled/skipped, typecheck/build/import and package **126** (one newly indexed contract document). An earlier attempt stopped at typecheck on the coordinator's intentional-invalid-fixture `unknown` versus `ToolCall.arguments` annotation; the typed input assertion was corrected before this fresh full run. No production source was changed: the earlier M2 26-entry source/test/dist/wrapper certificate remains byte-identical after rebuilding. Thus prior compiled M2 evidence is reused by exact unchanged inputs rather than a new fictitious compiled flat-runtime run. The actual terminal independent review is **VERIFIED / APPROVE**: it independently passed **20/20** bounded properties and strict typecheck, read both complete author reports and the real SDK/provider code, and verified frozen **10/10** probe/doc/vendor entries plus unchanged M2 **26/26** before/after. It accepted the bounded replacement decision based on inspected Anthropic wire loss while retaining stable's native simplicity objection and every stale-wrapper/owner counterexample. It did not independently rerun full1433/rebuild/remote providers or certify installed flat semantics. The complete report was consumed after terminal before unfreezing and closing M3.1; no implementation remediation was requested. Both bounded authors returned; their actual reports were read. The native author's concurrent typecheck failure in the provider-owned file was superseded by an integrated clean typecheck after both returned, not ignored.

### M3.2a detached boundary evidence

Fresh full `npm run validate`: **1459/1459**, zero fail/cancel/skip; typecheck/build/import/package **129** (new source domain and compiled JS/declaration add three package files). Focused affected source **47/47** and complete import-only compiled new bodies **26/26** overlap the aggregate. Exact accepted M2 source/test/dist/wrapper **26/26** remain unchanged after build; this reuses bound prior M2 evidence, not a new flat-runtime proof. Context0errors/22warnings, DAG0/25 and diff pass. The first coordinator typecheck stopped on intentional-invalid-fixture annotations/Node assertion overload; corrected casts/overload before fresh clean full validation. Author corrections were test-oracle alignment with existing query metadata/true temporal origin, not weakening implementation semantics. No blocking code change followed independent review. Closure changes only decision/review documentation and the canonical open-work surface.

### M3.2b native-read candidate evidence

Fresh full `npm run validate`: **1490/1490**, zero fail/cancel/skip, typecheck/build/import/package **129**. New **31/31** through exact compiled mirrors =25 SDK+6 explicit source-harness faults; these overlap full/affected source results (**66/66** targeted and **212/212** broader extension/composition checks). Existing compiled native/control cohorts **148/148** and mixed compatibility **36/36** were rerun against the changed factory, not reused as unchanged. Two entries in the old 26-entry M2 certificate intentionally change: `lib/extension.ts` and `dist/lib/extension.js`; the other24, including declarations/SDK wrappers/storage/runtime, remain identical. Whole-body compiled mirrors differ only in declared module imports; the six raw cases use the complete existing harness with the dist factory, not an SDK substitute. Context0errors/22warnings, DAG0/25, docs/diff checks pass. Independent terminal review accepted this bounded implementation, with actual counts/limits above; closure changed only review/decision documentation and the canonical open-work surface.

The first complete candidate run was **1482/1490**: seven excluded-owner failures came from a new earlier precise patch gate rather than the old misleading Skill-compilation diagnostic; the two shared assertions now name actual patch exclusion, retaining all atomic/no-private-widening assertions. The eighth was an unchanged ASCII grammar obligation checked by exact wording; that wording was preserved in the new conditional read description. No required-private/semantic acceptance failure was waived. The native round-trip fixture's final inspector assertion was corrected from absent to materialized empty intents (`{}`); explicit native target preservation/deletion checks remain the actual semantic oracle.

### M3.2b native-mutation candidate evidence

Fresh full `npm run validate`: **1513/1513**, zero fail/cancel/skip; typecheck/build/import/package **129**. Seventeen complete current native/control test bodies pass **202/202** against the actual dist factory (193 SDK+7 raw+2 pure); imports alone differ. The SDK wrapper is the prior unchanged wrapper plus an explicit `stateFlow:false` opt-out for the two instrumented actual-factory cases; it never enables a source fallback. The complete raw harness and fixture argument helper likewise differ only in imports. Compatibility **36/36** passes with one exact obsolete scoped-single call changed to actual flat syntax; other 35 bodies and the entire remainder are byte-equivalent. The original immutable M2 probe is preserved, including its honest35/36 result under the new grammar. These counts overlap source validation and are not summed. Context0errors/22warnings, DAG0/25 and diff pass. Both independent terminal reviews are accepted below.

The first complete candidate was **1498/1512**: six old configured-single valid input shapes, diagnostic wording, unnecessarily repeated nested multi-body schemas and the detached failure-input regression were diagnosed explicitly. The old multi-owner dictionary schema was retained (canonical runtime plane/compiler validation remains strict), restoring native runtime rejection diagnostics and the unchanged large-trajectory prefix test without weakening its numeric oracle. Field diagnostics now identify forbidden response/retired/unknown planes. Failure diagnostics now retain the captured arguments used by publication after a caller mutation while waiting. No private/source/cancellation invariant was waived. One additional raw caller/getter regression brought the final count to1513. Two author reports separately record focused66 and113; their only corrections retarget legitimate model arguments, not negative controls or production mechanics. Initial registration-count failures were traced to a genuinely host-filtered observer fixture, not assumed schema cloning or delayed refresh; an explicitly allowed observer and separate denied-metadata witness now pass.

### Independent native-mutation acceptance

Both actual terminal reports were consumed after both roots completed: **VERIFIED / APPROVE**, no blocking finding or requested remediation. Authority independently passed **104/104** focused mixed properties, **47/47** private/first-authoring/source constraints, **26/26** compiled subset and strict typecheck. Integrity independently passed **541/541** source properties, **202/202** exact compiled bodies, mixed compatibility **36/36** and strict typecheck. Both verified frozen **55/55** before/after. These sets overlap, not additive coverage. Integrity additionally proved complete17 test mirrors/helpers/wrapper/one-input compatibility clone equality and inspected all16 prior-fixture preservation diffs; authority traced actual native receipt/physical/signal/private/source/staging ports. Neither independently rebuilt or reran full1513/package129, nor supplied live-model or exhaustive-interleaving proof.

The strongest authority objection remains explicit: identity-free flat shape cannot bind an old request; only original receipts do. The strongest fixture objection was addressed by complete diffs and exact native argument evidence, not a hidden converter. Real detached-diagnostic regression, host-filtered metadata cache counterexample, historical read/ref ownership-loss witness and all failure labels are retained. Pre-admission/excluded-root/capture failures and native SDK schema rejection may precede the admitted diagnostic domain; cancellation suppresses stale reporting. No log-for-every-rejection or arbitrary-host-object guarantee is implied. Shared state stayed frozen until both reports were consumed; closure changes only review/decision docs and BACKLOG. Native flat mutation binding is accepted; **complete M3 model surface acceptance is not**. No working-store operation, credential discovery, remote-model evaluation, global-default mutation, release, history rewrite or remote publication follows. Remaining M3.3/M3.4 and later live comparison retain their own evidence and gates.