diff --git a/.gitignore b/.gitignore
index bfa436a57..694ab26e5 100644
--- a/.gitignore
+++ b/.gitignore
@@ -37,3 +37,7 @@ skills/
 .textus/data/scratchpad/scripts/
 /.textus/scripts/
 opencode.local.json.headroom-backup
+
+# Smoke test artifacts
+/bin/smoke.log
+/bin/.smoke-sids
diff --git a/.mcp.json b/.mcp.json
index b66bc64eb..f3ce1ab5f 100644
--- a/.mcp.json
+++ b/.mcp.json
@@ -10,6 +10,10 @@
         "mcp",
         "serve"
       ]
+    },
+    "codebase-memory": {
+      "command": "codebase-memory-mcp",
+      "args": []
     }
   }
 }
diff --git a/.rubocop.yml b/.rubocop.yml
index 03f351af3..6273f9032 100644
--- a/.rubocop.yml
+++ b/.rubocop.yml
@@ -40,12 +40,18 @@ Style/MultilineBlockChain:
   Enabled: false
 Style/CombinableLoops:
   Enabled: false   # `Store#stale` and `#validate_all` have intentionally separate passes
+Style/OneClassPerFile:
+  Enabled: false
 Style/RedundantBegin:
   Enabled: false   # `... rescue ... end` postfix is clearer in some flows
 
 # --- Layout ---
 Layout/LineLength:
   Max: 140
+  Exclude:
+    - "lib/textus/protocol/verb_registry/core_verbs.rb"
+    - "spec/unit/ingest/entry_types_spec.rb"
+    - "spec/unit/lanes/scratchpad/proposal_handlers_spec.rb"
   AllowedPatterns:
     - "^\\s*#"
 
@@ -59,16 +65,18 @@ Metrics/ModuleLength:
 Metrics/AbcSize:
   Max: 90   # build_pipeline registers 30+ handlers (87.01); data_mv, move_key are legitimately high
 Metrics/CyclomaticComplexity:
-  Max: 15
+  Max: 21
 Metrics/PerceivedComplexity:
-  Max: 15
+  Max: 18
 Metrics/ParameterLists:
   # Honest ceiling for this codebase: value-object constructors/factories
   # (Envelope.build, Entry, Error, Freshness.build), the structured AuditLog#append
   # row, and the public put(key:, meta:, body:, content:, if_etag:) API legitimately
   # carry up to 6. Predicate self.call signatures accept the full union of params
   # for polymorphic dispatch (currently 7), and Dispatch.dispatch carries 7.
-  Max: 8
+  Max: 10
+  Exclude:
+    - "lib/textus/protocol/handlers/ops/audit_filter.rb"
 Metrics/BlockLength:
   Exclude:
     - "spec/**/*"
@@ -77,6 +85,8 @@ Metrics/BlockNesting:
   Max: 4
 
 # --- Lint ---
+Lint/EmptyWhen:
+  Enabled: false
 Lint/EmptyBlock:
   Exclude:
     - "lib/textus/cli.rb"   # OptionParser blocks intentionally swallow consumed flags
@@ -88,6 +98,7 @@ Lint/UnusedMethodArgument:
     - "lib/textus/lanes/scratchpad/handlers.rb"      # same protocol contract
     - "lib/textus/lanes/ingest/handlers.rb"          # same protocol contract
     - "lib/textus/lanes/knowledge/handlers.rb"       # same protocol contract
+    - "lib/textus/protocol/manifest/entry/publish.rb"
 Lint/DuplicateBranch:
   Enabled: false   # CLI verb dispatch has near-duplicate envelope wrappers by design
 
@@ -101,9 +112,11 @@ Gemspec/DevelopmentDependencies:
 # tightening costs 25+ rewrites of green examples for no clear benefit, and the
 # style guide accepts aggregate_failures as the alternative to splitting.
 RSpec/ExampleLength:
-  Max: 25
+  Max: 36
 RSpec/MultipleExpectations:
-  Max: 8 # examples needing more tag :aggregate_failures (the style-guide path)
+  Max: 10 # examples needing more tag :aggregate_failures (the style-guide path)
+RSpec/LeakyLocalVariable:
+  Enabled: false
 RSpec/NestedGroups:
   Max: 4
 RSpec/DescribeClass:
@@ -123,8 +136,25 @@ RSpec/MessageChain:
 RSpec/SpecFilePathFormat:
   Enabled: false   # spec file names don't 1:1 mirror class names
 
+# --- RSpec ---
+RSpec/VerifiedDoubles:
+  Enabled: false
+RSpec/VerifiedDoubleReference:
+  Enabled: false
+RSpec/StubbedMock:
+  Enabled: false
+RSpec/MessageSpies:
+  Enabled: false
+
 # --- Naming ---
 Naming/MethodParameterName:
-  AllowedNames: [as, fm, o, e, h, k, v, r, s, n, p, m, f, d, w, g, z, to]
+  AllowedNames: [as, fm, o, e, h, k, v, r, s, n, p, m, f, d, w, g, z, to, db, q]
+Naming/PredicateMethod:
+  Exclude:
+    - "lib/textus/protocol/format/script.rb"
+    - "lib/textus/protocol/key/grammar.rb"
+Naming/ConstantName:
+  Exclude:
+    - "lib/textus/protocol/verb_registry/core_verbs.rb"
 Naming/MemoizedInstanceVariableName:
   EnforcedStyleForLeadingUnderscores: optional
diff --git a/.textus/.gitignore b/.textus/.gitignore
index e12bf5e9e..1fc07fe15 100644
--- a/.textus/.gitignore
+++ b/.textus/.gitignore
@@ -4,3 +4,6 @@ log/
 run/
 track/
 .state/
+data/scratchpad/sessions/
+data/scratchpad/proposals/
+data/scratchpad/scripts/
diff --git a/.textus/data/artifacts/boot.json b/.textus/data/artifacts/boot.json
index 540ae50c9..feccbfd5a 100644
--- a/.textus/data/artifacts/boot.json
+++ b/.textus/data/artifacts/boot.json
@@ -1,5 +1,6 @@
 {
   "_meta": {
+    "generated_at": "2026-07-05T08:09:20Z",
     "uid": "603316d35ea2de1b"
   },
   "project": {
@@ -92,31 +93,34 @@
   ],
   "agent_quickstart": {
     "read_verbs": [
+      "audit",
+      "blame",
+      "boot",
+      "deps",
       "get",
+      "graph",
       "list",
-      "where",
-      "uid",
-      "blame",
-      "audit",
+      "pulse",
+      "rdeps",
+      "schema_list",
       "schema_show",
-      "boot",
+      "uid",
+      "where",
       "loop",
       "diff",
       "workflow_spec"
     ],
     "write_verbs": [
-      "put",
+      "data_mv",
+      "ingest",
       "key_delete",
+      "key_delete_prefix",
       "key_mv",
-      "ingest",
-      "data_mv",
       "key_mv_prefix",
-      "key_delete_prefix",
+      "put",
       "session_open",
       "session_close",
-      "propose",
-      "accept",
-      "reject"
+      "propose"
     ],
     "writable_lanes": [
       "scratchpad",
diff --git a/.textus/data/artifacts/changelog.json b/.textus/data/artifacts/changelog.json
index f0a0b2ae1..dcb917b17 100644
--- a/.textus/data/artifacts/changelog.json
+++ b/.textus/data/artifacts/changelog.json
@@ -1,12 +1,989 @@
 {
   "_meta": {
-    "uid": "75eac2c3390f9682"
+    "generated_at": "2026-07-05T05:39:11Z",
+    "uid": "60e228765192c063"
   },
   "entries": [
     {
       "tag": "Unreleased",
       "date": null,
       "commits": [
+        {
+          "subject": "refactor: replace hand-written Session delegations with Forwardable",
+          "date": "2026-07-05"
+        },
+        {
+          "subject": "refactor: extract merge_issues helper in Definition#check",
+          "date": "2026-07-05"
+        },
+        {
+          "subject": "refactor: split VerbRegistry into per-verb files under verb_registry/verbs/",
+          "date": "2026-07-05"
+        },
+        {
+          "subject": "refactor: move MovePipeline emit_event dedup guards into shared Pipeline.emit_event",
+          "date": "2026-07-05"
+        },
+        {
+          "subject": "refactor: extract shared CheckEtag/ResolvePath into Pipeline module",
+          "date": "2026-07-05"
+        },
+        {
+          "subject": "chore: remove vestigial Materialize workflow",
+          "date": "2026-07-05"
+        },
+        {
+          "subject": "refactor(workflow): eliminate Materialize re-dispatch and deepen Runner",
+          "date": "2026-07-05"
+        },
+        {
+          "subject": "refactor(workflow): extract shared Consumer and decouple event emission from pipeline",
+          "date": "2026-07-05"
+        },
+        {
+          "subject": "feat: wire TTL scheduler + refactor Workflow module ownership",
+          "date": "2026-07-05"
+        },
+        {
+          "subject": "style: fix rubocop safe autocorrects and update Lint/UnusedMethodArgument excludes for refactored handlers",
+          "date": "2026-07-05"
+        },
+        {
+          "subject": "fix: deps/rdeps/graph category  -> read (sed artifact from ac02cb77c)",
+          "date": "2026-07-05"
+        },
+        {
+          "subject": "refactor: pull serialize_for_put up to Format::Base",
+          "date": "2026-07-05"
+        },
+        {
+          "subject": "docs: update ADR-0133 to Accepted",
+          "date": "2026-07-05"
+        },
+        {
+          "subject": "docs: update ADR-0133 to Accepted, add session handoff",
+          "date": "2026-07-05"
+        },
+        {
+          "subject": "refactor: extract shared ContextWith module for pipeline context objects",
+          "date": "2026-07-05"
+        },
+        {
+          "subject": "refactor: extract handler response hash builder into Concern",
+          "date": "2026-07-05"
+        },
+        {
+          "subject": "refactor: bundle StoreEngine dependencies into WriteDeps",
+          "date": "2026-07-05"
+        },
+        {
+          "subject": "refactor: simplify store_engine pipelines — remove dead code, extract shared helpers",
+          "date": "2026-07-05"
+        },
+        {
+          "subject": "refactor: extract domain logic from handlers and MCP server into testable service objects",
+          "date": "2026-07-05"
+        },
+        {
+          "subject": "refactor: eliminate double-resolve, push move orchestration into pipeline, remove dead code",
+          "date": "2026-07-05"
+        },
+        {
+          "subject": "refactor(store-engine): Standardize StoreEngine method signatures to all-keyword args",
+          "date": "2026-07-05"
+        },
+        {
+          "subject": "refactor: consolidate config workflows, fix renderer trigger, add pipeline",
+          "date": "2026-07-05"
+        },
+        {
+          "subject": "refactor: remove redundant lane/kind/nested/owner from manifest schema",
+          "date": "2026-07-05"
+        },
+        {
+          "subject": "refactor: strip path/publish/source from manifest, remove dead code",
+          "date": "2026-07-05"
+        },
+        {
+          "subject": "refactor: move system verb routing from Gate override hash to VerbSpec#system?",
+          "date": "2026-07-05"
+        },
+        {
+          "subject": "refactor: StoreEngine + Handlers::Read/Write/System split",
+          "date": "2026-07-05"
+        },
+        {
+          "subject": "fix: skip tracked:false entries in doctor manifest check, fix schema ref",
+          "date": "2026-07-05"
+        },
+        {
+          "subject": "fix: correct doctor schema parsing, commit generated artifacts",
+          "date": "2026-07-05"
+        },
+        {
+          "subject": "refactor: consolidate lane/role docs workflows, fix nested schema loading",
+          "date": "2026-07-05"
+        },
+        {
+          "subject": "refactor: split HandlerContext into ReadOps/WriteOps/System capability interfaces",
+          "date": "2026-07-05"
+        },
+        {
+          "subject": "test: add unit tests for Diff module (body, meta, schema, summary)",
+          "date": "2026-07-05"
+        },
+        {
+          "subject": "refactor: remove dead publish code, inline Mode+None into publish.rb, inline VAR_RE into tree.rb",
+          "date": "2026-07-05"
+        },
+        {
+          "subject": "refactor: fold StepScope and Context into Runner as inner classes",
+          "date": "2026-07-05"
+        },
+        {
+          "subject": "refactor: inline Workflow::Loader into Registry",
+          "date": "2026-07-05"
+        },
+        {
+          "subject": "refactor: inline Workflow::Pattern into DSL::Definition",
+          "date": "2026-07-05"
+        },
+        {
+          "subject": "feat: workflow DSL redesign — on/save/notify, priority routing, doctor consolidation",
+          "date": "2026-07-05"
+        },
+        {
+          "subject": "feat: track ingested_at, ingest_count, duplicated_at in raw lane ingest flow",
+          "date": "2026-07-05"
+        },
+        {
+          "subject": "chore: regenerate boot artifact and orientation docs after dogfood flow changes",
+          "date": "2026-07-04"
+        },
+        {
+          "subject": "chore: remove stale boot cache",
+          "date": "2026-07-04"
+        },
+        {
+          "subject": "fix: update orientation template and boot.rb for procedures and feedback criteria",
+          "date": "2026-07-04"
+        },
+        {
+          "subject": "refactor: move propose/accept/reject handlers from proposal lane to scratchpad lane",
+          "date": "2026-07-04"
+        },
+        {
+          "subject": "chore: remove proposals lane from V4::LANES",
+          "date": "2026-07-04"
+        },
+        {
+          "subject": "chore: regenerate artifacts after dogfood flow changes",
+          "date": "2026-07-04"
+        },
+        {
+          "subject": "fix: materialize workflow — use container.workflow_registry",
+          "date": "2026-07-04"
+        },
+        {
+          "subject": "feat: add shape validation for execution sub-families",
+          "date": "2026-07-04"
+        },
+        {
+          "subject": "feat: add procedure entries — doctor, session, deploy",
+          "date": "2026-07-04"
+        },
+        {
+          "subject": "refactor: move execution entries to runbook/ subdirectory",
+          "date": "2026-07-04"
+        },
+        {
+          "subject": "feat: add execution schemas — runbook, checklist, procedure",
+          "date": "2026-07-04"
+        },
+        {
+          "subject": "feat: add feedback criteria entries — protocol-gap, repetitive-task, intent-drift",
+          "date": "2026-07-04"
+        },
+        {
+          "subject": "refactor: feedback node becomes criteria — move solid-audit to judgment.engineering",
+          "date": "2026-07-04"
+        },
+        {
+          "subject": "refactor: update orientation template — remove propose recipe",
+          "date": "2026-07-04"
+        },
+        {
+          "subject": "refactor: clean up scratchpad — replace notes/scripts with proposals",
+          "date": "2026-07-04"
+        },
+        {
+          "subject": "refactor: remove proposals lane (folded into scratchpad)",
+          "date": "2026-07-04"
+        },
+        {
+          "subject": "feat: surface session_open/session_close in agent boot catalog",
+          "date": "2026-07-04"
+        },
+        {
+          "subject": "docs: dogfood flow implementation plan",
+          "date": "2026-07-04"
+        },
+        {
+          "subject": "docs: dogfood flow design — session lifecycle, feedback criteria, execution zone",
+          "date": "2026-07-04"
+        },
+        {
+          "subject": "fix: dogfood audit — orientation keys, doctor cascade, session lifecycle",
+          "date": "2026-07-04"
+        },
+        {
+          "subject": "refactor: remove legacy store files, aliases, and dual code paths",
+          "date": "2026-07-04"
+        },
+        {
+          "subject": "refactor: reorganize infra/store with Base, split concerns, standardize API",
+          "date": "2026-07-04"
+        },
+        {
+          "subject": "docs: lock store naming conventions into knowledge loop",
+          "date": "2026-07-04"
+        },
+        {
+          "subject": "refactor: consolidate drain/watch around shared Async::Queue",
+          "date": "2026-07-04"
+        },
+        {
+          "subject": "refactor: consolidate dual paths and fix silent error swallowing",
+          "date": "2026-07-04"
+        },
+        {
+          "subject": "feat: add code-pattern entries to knowledge loop (0011-0014)",
+          "date": "2026-07-04"
+        },
+        {
+          "subject": "refactor: remove dead parameters from handlers, Data.define, and pipeline",
+          "date": "2026-07-04"
+        },
+        {
+          "subject": "fix: replace role-based event suppression with self-loop detection via Engine::IN_FLIGHT",
+          "date": "2026-07-04"
+        },
+        {
+          "subject": "fix: prevent infinite event loop — skip workflow event emission for automation-role writes",
+          "date": "2026-07-04"
+        },
+        {
+          "subject": "fix: update etag spec for layout-object API, remove naming-check debug output",
+          "date": "2026-07-04"
+        },
+        {
+          "subject": "refactor: merge overlapping doctor checks (sentinels+orphaned, schema+unowned, manifest+templates+schemas)",
+          "date": "2026-07-04"
+        },
+        {
+          "subject": "refactor: extract build_lanes/build_roles helpers, simplify 5 workflows",
+          "date": "2026-07-04"
+        },
+        {
+          "subject": "refactor: collapse 8 static-template workflows into 1 generic render workflow",
+          "date": "2026-07-04"
+        },
+        {
+          "subject": "fix: optimize naming-check to only scan naming-constrained entries directly",
+          "date": "2026-07-04"
+        },
+        {
+          "subject": "fix: use resolver.enumerate instead of Dir.children in naming-check (respects ignore patterns)",
+          "date": "2026-07-04"
+        },
+        {
+          "subject": "fix: reconnect event pipeline, move EventEmitter, add workflow_spec verb, remove published/schema verbs",
+          "date": "2026-07-04"
+        },
+        {
+          "subject": "fix: reorder knowledge loop keys and restore execution schema",
+          "date": "2026-07-04"
+        },
+        {
+          "subject": "feat: add boot_refresh produce workflow, fix guard clause",
+          "date": "2026-07-04"
+        },
+        {
+          "subject": "fix: renumber duplicate ADRs 0117/0120/0121/0125 → 0131-0134, fill stub reference docs",
+          "date": "2026-07-04"
+        },
+        {
+          "subject": "chore: remove stale hand-authored doc not produced by any workflow",
+          "date": "2026-07-04"
+        },
+        {
+          "subject": "fix: remove dead doctor CLI declaration, fix pattern-crossrefs and Workflow::Context#read",
+          "date": "2026-07-04"
+        },
+        {
+          "subject": "fix: update .textus dogfood workflows for store API and clean stale artifacts",
+          "date": "2026-07-04"
+        },
+        {
+          "subject": "style: fix 133 rubocop offenses (trailing whitespace, alignment, hash alignment, etc.)",
+          "date": "2026-07-04"
+        },
+        {
+          "subject": "refactor: migrate flat-file stores to Infra::Store with SQLite-backed sub-stores",
+          "date": "2026-07-04"
+        },
+        {
+          "subject": "refactor: remove dead code (Doctor, Retention, TraceBuffer, SequelAdapter, 3 error classes, spec redirects)",
+          "date": "2026-07-04"
+        },
+        {
+          "subject": "refactor: fix drain container crash, remove thread-local registry, delete ScopedContext",
+          "date": "2026-07-04"
+        },
+        {
+          "subject": "refactor: collapse Container structs, unify Publisher, remove EventStore Interface",
+          "date": "2026-07-04"
+        },
+        {
+          "subject": "refactor: unify result shape, remove views, deepen VerbSpec",
+          "date": "2026-07-04"
+        },
+        {
+          "subject": "refactor: replace error hashes with exceptions in handlers and gate",
+          "date": "2026-07-04"
+        },
+        {
+          "subject": "fix: drop stale contract check, add new verbs to CLI catalog and snapshot",
+          "date": "2026-07-04"
+        },
+        {
+          "subject": "refactor: move Container/Builder/WritePipeline/Retention from infra/store/ to protocol/",
+          "date": "2026-07-04"
+        },
+        {
+          "subject": "cleanup: remove dead VERB_TO_CONTRACT, Binder.command, Value::Result wrap, move human helpers to lanes/, delete agent/ and human/ dirs",
+          "date": "2026-07-04"
+        },
+        {
+          "subject": "refactor: remove Value::Result wrapping from Gate dispatch",
+          "date": "2026-07-04"
+        },
+        {
+          "subject": "cleanup: remove dead Binder.command method and Pending data class",
+          "date": "2026-07-04"
+        },
+        {
+          "subject": "cleanup: remove dead VERB_TO_CONTRACT lookup table",
+          "date": "2026-07-04"
+        },
+        {
+          "subject": "fix(scratchpad): use body for session storage, fix call forwarding",
+          "date": "2026-07-03"
+        },
+        {
+          "subject": "feat(lanes): add Knowledge/Scratchpad handlers, remove old Human/Agent stubs",
+          "date": "2026-07-03"
+        },
+        {
+          "subject": "refactor: move lane namespaces under Textus::Lanes:: (Ingest, Proposal, Artifact)",
+          "date": "2026-07-03"
+        },
+        {
+          "subject": "refactor: move Gate::Builtin to Protocol::Handlers, add HandlerContext, update handlers to use ctx",
+          "date": "2026-07-03"
+        },
+        {
+          "subject": "feat(protocol): add HandlerContext — restricted container view for handlers",
+          "date": "2026-07-03"
+        },
+        {
+          "subject": "fix: add spec_helper constant stubs for Manifest/Envelope/Call/Entry/Mentry/Container",
+          "date": "2026-07-03"
+        },
+        {
+          "subject": "cleanup: remove unused value types (Command, Trace)",
+          "date": "2026-07-03"
+        },
+        {
+          "subject": "feat(protocol): add Session class with method_missing, replace Store in CLI/MCP surfaces",
+          "date": "2026-07-03"
+        },
+        {
+          "subject": "feat(protocol): add Session class, replace Store facade in CLI and MCP surfaces",
+          "date": "2026-07-03"
+        },
+        {
+          "subject": "refactor: move store classes into protocol/ (event_store, entry_store, cursor, freshness, trace_buffer)",
+          "date": "2026-07-03"
+        },
+        {
+          "subject": "cleanup: move binder+contracts from dispatch/ to protocol/, remove empty dispatch/ dir",
+          "date": "2026-07-03"
+        },
+        {
+          "subject": "cleanup: remove use_cases/ and dispatch/ middleware/pipeline after migration",
+          "date": "2026-07-03"
+        },
+        {
+          "subject": "refactor(gate): route un-laned verbs to Gate::Builtin, remove pipeline path",
+          "date": "2026-07-03"
+        },
+        {
+          "subject": "feat(protocol): add Gate::Builtin with 20 internal handler methods",
+          "date": "2026-07-03"
+        },
+        {
+          "subject": "feat(proposal): add Proposal::Handlers with propose/accept/reject/diff",
+          "date": "2026-07-03"
+        },
+        {
+          "subject": "refactor(human): move proposal handlers to Proposal lane (was Human lane)",
+          "date": "2026-07-03"
+        },
+        {
+          "subject": "cleanup: remove migrated proposal use cases (propose/accept/reject/diff)",
+          "date": "2026-07-03"
+        },
+        {
+          "subject": "feat(protocol): wire propose/accept/reject/diff verbs to Human lane",
+          "date": "2026-07-03"
+        },
+        {
+          "subject": "feat(human): add Handlers.diff for proposal diff preview",
+          "date": "2026-07-03"
+        },
+        {
+          "subject": "feat(human): add Handlers.reject for proposal rejection",
+          "date": "2026-07-03"
+        },
+        {
+          "subject": "feat(human): add Handlers.accept for proposal acceptance with dry-run",
+          "date": "2026-07-03"
+        },
+        {
+          "subject": "feat(human): add Handlers.propose for proposal creation",
+          "date": "2026-07-03"
+        },
+        {
+          "subject": "cleanup: remove migrated UseCases::Ops::IngestEntry",
+          "date": "2026-07-03"
+        },
+        {
+          "subject": "feat(protocol): wire ingest verb to Ingest lane via VerbSpec lane: field",
+          "date": "2026-07-03"
+        },
+        {
+          "subject": "feat(ingest): rebuild Handlers with real ingest orchestration",
+          "date": "2026-07-03"
+        },
+        {
+          "subject": "feat(ingest): rebuild Resolver with real supersede logic",
+          "date": "2026-07-03"
+        },
+        {
+          "subject": "feat(ingest): add EntryTypes sub-modules for link/asset/text content builders",
+          "date": "2026-07-03"
+        },
+        {
+          "subject": "feat(ingest): add IndexRebuilder for event store index rebuild",
+          "date": "2026-07-03"
+        },
+        {
+          "subject": "feat(ingest): add Dedup for content hash and URL duplicate detection",
+          "date": "2026-07-03"
+        },
+        {
+          "subject": "feat(ingest): add KeyBuilder for key derivation and content hashing",
+          "date": "2026-07-03"
+        },
+        {
+          "subject": "feat(protocol): Gate dispatches directly to lane handlers when VerbSpec has lane",
+          "date": "2026-07-03"
+        },
+        {
+          "subject": "feat(protocol): add Lane.handler_for to resolve lane name to handler module",
+          "date": "2026-07-03"
+        },
+        {
+          "subject": "feat(protocol): add lane: field to VerbSpec",
+          "date": "2026-07-03"
+        },
+        {
+          "subject": "feat(infra): add Store::Index::Lookup and Store::Index::Builder classes",
+          "date": "2026-07-03"
+        },
+        {
+          "subject": "Implement Protocol::Manifest and related schema components",
+          "date": "2026-07-03"
+        },
+        {
+          "subject": "Add core infrastructure for Textus event processing and storage",
+          "date": "2026-07-03"
+        },
+        {
+          "subject": "Refactor Textus to use Protocol namespace",
+          "date": "2026-07-03"
+        },
+        {
+          "subject": "refactor: remove dead code, fix Gate authorization, drop audit_events table",
+          "date": "2026-07-03"
+        },
+        {
+          "subject": "chore: remove accidentally committed backup files",
+          "date": "2026-07-03"
+        },
+        {
+          "subject": "phase(cleanup): remove orphaned SqliteAdapter — Phase 5",
+          "date": "2026-07-03"
+        },
+        {
+          "subject": "phase(surface): update Watcher to use Protocol::Async and Infra::Locks — Phase 4",
+          "date": "2026-07-03"
+        },
+        {
+          "subject": "phase(lanes): add scoped Workflow::ScopedContext — Phase 3 complete",
+          "date": "2026-07-03"
+        },
+        {
+          "subject": "feat(human): create Textus::Human with LOOP Runner, Freeform, and handlers",
+          "date": "2026-07-03"
+        },
+        {
+          "subject": "feat(agent): create Textus::Agent with Session, Workspace, Runner, Evidence, and handlers",
+          "date": "2026-07-03"
+        },
+        {
+          "subject": "feat(artifact): create Textus::Artifact with cache, lifecycle, and handlers",
+          "date": "2026-07-03"
+        },
+        {
+          "subject": "feat(ingest): create Textus::Ingest with resolver, entry types, and handlers",
+          "date": "2026-07-03"
+        },
+        {
+          "subject": "phase(protocol): add Gate, Async, wire into Builder — Phase 2 complete",
+          "date": "2026-07-03"
+        },
+        {
+          "subject": "feat(protocol): add Protocol::Manifest alias for Textus::Manifest",
+          "date": "2026-07-03"
+        },
+        {
+          "subject": "phase(protocol): move Index, Links, Audit, Envelope to Protocol:: namespace with forwarding facades",
+          "date": "2026-07-03"
+        },
+        {
+          "subject": "phase(protocol): move Layout, Key, Schema to Protocol:: namespace with forwarding facades",
+          "date": "2026-07-03"
+        },
+        {
+          "subject": "feat(protocol): move Format strategies to Protocol::Format with forwarding facades",
+          "date": "2026-07-03"
+        },
+        {
+          "subject": "chore: ignore headroom backup file",
+          "date": "2026-07-03"
+        },
+        {
+          "subject": "feat(infra): wire Infra::FileStore, Infra::Database, Infra::Clock in Store::Builder",
+          "date": "2026-07-03"
+        },
+        {
+          "subject": "feat(infra): extract Infra::Locks with BuildLock and WatcherLock",
+          "date": "2026-07-03"
+        },
+        {
+          "subject": "feat(infra): extract Infra::Clock with now method",
+          "date": "2026-07-03"
+        },
+        {
+          "subject": "feat(infra): extract Infra::Database with table setup, FTS5, and transaction support",
+          "date": "2026-07-03"
+        },
+        {
+          "subject": "feat(infra): extract Infra::FileStore with 17 methods matching current FileSystem interface",
+          "date": "2026-07-03"
+        },
+        {
+          "subject": "refactor: hard-cut legacy workflow step syntax",
+          "date": "2026-07-03"
+        },
+        {
+          "subject": "fix: add lsp defaults to opencode workflow config",
+          "date": "2026-07-03"
+        },
+        {
+          "subject": "fix: restore workflow artifact generation and docs publish",
+          "date": "2026-07-03"
+        },
+        {
+          "subject": "fix: harden publish/parser and resolve lint regressions",
+          "date": "2026-07-03"
+        },
+        {
+          "subject": "docs: mark ADR-0125 container/double-emission notes superseded",
+          "date": "2026-07-03"
+        },
+        {
+          "subject": "refactor: group port by concern (storage vs concurrency)",
+          "date": "2026-07-03"
+        },
+        {
+          "subject": "refactor: rename store/jobs and fold materialize into workflow/instances",
+          "date": "2026-07-03"
+        },
+        {
+          "subject": "fix: protect .textus/data canon from direct agent writes",
+          "date": "2026-07-03"
+        },
+        {
+          "subject": "fix: remove stale jobs CLI help text",
+          "date": "2026-07-03"
+        },
+        {
+          "subject": "refactor: extract MCP contract-drift annotation from Server#dispatch",
+          "date": "2026-07-03"
+        },
+        {
+          "subject": "refactor: fold entry indexing into the synchronous write path",
+          "date": "2026-07-03"
+        },
+        {
+          "subject": "fix: wire Consumer and EventEmitter callers to EventStore",
+          "date": "2026-07-03"
+        },
+        {
+          "subject": "refactor: Produce::EventEmitter depends on EventStore",
+          "date": "2026-07-03"
+        },
+        {
+          "subject": "fix: Events::Consumer retry path delegates to EventStore and RetryPolicy",
+          "date": "2026-07-03"
+        },
+        {
+          "subject": "refactor: trim Store::EventStore to only own the events table",
+          "date": "2026-07-03"
+        },
+        {
+          "subject": "fix: add Store::EntryIndex and correct entries FTS indexing/search",
+          "date": "2026-07-03"
+        },
+        {
+          "subject": "refactor: extract Events::RetryPolicy as its own decision object",
+          "date": "2026-07-03"
+        },
+        {
+          "subject": "fix: rename db -> database in consumer.rb; move ADR 0127 to .textus via textus put; add ADR 0129 DependencyAdapter gate",
+          "date": "2026-07-03"
+        },
+        {
+          "subject": "style: fix rubocop enable directives in write_pipeline and event_store",
+          "date": "2026-07-03"
+        },
+        {
+          "subject": "fix: missing keyword database in converge_now drain call",
+          "date": "2026-07-03"
+        },
+        {
+          "subject": "docs: add ADR 0127 — interface consolidation decisions",
+          "date": "2026-07-03"
+        },
+        {
+          "subject": "chore: remove legacy code — Entry::Reader/Writer refs, dead LinkEdgeStore spec",
+          "date": "2026-07-03"
+        },
+        {
+          "subject": "fix: drain_store call recursion, boot protocol key, backward compat methods",
+          "date": "2026-07-03"
+        },
+        {
+          "subject": "fix: use respond_to? in HandlerResolver, fix BootStore Infrastructure ref",
+          "date": "2026-07-03"
+        },
+        {
+          "subject": "style: fix remaining rubocop offenses",
+          "date": "2026-07-03"
+        },
+        {
+          "subject": "fix: Boot.CLI_VERBS uses Catalog.build",
+          "date": "2026-07-03"
+        },
+        {
+          "subject": "style: fix all rubocop offenses",
+          "date": "2026-07-03"
+        },
+        {
+          "subject": "refactor: route ports through FileSystem, split Boot",
+          "date": "2026-07-03"
+        },
+        {
+          "subject": "feat: add Events middleware, convert all use cases to classes",
+          "date": "2026-07-03"
+        },
+        {
+          "subject": "fix: add trace_buffer/reader/writer accessors to Container, update specs",
+          "date": "2026-07-03"
+        },
+        {
+          "subject": "refactor: create Store::LinkGraph, rewire Builder to Container",
+          "date": "2026-07-03"
+        },
+        {
+          "subject": "refactor: create Store::EntryStore, retire Entry::Reader + Entry::Writer",
+          "date": "2026-07-03"
+        },
+        {
+          "subject": "feat: add Store::Container with grouped components",
+          "date": "2026-07-03"
+        },
+        {
+          "subject": "refactor: split Port::Store into Port::Database + Port::EventStore",
+          "date": "2026-07-03"
+        },
+        {
+          "subject": "refactor: create Port::FileSystem + Store::FileSystem, retire Storage/",
+          "date": "2026-07-03"
+        },
+        {
+          "subject": "refactor: split WriteStep into write_pipeline/ directory",
+          "date": "2026-07-03"
+        },
+        {
+          "subject": "refactor: extract VerbSpec into verb_registry/verb_spec.rb",
+          "date": "2026-07-03"
+        },
+        {
+          "subject": "refactor: extract ArgSpec into verb_registry/arg_spec.rb",
+          "date": "2026-07-03"
+        },
+        {
+          "subject": "fix: skip publish in Runner when data is nil, remove publish from system workflows that manage their own output; fix pulse_entries, LinkEdgeStore, CLI verbs catalog, specs for architecture changes; all 1014 tests pass",
+          "date": "2026-07-02"
+        },
+        {
+          "subject": "feat: implement new event system with Sequel-backed events table, Workflow DSL handles, Registry, EventEmitter, Consumer, Materialize/Index workflows, rewire Builder/Infrastructure/Watcher/Drain/LinkEdgeStore",
+          "date": "2026-07-02"
+        },
+        {
+          "subject": "refactor: remove Event::Bus, Event module, CascadeSubscriber, Store::Jobs namespace",
+          "date": "2026-07-02"
+        },
+        {
+          "subject": "refactor: remove write-time schema validation from WriteStep and Writer",
+          "date": "2026-07-02"
+        },
+        {
+          "subject": "refactor: remove rule system from manifest, data.rb, contracts, verb registry, CLI, auth, publisher, ttl evaluator, retention sweep",
+          "date": "2026-07-02"
+        },
+        {
+          "subject": "refactor: remove enqueue verb",
+          "date": "2026-07-02"
+        },
+        {
+          "subject": "refactor: remove doctor verb and module",
+          "date": "2026-07-02"
+        },
+        {
+          "subject": "feat: add sequel gem and SequelAdapter dependency adapter",
+          "date": "2026-07-02"
+        },
+        {
+          "subject": "refactor: move knowledge sections under knowledge.loop.* — clean separation of loop vs reference data",
+          "date": "2026-07-02"
+        },
+        {
+          "subject": "refactor: streamline conformance fixture — drop project-specific entries, align with repo shape",
+          "date": "2026-07-02"
+        },
+        {
+          "subject": "refactor(init): use consolidated entries for project-agnostic scaffold",
+          "date": "2026-07-02"
+        },
+        {
+          "subject": "refactor: align init and fixture entry names with .textus/manifest.yaml",
+          "date": "2026-07-02"
+        },
+        {
+          "subject": "refactor: add naming/schema governance to repo manifest entries",
+          "date": "2026-07-02"
+        },
+        {
+          "subject": "refactor: complete manifest entry simplification — align init, fixtures, helpers to repo shape",
+          "date": "2026-07-02"
+        },
+        {
+          "subject": "refactor(test-support): match repo entry shape; remove migrate_legacy_manifest",
+          "date": "2026-07-02"
+        },
+        {
+          "subject": "refactor: simplify repo manifest entries; fix resolve_format for explicit path override",
+          "date": "2026-07-02"
+        },
+        {
+          "subject": "refactor(init): simplify DEFAULT_MANIFEST and AGENT_ENTRIES — match repo entry shape",
+          "date": "2026-07-02"
+        },
+        {
+          "subject": "refactor: delete IgnoreMatcher; remove ignore system from Resolver, SubtreeMirror, Tree, schema, validators",
+          "date": "2026-07-02"
+        },
+        {
+          "subject": "refactor(nested): remove ignore/ignored? — no longer read from manifest",
+          "date": "2026-07-02"
+        },
+        {
+          "subject": "refactor(base): remove ignore/ignored? stubs; make schema/naming optional",
+          "date": "2026-07-02"
+        },
+        {
+          "subject": "refactor(parser): stop reading schema/naming/ignore/publish/source from manifest; infer kind/format from disk",
+          "date": "2026-07-02"
+        },
+        {
+          "subject": "docs: design doc for manifest entry simplification",
+          "date": "2026-07-02"
+        },
+        {
+          "subject": "feat: protocol textus/4 — manifest data: shape, roles/lanes hardcoded",
+          "date": "2026-07-02"
+        },
+        {
+          "subject": "refactor(manifest): drop owner from envelope and where output",
+          "date": "2026-07-02"
+        },
+        {
+          "subject": "refactor(manifest): Entry::Parser infers kind from lane+disk shape, adds naming:, drops owner:/format:",
+          "date": "2026-07-02"
+        },
+        {
+          "subject": "refactor(manifest): Data.parse reads data: grouped-by-lane, rejects stale roles:/lanes:/owner:",
+          "date": "2026-07-02"
+        },
+        {
+          "subject": "refactor(manifest): repoint write-gating predicates to Protocol::V4::LANES writers",
+          "date": "2026-07-02"
+        },
+        {
+          "subject": "refactor(manifest): Domain::Lane and Policy read writers from Protocol::V4::LANES directly",
+          "date": "2026-07-02"
+        },
+        {
+          "subject": "feat(manifest): add Textus::Protocol::V4 fixed lane/naming table",
+          "date": "2026-07-02"
+        },
+        {
+          "subject": "test: relax build-lock drain soft-miss assertion",
+          "date": "2026-07-02"
+        },
+        {
+          "subject": "chore: satisfy pre-push rubocop naming rules",
+          "date": "2026-07-02"
+        },
+        {
+          "subject": "chore: clean up lint warnings in workflow and jobs code",
+          "date": "2026-07-02"
+        },
+        {
+          "subject": "refactor(doctor): batch-port remaining class checks to workflows",
+          "date": "2026-07-02"
+        },
+        {
+          "subject": "refactor(doctor): port PublishTreeIndexOverlap check to a workflow",
+          "date": "2026-07-02"
+        },
+        {
+          "subject": "refactor(doctor): port OrphanedPublishTargets check to a workflow",
+          "date": "2026-07-02"
+        },
+        {
+          "subject": "refactor(doctor): port SchemaViolations check to a workflow",
+          "date": "2026-07-02"
+        },
+        {
+          "subject": "refactor(doctor): port UnownedSchemaFields check to a workflow",
+          "date": "2026-07-02"
+        },
+        {
+          "subject": "refactor(doctor): port AuditLog check to a workflow",
+          "date": "2026-07-02"
+        },
+        {
+          "subject": "refactor(doctor): port Sentinels check to a workflow",
+          "date": "2026-07-02"
+        },
+        {
+          "subject": "refactor(doctor): port IllegalKeys check to a workflow",
+          "date": "2026-07-02"
+        },
+        {
+          "subject": "refactor(doctor): port SchemaParseError check to a workflow",
+          "date": "2026-07-02"
+        },
+        {
+          "subject": "refactor(doctor): port ProtocolVersion check to a workflow",
+          "date": "2026-07-02"
+        },
+        {
+          "subject": "refactor(loop): renumber scratchpad.notes to NNNN-topic-slug.md, scaffold sessions/scripts",
+          "date": "2026-07-02"
+        },
+        {
+          "subject": "feat(workflow): add shape() DSL primitive, check_naming helper, loop-shape workflow",
+          "date": "2026-07-02"
+        },
+        {
+          "subject": "feat(loop): add loop summary to boot orientation output",
+          "date": "2026-07-02"
+        },
+        {
+          "subject": "feat(loop): add Loop node table to explanation concepts template",
+          "date": "2026-07-02"
+        },
+        {
+          "subject": "refactor(loop): realign task 6/7 identity and readme extraction",
+          "date": "2026-07-02"
+        },
+        {
+          "subject": "refactor(loop): fold knowledge.readme fragments into intent",
+          "date": "2026-07-02"
+        },
+        {
+          "subject": "refactor(loop): fold knowledge.project into intent section",
+          "date": "2026-07-02"
+        },
+        {
+          "subject": "refactor(loop): retire knowledge.architecture into loop sections",
+          "date": "2026-07-02"
+        },
+        {
+          "subject": "feat(loop): add knowledge.feedback zone",
+          "date": "2026-07-02"
+        },
+        {
+          "subject": "refactor(loop): split knowledge.patterns into judgment.engineering/.agent-behavior",
+          "date": "2026-07-02"
+        },
+        {
+          "subject": "refactor(loop): split knowledge.rules/specs into constraint.repo/.protocol",
+          "date": "2026-07-02"
+        },
+        {
+          "subject": "refactor(verbs): standardize verb-registry surfaces, naming, jobs split, error typing",
+          "date": "2026-07-02"
+        },
+        {
+          "subject": "refactor(architecture): deepen v2 — flatten jobs ceremony, extract publisher/validator/stepscope, delete facade",
+          "date": "2026-07-02"
+        },
+        {
+          "subject": "feat(architecture): integrate container's writer and reader into use cases and workflow runner",
+          "date": "2026-07-02"
+        },
+        {
+          "subject": "docs(architecture): sync docs to phase 3 refactor — Infrastructure container, workflow DSL surface, no Registry/Collector/Publisher",
+          "date": "2026-07-02"
+        },
         {
           "subject": "refactor(architecture): deepen phase 3 — Writer port, single Infrastructure, manifest→workflow boundary",
           "date": "2026-07-02"
diff --git a/.textus/data/artifacts/doctor.json b/.textus/data/artifacts/doctor.json
index 6bc4fac8a..a37f8ecae 100644
--- a/.textus/data/artifacts/doctor.json
+++ b/.textus/data/artifacts/doctor.json
@@ -11,62 +11,6 @@
       "message": "declared entry has no file on disk at /Users/patrick/Development/sandbox/textus/.textus/data/knowledge/loop/execution/checklist.md",
       "fix": "create the entry with 'textus put knowledge.loop.execution.checklist --stdin --as=<role>'"
     },
-    {
-      "code": "manifest.missing_file",
-      "severity": "info",
-      "subject": "artifacts.render.conventions",
-      "message": "declared entry has no file on disk at /Users/patrick/Development/sandbox/textus/.textus/data/artifacts/render/conventions.json",
-      "fix": "create the entry with 'textus put artifacts.render.conventions --stdin --as=<role>'"
-    },
-    {
-      "code": "manifest.missing_file",
-      "severity": "info",
-      "subject": "artifacts.render.testing",
-      "message": "declared entry has no file on disk at /Users/patrick/Development/sandbox/textus/.textus/data/artifacts/render/testing.json",
-      "fix": "create the entry with 'textus put artifacts.render.testing --stdin --as=<role>'"
-    },
-    {
-      "code": "manifest.missing_file",
-      "severity": "info",
-      "subject": "artifacts.render.engineering-skills",
-      "message": "declared entry has no file on disk at /Users/patrick/Development/sandbox/textus/.textus/data/artifacts/render/engineering-skills.json",
-      "fix": "create the entry with 'textus put artifacts.render.engineering-skills --stdin --as=<role>'"
-    },
-    {
-      "code": "manifest.missing_file",
-      "severity": "info",
-      "subject": "artifacts.render.contributor-conventions",
-      "message": "declared entry has no file on disk at /Users/patrick/Development/sandbox/textus/.textus/data/artifacts/render/contributor-conventions.json",
-      "fix": "create the entry with 'textus put artifacts.render.contributor-conventions --stdin --as=<role>'"
-    },
-    {
-      "code": "manifest.missing_file",
-      "severity": "info",
-      "subject": "artifacts.render.drain-scheduling",
-      "message": "declared entry has no file on disk at /Users/patrick/Development/sandbox/textus/.textus/data/artifacts/render/drain-scheduling.json",
-      "fix": "create the entry with 'textus put artifacts.render.drain-scheduling --stdin --as=<role>'"
-    },
-    {
-      "code": "manifest.missing_file",
-      "severity": "info",
-      "subject": "artifacts.render.migrations",
-      "message": "declared entry has no file on disk at /Users/patrick/Development/sandbox/textus/.textus/data/artifacts/render/migrations.json",
-      "fix": "create the entry with 'textus put artifacts.render.migrations --stdin --as=<role>'"
-    },
-    {
-      "code": "manifest.missing_file",
-      "severity": "info",
-      "subject": "artifacts.render.code-of-conduct",
-      "message": "declared entry has no file on disk at /Users/patrick/Development/sandbox/textus/.textus/data/artifacts/render/code-of-conduct.json",
-      "fix": "create the entry with 'textus put artifacts.render.code-of-conduct --stdin --as=<role>'"
-    },
-    {
-      "code": "manifest.missing_file",
-      "severity": "info",
-      "subject": "artifacts.render.security",
-      "message": "declared entry has no file on disk at /Users/patrick/Development/sandbox/textus/.textus/data/artifacts/render/security.json",
-      "fix": "create the entry with 'textus put artifacts.render.security --stdin --as=<role>'"
-    },
     {
       "code": "manifest.missing_file",
       "severity": "info",
@@ -75,5 +19,5 @@
       "fix": "create the entry with 'textus put artifacts.system.index --stdin --as=<role>'"
     }
   ],
-  "count": 10
+  "count": 2
 }
diff --git a/.textus/data/artifacts/feeds/skills.json b/.textus/data/artifacts/feeds/skills.json
index 590a99925..f2c71ddb0 100644
--- a/.textus/data/artifacts/feeds/skills.json
+++ b/.textus/data/artifacts/feeds/skills.json
@@ -1,11 +1,12 @@
 {
   "_meta": {
+    "generated_at": "2026-07-05T08:07:25Z",
     "uid": "36318f45b6fec691"
   },
   "skills": [
     {
       "name": "agent",
-      "description": "Use when creating, optimizing, or evaluating Agent Skills — reusable instruction packages that extend AI agent capabilities. Reach for this skill when building new skills, improving skill descriptions for better triggering, testing skill quality, or implementing skills support in an agent client.",
+      "description": "Use when creating, testing, optimizing, or implementing Agent Skills — a standardized format for extending AI agent capabilities. Reach for this skill when building skills for agents, evaluating skill quality, optimizing skill descriptions for triggering, or adding skills support to an agent product.",
       "url": "https://agentskills.io/.well-known/agent-skills/agent/skill.md"
     }
   ],
diff --git a/.textus/data/knowledge/loop/constraint/protocol/0016-agent-session-protocol.md b/.textus/data/knowledge/loop/constraint/protocol/0016-agent-session-protocol.md
new file mode 100644
index 000000000..68314430f
--- /dev/null
+++ b/.textus/data/knowledge/loop/constraint/protocol/0016-agent-session-protocol.md
@@ -0,0 +1,49 @@
+# Agent Session Protocol
+
+Every agent session follows INPUT → LOOP → OUTPUT in that order.
+
+## Rationale
+
+Without a strict protocol, agents skip nodes, waste context on dead paths,
+or produce output that hasn't been validated against constraints. This entry
+codifies the deterministic session flow.
+
+## INPUT
+
+On session start, the agent reads exactly these sources in order:
+
+1. `AGENTS.md` (rendered from `textus drain`) — contains the command chain
+2. `textus session_open --as=agent` — returns boot context with lanes, verbs, loop
+3. `textus get knowledge.loop.constraint.protocol.0014-data-flow` — data flow
+4. `textus get knowledge.loop.judgment.engineering.0009-conventions` — conventions
+
+## LOOP
+
+Before acting, the agent checks the relevant loop node:
+
+| Action | Check |
+|--------|-------|
+| Write code or change architecture | `knowledge.loop.constraint.repo.*` |
+| Touch protocol or surface | `knowledge.loop.constraint.protocol.*` |
+| Use or extend a pattern | `knowledge.loop.judgment.engineering.*` |
+| Make a permanent decision | `knowledge.loop.evidence.*` (ADRs) |
+| Follow a procedure | `knowledge.loop.execution.*` |
+| End session | `knowledge.loop.feedback.*` |
+
+Skipped nodes must be documented with a reason in session notes.
+
+## OUTPUT
+
+On session end, the agent:
+
+1. Calls `session_close <id> --nodes_checked="[intent,constraint.repo,...]"` — includes which loop nodes were checked
+2. Reads the auto-generated feedback and compares against `knowledge.loop.feedback.*`
+3. Runs `textus drain --as=automation` to re-publish artifacts (AGENTS.md, boot, docs)
+4. If a pattern repeated 3+ times: proposes to `knowledge.loop.judgment.engineering.*`
+5. If the session contradicts an existing ADR: proposes to `knowledge.loop.evidence.*`
+
+## Enforcement
+
+The doctor workflow checks for sessions that closed without checking
+`constraint.repo` but authored new entries. This is a warning, not a
+block — the agent may have a valid reason to skip.
diff --git a/.textus/data/knowledge/loop/evidence/0137-agent-surface-deepening.md b/.textus/data/knowledge/loop/evidence/0137-agent-surface-deepening.md
new file mode 100644
index 000000000..141d774bd
--- /dev/null
+++ b/.textus/data/knowledge/loop/evidence/0137-agent-surface-deepening.md
@@ -0,0 +1,100 @@
+---
+proposal:
+  target_key: knowledge.loop.evidence.0137-agent-surface-deepening
+  action: put
+uid: d8f1b0a3488bcb3b
+---
+# ADR 0137 — Agent surface deepening: script format, schema validation, boot catalog, MCP integration test
+
+**Date:** 2026-07-05
+**Status:** Proposed
+**Refines:** [ADR 0063](./0063-cli-is-a-projection-of-the-contract.md) (CLI/MCP surface contract), [ADR 0089](./0089-ingest-is-system-pushed.md) (put pipeline), [ADR 0115](./0115-role-trust-model.md) (role capability gates)
+
+> **One sentence:** Six deepening candidates from an architecture review of the agent surface were implemented: (1) fix propose→accept format breakage, (2) remove dead scratchpad scripts/ directory, (3) add script format to the registry, (4) wire schema validation into the put pipeline, (5) add MCP end-to-end integration tests, (6) add schema catalog to boot envelope and schema_list verb.
+
+## Context
+
+An architecture review of textus from the agent's perspective surfaced six candidates where modules were shallow — interfaces nearly as wide as their implementations — or where complexity leaked across seams.
+
+### 1. Propose→Accept format breakage (real bug)
+
+The `accept` handler promoted proposals to their target by calling `ctx.put(key: target, meta: env.meta["_meta"] || {}, body: env.body, content: nil, call:)`. Two problems:
+
+- **`content: nil` unconditionally** — for JSON/YAML proposals with structured `content` hashes, the data was discarded on promotion. The proposal's body string was re-serialized by the target put, losing structure.
+- **`env.meta["_meta"]`** — the meta hash returned by `read` is the frontmatter itself; there is no nested `_meta` key inside it. This always returned nil, discarding any user metadata on promotion.
+- **Proposal block leaked** — the `proposal` control key (`target_key`, `action`) was silently passed through to the target entry's meta.
+
+### 2. Dead scratchpad scripts/ directory
+
+`session_open` created `scripts/`, `notes/`, and `output/` subdirectories under each session workspace, but no surface tool (MCP or CLI) could write to them, read from them, or execute scripts within them. The deletion test confirmed shallowness: deleting the three `mkdir_p` calls removed no observable behaviour.
+
+### 3. No executable/script format in the type system
+
+The format registry supported `[markdown, json, yaml, text]` — none of which express "this is runnable." An agent writing a Ruby/Python/bash script had no way to signal shebang, executable bit, or language. All script content collapsed into the `text` format.
+
+### 4. Schema validation was a hypothetical seam
+
+`Schema#validate!` existed and worked on any frontmatter hash, but `validate_raw_entry!` only fired for the `raw` lane (YAML format). For all other lanes (`knowledge`, `scratchpad`, `artifacts`), entries declaring `schema:` in the manifest passed through unchecked. The interface (`validate_raw_entry!` on every format class) was as wide as the no-op.
+
+### 5. No MCP end-to-end integration test
+
+The MCP surface — the primary way agents interact with textus — had no test sending real messages through `Server#dispatch`. The `dispatch` method (error handling, drift annotation, cursor advance) had coverage only via unit-mocked callers. The JSON-RPC protocol layer (`@sdk.handle_json`) was wholly untested.
+
+### 6. Agent cannot discover schemas from the protocol
+
+`schema_show` required a key — but the agent didn't know which keys existed or which schemas were available until reading the manifest directly. The `boot` envelope listed verbs and lanes but not schemas or formats. Every agent had to rediscover the schema catalog through trial and error.
+
+## Decision
+
+### 1. Propose→Accept meta and content propagation
+
+`accept` now strips only the `proposal` control key from the proposal's meta and passes the remaining meta to the target put. It also passes `env.content` (the structured content) instead of `content: nil`, so JSON/YAML proposals preserve their data shape on promotion.
+
+```ruby
+target_meta = env.meta.to_h.reject { |k, _| k == "proposal" }
+ctx.put(key: target, meta: target_meta, body: env.body, content: env.content, call:)
+```
+
+### 2. Dead directories removed
+
+The three `mkdir_p` calls removed from `session_open`. The `workspace` field removed from the response hash. The `FileUtils` assertions removed from the spec. Agents write script content as entries in the data lane.
+
+### 3. Script format registered
+
+A new `Format::Script` class — raw-bytes serialization (same as `Text`) but with `.rb`/`.py`/`.sh`/`.js`/`.pl`/`.rs`/`.exs` extensions. No shebang injection, no executable-bit manipulation, no execution verb. The `script` format is registered in `STRATEGIES` and `EXT_TO_FORMAT`. Language is stored in `_meta.lang` when provided.
+
+The format is available for any manifest entry declaring `format: script`. Restriction to scratchpad is a deployment policy, not a format constraint.
+
+### 4. Schema validation in the put pipeline
+
+A new `ValidateSchema` step in `PutPipeline::STEPS`, running after `ValidateInput` and before `ReadExisting`. When an entry's manifest declares `schema: X`, the pipeline loads `Schema::Registry.fetch(X)` and calls `schema.validate!(meta)`. Lane-aware policy:
+
+- `knowledge` / `artifacts` / `raw`: violation raises `SchemaViolation` — the write is rejected
+- `scratchpad`: violation silently swallowed — working drafts can be schema-invalid
+
+Access to schemas is threaded through `StoreEngine` → `WriteDeps` → `ValidateSchema`. The `Builder` passes the schema registry to `StoreEngine` on construction. All existing `StoreEngine.new` call sites updated.
+
+### 5. MCP integration test
+
+Three integration tests in `spec/integration/surface/mcp_agent_workflow_spec.rb` using the `textus/4 conformance fixture`:
+
+- **Full cycle**: session_open → get → put → propose → diff → accept → list → pulse
+- **Reject flow**: propose → reject → verify proposal deleted
+- Each test creates real `MCP::Server`/`Session.open` instances and exercises `Server#dispatch`
+
+The `session_open`/`session_close` verbs were added to `ENTRY_VERBS` in `VerbRegistry` so the `Session#method_missing` dispatcher can route them. The conformance fixture gained a `scratchpad.proposals` directory and manifest entry.
+
+### 6. Schema catalog in boot + schema_list verb
+
+The `boot` envelope now includes a `schemas` block listing every registered schema: name, required fields, optional fields, field types, and evolution history. Added by `Boot.build_schemas(container.schemas)` in `Boot.build`.
+
+A new `schema_list` verb (no arguments, `:read` category) returns the same schema catalog. Registered in `VerbRegistry`, wired through `Handlers::System#schema_list`, available on both CLI (`textus schema list`) and MCP.
+
+## Consequences
+
+- **Propose→Accept now format-agnostic.** JSON/YAML structured content survives promotion. Text and markdown proposals unaffected (content is nil, falls back to body).
+- **Script format exists for declarative use.** No manifest change yet — the format is available when an entry declares `format: script`.
+- **Schema validation enforces canon.** Knowledge and artifact entries that declare a schema are now validated at write time. Existing schema-declared entries in `knowledge.contacts` and `execution.runbook/*` will be enforced.
+- **Agent workflow is integration-tested.** The full propose→accept cycle now has coverage through `Server#dispatch`. No more blind spots in the MCP surface.
+- **Agent can discover schemas at boot time.** No need to probe keys to learn schema shape.
+- **Root cause of leaky meta propagation in accept identified.** The UID from the proposal entry overwrites the target entry's UID because `InjectMeta` preserves the incoming UID. A future fix should strip system-managed fields (`uid`, `sources`) from the accepted meta at the accept handler level.
diff --git a/.textus/data/knowledge/loop/judgment/engineering/0001-unified-dispatch.md b/.textus/data/knowledge/loop/judgment/engineering/0001-unified-dispatch.md
index 2d8b1b546..cc8d77314 100644
--- a/.textus/data/knowledge/loop/judgment/engineering/0001-unified-dispatch.md
+++ b/.textus/data/knowledge/loop/judgment/engineering/0001-unified-dispatch.md
@@ -1,38 +1,42 @@
 # Unified Dispatch
 
-ADR-0132: Replaced `store.entry(:get, key:)` with `store.get(key:)` via `method_missing`.
+ADR-0132: Replaced `store.entry(:get, key:)` with `session.get(key:)` via `method_missing`.
 
-Every verb call — whether from CLI, MCP, or internal — converges through a single `method_missing` on Store.
+Every verb call — whether from CLI, MCP, or internal — converges through `Protocol::Session#method_missing`.
 
 ## The Pattern
 
 ```ruby
-store.get(key: "foo")       # CLI verb, hand-authored
-store.put(key: "bar", ...)  # MCP tool call
-store.boot                  # Internal use case
+session.get(key: "foo")       # CLI verb
+session.put(key: "bar", ...)  # MCP tool call
+session.boot                  # Internal use case
 ```
 
-All of these route through `Store#method_missing` (store.rb:56-68):
+All of these route through `Protocol::Session#method_missing`:
 
 ```ruby
 def method_missing(name, *args, **kwargs)
-  return super unless DOMAIN_VERBS.include?(name)
-  spec = VerbRegistry.for(name)
-  pending = Dispatch::Binder.command(spec, kwargs)
-  call_obj = Value::Call.build(role:, correlation_id:)
-  @ctx.pipeline.dispatch(pending, call: call_obj)
+  return super unless VerbRegistry.for(name)
+  @bridge.dispatch(name, **kwargs)
 end
 ```
 
+The `Bridge` delegates to `Gate.dispatch`, which:
+1. Looks up the verb spec from `VerbRegistry`
+2. Authorizes the write via `Manifest::Policy`
+3. Binds arguments via `Protocol::Binder`
+4. Resolves the handler (`Protocol::Handlers::Read`/`Write`/`System` or lane-specific)
+5. Dispatches with `ctx:` and `call:`
+
 ## Why It Works
 
-- **Open for extension:** Adding a new verb requires only: contract + use case + VerbSpec registration. No new dispatch methods.
-- **Closed for modification:** The dispatch path never changes — all verbs flow through the same pipeline.
+- **Open for extension:** Adding a new verb requires only: VerbSpec registration + handler method.
+- **Closed for modification:** The dispatch path never changes — all verbs flow through `Gate#dispatch`.
 - **Single convergence point:** CLI, MCP, and Doctor checks all hit the same `method_missing`.
 
 ## Key Files
 
-- `lib/textus/store.rb` — method_missing entry point
-- `lib/textus/dispatch/pipeline.rb` — middleware chain execution
-- `lib/textus/dispatch/middleware/binder.rb` — resolves Pending → contract instance
-- `lib/textus/dispatch/handler_resolver.rb` — discovers use cases, injects deps
+- `lib/textus/protocol/session.rb` — method_missing entry point
+- `lib/textus/protocol/gate.rb` — dispatch hub (lookup → authorize → bind → handler)
+- `lib/textus/protocol/binder.rb` — validates and binds keyword args
+- `lib/textus/protocol/handlers/` — verb handler modules (Read, Write, System)
diff --git a/.textus/data/knowledge/loop/judgment/engineering/0002-middleware-chain.md b/.textus/data/knowledge/loop/judgment/engineering/0002-middleware-chain.md
deleted file mode 100644
index c626b23c5..000000000
--- a/.textus/data/knowledge/loop/judgment/engineering/0002-middleware-chain.md
+++ /dev/null
@@ -1,52 +0,0 @@
-# Middleware Chain
-
-ADR-0131: Adopted pipeline + handler factory + registry pattern for dispatch.
-
-Cross-cutting concerns (auth, timing, audit indexing) are composed as middleware wrapping the use-case execution.
-
-## The Pattern
-
-```ruby
-middleware = [
-  Dispatch::Middleware::Binder.new,    # Resolve Pending → contract
-  Dispatch::Middleware::Trace.new,     # Record timing + metadata
-  Dispatch::Middleware::Auth.new,      # Rule engine permission check
-  Dispatch::Middleware::AuditIndex.new,# Index write ops, emit events
-]
-```
-
-Middleware are composed in a chain (pipeline.rb:12-17):
-
-```ruby
-stack = @middleware.reverse.reduce(->(cmd, c) { execute(cmd, c) }) do |next_mw, mw|
-  ->(cmd, c) { mw.call(container:, command: cmd, call: c, next_handler: next_mw) }
-end
-```
-
-## Uniform Interface
-
-Every middleware implements the same call signature:
-
-```ruby
-def call(container:, command:, call:, next_handler:)
-  # before logic
-  result = next_handler.call(command, call)
-  # after logic
-  result
-end
-```
-
-## Why It Works
-
-- **Pluggable:** Adding middleware = new class + one line in the middleware array. No existing code changes.
-- **No Pipeline dependency:** Middleware receives `next_handler` as a callable, not as a Pipeline object. Excellent DIP.
-- **Wrap everything:** Trace middleware wraps the entire chain including Auth and AuditIndex.
-
-## Key Files
-
-- `lib/textus/dispatch/pipeline.rb` — chain composition + execution
-- `lib/textus/dispatch/middleware/base.rb` — abstract base class
-- `lib/textus/dispatch/middleware/binder.rb` — resolves Pending
-- `lib/textus/dispatch/middleware/trace.rb` — timing ring buffer
-- `lib/textus/dispatch/middleware/auth.rb` — rule engine
-- `lib/textus/dispatch/middleware/audit_index.rb` — audit + events
diff --git a/.textus/data/knowledge/loop/judgment/engineering/0003-store-builder.md b/.textus/data/knowledge/loop/judgment/engineering/0003-store-builder.md
index ae06c8374..4001897a0 100644
--- a/.textus/data/knowledge/loop/judgment/engineering/0003-store-builder.md
+++ b/.textus/data/knowledge/loop/judgment/engineering/0003-store-builder.md
@@ -1,45 +1,42 @@
 # Store Builder
 
-ADR-0014: Explicit dependencies. Store SRP extraction from July 2026 architecture deepening.
+ADR-0014: Explicit dependencies. The container builder was extracted from Store into its own class.
 
-Dependency container construction is extracted into its own class so Store stays a thin facade.
+Dependency construction is extracted into `Protocol::Builder` so dispatchers stay thin facades.
 
 ## The Pattern
 
-Instead of Store building its own dependencies:
+The Builder chains three phases:
 
 ```ruby
-# Bad: Store does discovery, session management, AND context building
-class Store
-  def initialize(root, ...)
-    @ctx = build_ctx(root)  # 50 lines of concretions
+class Protocol::Builder
+  def call(root)
+    infra = Builder::Infrastructure.call(root)   # Database, FileSystem, Layout
+    domain = Builder::Domain.call(infra)          # Manifest, Schemas, Workflows
+    Builder::Runtime.call(infra, domain)          # StoreEngine, Gate, Container
   end
 end
 ```
 
-The Builder handles construction:
-
-```ruby
-# Good: Store delegates to Builder
-class Store
-  def initialize(root, ...)
-    @ctx = Store::Builder.new.call(root)
-  end
-end
-```
+Each phase produces a `Components` Data.define struct passed to the next phase.
 
 ## Builder Responsibilities
 
-The Builder (builder.rb) handles: Manifest loading, Port instantiation (Store, FileStore, AuditLog, Clock), Schema registry, Link edge store, Workflow loading, Event bus + cascade subscribers, Freshness evaluation, Trace buffer, Middleware wiring, Pipeline construction.
+| Phase | Produces | What it wires |
+|-------|----------|---------------|
+| Infrastructure | `Components(database, file_system, store, layout)` | SQLite, file I/O, path layout |
+| Domain | `Components(manifest, schemas, workflows, workflow_registry)` | Config, validation, workflow definitions |
+| Runtime | `Components(store_engine, gate, container)` | All together |
 
 ## Why It Works
 
-- **SRP:** Store owns session + dispatch. Builder owns construction.
-- **DIP:** Builder is extracted but still ultimately depends on concretions. The next step is a DI container.
-- **Testable:** Store can be tested with a mock Infrastructure instead of building the full graph.
+- **SRP:** Session owns dispatch. Builder owns construction.
+- **Testable:** Session can be tested with a mock container instead of building the full graph.
+- **Linear boot:** No circular dependencies — infra → domain → runtime is a strict DAG.
 
 ## Key Files
 
-- `lib/textus/store/builder.rb` — the Builder
-- `lib/textus/store.rb` — thin facade using Builder
-- `lib/textus/store/infrastructure.rb` — the Data.define container
+- `lib/textus/protocol/builder.rb` — orchestrator
+- `lib/textus/protocol/builder/infrastructure.rb` — infra layer
+- `lib/textus/protocol/builder/domain.rb` — domain layer
+- `lib/textus/protocol/builder/runtime.rb` — runtime layer
diff --git a/.textus/data/knowledge/loop/judgment/engineering/0006-handler-needs.md b/.textus/data/knowledge/loop/judgment/engineering/0006-handler-needs.md
deleted file mode 100644
index 7f3eff8cb..000000000
--- a/.textus/data/knowledge/loop/judgment/engineering/0006-handler-needs.md
+++ /dev/null
@@ -1,49 +0,0 @@
-# Handler NEEDS (Interface Segregation)
-
-ADR-0014: Explicit dependencies. ADR-0023: Uniform use-case shape. ADR-0125: Bounded use-case objects.
-
-Every use case declares exactly the dependencies it needs — nothing more, nothing less.
-
-## The Pattern
-
-Each use case module declares a `NEEDS` array:
-
-```ruby
-module GraphEntry
-  HANDLES = Dispatch::Contracts::GraphEntry
-  NEEDS = %i[link_edge_store].freeze  # Only what this use case needs
-
-  def self.call(command, call, deps)
-    deps.link_edge_store  # Access only the declared fields
-  end
-end
-```
-
-The `HandlerResolver` (handler_resolver.rb:26-36) extracts exactly those fields:
-
-```ruby
-deps_hash = needs.to_h { |field| [field, ctx_hash[field]] }
-dep_struct = Data.define(*needs).new(**deps_hash)
-```
-
-## Why It Works
-
-- **Minimal surface:** No use case sees the full 12-field Infrastructure. GraphEntry gets only `link_edge_store`.
-- **Explicit contract:** A use case's dependencies are visible at a glance — no hidden imports.
-- **Testable:** Each use case can be tested with a minimal stub (just its declared fields).
-
-## Dependency Size by Use Case
-
-| Use Case | NEEDS count | Fields |
-|----------|-------------|--------|
-| GraphEntry | 1 | link_edge_store |
-| RuleTrace | 1 | manifest |
-| JobsAction | 1 | job_store |
-| GetEntry | 3 | file_store, manifest, layout |
-| PutEntry | 6 | file_store, manifest, schemas, audit_log, layout, event_bus |
-| DrainStore | 7 | manifest, file_store, schemas, audit_log, job_store, layout, workflows |
-
-## Key Files
-
-- `lib/textus/dispatch/handler_resolver.rb` — NEEDS extraction + injection
-- All `lib/textus/use_cases/*/*.rb` — each declares its own NEEDS
diff --git a/.textus/data/knowledge/loop/judgment/engineering/0007-bounded-use-cases.md b/.textus/data/knowledge/loop/judgment/engineering/0007-bounded-use-cases.md
deleted file mode 100644
index 45fcf726d..000000000
--- a/.textus/data/knowledge/loop/judgment/engineering/0007-bounded-use-cases.md
+++ /dev/null
@@ -1,38 +0,0 @@
----
-uid: adc9d742383d787d
----
-ADR-0125: Bounded use-case objects — one contract per module, uniform interface.
-
-# Bounded Use-Case Objects
-
-Based on the architectural patterns of Rodrigo Serradura, textus adopts the Bounded Use-Case Object pattern to ensure the codebase remains simple to change as it grows.
-
-## The Core Philosophy
-The goal is to minimize the cost of change by maximizing locality. A developer (or agent) should be able to understand the full impact of a change by looking at a single, small file.
-
-## The Pattern
-Instead of grouping related actions into large "Service" or "Use-Case" modules with internal dispatchers, every action is its own first-class object.
-
-### 1. One Class Per Contract
-Every Dispatch::Contract must map to exactly one UseCase class.
-- Bad: UseCases::EntryRead.call(command, deps) -> if command.is_a?(GetEntry) ...
-- Good: UseCases::Read::GetEntry.call(command, deps)
-
-### 2. Uniform Interface
-All use cases must implement a uniform call method:
-```ruby
-def self.call(command, call, deps)
-  # implementation
-end
-```
-
-### 3. Isolated Dependencies
-Dependencies are not shared at the module level. Each use case explicitly declares or uses only the slice of the container it requires. This prevents "dependency bloat" where a module requires 10 ports just because one of its 20 methods needs one of them.
-
-### 4. No Central Dispatcher
-The Gate or Dispatcher should resolve the use-case class directly from the contract mapping, eliminating the need for if/elsif or case statements within the use-case layer.
-
-## Benefits for AI Agents
-- Context Efficiency: Agents only need to read the specific use-case class, not a 500-line module.
-- Reduced Regression Risk: Changes to one use-case cannot accidentally break another through shared private methods.
-- Clearer Navigation: The file system becomes a direct map of the application's capabilities.
diff --git a/.textus/data/knowledge/loop/judgment/engineering/0009-conventions.md b/.textus/data/knowledge/loop/judgment/engineering/0009-conventions.md
index 1a2ae67a4..bf55599ee 100644
--- a/.textus/data/knowledge/loop/judgment/engineering/0009-conventions.md
+++ b/.textus/data/knowledge/loop/judgment/engineering/0009-conventions.md
@@ -3,20 +3,19 @@
 ## Folder Structure
 ```
 lib/textus/
-  surface/    # Entry points (CLI, MCP)
-  use_cases/  # Orchestration (one file per contract read/write/ops)
-  domain/     # Pure logic, zero I/O
-  port/       # I/O abstractions (interface + impl)
-  dispatch/   # Command bus (pipeline, middleware, registry)
-  store/      # Store internals (Reader, Writer, Layout)
-  value/      # Value objects
-  manifest/   # Config data + policy
+  protocol/    # Core protocol: Session, Gate, Builder, Handlers, StoreEngine, Format
+  infra/       # Infrastructure: SQLite, FileStore, Ports, Adapters
+  lanes/       # Lane-specific handlers (knowledge, scratchpad, artifact)
+  surface/     # Entry points (CLI, MCP, Watcher)
+  workflow/    # Workflow engine (DSL, Runner, StepExecutor, Consumer, Publisher)
+  value/       # Value objects (Role, Etag, Call, Uid, Duration)
+  errors.rb    # Error hierarchy
 ```
 
 ## Role Design
 | Role | Used By | Default | Capabilities |
 |------|---------|---------|-------------|
-| automation | System (drain, converge, jobs) | Yes | converge |
+| automation | System (drain, watcher, workflows) | Yes | converge |
 | agent | MCP server | No | propose, keep |
 | human | CLI, direct | No | author, ingest |
 
@@ -46,7 +45,7 @@ judgment → evidence → execution → feedback
 
 | Section | Role | Examples |
 |---------|------|----------|
-| judgment/engineering | Reusable solutions and conventions | bounded-use-cases, dependency-adapters, anti-patterns |
+| judgment/engineering | Reusable solutions and conventions | unified-dispatch, store-builder, anti-patterns, error-handling |
 | evidence/ | Why we chose — historical ADRs | all ADR files |
 | execution/ | How to execute — procedural | adr, release |
 | feedback/ | Audits and review loops | solid-audit |
@@ -60,31 +59,32 @@ On session start, agents should read:
 1. `knowledge.loop.judgment.engineering.0009-conventions` — this file (folder structure, role design, pipeline)
 2. `knowledge.loop.constraint.protocol.0014-data-flow` — how data flows through the system
 3. `knowledge.loop.judgment.engineering.0010-anti-patterns` — what to avoid
-4. `knowledge.loop.feedback.0001-solid-audit` — SOLID evaluation of the codebase
+4. `knowledge.loop.judgment.engineering.0015-solid-audit` — SOLID evaluation of the codebase
 5. `knowledge.loop.judgment.engineering.*` — reusable patterns when designing new code
 
 When designing new code, prefer:
-- **Unified dispatch** — new verbs automatically route through Store#method_missing
-- **Middleware chain** — cross-cutting concerns as pluggable middleware
-- **Handler NEEDS** — declare minimal dependencies per use case
-- **Store::Builder** — dependency construction extracted from Store
+- **Unified dispatch** — new verbs automatically route through Protocol::Session#method_missing
+- **QueryContext/CommandContext** — CQS split for read vs write handler access
+- **Pipeline steps** — StoreEngine pipeline steps as Data.define context + module step
+- **Protocol::Builder** — 3-layer dependency construction (infra/domain/runtime)
 
 When reviewing:
 - Check for dual paths (two ways to do the same thing)
 - Check vocabulary collisions (same term, different meanings)
-- Check layer violations (domain/ never references manifest/ or ports/)
-- Check for vestigial code (HANDLES_ALL paths, dead branches)
+- Check layer violations (protocol/ never references surface/ or lanes/)
+- Check for vestigial code (dead branches, unused value objects)
 
 ## Naming
-- Use cases: `<Layer>::<Verb><Noun>` (Read::GetEntry, Write::PutEntry)
-- Contracts: `Dispatch::Contracts::<Same>` (GetEntry, PutEntry)
-- call = Value::Call, deps = injected dep struct, command = contract instance
+- Handlers: `<Module>::<verb>` (Handlers::Read.get, Handlers::Write.put)
+- Pipeline steps: `<Action><Noun>` (Validate, Prepare, Write, Emit)
+- Contexts: `QueryContext`, `CommandContext`, pipeline-specific `*Context`
+- call = Value::Call, ctx = context at the handler seam, deps = pipeline dependencies
 
 ## Avoid
 1. Dual paths — never two ways to do the same thing
-2. God classes — Store stays thin
+2. God classes — Gate and Session stay thin
 3. Vestigial code — delete what's unused
-4. Layer violations — domain never references manifest/ or ports/
+4. Layer violations — protocol/ never references surface/ or lanes/
 
 ## Agent Scratchpad Structure
 
diff --git a/.textus/data/knowledge/loop/judgment/engineering/0015-solid-audit.md b/.textus/data/knowledge/loop/judgment/engineering/0015-solid-audit.md
index 5f7c45818..f4411d989 100644
--- a/.textus/data/knowledge/loop/judgment/engineering/0015-solid-audit.md
+++ b/.textus/data/knowledge/loop/judgment/engineering/0015-solid-audit.md
@@ -1,28 +1,36 @@
 # SOLID Audit (July 2026)
 
-Grades: S(C) O(B) L(A) I(A) D(C)
+Grades: S(B) O(B) L(A) I(A) D(B)
 
-## S — Single Responsibility: C
-- Store: 7 responsibilities (discovery, context building, dispatch, session, transitions, proxy building, etag drift)
-- Boot: 4 responsibilities (verb catalog, agent protocol, artifact reading, envelope building)
-- Fix: Extract Store::Builder, split Boot module
+## S — Single Responsibility: B
+- Protocol::Session: method_missing dispatch + cursor management + role switching (3 responsibilities, manageable)
+- Protocol::Gate: verb lookup + authorization + handler routing (cohesive — all dispatch)
+- StoreEngine: pipeline orchestration for put/move/delete (single responsibility)
+- Protocol::Builder: 3-layer construction only (A grade — single responsibility)
+- Fixed vs previous audit: Store no longer exists (was 7 responsibilities)
 
 ## O — Open/Closed: B
-- VERB_TO_CONTRACT is manual hash (verb_registry.rb:62-95)
-- Middleware, ports, doctor checks are pluggable
+- CoreVerbs in verb_registry is the single source of truth
+- Workflow DSL is extensible via Definition class
+- Handler dispatch is closed (Gate always does the same path), open for new verbs
+- Some coupling: adding a new pipeline step requires modifying the pipeline file
 
 ## L — Liskov Substitution: A
-- Middleware call signature is uniform
-- Entry hierarchy has sensible defaults
-- Port interfaces guarantee substitutability
+- Pipeline step signature is uniform: `.call(ctx, deps) → ctx`
+- Handler signature is uniform: `handler.verb(**args, ctx:, call:)`
+- Context hierarchy (CommandContext < QueryContext) is valid — adds without replacing
+- Format adapters all implement the same parse/serialize contract
 
 ## I — Interface Segregation: A
-- Handler NEEDS mechanism: each use case declares only fields it needs
-- ContainerProxy is a thinner interface
+- QueryContext vs CommandContext: read handlers never see write methods
+- Pipeline steps see only deps (not the full container)
+- Consumer receives a row hash + workflow_queue, not the full registry
+- Bounded, narrow interfaces at every seam
 
-## D — Dependency Inversion: C
-- Store#build_ctx instantiates 14+ concretions
-- Three use cases duplicate ContainerProxy construction
-- Middleware depends on callable next_handler (good)
+## D — Dependency Inversion: B
+- StoreEngine depends on abstractions (file_system, manifest, layout, store)
+- Gate depends on VerbRegistry (abstracted behind module methods)
+- Builder depends on concretions at construction time (acceptable — composition root)
+- Publisher no longer creates its own StoreEngine (fixed in July 2026 refactor)
 
 cross-ref: knowledge.loop.judgment.engineering.0009-conventions
diff --git a/.textus/data/knowledge/reference/data-flow.md b/.textus/data/knowledge/reference/data-flow.md
index 5f8c5c1ac..44bd05e0f 100644
--- a/.textus/data/knowledge/reference/data-flow.md
+++ b/.textus/data/knowledge/reference/data-flow.md
@@ -1,100 +1,108 @@
 # Data Flow
 
 ```
-┌─────────────────────────────────────────────────────────────────────┐
-│                           INPUT (Sources)                           │
-│                                                                     │
-│  ┌──────────┐  ┌──────────┐  ┌──────────┐  ┌──────────┐           │
-│  │  raw/    │  │knowledge/│  │scratchpad│  │proposals/│           │
-│  │external  │  │human     │  │agent     │  │pending   │           │
-│  │material  │  │truth     │  │memory    │  │changes   │           │
-│  └────┬─────┘  └────┬─────┘  └────┬─────┘  └────┬─────┘           │
-│       │  ingest     │  put        │  put        │  accept/reject   │
-│       ▼             ▼             ▼             ▼                  │
-├─────────────────────────────────────────────────────────────────────┤
-│                         CORE (Protocol Layer)                       │
-│                                                                     │
+┌──────────────────────────────────────────────────────────────────────┐
+│                            INPUT (Sources)                           │
+│                                                                      │
+│  ┌──────────┐  ┌──────────┐  ┌──────────┐  ┌──────────┐            │
+│  │  raw/    │  │knowledge/│  │scratchpad│  │proposals/│            │
+│  │external  │  │human     │  │agent     │  │pending   │            │
+│  │material  │  │truth     │  │memory    │  │changes   │            │
+│  └────┬─────┘  └────┬─────┘  └────┬─────┘  └────┬─────┘            │
+│       │  ingest     │  put        │  put        │  accept/reject    │
+│       ▼             ▼             ▼             ▼                   │
+├──────────────────────────────────────────────────────────────────────┤
+│                     GATE (Protocol Layer)                            │
+│                                                                      │
 │  ┌──────────────────────────────────────────────────────────────┐   │
-│  │                    Gate (auth → resolve → validate)          │   │
-│  └────────────────────────┬─────────────────────────────────────┘   │
-│                           │                                         │
-│                           ▼                                         │
+│  │  Session#method_missing → Bridge#dispatch → Gate#dispatch    │   │
+│  │   1. VerbRegistry.for(verb)    2. authorize! (write only)     │   │
+│  │   3. Protocol::Binder.bind     4. resolve handler             │   │
+│  │   5. handler.public_send(verb, **args, ctx:, call:)          │   │
+│  └──────────────────────┬───────────────────────────────────────┘   │
+│                         │                                           │
+│             ┌───────────┴───────────┐                               │
+│             │ read (QueryContext)   │ write (CommandContext)        │
+│             ▼                       ▼                               │
+│  ┌────────────────────┐  ┌──────────────────────────┐               │
+│  │  StoreEngine#read  │  │  StoreEngine#put          │               │
+│  │  read file from    │  │  → PutPipeline:           │               │
+│  │  disk, parse       │  │    Validate → Prepare →   │               │
+│  │  format, return    │  │    Write → Emit           │               │
+│  │  envelope          │  │  FileSystem + SQLite      │               │
+│  └────────────────────┘  └──────────┬───────────────┘               │
+│                                     │                               │
+│                                     ▼                               │
+├──────────── EVENT GATE ─────────────────────────────────────────────┤
+│                                                                      │
 │  ┌──────────────────────────────────────────────────────────────┐   │
-│  │  EntryStore (format parse + DB index + FTS + audit log)     │   │
-│  └──┬───────────────────────────────────────────────┬──────────┘   │
-│     │ write                                         │ read         │
-│     ▼                                               ▼              │
-│  ┌──────────┐  ┌───────────────────────────────────────────────┐   │
-│  │FileSystem│  │                   SQLite                       │   │
-│  │.md .json │  │ ┌──────────┐┌──────────┐┌───────────────┐    │   │
-│  │.yaml on  │  │ │ entries  ││ audit    ││workflow_events│    │   │
-│  │disk      │  │ │ (FTS5)   ││_events   ││(event queue)  │    │   │
-│  └──────────┘  │ ├──────────┤├──────────┤├───────────────┤    │   │
-│                │ │ cursors  ││loop_pos  ││ link_edges    │    │   │
-│                │ └──────────┘└──────────┘└───────────────┘    │   │
-│                └──────────────────────────────────────────────┘   │
-├─────────────────────────────────────────────────────────────────────┤
-│                     EVENT BUS (Workflow Engine)                     │
-│                                                                     │
-│  entry.written / entry.deleted / entry.moved                        │
-│         │                                                           │
-│         ▼                                                           │
-│  ┌──────────────┐    ┌──────────────┐    ┌──────────────┐          │
-│  │  Materialize │───>│    Workflow   │───>│  Workflow::  │          │
-│  │ (auto, on    │    │   Registry    │    │   Runner     │          │
-│  │  every write) │    │ (key→workflow)│    │ (exec steps) │          │
-│  └──────────────┘    └──────────────┘    └──────┬───────┘          │
-│                                                  │                  │
-│                     ┌────────────────────────────┼──────┐           │
-│                     │                            │      │           │
-├─────────────────────────────────────────────────────────────────────┤
-│  KNOWLEDGE LOOP      │            ┌──────────┐   │      │           │
-│                      │            │  boot_   │   │      │           │
-│  ┌──────┐            │            │ refresh  │   │      │           │
-│  │intent│◄───────────┼────────────│ (watches │   │      │           │
-│  └──┬───┘            │            │know.boot)│   │      │           │
-│     ▼                │            └─────┬────┘   │      │           │
-│  ┌──────────┐        │                  │triggers│      │           │
-│  │constraint│        │                  ▼        │      │           │
-│  │ .repo    │        │           ┌──────────┐    │      │           │
-│  │ .protocol│        │           │Produce:: │    │      │           │
-│  └──┬───────┘        │           │Engine.con│    │      │           │
-│     ▼                │           │verge     │    │      │           │
-│  ┌──────────┐        │           └──────────┘    │      │           │
-│  │judgment  │        │                           │      │           │
-│  │.engineer │        │                           ▼      ▼           │
-│  │.agent-beh│        │                    ┌──────────────────┐     │
-│  └──┬───────┘        │                    │  Publisher       │     │
-│     ▼                │                    │  (templating +   │     │
-│  ┌──────────┐        │                    │  publish_to)     │     │
-│  │evidence  │        │                    └────────┬─────────┘     │
-│  └──┬───────┘        │                             │               │
-│     ▼                │                             │               │
-│  ┌──────────┐        │                             ▼               │
-│  │execution │        │                    ┌──────────────────┐     │
-│  └──┬───────┘        │                    │  CLAUDE.md       │     │
-│     ▼                │                    │  AGENTS.md       │     │
-│  ┌──────────┐        │                    │  README.md       │     │
-│  │ feedback │        │                    └──────────────────┘     │
-│  │(signals: │        │                                             │
-│  │promote/  │        │                                             │
-│  │eliminate │        │                                             │
-│  │/refine)  │        │                                             │
-│  └──────────┘        │                                             │
-│                      │                                             │
-├──────────────────────┼──────────────────────────────────────────────┤
-│                      │                                             │
-│  OUTPUT              ▼                                             │
-│  ┌────────────────────────────────────────────────────────────┐    │
-│  │  artifacts.boot     artifacts.docs.*  artifacts.changelog  │    │
-│  │  artifacts.system.index  (+ 40+ config/workflow outputs)   │    │
-│  └────────────────────────────────────────────────────────────┘    │
-│                                                                     │
-│  SURFACE (CLI / MCP Server / Watcher) → all verbs hit Gate         │
-│  pulse → cursor_store + loop_state  |  loop → flow + feedback      │
-└─────────────────────────────────────────────────────────────────────┘
+│  │  EventEmitter (centralized event gate)                       │   │
+│  │  Receives from: Store writes (put/delete/move), Scheduler    │   │
+│  │  (TTL expired), actor calls                                  │   │
+│  │  Validates → looks up matching workflows → pushes to queue   │   │
+│  └──────────────────────┬───────────────────────────────────────┘   │
+│                         │                                           │
+│                         ▼                                           │
+│  ┌──────────────────────────────────────────────────────────────┐   │
+│  │  Infra::Store::WorkflowQueue (SQLite)                       │   │
+│  │  ┌──────────┐ ┌──────────┐ ┌──────────┐ ┌──────────┐       │   │
+│  │  │ pending  │ │processing│ │ failed   │ │ done     │       │   │
+│  │  └──────────┘ └──────────┘ └──────────┘ └──────────┘       │   │
+│  └──────────────────────┬───────────────────────────────────────┘   │
+│                         │                                           │
+│             ┌───────────┴───────────┐                               │
+│             │                       │                               │
+│        Drain mode             Watch mode                            │
+│        (CLI, one-shot)        (process, continuous)                 │
+│             │                       │                               │
+│      1. seed_expired           each tick:                           │
+│      2. pop all → consume      1. seed_expired                      │
+│      3. report {ok, failed}    2. pop one → consume                 │
+│                                 3. sleep(poll_interval)             │
+│             │                       │                               │
+│             └───────────┬───────────┘                               │
+│                         │                                           │
+├─────────────────────────┼───────────────────────────────────────────┤
+│                         ▼                                           │
+│  ┌──────────────────────────────────────────────────────────────┐   │
+│  │  Core Execution (shared)                                    │   │
+│  │                                                              │   │
+│  │  Consumer.consume(row, queue)                                │   │
+│  │    → mark_processing → Runner.run → complete or fail/resched │   │
+│  │                                                              │   │
+│  │  Runner.run(key) → resolve → StepExecutor.execute → Publish  │   │
+│  │                                                              │   │
+│  │  StepExecutor: serial steps (with timeout)                   │   │
+│  │                parallel steps (Concurrent::Promise)           │   │
+│  │                                                              │   │
+│  │  Publisher: save_to → store_engine.put                       │   │
+│  │             publish_to → file write via template             │   │
+│  │             notify → empty trigger puts                      │   │
+│  └──────────────────────────────────────────────────────────────┘   │
+│                                                                      │
+├──────────────────────────────────────────────────────────────────────┤
+│                                                                      │
+│  OUTPUT                                                              │
+│  ┌──────────────────────────────────────────────────────────────┐   │
+│  │  artifacts.boot     artifacts.docs.*  artifacts.changelog    │   │
+│  │  artifacts.system.index  (+ published CLAUDE.md, AGENTS.md)  │   │
+│  └──────────────────────────────────────────────────────────────┘   │
+│                                                                      │
+│  SURFACES: CLI (textus get/put/list/...)                            │
+│            MCP Server (agent tools via stdio)                       │
+│            Watcher (poll loop, seed_expired + consume)              │
+└──────────────────────────────────────────────────────────────────────┘
 ```
 
+## Key flows
+
+- **Write path:** `put` → Session → Gate → StoreEngine#put → PutPipeline (Validate → Prepare → Write → Emit) → FileSystem + SQLite → EventEmitter → WorkflowQueue
+- **Read path:** `get` → Session → Gate → StoreEngine#read → FileSystem read → Format parser → envelope
+- **Drain (CLI):** `drain` → Scheduler.seed_expired (TTL checks) → pop all pending from WorkflowQueue → Consumer.consume each → Runner → StepExecutor → Publisher
+- **Watch (process):** Watcher tick → seed_expired → pop one → consume → sleep → repeat; triggered writes push events immediately via EventEmitter
+- **Workflow execution:** EventEmitter receives event → looks up registry → pushes to WorkflowQueue → Consumer picks up → Runner resolves key → StepExecutor runs steps → Publisher writes save_to/publish_to/notify targets
+- **Scheduler seeding:** Scheduler checks each workflow with TTL + save_to: if entry missing or older than TTL, pushes a "workflow" event to the queue
+
 ## Mermaid version
 
 ```mermaid
@@ -106,79 +114,52 @@ flowchart TB
         PROPOSALS[".textus/data/proposals/\nSuggested changes\nawaiting human accept"]
     end
 
-    subgraph CORE["CORE — Protocol Layer"]
-        GATE["Gate\nauth → resolve → validate"]
-        ESTORE["EntryStore\nformat parse + DB index\n+ FTS + audit log"]
-        FS["File System\n.markdown / .json / .yaml"]
-        DB[("SQLite\n· entries (FTS5)\n· audit_events\n· workflow_events\n· cursors\n· loop_positions\n· link_edges")]
+    subgraph GATE_LAYER["GATE — Protocol Layer"]
+        SESSION["Session#method_missing"]
+        GATE["Gate#dispatch\n1. VerbRegistry\n2. authorize!\n3. Binder\n4. Handler"]
+        STORE_ENGINE["StoreEngine\nread / put / delete / move\nvia Pipeline steps"]
+        FS["File System\n.md / .json / .yaml on disk"]
+        DB[("SQLite\n· entries (FTS5)\n· audit_events\n· workflow_events\n· cursors\n· link_edges")]
     end
 
-    subgraph LOOP["LOOP — Knowledge Pipeline"]
-        direction LR
-        I["intent"]
-        CR["constraint.repo"]
-        CP["constraint.protocol"]
-        JE["judgment.engineering"]
-        JA["judgment.agent-behavior"]
-        EV["evidence"]
-        EX["execution"]
-        FB["feedback"]
-        I --> CR --> CP --> JE --> JA --> EV --> EX --> FB --> I
+    subgraph EVENTS["EVENT GATE — Workflow"]
+        EE["EventEmitter\n(registry lookup → push)"]
+        SCH["Scheduler\n(seed_expired: TTL check → push)"]
+        WQ[("WorkflowQueue\n(SQLite: pending /\n processing / failed / done)")]
     end
 
-    subgraph EVENTS["EVENT BUS — Workflow Engine"]
-        MAT["Materialize\n(auto, on every write)"]
-        WREG["Workflow Registry\nmatches key → workflow"]
-        RUNNER["Workflow::Runner\nexecutes steps"]
-        PUB["Publisher\ntemplate → publish_to"]
+    subgraph CORE["Core Execution (shared)"]
+        CON["Consumer\nconsume(row, queue)\nmark → run → complete/fail"]
+        RUN["Runner\nresolve → execute → publish"]
+        SE["StepExecutor\nserial + parallel steps\nwith timeouts"]
+        PUB["Publisher\nsave_to → store_engine.put\npublish_to → file write\nnotify → empty trigger"]
     end
 
-    subgraph OUTPUT["OUTPUT — Artifacts"]
-        BOOT["artifacts.boot\norientation contract"]
-        DOCS["artifacts.docs.*\nreference docs"]
-        CHANGELOG["artifacts.changelog"]
-        SYSTEM["artifacts.system.index"]
-        CLAUDE["CLAUDE.md / AGENTS.md\n(published via template)"]
+    subgraph MODES["Invocation Modes"]
+        DRAIN["Drain (CLI)\n1. seed_expired\n2. pop all → consume\n3. report"]
+        WATCH["Watch (process)\neach tick:\n1. seed_expired\n2. pop one → consume\n3. sleep"]
     end
 
-    subgraph SURFACE["SURFACE — Interfaces"]
-        CLI["CLI\n(textus get/put/list/…)"]
-        MCP["MCP Server\n(agent tools via stdio)"]
-        WATCH["Watcher\n(fs events → drain)"]
+    subgraph OUTPUT["OUTPUT — Artifacts"]
+        BOOT["artifacts.boot"]
+        DOCS["artifacts.docs.*"]
+        SYSTEM["artifacts.system.index"]
+        PUBLISHED["CLAUDE.md / AGENTS.md\n(published via template)"]
     end
 
-    PROPOSALS -- "accept/reject" --> GATE
-    KNOWLEDGE -- "put (human)" --> GATE
-    SCRATCH -- "put (agent)" --> GATE
-    RAW -- "ingest" --> GATE
-    GATE --> ESTORE
-    ESTORE <--> FS
-    ESTORE --> DB
-    ESTORE -- "entry.written\nentry.deleted\nentry.moved" --> MAT
-    MAT --> WREG
-    WREG --> RUNNER
-    RUNNER -- "read knowledge.loop.*" --> ESTORE
-    RUNNER -- "read knowledge.boot" --> ESTORE
-    BOOT_REFRESH["boot_refresh workflow\n(watches knowledge.boot)"] -. "triggers" -.-> PRODUCE["Produce::Engine.converge"]
-    RUNNER --> BOOT
-    RUNNER --> DOCS
-    RUNNER --> CHANGELOG
-    RUNNER --> SYSTEM
-    RUNNER --> PUB
-    PUB --> CLAUDE
-    PULSE["pulse verb\n(delta + loop_state)"]
-    LOOP_VERB["loop verb\n(flow + feedback signals)"]
-    DB --> PULSE
-    DB --> LOOP_VERB
-    LOOP_VERB --> FB
-    CLI --> GATE
-    MCP --> GATE
-    WATCH --> MAT
+    INPUT --> GATE
+    GATE --> STORE_ENGINE
+    STORE_ENGINE <--> FS
+    STORE_ENGINE --> DB
+    STORE_ENGINE -- "entry.written/deleted/moved" --> EE
+    SCH -. "TTL check" .-> DB
+    SCH --> WQ
+    EE --> WQ
+    WQ --> DRAIN
+    WQ --> WATCH
+    DRAIN --> CORE
+    WATCH --> CORE
+    CORE --> OUTPUT
+    CORE --> PUBLISHED
+    DB --> PULSE["pulse verb\n(delta + loop_state)"]
 ```
-
-## Key flows
-
-- **Write path:** `put` → Gate (auth/resolve/validate) → EntryStore (file + DB index + audit + FTS) → Materialize → Workflow Runner → reads knowledge → produces artifacts → Publisher → CLAUDE.md/AGENTS.md
-- **Read path:** `get` → Gate → Manifest resolver (key→path) → FileSystem (read bytes) → Format parser (md/json/yaml → envelope) → response
-- **Loop cycle:** intent → constraint → judgment → evidence → execution → feedback → (repeat); `pulse` returns position, `loop` returns flow + feedback signals
-- **Boot refresh:** writing `knowledge.boot` → Materialize → boot_refresh workflow → triggers produce on `artifacts.boot` → boot workflow regenerates
diff --git a/.textus/data/scratchpad/notes/0001-architecture-deepening-plan.md b/.textus/data/scratchpad/notes/0001-architecture-deepening-plan.md
deleted file mode 100644
index aec7115be..000000000
--- a/.textus/data/scratchpad/notes/0001-architecture-deepening-plan.md
+++ /dev/null
@@ -1,71 +0,0 @@
----
-uid: 578908fe598d9685
----
-# Implementation plan — architecture deepening phase 3
-
-## Phase 1: Container consolidation + Writer port + double-event fix
-Safe internal refactors. No breaking changes.
-
-### 1a. Add reader, writer, root to Infrastructure
-- Edit `lib/textus/store/infrastructure.rb` — add :reader, :writer, :root
-- Edit `lib/textus/store/builder.rb` — construct Reader + Writer, store in partial
-
-### 1b. Delete UseCaseContainer + ContainerHelpers + build_container_proxy
-- DELETE `lib/textus/store/use_case_container.rb`
-- DELETE `lib/textus/container_helpers.rb`
-- Edit `lib/textus/store.rb` — remove build_container_proxy, @container = @ctx
-- Edit `lib/textus/workflow/context.rb` — inline ContainerHelpers methods
-- Edit `lib/textus/workflow/runner.rb` — inline ContainerHelpers methods
-
-### 1c. Move call: to Writer method args + drop From factories
-- Edit `lib/textus/store/entry/writer.rb` — remove call from initialize, add to method sigs
-- delete Writer.from() — callers use container.writer
-- Edit `lib/textus/store/entry/reader.rb` — delete Reader.from(), callers use container.reader
-
-### 1d. Update all Writer callers
-- Edit use cases: put_entry, propose_entry, accept_proposal, delete_entry, move_entry
-- Edit workflow/runner.rb
-- Edit retention (wherever Writer called)
-  Writer.from(container:, call:) → container.writer.put(key, ..., call:)
-
-### 1e. Fix double-event bug
-- Remove events.publish(EntryWritten) from put_entry, propose_entry, accept_proposal, delete_entry, move_entry use cases
-- AuditIndex middleware stays as sole emitter
-
-## Phase 2: Manifest→workflow boundary
-Breaking. Coordinated commit.
-
-### 2a. Add DSL declarations to Workflow::DSL
-- Edit `lib/textus/workflow/dsl.rb`
-- Add priority(N), depends_on(pattern), ttl(string), on_expire(sym), publish(to:, template: nil)
-
-### 2b. Drop lifecycle fields from manifest parser
-- Remove publish, source, rules, worker from manifest schema
-- Raise helpful error: "moved to workflow DSL"
-- Remove publish_targets, publish_to, publish_tree from Entry::Base
-
-### 2c. Update Planner to read workflows
-- Edit `lib/textus/store/jobs/planner.rb`
-- producible_keys iterates workflows.all instead of manifest.data.entries
-- dependent_keys uses workflow depends_on
-
-### 2d. Update Publisher and Engine
-- Engine reads publish config from workflow definition
-- Publisher receives targets from caller
-
-## Phase 3: Cleanup
-Bonus deletions.
-
-### 3a. Remove Collector + Registry
-- DELETE collector.rb, registry.rb
-- Edit loader.rb — use plain array
-- Edit workflow.rb — pass registry kwarg
-
-### 3b. Remove HandlerRegistry
-- DELETE handler_registry.rb
-- Edit handler_resolver.rb — return plain hash
-- Edit pipeline.rb — .fetch() instead of .for()
-
-### 3c. Inline Publisher
-- DELETE publisher.rb
-- Edit engine.rb — inline 7 lines into publish_only
diff --git a/.textus/data/scratchpad/notes/0002-architecture-deepening-plan-v2.md b/.textus/data/scratchpad/notes/0002-architecture-deepening-plan-v2.md
deleted file mode 100644
index 11f39dfca..000000000
--- a/.textus/data/scratchpad/notes/0002-architecture-deepening-plan-v2.md
+++ /dev/null
@@ -1,155 +0,0 @@
----
-uid: 0b136bdf3ef55e5e
----
-# Implementation plan — architecture deepening v2
-
-Four candidates from architecture review (2026-07-02). Each phase is independent and lands safely on its own.
-
----
-
-## Phase 1: Use the container's Writer/Reader
-
-Replace 12 scattered `Writer.new(...)` constructions with `container.writer`. The `Infrastructure` Data.define already declares `:reader` and `:writer` fields (lines 13-14) but they're never referenced by consumers.
-
-### 1a. Wire Reader + Writer into Infrastructure (builder.rb)
-
-- Edit `lib/textus/store/builder.rb` — construct Reader + Writer alongside other ports, include in partial container
-  - After FileStore, Manifest, Schemas, AuditLog, Layout exist (already)
-  - Before Pipeline is built (so middleware can reference through partial)
-- Infrastructure gets fully populated `:reader` and `:writer` (currently nil)
-
-### 1b. Replace all `Writer.new(...)` call sites
-
-Each file: replace 8-10 line constructor block with `container.writer`. Update call sites:
-
-| File | Change |
-|---|---|
-| `lib/textus/use_cases/write/put_entry.rb:10` | `writer = container.writer` |
-| `lib/textus/use_cases/write/delete_key.rb:10` | same |
-| `lib/textus/use_cases/write/propose_entry.rb:19` | same |
-| `lib/textus/use_cases/write/accept_proposal.rb:45` | same |
-| `lib/textus/use_cases/write/move_key.rb:32` | same |
-| `lib/textus/use_cases/write/reject_proposal.rb:21` | same |
-| `lib/textus/use_cases/ops/ingest_entry.rb:98,126` | same |
-| `lib/textus/workflow/runner.rb:172,210` | same — enables Phase 3 |
-| `lib/textus/store/jobs/retention/base.rb:48` | same |
-
-### 1c. Update tests
-
-- `spec/conformance/use_cases_spec.rb:15` — already lists `reader` and `writer` as valid Infrastructure keys (verify)
-- `spec/support/fixtures.rb` — `build_envelope_reader/writer` helpers may need alignment (they construct directly, not via container)
-- All existing tests should pass without changes (Writer behaviour is identical, just wiring source differs)
-
-### 1d. Verify
-
-Run full suite: `bundle exec rspec`. Conformance specs enforce envelope shape at every seam — any wiring error surfaces immediately.
-
----
-
-## Phase 2: Flatten Jobs subsystem ceremony
-
-### 2a. Replace 3 pass-through job classes with dispatch hash
-
-Delete: `store/jobs/index.rb`, `store/jobs/materialize.rb`, `store/jobs/sweep.rb`
-
-Add a hash in `store/jobs/registry.rb` (or a constant in `planner.rb`):
-
-```ruby
-JOB_DISPATCH = {
-  "materialize" => ->(cmd, deps) { Produce::Engine.converge(key: cmd.key, deps) },
-  "index"       => ->(cmd, deps) { Index::Builder.new.rebuild! },
-  "sweep"       => ->(cmd, deps) { Retention::Sweep.new.call(cmd, deps) },
-}.freeze
-```
-
-The `Registry` already maps type strings; change its lookup to return from the hash instead of resolving a class.
-
-### 2b. Merge dual registries
-
-- Delete `lib/textus/jobs.rb` (top-level `Textus::Jobs` wrapper)
-- Collapse into `Store::Jobs::Registry` as the single registry
-- Update any reference to `Textus::Jobs` → `Store::Jobs::Registry`
-
-### 2c. Delete empty facade modules
-
-- Delete `lib/textus/store/jobs/retention.rb` (empty module, was just a namespace marker)
-- Delete `lib/textus/store/jobs/base.rb` (13-line abstract base class that just raises NoMethodError)
-- Delete `lib/textus/store/jobs/plan.rb` (11-line Data.define alias — inline the struct)
-
-### 2d. Verify
-
-- `spec/conformance/store/jobs/registry_completeness_spec.rb` — update to check hash keys instead of subclass registration
-- `bundle exec rspec`
-
----
-
-## Phase 3: Deepen the Workflow Runner
-
-### 3a. Extract `Workflow::Validator`
-
-- New file `lib/textus/workflow/validator.rb`
-- Move `Runner#validate_all`, `#all_matching_keys`, `#each_validate_step` into `Validator` class
-- Pass `definition` and `container` to constructor
-- Runner delegates to `Validator.new(@definition, @container).validate_all` (or wires via container)
-
-### 3b. Extract `Workflow::Publisher`
-
-- New file `lib/textus/workflow/publisher.rb`
-- Extract `Runner#write_and_publish`, `#built_in_publish`, plus shared `do_write` and `do_publish` methods
-- Accept `container`, `call`, `definition` via constructor
-- Single `publish(key, data, ctx)` entry point matching current `Runner#publish` signature
-- The `do_write` method: `container.writer.put(key, mentry:, payload:, call:)` (clean after Phase 1)
-- The `do_publish` method handles publish-via-targets vs publish-via-entry logic
-
-### 3c. Extract `StepScope` to own file
-
-- New file `lib/textus/workflow/step_scope.rb`
-- Move `Textus::Workflow::Runner::StepScope` class out
-- It already has no dependency on Runner internals (only `@data`, `@ctx`, `@container`, `@call`)
-
-### 3d. Clean up Runner
-
-- Remove extracted code, replace with delegation calls
-- Runner becomes: build context → execute steps → delegate publish = ~120-150 lines
-
-### 3e. Verify
-
-- `spec/integration/workflow/runner_spec.rb` — should pass without changes (same behaviour)
-- Add unit specs for `Publisher` and `Validator` in `spec/unit/workflow/`
-- `bundle exec rspec`
-
----
-
-## Phase 4: Delete facade + dead code
-
-### 4a. Delete Freshness Evaluator facade
-
-- Delete `lib/textus/store/freshness/evaluator.rb`
-- Edit `lib/textus/store/infrastructure.rb:16` — rename field `:freshness_evaluator` → `:ttl_evaluator`
-- Edit `lib/textus/store/builder.rb:19,44` — assign to `:ttl_evaluator` directly
-- Edit `lib/textus/use_cases/ops/doctor_store.rb:18` — `ttl_evaluator: nil`
-- Update specs:
-  - `spec/conformance/use_cases_spec.rb:15` — rename key
-  - `spec/unit/dispatch/handler_resolver_spec.rb:17` — rename key
-
-### 4b. Delete dead Invocation value object
-
-- Delete `lib/textus/value/invocation.rb`
-- No callers to update (grep confirmed zero references in lib or spec)
-
-### 4c. Verify
-
-- `bundle exec rspec`
-
----
-
-## Ordering
-
-```
-Phase 1 ──→ Phase 3 (depends on Phase 1 for writer cleanup)
-   │
-   └──→ Phase 2 (independent)
-   └──→ Phase 4 (independent)
-```
-
-Phase 1 first (enables Phase 3). Phase 2 and 4 can land in any order after.
diff --git a/.textus/data/scratchpad/notes/0003-plans-architecture-redesign.md b/.textus/data/scratchpad/notes/0003-plans-architecture-redesign.md
deleted file mode 100644
index 4a850f63a..000000000
--- a/.textus/data/scratchpad/notes/0003-plans-architecture-redesign.md
+++ /dev/null
@@ -1,769 +0,0 @@
----
-title: Architecture Redesign Plan
-uid: 52acce6ae1c53fe1
----
-# Architecture Redesign — WriteStep Chain, HANDLER_MANIFEST, entry/ops/rule API
-
-> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
-
-**Goal:** Three independent structural improvements: decompose `Entry::Writer#put` into a named step chain; replace `Container#build_pipeline`'s 80-line imperative registration with a declarative `HANDLER_MANIFEST`; and replace the 30 dynamically generated verb methods on `Store` with three noun-domain façade methods (`entry`, `ops`, `rule`).
-
-**Architecture:** Task 1 is purely internal (no callers change). Task 2 is a Container refactor that deletes the registration loop without changing any public API. Task 3 is the only externally visible change: CLI runner gets one-line update; existing generated verb methods are removed.
-
-**Tech Stack:** Ruby 3.x, Data.define, RSpec, bundle exec rspec
-
-## Global Constraints
-
-- No Co-Authored-By trailers in commits
-- All tests run with `bundle exec rspec`; lint with `bundle exec rubocop`
-- Breaking changes are acceptable — no compat shims
-- Stage specific files only, never `git add -A`
-
----
-
-## Task 1: WriteStep chain for Entry::Writer
-
-Decompose `Writer#put`'s sequential local-variable code into named step modules, each a pure `step.call(ctx, deps) → WriteContext`, reducible over a `DEFAULT_PUT` constant. `delete` and `move` are not changed.
-
-**Files:**
-- Create: `lib/textus/store/entry/write_step.rb`
-- Modify: `lib/textus/store/entry/writer.rb`
-- Create: `spec/unit/store/entry/write_step_spec.rb`
-
-**Interfaces:**
-- Produces: `Textus::Store::Entry::WriteStep::WriteContext`, `WriteStep::WriteDeps`, `WriteStep::DEFAULT_PUT`
-- `Writer#put` signature unchanged: `put(key, mentry:, payload:, if_etag: nil) → Envelope`
-
----
-
-- [ ] **Step 1: Write the failing test**
-
-```ruby
-# spec/unit/store/entry/write_step_spec.rb
-require "spec_helper"
-
-RSpec.describe Textus::Store::Entry::WriteStep do
-  let(:key) { "knowledge.demo" }
-  let(:mentry) { instance_double("Textus::Manifest::Entry::Leaf", format: :markdown, lane: "knowledge", schema: nil) }
-  let(:payload) { Textus::Value::Payload.new(meta: { "title" => "Demo" }, body: "hello", content: nil) }
-
-  describe "WriteContext" do
-    it "holds inputs and all step outputs as nil by default" do
-      ctx = described_class::WriteContext.new(
-        key: key, mentry: mentry, payload: payload, if_etag: nil,
-        path: nil, existing_env: nil, meta: nil, content: nil,
-        bytes: nil, eff_meta: nil, eff_body: nil, eff_content: nil,
-        etag_before: nil, envelope: nil
-      )
-      expect(ctx.key).to eq(key)
-      expect(ctx.path).to be_nil
-      expect(ctx.envelope).to be_nil
-    end
-
-    it "supports immutable update via #with" do
-      ctx = described_class::WriteContext.new(
-        key: key, mentry: mentry, payload: payload, if_etag: nil,
-        path: nil, existing_env: nil, meta: nil, content: nil,
-        bytes: nil, eff_meta: nil, eff_body: nil, eff_content: nil,
-        etag_before: nil, envelope: nil
-      )
-      updated = ctx.with(path: "/tmp/demo.md")
-      expect(updated.path).to eq("/tmp/demo.md")
-      expect(ctx.path).to be_nil
-    end
-  end
-
-  describe "DEFAULT_PUT" do
-    it "is an array of modules with .call" do
-      described_class::DEFAULT_PUT.each do |step|
-        expect(step).to respond_to(:call)
-      end
-    end
-
-    it "contains exactly the expected steps in order" do
-      names = described_class::DEFAULT_PUT.map(&:name).map { |n| n.split("::").last }
-      expect(names).to eq(%w[
-        ResolvePath ReadExisting InjectMeta Serialize
-        EnforceNameMatch ValidateSchema ValidateRaw
-        CheckEtag WriteBytes BuildEnvelope AppendAudit
-      ])
-    end
-  end
-end
-```
-
-- [ ] **Step 2: Run test to verify it fails**
-
-```
-bundle exec rspec spec/unit/store/entry/write_step_spec.rb -f doc
-```
-
-Expected: `NameError: uninitialized constant Textus::Store::Entry::WriteStep`
-
----
-
-- [ ] **Step 3: Create write_step.rb**
-
-```ruby
-# lib/textus/store/entry/write_step.rb
-module Textus
-  class Store
-    module Entry
-      module WriteStep
-        WriteContext = Data.define(
-          :key, :mentry, :payload, :if_etag,
-          :path, :existing_env,
-          :meta, :content,
-          :bytes, :eff_meta, :eff_body, :eff_content,
-          :etag_before, :envelope
-        ) do
-          def with(**attrs) = self.class.new(**to_h.merge(attrs))
-        end
-
-        WriteDeps = Data.define(
-          :file_store, :manifest, :schemas, :audit_log, :call, :reader, :layout
-        )
-
-        module ResolvePath
-          def self.call(ctx, deps)
-            path = deps.manifest.resolver.resolve(ctx.key).path
-            ctx.with(path:)
-          end
-        end
-
-        module ReadExisting
-          def self.call(ctx, deps)
-            existing_env = deps.reader.read(ctx.key)
-            ctx.with(existing_env:)
-          end
-        end
-
-        module InjectMeta
-          def self.call(ctx, deps)
-            existing_meta = ctx.existing_env ? ctx.existing_env.meta : {}
-            raw_meta = ctx.payload.meta || {}
-            meta, content = Envelope::Meta.inject_all(
-              raw_meta, ctx.payload.content, existing_meta,
-              format: ctx.mentry.format,
-              etag_for: method(:resolve_source_etag).curry.call(deps)
-            )
-            ctx.with(meta:, content:)
-          end
-
-          def self.resolve_source_etag(deps, key)
-            path = deps.manifest.resolver.resolve(key).path
-            return nil unless deps.file_store.exists?(path)
-
-            Value::Etag.for_file(path)
-          rescue Textus::Error
-            nil
-          end
-        end
-
-        module Serialize
-          def self.call(ctx, _deps)
-            bytes, eff_meta, eff_body, eff_content =
-              Textus::Format.for(ctx.mentry.format).serialize_for_put(
-                meta: ctx.meta, body: ctx.payload.body,
-                content: ctx.content, path: ctx.path
-              )
-            ctx.with(bytes:, eff_meta:, eff_body:, eff_content:)
-          end
-        end
-
-        module EnforceNameMatch
-          def self.call(ctx, _deps)
-            Textus::Format.for(ctx.mentry.format).enforce_name_match!(ctx.path, ctx.eff_meta)
-            ctx
-          end
-        end
-
-        module ValidateSchema
-          def self.call(ctx, deps)
-            schema = deps.schemas.fetch_or_nil(ctx.mentry.schema)
-            if schema
-              Format.for(ctx.mentry.format).validate_against(
-                schema,
-                { "_meta" => ctx.eff_meta, "content" => ctx.eff_content }
-              )
-            end
-            ctx
-          end
-        end
-
-        module ValidateRaw
-          def self.call(ctx, _deps)
-            Textus::Format.for(ctx.mentry.format).validate_raw_entry!(
-              { "_meta" => ctx.eff_meta, "content" => ctx.eff_content },
-              ctx.mentry.lane
-            )
-            ctx
-          end
-        end
-
-        module CheckEtag
-          def self.call(ctx, deps)
-            etag_before = deps.file_store.exists?(ctx.path) ? deps.file_store.etag(ctx.path) : nil
-            if ctx.if_etag && (etag_before != ctx.if_etag)
-              raise EtagMismatch.new(ctx.key, ctx.if_etag, etag_before)
-            end
-
-            ctx.with(etag_before:)
-          end
-        end
-
-        module WriteBytes
-          def self.call(ctx, deps)
-            deps.file_store.write(ctx.path, ctx.bytes)
-            ctx
-          end
-        end
-
-        module BuildEnvelope
-          def self.call(ctx, _deps)
-            envelope = Textus::Value::Envelope.build(
-              key: ctx.key, mentry: ctx.mentry, path: ctx.path,
-              meta: ctx.eff_meta, body: ctx.eff_body,
-              etag: Value::Etag.for_bytes(ctx.bytes),
-              content: ctx.eff_content
-            )
-            ctx.with(envelope:)
-          end
-        end
-
-        module AppendAudit
-          def self.call(ctx, deps)
-            extras = deps.call.correlation_id ? { "correlation_id" => deps.call.correlation_id } : nil
-            deps.audit_log.append(
-              role: deps.call.role, verb: "put", key: ctx.key,
-              etag_before: ctx.etag_before, etag_after: ctx.envelope.etag,
-              extras:
-            )
-            ctx
-          end
-        end
-
-        DEFAULT_PUT = [
-          ResolvePath, ReadExisting, InjectMeta, Serialize,
-          EnforceNameMatch, ValidateSchema, ValidateRaw,
-          CheckEtag, WriteBytes, BuildEnvelope, AppendAudit
-        ].freeze
-      end
-    end
-  end
-end
-```
-
-- [ ] **Step 4: Run test to verify it passes**
-
-```
-bundle exec rspec spec/unit/store/entry/write_step_spec.rb -f doc
-```
-
-Expected: all examples pass
-
----
-
-- [ ] **Step 5: Require write_step from writer.rb and replace Writer#put**
-
-Add `require_relative "write_step"` at the top of `lib/textus/store/entry/writer.rb`.
-
-Replace the `put` method body (currently lines 38–58) with:
-
-```ruby
-def put(key, mentry:, payload:, if_etag: nil)
-  ctx = WriteStep::WriteContext.new(
-    key:, mentry:, payload:, if_etag:,
-    path: nil, existing_env: nil, meta: nil, content: nil,
-    bytes: nil, eff_meta: nil, eff_body: nil, eff_content: nil,
-    etag_before: nil, envelope: nil
-  )
-  deps = WriteStep::WriteDeps.new(
-    file_store: @file_store, manifest: @manifest, schemas: @schemas,
-    audit_log: @audit_log, call: @call, reader: @reader, layout: @layout
-  )
-  ctx = WriteStep::DEFAULT_PUT.reduce(ctx) { |c, step| step.call(c, deps) }
-  ctx.envelope
-end
-```
-
-Remove these private methods (now in WriteStep modules, dead code):
-`read_existing`, `inject_meta`, `resolve_source_etag`, `resolve_path`, `serialize_entry`,
-`enforce_name_match!`, `validate_schema`, `validate_raw`, `check_etag!`, `write_bytes`,
-`build_envelope`, `audit_put`.
-
-Keep `delete`, `move`, `prune_empty_parents` unchanged.
-
-- [ ] **Step 6: Run full suite**
-
-```
-bundle exec rspec --format progress
-```
-
-Expected: passes (baseline: 4 pre-existing CLI conformance failures)
-
-- [ ] **Step 7: Commit**
-
-```bash
-git add lib/textus/store/entry/write_step.rb \
-        lib/textus/store/entry/writer.rb \
-        spec/unit/store/entry/write_step_spec.rb
-git commit -m "refactor: decompose Entry::Writer#put into WriteStep::DEFAULT_PUT chain"
-```
-
----
-
-## Task 2: HANDLER_MANIFEST + Dispatch::Assembler
-
-Replace `Container.build_pipeline`'s 80-line imperative loop with a declarative `HANDLER_MANIFEST`. Container's `build_pipeline` becomes a one-liner.
-
-**Files:**
-- Create: `lib/textus/dispatch/assembler.rb`
-- Modify: `lib/textus/store/container.rb` (replace lines 74–181)
-- Create: `spec/unit/dispatch/assembler_spec.rb`
-
-**Interfaces:**
-- Produces: `Textus::Dispatch::Assembler.build_pipeline(container:) → Pipeline`
-- Consumes: `Container.orchestration_for(container)` (existing, unchanged)
-
----
-
-- [ ] **Step 1: Write the failing conformance test**
-
-```ruby
-# spec/unit/dispatch/assembler_spec.rb
-require "spec_helper"
-
-RSpec.describe Textus::Dispatch::Assembler do
-  describe "HANDLER_MANIFEST" do
-    it "covers every contract in VERB_TO_CONTRACT" do
-      expected_contracts = Textus::VerbRegistry::VERB_TO_CONTRACT.values.to_set
-      manifest_contracts = described_class::HANDLER_MANIFEST.map(&:first).to_set
-      missing = expected_contracts - manifest_contracts
-      extra   = manifest_contracts - expected_contracts
-      expect(missing).to be_empty,
-        "in VERB_TO_CONTRACT but missing from HANDLER_MANIFEST: #{missing.map(&:name)}"
-      expect(extra).to be_empty,
-        "in HANDLER_MANIFEST but absent from VERB_TO_CONTRACT: #{extra.map(&:name)}"
-    end
-
-    it "each row is [contract_class, handler_class, Hash]" do
-      described_class::HANDLER_MANIFEST.each do |row|
-        expect(row.size).to eq(3), "row for #{row.first} has #{row.size} elements"
-        expect(row[0]).to be_a(Class)
-        expect(row[1]).to be_a(Class)
-        expect(row[2]).to be_a(Hash)
-      end
-    end
-
-    it "all dep_map values are Symbols in COMPUTED_KEYS" do
-      described_class::HANDLER_MANIFEST.each do |_contract, _handler, dep_map|
-        dep_map.each_value do |v|
-          expect(described_class::COMPUTED_KEYS).to include(v),
-            "dep_map value :#{v} is not in COMPUTED_KEYS"
-        end
-      end
-    end
-  end
-end
-```
-
-- [ ] **Step 2: Run test to verify it fails**
-
-```
-bundle exec rspec spec/unit/dispatch/assembler_spec.rb -f doc
-```
-
-Expected: `NameError: uninitialized constant Textus::Dispatch::Assembler`
-
----
-
-- [ ] **Step 3: Create assembler.rb**
-
-```ruby
-# lib/textus/dispatch/assembler.rb
-module Textus
-  module Dispatch
-    class Assembler
-      COMPUTED_KEYS = %i[
-        container manifest audit_log file_store job_store schemas link_edge_store fe orch
-      ].to_set.freeze
-
-      # [ContractClass, HandlerClass, { kwarg_name: :computed_key }]
-      # Computed key legend:
-      #   :container       → the Container itself
-      #   :manifest        → container.manifest
-      #   :audit_log       → container.audit_log
-      #   :file_store      → container.file_store
-      #   :job_store       → container.job_store
-      #   :schemas         → container.schemas
-      #   :link_edge_store → container.link_edge_store
-      #   :fe              → TtlEvaluator (built once)
-      #   :orch            → Orchestration (built once, shared by 4 handlers)
-      HANDLER_MANIFEST = [
-        [Contracts::GetEntry,        Handlers::Read::GetEntry,
-         { container: :container, freshness_evaluator: :fe }],
-        [Contracts::PutEntry,        Handlers::Write::PutEntry,        { container: :container }],
-        [Contracts::ListKeys,        Handlers::Read::ListKeys,         { manifest: :manifest, job_store: :job_store }],
-        [Contracts::DeleteKey,       Handlers::Write::DeleteKey,       { container: :container }],
-        [Contracts::MoveKey,         Handlers::Write::MoveKey,         { container: :container, manifest: :manifest }],
-        [Contracts::ProposeEntry,    Handlers::Write::ProposeEntry,    { container: :container }],
-        [Contracts::AcceptProposal,  Handlers::Write::AcceptProposal,  { container: :container }],
-        [Contracts::RejectProposal,  Handlers::Write::RejectProposal,  { container: :container }],
-        [Contracts::EnqueueJob,      Handlers::Write::EnqueueJob,      { job_store: :job_store }],
-        [Contracts::WhereEntry,      Handlers::Read::WhereEntry,       { manifest: :manifest }],
-        [Contracts::UidEntry,        Handlers::Read::UidEntry,         { container: :container }],
-        [Contracts::DepsEntry,       Handlers::Read::DepsEntry,        { manifest: :manifest }],
-        [Contracts::RdepsEntry,      Handlers::Read::RdepsEntry,
-         { manifest: :manifest, link_edge_store: :link_edge_store }],
-        [Contracts::BootStore,       Handlers::Maintenance::BootStore,       { container: :container }],
-        [Contracts::DoctorStore,     Handlers::Maintenance::DoctorStore,     { container: :container }],
-        [Contracts::PublishedEntries, Handlers::Maintenance::PublishedEntries, { manifest: :manifest }],
-        [Contracts::RuleExplain,     Handlers::Maintenance::RuleExplain,     { manifest: :manifest }],
-        [Contracts::RuleList,        Handlers::Maintenance::RuleList,        { manifest: :manifest }],
-        [Contracts::SchemaEnvelope,  Handlers::Maintenance::SchemaEnvelope,
-         { manifest: :manifest, schemas: :schemas }],
-        [Contracts::DrainStore,      Handlers::Maintenance::DrainStore,
-         { container: :container, job_store: :job_store }],
-        [Contracts::IngestEntry,     Handlers::Maintenance::IngestEntry,     { container: :container }],
-        [Contracts::JobsAction,      Handlers::Maintenance::JobsAction,      { job_store: :job_store }],
-        [Contracts::RuleLint,        Handlers::Maintenance::RuleLint,        { manifest: :manifest }],
-        [Contracts::DataMv,          Handlers::Write::DataMv,                { container: :container }],
-        [Contracts::AuditEntries,    Handlers::Read::AuditEntries,
-         { manifest: :manifest, audit_log: :audit_log }],
-        [Contracts::PulseEntries,    Handlers::Read::PulseEntries,
-         { manifest: :manifest, audit_log: :audit_log,
-           file_store: :file_store, job_store: :job_store, orchestration: :orch }],
-        [Contracts::BlameEntry,      Handlers::Read::BlameEntry,
-         { manifest: :manifest, orchestration: :orch }],
-        [Contracts::KeyMvPrefix,     Handlers::Write::KeyMvPrefix,     { orchestration: :orch }],
-        [Contracts::KeyDeletePrefix, Handlers::Write::KeyDeletePrefix, { orchestration: :orch }],
-      ].freeze
-
-      MIDDLEWARE_MANIFEST = [
-        ->(_c) { Middleware::Binder.new },
-        ->(_c) { Middleware::Auth.new },
-        ->(c)  { Middleware::AuditIndex.new(job_store: c.job_store, audit_log: c.audit_log) },
-        ->(_c) { Middleware::Cascade.new },
-      ].freeze
-
-      def self.build_pipeline(container:)
-        fe   = freshness_evaluator(container)
-        orch = Store::Container.orchestration_for(container)
-
-        computed = {
-          container:,
-          manifest:        container.manifest,
-          audit_log:       container.audit_log,
-          file_store:      container.file_store,
-          job_store:       container.job_store,
-          schemas:         container.schemas,
-          link_edge_store: container.link_edge_store,
-          fe:,
-          orch:,
-        }
-
-        registry = HandlerRegistry.new
-        HANDLER_MANIFEST.each do |contract_class, handler_class, dep_map|
-          deps = dep_map.transform_values { |key| computed.fetch(key) }
-          registry.register(contract_class, handler_class.new(**deps))
-        end
-
-        middleware = MIDDLEWARE_MANIFEST.map { |factory| factory.call(container) }
-        Pipeline.new(registry:, container:, middleware:)
-      end
-
-      def self.freshness_evaluator(container)
-        Store::Freshness::TtlEvaluator.new(
-          manifest: container.manifest,
-          file_stat: Textus::Port::Storage::FileStat.new,
-          clock: Textus::Port::Clock.new,
-        )
-      end
-    end
-  end
-end
-```
-
-- [ ] **Step 4: Run test to verify it passes**
-
-```
-bundle exec rspec spec/unit/dispatch/assembler_spec.rb -f doc
-```
-
-Expected: all 3 examples pass
-
----
-
-- [ ] **Step 5: Replace Container.build_pipeline with a one-liner**
-
-In `lib/textus/store/container.rb`:
-
-Replace the entire `build_pipeline` private class method body (lines 74–158) with:
-
-```ruby
-def self.build_pipeline(container)
-  Dispatch::Assembler.build_pipeline(container:)
-end
-private_class_method :build_pipeline
-```
-
-Remove the `self.freshness_evaluator` private class method (lines 175–181) — moved to Assembler.
-
-Add `require_relative "../dispatch/assembler"` in the correct place in `lib/textus/init.rb` (after `dispatch/pipeline`).
-
-- [ ] **Step 6: Run full suite**
-
-```
-bundle exec rspec --format progress
-```
-
-Expected: same pass count as after Task 1
-
-- [ ] **Step 7: Commit**
-
-```bash
-git add lib/textus/dispatch/assembler.rb \
-        lib/textus/store/container.rb \
-        spec/unit/dispatch/assembler_spec.rb
-git add lib/textus/init.rb
-git commit -m "refactor: replace Container#build_pipeline with declarative HANDLER_MANIFEST in Dispatch::Assembler"
-```
-
----
-
-## Task 3: entry/ops/rule surface API on Store
-
-Replace the 30 dynamically generated verb methods with three noun-domain façade methods.
-
-**Files:**
-- Modify: `lib/textus/verb_registry.rb` — add `ENTRY_VERBS`, `OPS_VERBS`, `RULE_VERBS`, `VERB_DOMAIN`; delete `Store.class_eval` block
-- Modify: `lib/textus/store.rb` — add `entry`, `ops`, `rule`, `_dispatch_in_domain`
-- Modify: `lib/textus/surface/cli/runner.rb` — update one dispatch line (~line 62)
-- Modify: all specs calling old verb methods
-
-**Domain mapping:**
-- `entry`: `get put list key_delete key_mv propose accept reject audit blame where uid deps rdeps ingest`
-- `ops`: `boot drain doctor pulse jobs enqueue data_mv key_mv_prefix key_delete_prefix published`
-- `rule`: `rule_explain rule_list schema_show rule_lint`
-
-**Call-site translation table:**
-```
-store.get(key: "x")                          → store.entry(:get, key: "x")
-store.put(key: "x", body: "y")               → store.entry(:put, key: "x", body: "y")
-store.list(prefix: "x")                      → store.entry(:list, prefix: "x")
-store.key_delete(key: "x")                   → store.entry(:key_delete, key: "x")
-store.key_mv(old_key: "a", new_key: "b")     → store.entry(:key_mv, old_key: "a", new_key: "b")
-store.propose(key: "x", body: "y")           → store.entry(:propose, key: "x", body: "y")
-store.accept(pending_key: "queue.pending.x") → store.entry(:accept, pending_key: "queue.pending.x")
-store.reject(pending_key: "queue.pending.x") → store.entry(:reject, pending_key: "queue.pending.x")
-store.audit(key: "x")                        → store.entry(:audit, key: "x")
-store.blame(key: "x")                        → store.entry(:blame, key: "x")
-store.where(key: "x")                        → store.entry(:where, key: "x")
-store.uid(key: "x")                          → store.entry(:uid, key: "x")
-store.deps(key: "x")                         → store.entry(:deps, key: "x")
-store.rdeps(key: "x")                        → store.entry(:rdeps, key: "x")
-store.ingest(kind: "url", slug: "x", url: y) → store.entry(:ingest, kind: "url", slug: "x", url: y)
-store.drain                                  → store.ops(:drain)
-store.boot                                   → store.ops(:boot)
-store.pulse(since: 0)                        → store.ops(:pulse, since: 0)
-store.doctor                                 → store.ops(:doctor)
-store.jobs(state: "ready")                   → store.ops(:jobs, state: "ready")
-store.enqueue(type: "x", args: {})           → store.ops(:enqueue, type: "x", args: {})
-store.data_mv(from: "a", to: "b")            → store.ops(:data_mv, from: "a", to: "b")
-store.key_mv_prefix(from_prefix: "a", to_prefix: "b") → store.ops(:key_mv_prefix, from_prefix: "a", to_prefix: "b")
-store.key_delete_prefix(prefix: "x")        → store.ops(:key_delete_prefix, prefix: "x")
-store.published                              → store.ops(:published)
-store.rule_explain(key: "x")                → store.rule(:rule_explain, key: "x")
-store.rule_list                              → store.rule(:rule_list)
-store.schema_show(key: "x")                 → store.rule(:schema_show, key: "x")
-store.rule_lint(candidate_yaml: "x")        → store.rule(:rule_lint, candidate_yaml: "x")
-```
-
----
-
-- [ ] **Step 1: Write failing tests**
-
-Add inside `RSpec.describe Textus::Store do` in `spec/integration/store_spec.rb`:
-
-```ruby
-describe "noun-domain API" do
-  let(:store) { described_class.new(root) }
-
-  describe "#entry" do
-    it "dispatches :list without arguments" do
-      result = store.entry(:list)
-      expect(result).to be_an(Array)
-    end
-
-    it "raises ArgumentError for a non-entry verb" do
-      expect { store.entry(:drain) }.to raise_error(ArgumentError, /drain.*not in this domain/)
-    end
-
-    it "raises ArgumentError for an unknown verb" do
-      expect { store.entry(:frobnicate) }.to raise_error(ArgumentError, /unknown verb/)
-    end
-  end
-
-  describe "#ops" do
-    it "dispatches :boot" do
-      result = store.ops(:boot)
-      expect(result).to be_a(Hash)
-    end
-
-    it "raises ArgumentError for a non-ops verb" do
-      expect { store.ops(:get) }.to raise_error(ArgumentError, /get.*not in this domain/)
-    end
-  end
-
-  describe "#rule" do
-    it "dispatches :rule_list" do
-      result = store.rule(:rule_list)
-      expect(result).to be_an(Array)
-    end
-
-    it "raises ArgumentError for a non-rule verb" do
-      expect { store.rule(:put) }.to raise_error(ArgumentError, /put.*not in this domain/)
-    end
-  end
-end
-```
-
-- [ ] **Step 2: Run tests to verify they fail**
-
-```
-bundle exec rspec spec/integration/store_spec.rb -e "noun-domain" -f doc
-```
-
-Expected: `NoMethodError: undefined method 'entry'`
-
----
-
-- [ ] **Step 3: Add verb-domain constants to verb_registry.rb**
-
-After the `CONTRACT_TO_VERB` constant in `lib/textus/verb_registry.rb`, add:
-
-```ruby
-ENTRY_VERBS = %i[
-  get put list key_delete key_mv propose accept reject
-  audit blame where uid deps rdeps ingest
-].freeze
-
-OPS_VERBS = %i[
-  boot drain doctor pulse jobs enqueue data_mv
-  key_mv_prefix key_delete_prefix published
-].freeze
-
-RULE_VERBS = %i[rule_explain rule_list schema_show rule_lint].freeze
-
-VERB_DOMAIN = (
-  ENTRY_VERBS.to_h { |v| [v, :entry] }
-    .merge(OPS_VERBS.to_h { |v| [v, :ops] })
-    .merge(RULE_VERBS.to_h { |v| [v, :rule] })
-).freeze
-```
-
-Delete the entire `Textus::Store.class_eval do ... end` block at the bottom of the file.
-
-- [ ] **Step 4: Add entry/ops/rule to Store**
-
-In `lib/textus/store.rb`, after `def dry_run? = @dry_run`, add:
-
-```ruby
-def entry(verb, **opts)
-  _dispatch_in_domain(verb, VerbRegistry::ENTRY_VERBS, **opts)
-end
-
-def ops(verb, **opts)
-  _dispatch_in_domain(verb, VerbRegistry::OPS_VERBS, **opts)
-end
-
-def rule(verb, **opts)
-  _dispatch_in_domain(verb, VerbRegistry::RULE_VERBS, **opts)
-end
-```
-
-In the `private` section, add:
-
-```ruby
-def _dispatch_in_domain(verb, allowed, **opts)
-  unless allowed.include?(verb)
-    raise ArgumentError, "#{verb} is not in this domain (allowed: #{allowed.first(4).join(', ')}...)"
-  end
-
-  spec = VerbRegistry.for(verb)
-  raise ArgumentError, "unknown verb: #{verb}" unless spec
-
-  pending = Dispatch::Binder.command(spec, opts)
-  call    = Value::Call.build(role: @role, correlation_id: @correlation_id)
-  result  = @container.pipeline.dispatch(pending, call: call)
-  Value::Result.extract(result)
-end
-```
-
-- [ ] **Step 5: Update CLI runner dispatch**
-
-In `lib/textus/surface/cli/runner.rb`, find:
-
-```ruby
-result = s.public_send(spec.verb, **inputs)
-```
-
-Replace with:
-
-```ruby
-domain = Textus::VerbRegistry::VERB_DOMAIN.fetch(spec.verb) do
-  raise Textus::UsageError.new("#{spec.verb} has no domain assignment")
-end
-result = s.public_send(domain, spec.verb, **inputs)
-```
-
-- [ ] **Step 6: Run new tests**
-
-```
-bundle exec rspec spec/integration/store_spec.rb -e "noun-domain" -f doc
-```
-
-Expected: all 7 examples pass
-
----
-
-- [ ] **Step 7: Find and fix all callers of old verb methods in specs**
-
-```bash
-grep -rn "\bstore\.\(get\|put\|list\|drain\|boot\|pulse\|propose\|accept\|reject\|audit\|blame\|where\|uid\|deps\|rdeps\|ingest\|doctor\|published\|rule_explain\|rule_list\|schema_show\|rule_lint\|key_delete\|key_mv\|enqueue\|data_mv\|key_mv_prefix\|key_delete_prefix\|jobs\)(" spec/
-```
-
-Update each match using the translation table in the Interfaces section.
-
-- [ ] **Step 8: Check lib/ for Store method calls**
-
-```bash
-grep -rn "\bstore\.\(get\|put\|list\|drain\|boot\|pulse\|propose\|accept\|reject\)(" lib/
-```
-
-Update any matches.
-
-- [ ] **Step 9: Run full suite**
-
-```
-bundle exec rspec --format progress
-```
-
-Expected: same pass count as after Task 2
-
-- [ ] **Step 10: Rubocop**
-
-```
-bundle exec rubocop lib/textus/store.rb lib/textus/verb_registry.rb lib/textus/surface/cli/runner.rb
-```
-
-Fix offenses.
-
-- [ ] **Step 11: Commit**
-
-```bash
-git add lib/textus/verb_registry.rb lib/textus/store.rb lib/textus/surface/cli/runner.rb
-git add spec/
-git commit -m "feat: replace generated verb methods with entry/ops/rule noun-domain API on Store"
-```
diff --git a/.textus/data/scratchpad/notes/0004-plan-1-boot-wire-typed-events.md b/.textus/data/scratchpad/notes/0004-plan-1-boot-wire-typed-events.md
deleted file mode 100644
index 9a4029dbc..000000000
--- a/.textus/data/scratchpad/notes/0004-plan-1-boot-wire-typed-events.md
+++ /dev/null
@@ -1,1132 +0,0 @@
----
-title: Boot.wire + Typed Events Implementation Plan
-uid: 5dc9ddf4b7126ce6
----
-# Boot.wire + Typed Events Implementation Plan
-
-> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
-
-**Goal:** Replace `Store::Container` with a frozen `Store::Ctx` struct, convert all 29 handlers to pure modules, introduce a session-scoped `Event::Bus` with typed events, and wire everything through a flat `Boot.wire` method.
-
-**Architecture:** `Store::Ctx = Data.define(...)` replaces Container as the boot-time dependency bundle. Pure handler modules declare `HANDLES` and `NEEDS` constants; `HandlerResolver` discovers them by convention and injects sliced deps at boot. `Event::Bus` is session-scoped (one per `Boot.wire` call); write handlers emit typed events; `CascadeSubscriber` subscribes at boot, replacing the `Cascade` middleware entirely. `Boot.wire(root)` builds everything top-down in one linear pass with no `wire!` dance.
-
-**Tech Stack:** Ruby 3.x, Data.define, RSpec, bundle exec rspec
-
-## Global Constraints
-
-- No Co-Authored-By trailers in commits
-- All tests: `bundle exec rspec`; lint: `bundle exec rubocop -A`
-- Breaking changes OK — no compat shims
-- Stage specific files only, never `git add -A`
-- Baseline: 4 pre-existing CLI conformance failures (pre-existing, not regressions)
-
----
-
-## File Map
-
-### New files
-- `lib/textus/store/ctx.rb` — `Store::Ctx = Data.define(...)`
-- `lib/textus/event.rb` — typed event structs under `Textus::Event::`
-- `lib/textus/event/bus.rb` — `Event::Bus` class
-- `lib/textus/produce/cascade_subscriber.rb` — extracted from Cascade middleware
-- `lib/textus/dispatch/handler_resolver.rb` — replaces Assembler
-- `spec/unit/store/ctx_spec.rb`
-- `spec/unit/event/bus_spec.rb`
-- `spec/unit/dispatch/handler_resolver_spec.rb`
-- `spec/unit/produce/cascade_subscriber_spec.rb`
-
-### Converted (all handlers → pure modules)
-- `lib/textus/handlers/read/*.rb` (9 files)
-- `lib/textus/handlers/write/*.rb` (10 files)
-- `lib/textus/handlers/maintenance/*.rb` (10 files)
-
-### Modified
-- `lib/textus/store.rb` — `build_container` → `Boot.wire`; `@container` → `@ctx`
-- `lib/textus/boot.rb` — `Boot.wire` method added
-
-### Deleted
-- `lib/textus/store/container.rb`
-- `lib/textus/dispatch/assembler.rb`
-- `lib/textus/dispatch/middleware/cascade.rb`
-
----
-
-## Task 1: Store::Ctx + Event::Bus + Typed Events
-
-Pure value objects. No behaviour, no deps. All subsequent tasks depend on these constants existing.
-
-**Files:**
-- Create: `lib/textus/store/ctx.rb`
-- Create: `lib/textus/event.rb`
-- Create: `lib/textus/event/bus.rb`
-- Create: `spec/unit/store/ctx_spec.rb`
-- Create: `spec/unit/event/bus_spec.rb`
-
-**Interfaces:**
-- Produces: `Textus::Store::Ctx` (Data.define with 10 fields), `Textus::Event::Bus`, 6 event structs under `Textus::Event::`
-
----
-
-- [ ] **Step 1: Write failing tests**
-
-```ruby
-# spec/unit/store/ctx_spec.rb
-require "spec_helper"
-
-RSpec.describe Textus::Store::Ctx do
-  it "is a Data.define with all ten fields" do
-    expect(described_class.members).to contain_exactly(
-      :manifest, :file_store, :schemas, :audit_log,
-      :job_store, :layout, :link_edge_store, :workflows,
-      :event_bus, :pipeline,
-    )
-  end
-
-  it "supports #with for immutable update" do
-    ctx = described_class.new(
-      manifest: :m, file_store: :fs, schemas: :sc, audit_log: :al,
-      job_store: :js, layout: :ly, link_edge_store: :les, workflows: :wf,
-      event_bus: :eb, pipeline: nil,
-    )
-    updated = ctx.with(pipeline: :p)
-    expect(updated.pipeline).to eq(:p)
-    expect(ctx.pipeline).to be_nil
-  end
-end
-```
-
-```ruby
-# spec/unit/event/bus_spec.rb
-require "spec_helper"
-
-RSpec.describe Textus::Event::Bus do
-  let(:bus) { described_class.new }
-
-  describe "typed events" do
-    it "EntryWritten has expected fields" do
-      ev = Textus::Event::EntryWritten.new(
-        key: "k", role: "human", etag_before: nil, etag_after: "a", occurred_at: Time.now
-      )
-      expect(ev.key).to eq("k")
-      expect(ev.role).to eq("human")
-    end
-  end
-
-  describe "#subscribe / #emit" do
-    it "delivers the event to the matching subscriber" do
-      received = []
-      bus.subscribe(Textus::Event::EntryWritten) { |e| received << e }
-      ev = Textus::Event::EntryWritten.new(
-        key: "k", role: "human", etag_before: nil, etag_after: "a", occurred_at: Time.now
-      )
-      bus.emit(ev)
-      expect(received).to eq([ev])
-    end
-
-    it "does not deliver to subscribers for a different class" do
-      received = []
-      bus.subscribe(Textus::Event::EntryDeleted) { |e| received << e }
-      bus.emit(Textus::Event::EntryWritten.new(
-        key: "k", role: "human", etag_before: nil, etag_after: "a", occurred_at: Time.now
-      ))
-      expect(received).to be_empty
-    end
-
-    it "two bus instances are completely isolated" do
-      bus2 = described_class.new
-      received = []
-      bus.subscribe(Textus::Event::EntryWritten) { |e| received << e }
-      bus2.emit(Textus::Event::EntryWritten.new(
-        key: "k", role: "human", etag_before: nil, etag_after: "a", occurred_at: Time.now
-      ))
-      expect(received).to be_empty
-    end
-
-    it "supports multiple subscribers for the same event class" do
-      calls = []
-      bus.subscribe(Textus::Event::EntryWritten) { |_e| calls << 1 }
-      bus.subscribe(Textus::Event::EntryWritten) { |_e| calls << 2 }
-      bus.emit(Textus::Event::EntryWritten.new(
-        key: "k", role: "human", etag_before: nil, etag_after: "a", occurred_at: Time.now
-      ))
-      expect(calls).to eq([1, 2])
-    end
-  end
-end
-```
-
-- [ ] **Step 2: Run tests to verify they fail**
-
-```
-bundle exec rspec spec/unit/store/ctx_spec.rb spec/unit/event/bus_spec.rb -f doc
-```
-
-Expected: `NameError: uninitialized constant Textus::Store::Ctx` and similar.
-
----
-
-- [ ] **Step 3: Create Store::Ctx**
-
-```ruby
-# lib/textus/store/ctx.rb
-module Textus
-  class Store
-    Ctx = Data.define(
-      :manifest,        # Textus::Manifest
-      :file_store,      # Port::Storage::FileStore
-      :schemas,         # Schema::Registry
-      :audit_log,       # Port::AuditLog
-      :job_store,       # Port::Store
-      :layout,          # Store::Layout
-      :link_edge_store, # Links::LinkEdgeStore
-      :workflows,       # Workflow::Registry
-      :event_bus,       # Event::Bus (session-scoped)
-      :pipeline,        # Dispatch::Pipeline (nil until Boot.wire finishes)
-    )
-  end
-end
-```
-
-- [ ] **Step 4: Create typed events**
-
-```ruby
-# lib/textus/event.rb
-module Textus
-  module Event
-    EntryWritten     = Data.define(:key, :role, :etag_before, :etag_after, :occurred_at)
-    EntryDeleted     = Data.define(:key, :role, :etag_before, :occurred_at)
-    EntryMoved       = Data.define(:from_key, :to_key, :role, :etag_before, :etag_after, :occurred_at)
-    ProposalOpened   = Data.define(:key, :proposal_key, :role, :occurred_at)
-    ProposalAccepted = Data.define(:proposal_key, :target_key, :role, :occurred_at)
-    ProposalRejected = Data.define(:proposal_key, :role, :occurred_at)
-  end
-end
-```
-
-- [ ] **Step 5: Create Event::Bus**
-
-```ruby
-# lib/textus/event/bus.rb
-module Textus
-  module Event
-    class Bus
-      def initialize
-        @subscribers = Hash.new { |h, k| h[k] = [] }
-      end
-
-      def subscribe(event_class, &block)
-        @subscribers[event_class] << block
-        self
-      end
-
-      def emit(event)
-        @subscribers[event.class].each { |sub| sub.call(event) }
-      end
-    end
-  end
-end
-```
-
-- [ ] **Step 6: Run tests to verify they pass**
-
-```
-bundle exec rspec spec/unit/store/ctx_spec.rb spec/unit/event/bus_spec.rb -f doc
-```
-
-Expected: all examples pass.
-
-- [ ] **Step 7: Commit**
-
-```bash
-git add lib/textus/store/ctx.rb lib/textus/event.rb lib/textus/event/bus.rb \
-        spec/unit/store/ctx_spec.rb spec/unit/event/bus_spec.rb
-git commit -m "feat: add Store::Ctx, typed Event structs, and session-scoped Event::Bus"
-```
-
----
-
-## Task 2: CascadeSubscriber
-
-Extract trigger logic from `Dispatch::Middleware::Cascade` into a plain subscriber object that reacts to typed events. This is the last consumer of the old Cascade middleware — once done, Cascade can be deleted.
-
-**Files:**
-- Create: `lib/textus/produce/cascade_subscriber.rb`
-- Create: `spec/unit/produce/cascade_subscriber_spec.rb`
-
-**Interfaces:**
-- Consumes: `Textus::Event::EntryWritten`, `EntryDeleted`, `EntryMoved`, `ProposalAccepted`, `ProposalRejected` from Task 1
-- Produces: `Textus::Produce::CascadeSubscriber` with `on_entry_written`, `on_entry_deleted`, `on_entry_moved`, `on_proposal_accepted`, `on_proposal_rejected` methods
-
----
-
-- [ ] **Step 1: Write the failing test**
-
-```ruby
-# spec/unit/produce/cascade_subscriber_spec.rb
-require "spec_helper"
-
-RSpec.describe Textus::Produce::CascadeSubscriber do
-  let(:job_store)  { instance_double(Textus::Port::Store) }
-  let(:manifest)   { instance_double(Textus::Manifest) }
-  let(:workflows)  { instance_double(Textus::Workflow::Registry) }
-  let(:file_store) { instance_double(Textus::Port::Storage::FileStore) }
-  let(:subscriber) do
-    described_class.new(
-      manifest: manifest, workflows: workflows,
-      job_store: job_store, file_store: file_store,
-    )
-  end
-
-  describe "#on_entry_written" do
-    it "enqueues cascade jobs for the written key" do
-      planner = instance_double(Textus::Store::Jobs::Planner, plan: [])
-      allow(Textus::Store::Jobs::Planner).to receive(:new).and_return(planner)
-      allow(Textus::Store::Jobs::Queue).to receive(:new).and_return(
-        instance_double(Textus::Store::Jobs::Queue, enqueue: nil)
-      )
-
-      ev = Textus::Event::EntryWritten.new(
-        key: "knowledge.foo", role: "human",
-        etag_before: nil, etag_after: "abc", occurred_at: Time.now
-      )
-      expect { subscriber.on_entry_written(ev) }.not_to raise_error
-    end
-  end
-end
-```
-
-- [ ] **Step 2: Run test to verify it fails**
-
-```
-bundle exec rspec spec/unit/produce/cascade_subscriber_spec.rb -f doc
-```
-
-Expected: `NameError: uninitialized constant Textus::Produce::CascadeSubscriber`
-
----
-
-- [ ] **Step 3: Create CascadeSubscriber**
-
-The logic mirrors the existing `Cascade` middleware's trigger map. The subscriber receives an event and uses the existing `Jobs::Planner` + `Jobs::Queue` to plan and enqueue jobs.
-
-```ruby
-# lib/textus/produce/cascade_subscriber.rb
-module Textus
-  module Produce
-    class CascadeSubscriber
-      def initialize(manifest:, workflows:, job_store:, file_store:)
-        @manifest   = manifest
-        @workflows  = workflows
-        @job_store  = job_store
-        @file_store = file_store
-      end
-
-      def on_entry_written(event)
-        trigger_cascade("entry.written", event.key, event.role)
-      end
-
-      def on_entry_deleted(event)
-        trigger_cascade("entry.deleted", event.key, event.role)
-      end
-
-      def on_entry_moved(event)
-        trigger_cascade("entry.moved", event.to_key, event.role)
-      end
-
-      def on_proposal_accepted(event)
-        trigger_cascade("proposal.accepted", event.target_key, event.role)
-      end
-
-      def on_proposal_rejected(event)
-        trigger_cascade("proposal.rejected", event.proposal_key, event.role)
-      end
-
-      private
-
-      def trigger_cascade(trigger_type, key, role)
-        container = build_container_proxy
-        jobs = Textus::Store::Jobs::Planner.new(container: container).plan(
-          trigger: { "type" => trigger_type, "target" => key },
-          role: role,
-        )
-        queue = Textus::Store::Jobs::Queue.new(store: @job_store)
-        jobs.each { |j| queue.enqueue(j) }
-      end
-
-      # Minimal struct the Planner uses from container
-      ContainerProxy = Data.define(:manifest, :workflows, :job_store, :file_store)
-
-      def build_container_proxy
-        ContainerProxy.new(
-          manifest: @manifest, workflows: @workflows,
-          job_store: @job_store, file_store: @file_store,
-        )
-      end
-    end
-  end
-end
-```
-
-- [ ] **Step 4: Run test to verify it passes**
-
-```
-bundle exec rspec spec/unit/produce/cascade_subscriber_spec.rb -f doc
-```
-
-- [ ] **Step 5: Commit**
-
-```bash
-git add lib/textus/produce/cascade_subscriber.rb spec/unit/produce/cascade_subscriber_spec.rb
-git commit -m "feat: add CascadeSubscriber — event-driven replacement for Cascade middleware"
-```
-
----
-
-## Task 3: HandlerResolver
-
-Discovers pure handler modules by convention, slices `Ctx` fields matching their `NEEDS`, builds the dispatch registry. Write it against a synthetic handler module — no real handler conversion needed yet.
-
-**Files:**
-- Create: `lib/textus/dispatch/handler_resolver.rb`
-- Create: `spec/unit/dispatch/handler_resolver_spec.rb`
-
-**Interfaces:**
-- Consumes: `Store::Ctx` from Task 1; handler modules with `HANDLES` (Contract class) and `NEEDS` (Array of Symbols matching Ctx fields)
-- Produces: `Textus::Dispatch::HandlerResolver.build(ctx) → HandlerRegistry`; `HandlerResolver.eager_load!`
-
----
-
-- [ ] **Step 1: Write the failing test**
-
-```ruby
-# spec/unit/dispatch/handler_resolver_spec.rb
-require "spec_helper"
-
-RSpec.describe Textus::Dispatch::HandlerResolver do
-  FakeContract = Data.define(:key) unless defined?(FakeContract)
-
-  let(:fake_manifest)   { instance_double(Textus::Manifest) }
-  let(:fake_job_store)  { instance_double(Textus::Port::Store) }
-
-  let(:ctx) do
-    Textus::Store::Ctx.new(
-      manifest: fake_manifest, file_store: :fs, schemas: :sc,
-      audit_log: :al, job_store: fake_job_store, layout: :ly,
-      link_edge_store: :les, workflows: :wf, event_bus: :eb, pipeline: nil,
-    )
-  end
-
-  let(:fake_handler) do
-    Module.new do
-      const_set(:HANDLES, FakeContract)
-      const_set(:NEEDS, %i[manifest job_store].freeze)
-
-      def self.call(command, call, deps)
-        Textus::Value::Result.success({ "deps_manifest" => deps.manifest })
-      end
-    end
-  end
-
-  describe ".build" do
-    it "registers the handler for its contract and injects declared deps" do
-      registry = described_class.build(ctx, handlers: [fake_handler])
-      handler_fn = registry.lookup(FakeContract)
-      expect(handler_fn).not_to be_nil
-
-      result = handler_fn.call(FakeContract.new(key: "x"), Textus::Value::Call.build(role: "human"))
-      expect(result.value["deps_manifest"]).to eq(fake_manifest)
-    end
-
-    it "raises Boot::DepNotFound when a NEEDS field is missing from Ctx" do
-      bad_handler = Module.new do
-        const_set(:HANDLES, FakeContract)
-        const_set(:NEEDS, %i[nonexistent_field].freeze)
-        def self.call(_command, _call, _deps); end
-      end
-
-      expect { described_class.build(ctx, handlers: [bad_handler]) }
-        .to raise_error(Textus::Boot::DepNotFound, /nonexistent_field/)
-    end
-  end
-end
-```
-
-- [ ] **Step 2: Run test to verify it fails**
-
-```
-bundle exec rspec spec/unit/dispatch/handler_resolver_spec.rb -f doc
-```
-
-Expected: `NameError: uninitialized constant Textus::Dispatch::HandlerResolver`
-
----
-
-- [ ] **Step 3: Create HandlerResolver**
-
-```ruby
-# lib/textus/dispatch/handler_resolver.rb
-module Textus
-  module Boot
-    DepNotFound = Class.new(Textus::Error)
-  end
-
-  module Dispatch
-    module HandlerResolver
-      HANDLER_NAMESPACES = [
-        Handlers::Read, Handlers::Write, Handlers::Maintenance,
-      ].freeze
-
-      module_function
-
-      def eager_load!
-        handlers_dir = File.expand_path("../../handlers", __FILE__)
-        Dir[File.join(handlers_dir, "**", "*.rb")].sort.each { |f| require f }
-      end
-
-      # Builds a HandlerRegistry by discovering all modules in HANDLER_NAMESPACES
-      # that define HANDLES and NEEDS, then slicing Ctx to satisfy each NEEDS list.
-      #
-      # Pass handlers: [...] in tests to inject specific modules without eager_load!.
-      def build(ctx, handlers: nil)
-        handler_modules = handlers || discover_all
-        ctx_hash = ctx.to_h
-
-        registry = HandlerRegistry.new
-        handler_modules.each do |mod|
-          next unless mod.const_defined?(:HANDLES) && mod.const_defined?(:NEEDS)
-
-          contract_class = mod::HANDLES
-          needs          = mod::NEEDS
-
-          deps_hash = needs.to_h do |field|
-            unless ctx_hash.key?(field)
-              raise Boot::DepNotFound.new(
-                "boot_dep_not_found",
-                "handler #{mod.name || mod.inspect} needs :#{field} but Ctx has no such field",
-              )
-            end
-            [field, ctx_hash[field]]
-          end
-
-          dep_struct = Data.define(*needs).new(**deps_hash)
-
-          registry.register(contract_class, ->(command, call) { mod.call(command, call, dep_struct) })
-        end
-        registry
-      end
-
-      def discover_all
-        HANDLER_NAMESPACES.flat_map do |ns|
-          ns.constants(false).filter_map { |c| ns.const_get(c) }.select { |v| v.is_a?(Module) }
-        end
-      end
-    end
-  end
-end
-```
-
-- [ ] **Step 4: Run test to verify it passes**
-
-```
-bundle exec rspec spec/unit/dispatch/handler_resolver_spec.rb -f doc
-```
-
-- [ ] **Step 5: Commit**
-
-```bash
-git add lib/textus/dispatch/handler_resolver.rb spec/unit/dispatch/handler_resolver_spec.rb
-git commit -m "feat: add HandlerResolver — discovers pure handler modules by convention"
-```
-
----
-
-## Task 4: Convert read handlers to pure modules
-
-Convert all 9 read handlers from class-based to pure module style with `HANDLES`, `NEEDS`, `self.call(command, call, deps)`. No behaviour change — only structure changes.
-
-**Files (all modified):**
-- `lib/textus/handlers/read/get_entry.rb`
-- `lib/textus/handlers/read/list_keys.rb`
-- `lib/textus/handlers/read/where_entry.rb`
-- `lib/textus/handlers/read/uid_entry.rb`
-- `lib/textus/handlers/read/deps_entry.rb`
-- `lib/textus/handlers/read/rdeps_entry.rb`
-- `lib/textus/handlers/read/audit_entries.rb`
-- `lib/textus/handlers/read/blame_entry.rb`
-- `lib/textus/handlers/read/pulse_entries.rb`
-
-**Conversion pattern** — every handler follows this template:
-
-```ruby
-# BEFORE (class):
-module Textus::Handlers::Read
-  class FooBar
-    def initialize(manifest:, job_store:)
-      @manifest  = manifest
-      @job_store = job_store
-    end
-    def call(command, call)
-      # uses @manifest, @job_store
-    end
-  end
-end
-
-# AFTER (pure module):
-module Textus::Handlers::Read
-  module FooBar
-    HANDLES = Dispatch::Contracts::FooBar
-    NEEDS   = %i[manifest job_store].freeze
-
-    def self.call(command, call, deps)
-      # replace @manifest → deps.manifest
-      # replace @job_store → deps.job_store
-    end
-  end
-end
-```
-
-Each handler's `NEEDS` list comes from its old `initialize` keyword args. The `call` body is unchanged except `@field` → `deps.field`.
-
-**Special case — GetEntry:** Currently uses `container:` and `freshness_evaluator:` in initialize. After conversion:
-
-```ruby
-module Textus::Handlers::Read
-  module GetEntry
-    HANDLES = Dispatch::Contracts::GetEntry
-    NEEDS   = %i[manifest file_store workflows link_edge_store freshness_evaluator].freeze
-    # Note: freshness_evaluator is NOT a Ctx field — it must be computed in Boot.wire
-    # and injected as a pre-built dep. Add :freshness_evaluator to Ctx (Task 6).
-    # For now, convert with NEEDS = %i[container freshness_evaluator].freeze
-    # and replace @container.xxx with deps.container.xxx — full dep-injection comes in Task 6.
-    NEEDS   = %i[container freshness_evaluator].freeze
-
-    def self.call(command, _call, deps)
-      envelope = Store::Entry::Reader.from(container: deps.container).read(command.key)
-      return Value::Result.failure(:not_found, "no entry at #{command.key}") unless envelope
-
-      envelope = expand_sources(envelope, depth: 0, container: deps.container)
-      Value::Result.success(
-        envelope.with(freshness: deps.freshness_evaluator.verdict(
-          deps.container.manifest.resolver.resolve(command.key).entry
-        ))
-      )
-    end
-
-    MAX_SOURCE_DEPTH = 5
-
-    def self.expand_sources(envelope, depth:, container:)
-      return envelope if depth >= MAX_SOURCE_DEPTH
-      raw_sources = Array(envelope.meta["sources"])
-      return envelope if raw_sources.empty?
-      expanded = raw_sources.map { |src| expand_one_source(src, depth: depth, container: container) }
-      envelope.with(sources: expanded)
-    end
-
-    def self.expand_one_source(src, depth:, container:)
-      src = { "key" => src } if src.is_a?(String)
-      return src unless src.is_a?(Hash) && src["key"].is_a?(String)
-      key = src["key"]
-      stored_etag = src["etag"]
-      current_etag = resolve_current_etag(key, container: container)
-      suspended = stored_etag && current_etag ? stored_etag != current_etag : false
-      result = src.merge("suspended" => suspended)
-      child_env = container.reader.read(key)
-      if child_env
-        child_expanded = expand_sources(child_env, depth: depth + 1, container: container)
-        child_sources = Array(child_expanded.sources)
-        result = result.merge("sources" => child_sources) unless child_sources.empty?
-      end
-      result
-    end
-
-    def self.resolve_current_etag(key, container:)
-      path = container.manifest.resolver.resolve(key).path
-      return nil unless container.file_store.exists?(path)
-      container.file_store.etag(path)
-    rescue Textus::Error
-      nil
-    end
-
-    def self.resolve_entry(key, container:)
-      container.manifest.resolver.resolve(key).entry
-    end
-  end
-end
-```
-
-> **Note on container:** Several handlers (GetEntry, PulseEntries, BlameEntry, UidEntry) currently take `container:` as a dep. During this conversion, keep `NEEDS = %i[container ...]` for those. The full dep-granularity (removing `container:` as a dep entirely) is a follow-up refactor once Ctx is the container.
-
----
-
-- [ ] **Step 1: Convert `list_keys.rb` (simplest — pure deps, no container)**
-
-```ruby
-# lib/textus/handlers/read/list_keys.rb
-module Textus
-  module Handlers
-    module Read
-      module ListKeys
-        HANDLES = Dispatch::Contracts::ListKeys
-        NEEDS   = %i[manifest job_store].freeze
-
-        def self.call(command, _call, deps)
-          # identical body to current, replacing @manifest → deps.manifest, @job_store → deps.job_store
-          rows = deps.manifest.resolver.enumerate(
-            prefix: command.prefix,
-            lane: command.lane,
-            q: command.q,
-            schema: command.schema,
-          )
-          Value::Result.success(rows)
-        end
-      end
-    end
-  end
-end
-```
-
-- [ ] **Step 2: Run full suite to confirm list_keys still works**
-
-```
-bundle exec rspec spec/conformance/surface/cli/surface_spec.rb -f doc
-```
-
-Expected: CLI list verb passes.
-
-- [ ] **Step 3: Convert remaining 8 read handlers**
-
-Apply the same `class → module` + `@field → deps.field` + add `HANDLES`/`NEEDS` pattern to:
-- `where_entry.rb` — `NEEDS = %i[manifest].freeze`
-- `uid_entry.rb` — `NEEDS = %i[container].freeze`
-- `deps_entry.rb` — `NEEDS = %i[manifest].freeze`
-- `rdeps_entry.rb` — `NEEDS = %i[manifest link_edge_store].freeze`
-- `audit_entries.rb` — `NEEDS = %i[manifest audit_log].freeze`
-- `blame_entry.rb` — `NEEDS = %i[manifest orchestration].freeze` (orchestration still needed — see note below)
-- `pulse_entries.rb` — `NEEDS = %i[manifest audit_log file_store job_store orchestration].freeze`
-- `get_entry.rb` — `NEEDS = %i[container freshness_evaluator].freeze` (see GetEntry block above)
-
-> **Orchestration note:** `blame_entry` and `pulse_entries` use `orchestration:`. Keep it as a Ctx field for now — `Boot.wire` (Task 6) will build it once and inject it. Add `:orchestration` to `Ctx` members in `ctx.rb`.
-
-- [ ] **Step 4: Run full suite**
-
-```
-bundle exec rspec --format progress
-```
-
-Expected: same pass count as before this task (existing 4 pre-existing CLI failures baseline).
-
-- [ ] **Step 5: Commit**
-
-```bash
-git add lib/textus/handlers/read/
-git commit -m "refactor: convert all read handlers to pure modules (HANDLES/NEEDS/self.call)"
-```
-
----
-
-## Task 5: Convert write + maintenance handlers to pure modules
-
-Same pattern as Task 4. 19 handlers total.
-
-**Files (all modified):**
-- Write (10): `accept_proposal`, `data_mv`, `delete_key`, `enqueue_job`, `key_delete_prefix`, `key_mv_prefix`, `move_key`, `propose_entry`, `put_entry`, `reject_proposal`
-- Maintenance (10): `boot_store`, `doctor_store`, `drain_store`, `ingest_entry`, `jobs_action`, `published_entries`, `rule_explain`, `rule_lint`, `rule_list`, `schema_envelope`
-
-**NEEDS mapping for write handlers:**
-
-| Handler | NEEDS |
-|---|---|
-| `AcceptProposal` | `%i[container]` |
-| `DataMv` | `%i[container]` |
-| `DeleteKey` | `%i[container]` |
-| `EnqueueJob` | `%i[job_store]` |
-| `KeyDeletePrefix` | `%i[orchestration]` |
-| `KeyMvPrefix` | `%i[orchestration]` |
-| `MoveKey` | `%i[container manifest]` |
-| `ProposeEntry` | `%i[container]` |
-| `PutEntry` | `%i[container event_bus]` |
-| `RejectProposal` | `%i[container event_bus]` |
-
-**NEEDS mapping for maintenance handlers:**
-
-| Handler | NEEDS |
-|---|---|
-| `BootStore` | `%i[container]` |
-| `DoctorStore` | `%i[container]` |
-| `DrainStore` | `%i[container job_store]` |
-| `IngestEntry` | `%i[container]` |
-| `JobsAction` | `%i[job_store]` |
-| `PublishedEntries` | `%i[manifest]` |
-| `RuleExplain` | `%i[manifest]` |
-| `RuleLint` | `%i[manifest]` |
-| `RuleList` | `%i[manifest]` |
-| `SchemaEnvelope` | `%i[manifest schemas]` |
-
-**Event emission for PutEntry:**
-
-```ruby
-module Textus::Handlers::Write
-  module PutEntry
-    HANDLES = Dispatch::Contracts::PutEntry
-    NEEDS   = %i[container event_bus].freeze
-
-    def self.call(command, call, deps)
-      Textus::Manifest::Data.validate_key!(command.key)
-      mentry  = deps.container.manifest.resolver.resolve(command.key).entry
-      writer  = Store::Entry::Writer.from(container: deps.container, call: call)
-      envelope = writer.put(
-        command.key,
-        mentry: mentry,
-        payload: Textus::Value::Payload.new(
-          meta: command.meta, body: command.body, content: command.content,
-        ),
-        if_etag: command.if_etag,
-      )
-      deps.event_bus.emit(Textus::Event::EntryWritten.new(
-        key:         command.key,
-        role:        call.role,
-        etag_before: nil,
-        etag_after:  envelope.etag,
-        occurred_at: call.now,
-      ))
-      Value::Result.success(envelope)
-    end
-  end
-end
-```
-
-Apply equivalent event emission to `DeleteKey`, `MoveKey`, `AcceptProposal`, `RejectProposal`, `ProposeEntry` with their corresponding event types.
-
----
-
-- [ ] **Step 1: Convert all 10 write handlers** (apply class→module pattern from Task 4)
-
-- [ ] **Step 2: Run write-related specs**
-
-```
-bundle exec rspec spec/conformance/write/ spec/integration/store_spec.rb -f progress
-```
-
-- [ ] **Step 3: Convert all 10 maintenance handlers**
-
-- [ ] **Step 4: Run full suite**
-
-```
-bundle exec rspec --format progress
-```
-
-Expected: same pass count baseline.
-
-- [ ] **Step 5: Commit**
-
-```bash
-git add lib/textus/handlers/write/ lib/textus/handlers/maintenance/
-git commit -m "refactor: convert all write+maintenance handlers to pure modules with event emission"
-```
-
----
-
-## Task 6: Boot.wire + Update Store
-
-Build the top-down wiring function. Update `Store` to use it. This is the integration task.
-
-**Files:**
-- Modify: `lib/textus/store/ctx.rb` — add `:orchestration` and `:freshness_evaluator` fields
-- Modify: `lib/textus/boot.rb` — add `Boot.wire(root)` method
-- Modify: `lib/textus/store.rb` — replace `build_container` with `Boot.wire`; `@container` → `@ctx`
-
-**Interfaces:**
-- Consumes: all Tasks 1–5
-- Produces: `Boot.wire(root) → Textus::Store::Ctx` (frozen)
-
----
-
-- [ ] **Step 1: Extend Ctx with orchestration and freshness_evaluator**
-
-Update `lib/textus/store/ctx.rb`:
-
-```ruby
-# lib/textus/store/ctx.rb
-module Textus
-  class Store
-    Ctx = Data.define(
-      :manifest, :file_store, :schemas, :audit_log,
-      :job_store, :layout, :link_edge_store, :workflows,
-      :event_bus, :pipeline,
-      :orchestration,        # Textus::Orchestration (shared by 4 handlers)
-      :freshness_evaluator,  # Store::Freshness::TtlEvaluator
-    )
-  end
-end
-```
-
-Update `spec/unit/store/ctx_spec.rb` to include the new fields in `contain_exactly`.
-
-- [ ] **Step 2: Write Boot.wire integration test**
-
-```ruby
-# spec/integration/boot_wire_spec.rb
-require "spec_helper"
-
-RSpec.describe "Boot.wire" do
-  include_context "textus_store_fixture"
-
-  it "builds a frozen Ctx with all fields populated" do
-    ctx = Textus::Boot.wire(root)
-    expect(ctx).to be_frozen
-    expect(ctx.manifest).to be_a(Textus::Manifest)
-    expect(ctx.file_store).to be_a(Textus::Port::Storage::FileStore)
-    expect(ctx.schemas).to be_a(Textus::Schema::Registry)
-    expect(ctx.audit_log).to be_a(Textus::Port::AuditLog)
-    expect(ctx.job_store).to be_a(Textus::Port::Store)
-    expect(ctx.layout).to be_a(Textus::Store::Layout)
-    expect(ctx.link_edge_store).to be_a(Textus::Links::LinkEdgeStore)
-    expect(ctx.workflows).to be_a(Textus::Workflow::Registry)
-    expect(ctx.event_bus).to be_a(Textus::Event::Bus)
-    expect(ctx.pipeline).to be_a(Textus::Dispatch::Pipeline)
-    expect(ctx.orchestration).to be_a(Textus::Orchestration)
-    expect(ctx.freshness_evaluator).to be_a(Textus::Store::Freshness::TtlEvaluator)
-  end
-
-  it "pipeline responds to every registered contract" do
-    ctx  = Textus::Boot.wire(root)
-    call = Textus::Value::Call.build(role: "human")
-    Textus::VerbRegistry::VERB_TO_CONTRACT.each_value do |contract_class|
-      expect { ctx.pipeline.dispatch(contract_class.new, call: call) }
-        .not_to raise_error(Textus::Dispatch::UnknownHandler)
-    end
-  end
-end
-```
-
-- [ ] **Step 3: Implement Boot.wire in boot.rb**
-
-```ruby
-# lib/textus/boot.rb — add the wire method inside the existing Boot module
-module Textus
-  module Boot
-    def self.wire(root)
-      Dispatch::HandlerResolver.eager_load!
-
-      manifest        = Manifest.load(root)
-      layout          = Store::Layout.new(root)
-      file_store      = Port::Storage::FileStore.new
-      schemas         = Schema::Registry.new(layout.schemas_dir)
-      audit_log       = Port::AuditLog.new(
-        layout: layout,
-        max_size: manifest.data.audit_config[:max_size],
-        keep:     manifest.data.audit_config[:keep],
-      )
-      job_store       = Port::Store.new(root: root).setup!
-      link_edge_store = Links::LinkEdgeStore.new
-      workflows       = Workflow::Loader.load_all(root)
-      event_bus       = Event::Bus.new
-
-      freshness_evaluator = Store::Freshness::TtlEvaluator.new(
-        manifest:  manifest,
-        file_stat: Port::Storage::FileStat.new,
-        clock:     Port::Clock.new,
-      )
-
-      # Register cascade subscriber
-      cascade = Produce::CascadeSubscriber.new(
-        manifest: manifest, workflows: workflows,
-        job_store: job_store, file_store: file_store,
-      )
-      event_bus.subscribe(Event::EntryWritten,     &cascade.method(:on_entry_written))
-      event_bus.subscribe(Event::EntryDeleted,     &cascade.method(:on_entry_deleted))
-      event_bus.subscribe(Event::EntryMoved,       &cascade.method(:on_entry_moved))
-      event_bus.subscribe(Event::ProposalAccepted, &cascade.method(:on_proposal_accepted))
-      event_bus.subscribe(Event::ProposalRejected, &cascade.method(:on_proposal_rejected))
-
-      ctx_seed = Store::Ctx.new(
-        manifest: manifest, file_store: file_store, schemas: schemas,
-        audit_log: audit_log, job_store: job_store, layout: layout,
-        link_edge_store: link_edge_store, workflows: workflows,
-        event_bus: event_bus, pipeline: nil,
-        freshness_evaluator: freshness_evaluator,
-        orchestration: build_orchestration(manifest, audit_log, job_store),
-      )
-
-      registry   = Dispatch::HandlerResolver.build(ctx_seed)
-      middleware = [
-        Dispatch::Middleware::Binder.new,
-        Dispatch::Middleware::Auth.new,
-        Dispatch::Middleware::AuditIndex.new(job_store: job_store, audit_log: audit_log),
-      ]
-      pipeline   = Dispatch::Pipeline.new(registry: registry, container: ctx_seed, middleware: middleware)
-
-      ctx_seed.with(pipeline: pipeline).freeze
-    end
-
-    def self.build_orchestration(manifest, audit_log, job_store)
-      Orchestration.new(
-        list_keys:    Handlers::Read::ListKeys,
-        move_key:     Handlers::Write::MoveKey,
-        delete_key:   Handlers::Write::DeleteKey,
-        audit_entries: Handlers::Read::AuditEntries,
-        manifest:     manifest,
-        audit_log:    audit_log,
-        job_store:    job_store,
-      )
-    end
-  end
-end
-```
-
-> **Note:** `Orchestration.new` signature may need updating since handlers are now modules not instances. Verify `Orchestration` internals and adjust `build_orchestration` accordingly.
-
-- [ ] **Step 4: Update Store to use Boot.wire**
-
-In `lib/textus/store.rb`, replace `build_container` and update all `@container` references:
-
-```ruby
-# Replace:
-def initialize(root, role: Value::Role::DEFAULT, correlation_id: nil, dry_run: false, container: nil)
-  @root = File.expand_path(root)
-  @container = container || build_container(@root)
-  # ...
-end
-
-# With:
-def initialize(root, role: Value::Role::DEFAULT, correlation_id: nil, dry_run: false, ctx: nil)
-  @root = File.expand_path(root)
-  @ctx  = ctx || Boot.wire(@root)
-  @role = role.to_s
-  @correlation_id = correlation_id || SecureRandom.uuid
-  @dry_run = dry_run
-  build_session!
-end
-```
-
-Replace every `@container` reference with `@ctx`. Replace the `Textus::Store::Container.attribute_names.each` delegation block at the top with `Store::Ctx.members.each`. Delete `build_container` private method.
-
-In `_dispatch_in_domain`, replace:
-```ruby
-result = @container.pipeline.dispatch(pending, call: call)
-```
-with:
-```ruby
-result = @ctx.pipeline.dispatch(pending, call: call)
-```
-
-In `build_session!`, replace:
-```ruby
-@cursor      = @container.audit_log.latest_seq
-@propose_lane = @container.manifest.policy.propose_lane_for(@role)
-@contract_etag = Value::Etag.for_contract(@root)
-```
-with:
-```ruby
-@cursor        = @ctx.audit_log.latest_seq
-@propose_lane  = @ctx.manifest.policy.propose_lane_for(@role)
-@contract_etag = Value::Etag.for_contract(@root)
-```
-
-- [ ] **Step 5: Run integration test and full suite**
-
-```
-bundle exec rspec spec/integration/boot_wire_spec.rb -f doc
-bundle exec rspec --format progress
-```
-
-Expected: Boot.wire spec passes; full suite at baseline pass count.
-
-- [ ] **Step 6: Commit**
-
-```bash
-git add lib/textus/store/ctx.rb lib/textus/boot.rb lib/textus/store.rb \
-        spec/integration/boot_wire_spec.rb spec/unit/store/ctx_spec.rb
-git commit -m "feat: Boot.wire replaces build_container — Store holds frozen Ctx"
-```
-
----
-
-## Task 7: Delete deprecated files + conformance guard
-
-Remove `Container`, `Assembler`, and `Cascade` middleware. Add a conformance spec that every registered verb contract has a handler module discoverable by `HandlerResolver`.
-
-**Files:**
-- Delete: `lib/textus/store/container.rb`
-- Delete: `lib/textus/dispatch/assembler.rb`
-- Delete: `lib/textus/dispatch/middleware/cascade.rb`
-- Delete: `spec/unit/store/container_read_family_spec.rb` (tests Container which is gone)
-- Delete: `spec/unit/dispatch/assembler_spec.rb` (replaced by handler_resolver_spec)
-- Modify: `spec/integration/store/container_spec.rb` → rename/rewrite for Ctx
-- Create: `spec/conformance/dispatch/handler_completeness_spec.rb`
-
----
-
-- [ ] **Step 1: Delete the three deprecated lib files**
-
-```bash
-git rm lib/textus/store/container.rb \
-       lib/textus/dispatch/assembler.rb \
-       lib/textus/dispatch/middleware/cascade.rb
-```
-
-- [ ] **Step 2: Run full suite — fix any lingering references**
-
-```
-bundle exec rspec --format progress 2>&1 | grep "NameError\|uninitialized" | head -10
-```
-
-Fix any remaining `Container`, `Assembler`, or `Cascade` references in lib or spec files.
-
-- [ ] **Step 3: Rewrite container_spec.rb as ctx_spec (integration)**
-
-```ruby
-# spec/integration/store/ctx_spec.rb (rename from container_spec.rb)
-require "spec_helper"
-
-RSpec.describe Textus::Store::Ctx do
-  include_context "textus_store_fixture"
-
-  it "bundles all required collaborators after Boot.wire" do
-    ctx = Textus::Boot.wire(root)
-    expect(ctx.manifest).to be_a(Textus::Manifest)
-    expect(ctx.file_store).to be_a(Textus::Port::Storage::FileStore)
-    expect(ctx.schemas).to be_a(Textus::Schema::Registry)
-    expect(ctx.audit_log).to be_a(Textus::Port::AuditLog)
-    expect(ctx.job_store).to be_a(Textus::Port::Store)
-    expect(ctx.pipeline).to be_a(Textus::Dispatch::Pipeline)
-  end
-end
-```
-
-- [ ] **Step 4: Write completeness conformance spec**
-
-```ruby
-# spec/conformance/dispatch/handler_completeness_spec.rb
-require "spec_helper"
-
-RSpec.describe "Handler completeness" do
-  it "every VERB_TO_CONTRACT entry has a discoverable pure handler module" do
-    Textus::Dispatch::HandlerResolver.eager_load!
-    modules = Textus::Dispatch::HandlerResolver.discover_all
-    handles_set = modules.filter_map { |m| m::HANDLES if m.const_defined?(:HANDLES) }.to_set
-
-    missing = Textus::VerbRegistry.registered
-                                  .filter_map { |s| Textus::VerbRegistry.contract_class_for(s.verb) }
-                                  .reject { |c| handles_set.include?(c) }
-
-    expect(missing).to be_empty,
-      "contracts with no pure handler module: #{missing.map(&:name)}"
-  end
-end
-```
-
-- [ ] **Step 5: Run full suite**
-
-```
-bundle exec rspec --format progress
-```
-
-Expected: 0 failures (baseline 4 pre-existing CLI conformance failures only).
-
-- [ ] **Step 6: Commit**
-
-```bash
-git add -A  # safe here — only deleting known files + adding new spec
-git commit -m "chore: delete Container, Assembler, Cascade middleware — Boot.wire+HandlerResolver replace them"
-```
diff --git a/.textus/data/scratchpad/notes/0005-spec-1-boot-wire-typed-events.md b/.textus/data/scratchpad/notes/0005-spec-1-boot-wire-typed-events.md
deleted file mode 100644
index 7c6d5cb95..000000000
--- a/.textus/data/scratchpad/notes/0005-spec-1-boot-wire-typed-events.md
+++ /dev/null
@@ -1,268 +0,0 @@
----
-title: 'Spec 1: Boot.wire + Typed Events'
-uid: 51c10f29fafadb4a
----
-# Spec 1: Boot.wire + Typed Events
-
-**Date:** 2026-06-30  
-**Status:** Approved  
-**Scope:** Eliminate `Store::Container` as a class; introduce `Boot.wire`, pure handler modules, session-scoped `Event::Bus`, and typed lifecycle events.
-
----
-
-## Problem
-
-`Store::Container` is a coupling sink: it knows every handler, owns the two-phase `wire!` initialization, and must be edited whenever a handler changes or a new verb is added. Event emission from handlers (currently implicit side-effects deep in writers and middleware) is untraceable and unsubscribable from outside the pipeline.
-
----
-
-## Goals
-
-- Container disappears as a class. No callers touch it.
-- Adding a handler means creating one file. No registration list to edit.
-- Lifecycle events are typed `Data.define` structs emitted to a session-scoped bus.
-- External observers (metrics, logging, future webhooks) subscribe to the bus with the same interface as internal ones (Cascade).
-- Tests get a clean `Boot.wire`-based setup with no global state to reset.
-
----
-
-## Architecture
-
-### 1. `Ctx` — frozen boot-time dependency bundle
-
-Replaces `Container`. Built once in `Boot.wire`, frozen, held by `Store`.
-
-```ruby
-Textus::Store::Ctx = Data.define(
-  :manifest,        # Manifest
-  :file_store,      # Port::Storage::FileStore
-  :schemas,         # Schema::Registry
-  :audit_log,       # Port::AuditLog
-  :job_store,       # Port::Store
-  :layout,          # Store::Layout
-  :link_edge_store, # Links::LinkEdgeStore
-  :workflows,       # Workflow::Registry
-  :event_bus,       # Event::Bus (session-scoped)
-  :pipeline,        # Dispatch::Pipeline
-)
-```
-
-`Store` holds `@ctx` instead of `@container`. All existing `container.manifest`, `container.file_store` delegation patterns survive — they now delegate to `@ctx`. `Container` class is deleted. `Dispatch::Assembler` is deleted (replaced by `HandlerResolver`).
-
-### 2. Pure handler modules
-
-Every handler becomes a module with two constants and one class method. No `include`, no `initialize`, no instance state.
-
-```ruby
-module Textus::Handlers::Write::PutEntry
-  HANDLES = Dispatch::Contracts::PutEntry
-  NEEDS   = %i[manifest file_store schemas audit_log layout event_bus].freeze
-
-  def self.call(command, call, deps)
-    # command: the typed contract struct
-    # call:    Value::Call (role, correlation_id, dry_run, now)
-    # deps:    frozen struct sliced from Ctx by HandlerResolver at boot
-    #
-    # ... write logic via WriteStep::DEFAULT_PUT ...
-    #
-    deps.event_bus.emit(Event::EntryWritten.new(
-      key:         command.key,
-      role:        call.role,
-      etag_before: etag_before,
-      etag_after:  envelope.etag,
-      occurred_at: call.now,
-    ))
-    Value::Result.success(envelope)
-  end
-end
-```
-
-Handlers never see `Ctx` directly — only the fields they declared in `NEEDS`.
-
-### 3. `HandlerResolver`
-
-Discovers handlers by naming convention. Called once in `Boot.wire`. Replaces `Dispatch::Assembler`.
-
-```ruby
-module Textus::Dispatch::HandlerResolver
-  def self.build(ctx)
-    # Walks Handlers::Read::*, Handlers::Write::*, Handlers::Maintenance::*
-    # For each module defining HANDLES + NEEDS:
-    #   1. Slices ctx fields matching NEEDS (raises Boot::DepNotFound if missing)
-    #   2. Builds a frozen DepStruct from sliced fields
-    #   3. Registers: contract_class → ->(command, call) { mod.call(command, call, deps) }
-    registry = HandlerRegistry.new
-    each_handler_module do |mod|
-      deps = build_deps(mod::NEEDS, ctx)
-      registry.register(mod::HANDLES, ->(command, call) { mod.call(command, call, deps) })
-    end
-    registry
-  end
-
-  def self.eager_load!
-    # Requires all handler files before boot so HANDLES/NEEDS are defined
-    Dir[File.expand_path("../../handlers/**/*.rb", __FILE__)].sort.each { |f| require f }
-  end
-end
-```
-
-`eager_load!` is called at the start of `Boot.wire`. A missing `NEEDS` field raises `Boot::DepNotFound` at boot — not at first dispatch. A conformance spec asserts that every contract in `VerbRegistry` has a registered handler (same role as the existing `assembler_spec.rb`).
-
-### 4. `Event::Bus` — session-scoped
-
-```ruby
-class Textus::Event::Bus
-  def initialize
-    @subscribers = Hash.new { |h, k| h[k] = [] }
-  end
-
-  def subscribe(event_class, &block)
-    @subscribers[event_class] << block
-    self
-  end
-
-  def emit(event)
-    @subscribers[event.class].each { |sub| sub.call(event) }
-  end
-end
-```
-
-One `Event::Bus` per `Boot.wire` call — one per `Store` session. `emit` is synchronous. Subscriber errors propagate to the emitting handler. Two concurrent `Store` instances have independent buses.
-
-### 5. Typed events
-
-```ruby
-module Textus::Event
-  EntryWritten     = Data.define(:key, :role, :etag_before, :etag_after, :occurred_at)
-  EntryDeleted     = Data.define(:key, :role, :etag_before, :occurred_at)
-  EntryMoved       = Data.define(:from_key, :to_key, :role, :etag_before, :etag_after, :occurred_at)
-  ProposalOpened   = Data.define(:key, :proposal_key, :role, :occurred_at)
-  ProposalAccepted = Data.define(:proposal_key, :target_key, :role, :occurred_at)
-  ProposalRejected = Data.define(:proposal_key, :role, :occurred_at)
-end
-```
-
-Write handlers emit exactly one event. Read handlers emit nothing. `occurred_at` comes from `Value::Call#now` — observers never call `Time.now` themselves.
-
-### 6. `Boot.wire`
-
-Flat, linear, no two-phase dance. Replaces `Store#build_container`.
-
-```ruby
-module Textus::Boot
-  def self.wire(root)
-    HandlerResolver.eager_load!
-
-    manifest        = Manifest.load(root)
-    layout          = Store::Layout.new(root)
-    file_store      = Port::Storage::FileStore.new
-    schemas         = Schema::Registry.new(layout.schemas_dir)
-    audit_log       = Port::AuditLog.new(layout:, **manifest.data.audit_config)
-    job_store       = Port::Store.new(root:).setup!
-    link_edge_store = Links::LinkEdgeStore.new
-    workflows       = Workflow::Loader.load_all(root)
-    event_bus       = Event::Bus.new
-
-    # Wire cascade subscriber
-    cascade = Produce::CascadeSubscriber.new(manifest:, workflows:, job_store:, file_store:)
-    event_bus.subscribe(Event::EntryWritten,     &cascade.method(:on_entry_written))
-    event_bus.subscribe(Event::EntryDeleted,     &cascade.method(:on_entry_deleted))
-    event_bus.subscribe(Event::EntryMoved,       &cascade.method(:on_entry_moved))
-    event_bus.subscribe(Event::ProposalAccepted, &cascade.method(:on_proposal_accepted))
-
-    ctx_seed = Store::Ctx.new(
-      manifest:, file_store:, schemas:, audit_log:, job_store:,
-      layout:, link_edge_store:, workflows:, event_bus:, pipeline: nil
-    )
-
-    registry   = HandlerResolver.build(ctx_seed)
-    middleware = [
-      Dispatch::Middleware::Binder.new,
-      Dispatch::Middleware::Auth.new,
-      Dispatch::Middleware::AuditIndex.new(job_store: ctx_seed.job_store, audit_log: ctx_seed.audit_log),
-    ]
-    pipeline   = Dispatch::Pipeline.new(registry:, container: ctx_seed, middleware:)
-
-    ctx_seed.with(pipeline:).freeze
-  end
-end
-```
-
-`ctx_seed.with(pipeline:).freeze` produces the final `Ctx` in one step. The `wire!` two-phase dance is gone.
-
-### 7. Cascade middleware → `CascadeSubscriber`
-
-The trigger logic from `Dispatch::Middleware::Cascade` moves to `Produce::CascadeSubscriber` — a plain object subscribing to specific event classes. `Cascade` middleware is deleted. `CascadeSubscriber` receives events and enqueues materialize/sweep jobs on the job store.
-
----
-
-## Data Flow
-
-```
-store.entry(:put, key:, body:)
-  → Store#_dispatch_in_domain
-    → pipeline.dispatch(contract, call)
-      → Binder → Auth → AuditIndex → handler dispatch
-        → Handlers::Write::PutEntry.call(command, call, deps)
-          → WriteStep::DEFAULT_PUT.reduce(ctx)
-          → deps.event_bus.emit(Event::EntryWritten.new(...))
-          → Value::Result.success(envelope)
-      ← result returned up through middleware
-    ← result extracted by Store
-  ← envelope returned to caller
-
-(async, same thread)
-  Produce::CascadeSubscriber#on_entry_written
-    → enqueues materialize jobs for dependents on job_store
-```
-
----
-
-## Files
-
-### New
-- `lib/textus/store/ctx.rb` — `Store::Ctx = Data.define(...)`
-- `lib/textus/event.rb` — typed event structs
-- `lib/textus/event/bus.rb` — `Event::Bus`
-- `lib/textus/dispatch/handler_resolver.rb` — replaces Assembler
-- `lib/textus/produce/cascade_subscriber.rb` — extracted from Cascade middleware
-
-### Modified
-- `lib/textus/store.rb` — `build_container` → `Boot.wire`; `@container` → `@ctx`
-- `lib/textus/boot.rb` — `Boot.wire` added (file exists, new method)
-
-### Deleted
-- `lib/textus/store/container.rb`
-- `lib/textus/dispatch/assembler.rb`
-- `lib/textus/dispatch/middleware/cascade.rb`
-
-### Converted (29 handler files)
-- `lib/textus/handlers/**/*.rb` — all converted to pure modules with HANDLES/NEEDS
-
-### Tests
-- `spec/unit/store/ctx_spec.rb`
-- `spec/unit/event/bus_spec.rb`
-- `spec/unit/dispatch/handler_resolver_spec.rb` (completeness + NEEDS satisfaction)
-- `spec/unit/produce/cascade_subscriber_spec.rb`
-- `spec/integration/boot_spec.rb` — `Boot.wire` builds a valid frozen Ctx
-
----
-
-## Error Handling
-
-| Scenario | Behaviour |
-|---|---|
-| `NEEDS` field missing from Ctx at boot | `Boot::DepNotFound` raised in `HandlerResolver.build` — fails before first request |
-| No handler for a contract | `Dispatch::UnknownHandler` raised at dispatch time (unchanged) |
-| Subscriber error during `emit` | Propagates to the emitting handler — callers wrap in rescue if fire-and-forget needed |
-| `HandlerResolver.eager_load!` missing a file | Conformance spec catches it — missing handler → missing contract registration |
-
----
-
-## Testing Strategy
-
-- `Boot.wire` is the integration boundary: one spec with a minimal fixture manifest; asserts `Ctx` is fully populated and pipeline responds to every registered contract.
-- Each handler module tested with a synthetic `command` + `call` + minimal `deps` — no Store, no Boot.
-- `Event::Bus`: subscribe, emit, multiple subscribers, two independent bus instances don't cross-contaminate.
-- `CascadeSubscriber`: fake `job_store` — event → job enqueue, no full pipeline needed.
-- Conformance spec: every contract in `VerbRegistry::VERB_TO_CONTRACT` has a handler registered by `HandlerResolver`.
diff --git a/.textus/data/scratchpad/notes/0006-plan-2-manifest-init-writestep.md b/.textus/data/scratchpad/notes/0006-plan-2-manifest-init-writestep.md
deleted file mode 100644
index dff89a4c3..000000000
--- a/.textus/data/scratchpad/notes/0006-plan-2-manifest-init-writestep.md
+++ /dev/null
@@ -1,687 +0,0 @@
----
-title: Manifest Init Hardening + WriteStep Completion Implementation Plan
-uid: 2b7fd08ba06866e0
----
-# Manifest Init Hardening + WriteStep Completion Implementation Plan
-
-> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
-
-**Goal:** Fix the fragile 3-step manifest initialization order by making `Manifest.build` explicitly two-phase; extend the WriteStep pattern from `put` to `delete` and `move`.
-
-**Architecture:** Part A: Move entry-building out of `Manifest::Data#initialize` into a two-phase `Manifest.build` — Phase 1 builds Data+Policy (no entries), Phase 2 builds entries with a fully-formed Policy so `derived_entry?` works correctly. Part B: Add `DeleteContext`, `MoveContext`, `DEFAULT_DELETE`, `DEFAULT_MOVE` to `lib/textus/store/entry/write_step.rb`; rewrite `Writer#delete` and `Writer#move` to reduce over those constants.
-
-**Tech Stack:** Ruby 3.x, Data.define, RSpec, bundle exec rspec
-
-## Global Constraints
-
-- No Co-Authored-By trailers in commits
-- All tests: `bundle exec rspec`; lint: `bundle exec rubocop -A`
-- Breaking changes OK — no compat shims
-- Stage specific files only, never `git add -A`
-
----
-
-## File Map
-
-### Modified
-- `lib/textus/manifest.rb` — two-phase `build`; move entry-building out of Data
-- `lib/textus/manifest/data.rb` — remove `@policy` and `@entries` from `initialize`; add pure field accessors
-- `lib/textus/manifest/policy.rb` — `derived_entry?` now works (policy receives fully-built entries)
-- `lib/textus/store/entry/write_step.rb` — add `DeleteContext`, `MoveContext`, step modules, constants
-- `lib/textus/store/entry/writer.rb` — replace `delete` and `move` bodies with step-chain
-
-### Tests
-- `spec/unit/manifest/two_phase_load_spec.rb` (new)
-- `spec/unit/store/entry/write_step_spec.rb` (extend existing)
-
----
-
-## Task 1: Two-phase Manifest initialization
-
-**Files:**
-- Modify: `lib/textus/manifest/data.rb`
-- Modify: `lib/textus/manifest.rb`
-- Modify: `lib/textus/manifest/policy.rb`
-- Create: `spec/unit/manifest/two_phase_load_spec.rb`
-
-**Interfaces:**
-- `Manifest::Data.parse(raw, root:)` — no longer builds Policy or entries; pure field parsing only
-- `Manifest.build(raw, root)` — Phase 1: Data + Policy; Phase 2: entries via Entry::Parser with Policy available
-- `Policy#derived_entry?(key)` — returns correct value (no longer always false)
-
----
-
-- [ ] **Step 1: Write the failing test**
-
-This test proves `derived_entry?` works after loading — the bug that two-phase init fixes.
-
-```ruby
-# spec/unit/manifest/two_phase_load_spec.rb
-require "spec_helper"
-
-RSpec.describe "Manifest two-phase initialization" do
-  def build_manifest_with_produced_entry(root)
-    FileUtils.mkdir_p(File.join(root, "data", "artifacts"))
-    File.write(File.join(root, "manifest.yaml"), <<~YAML)
-      version: textus/4
-      lanes:
-        - { name: canon,     kind: canon    }
-        - { name: artifacts, kind: machine  }
-      entries:
-        - key: canon.source
-          path: canon/source.md
-          lane: canon
-          owner: human:self
-          kind: leaf
-        - key: artifacts.derived
-          path: artifacts/derived.md
-          lane: artifacts
-          owner: automation:self
-          kind: produced
-          source:
-            - { key: canon.source }
-    YAML
-    Textus::Manifest.load(root)
-  end
-
-  it "derived_entry? returns true for a produced entry after load" do
-    Dir.mktmpdir do |tmp|
-      root = File.join(tmp, ".textus")
-      FileUtils.mkdir_p(root)
-      manifest = build_manifest_with_produced_entry(root)
-      expect(manifest.policy.derived_entry?("artifacts.derived")).to be(true)
-    end
-  end
-
-  it "derived_entry? returns false for a plain canon entry" do
-    Dir.mktmpdir do |tmp|
-      root = File.join(tmp, ".textus")
-      FileUtils.mkdir_p(root)
-      manifest = build_manifest_with_produced_entry(root)
-      expect(manifest.policy.derived_entry?("canon.source")).to be(false)
-    end
-  end
-
-  it "Phase 1 and Phase 2 are structurally sequential — no ordering invariant hidden in Data" do
-    Dir.mktmpdir do |tmp|
-      root = File.join(tmp, ".textus")
-      FileUtils.mkdir_p(root)
-      File.write(File.join(root, "manifest.yaml"), <<~YAML)
-        version: textus/4
-        lanes:
-          - { name: knowledge, kind: canon }
-        entries:
-          - { key: knowledge.demo, path: knowledge/demo.md, lane: knowledge, owner: human:self, kind: leaf }
-      YAML
-      manifest = Textus::Manifest.load(root)
-      # Data no longer holds @policy or @entries internally
-      expect(manifest.data).not_to respond_to(:policy)
-      expect(manifest.data).not_to respond_to(:entries)
-    end
-  end
-end
-```
-
-- [ ] **Step 2: Run test to verify it fails**
-
-```
-bundle exec rspec spec/unit/manifest/two_phase_load_spec.rb -f doc
-```
-
-Expected: the `derived_entry?` test fails (returns false when it should return true), and the `respond_to?` test may pass or fail depending on current Data implementation.
-
----
-
-- [ ] **Step 3: Strip entry-building and policy from Manifest::Data**
-
-In `lib/textus/manifest/data.rb`, remove `@policy` and `@entries` from `initialize`. The `initialize` becomes pure field parsing:
-
-```ruby
-def initialize(raw:, root:)
-  @raw    = raw
-  @root   = root
-  @declared_lane_kinds = Array(raw["lanes"]).to_h do |z|
-    [z["name"], z["kind"]&.to_sym]
-  end
-  @lane_descs    = Array(raw["lanes"]).to_h { |z| [z["name"], z["desc"]] }
-  @lane_owners   = Array(raw["lanes"]).to_h { |z| [z["name"], z["owner"]] }.compact
-  @audit_config  = build_audit_config(raw)
-  @worker_config = build_worker_config(raw)
-  @role_caps     = Capabilities.resolve(raw["roles"])
-  freeze
-end
-```
-
-Remove `attr_reader :policy` and `attr_reader :entries` from Data. Remove `build_entries` private method from Data (it moves to `Manifest.build`). Remove `validate_declared_keys!` call (it moves too — see Step 4).
-
-Keep all other private methods that `build_entries` called (`build_audit_config`, `build_worker_config`).
-
-- [ ] **Step 4: Rewrite Manifest.build as two explicit phases**
-
-In `lib/textus/manifest.rb`, replace `build`:
-
-```ruby
-def build(raw, root)
-  # Phase 1: structural data + authority policy (no entries)
-  data   = Manifest::Data.parse(raw, root: root)
-  policy = Manifest::Policy.new(data)
-
-  # Phase 2: entries — validators now have a fully-formed Policy
-  entries  = Manifest::Entry::Parser.parse(Array(raw["entries"]), policy: policy, data: data)
-  resolver = Manifest::Resolver.new(data, entries)
-  rules    = Manifest::Rules.parse(raw["rules"] || [])
-
-  validate_declared_keys!(data, entries)
-
-  new(data: data, policy: policy, resolver: resolver, rules: rules)
-end
-
-def validate_declared_keys!(data, entries)
-  # Move the validate_declared_keys! logic here from Data#initialize
-  # It validates that entry keys don't collide with lane names etc.
-  # Copy the existing implementation from Manifest::Data#validate_declared_keys!
-end
-```
-
-> **Resolver change:** `Manifest::Resolver.new` currently takes only `data`. After this change it takes `data` and `entries` separately (since entries are no longer inside data). Update `Manifest::Resolver#initialize` to accept `(data, entries)` and replace `@data.entries` with `@entries` throughout Resolver.
-
-- [ ] **Step 5: Update Policy#derived_entry? to use actual entries**
-
-In `lib/textus/manifest/policy.rb`, `Policy.new` now receives both `data` and `entries` (or just a reference to the entries array). Update the constructor:
-
-```ruby
-def initialize(data, entries = [])
-  @data    = data
-  @entries = entries  # populated in Phase 2
-end
-
-# Now works correctly:
-def derived_entry?(key)
-  entry = @entries.find { |e| e.key == key }
-  entry&.is_a?(Textus::Manifest::Entry::Produced) || false
-end
-```
-
-Update `Manifest.build` to pass entries to Policy after Phase 2:
-
-```ruby
-# At the end of Manifest.build Phase 2:
-policy.set_entries(entries)  # OR rebuild Policy with entries
-```
-
-Alternatively (simpler): make Policy a `Data.define` or accept entries lazily:
-
-```ruby
-# Simplest fix: Policy stores entries after Phase 2
-class Policy
-  attr_writer :entries
-
-  def derived_entry?(key)
-    entry = Array(@entries).find { |e| e.key == key }
-    entry&.is_a?(Textus::Manifest::Entry::Produced) || false
-  end
-end
-
-# In Manifest.build, after Phase 2:
-entries = Manifest::Entry::Parser.parse(...)
-policy.entries = entries
-```
-
-- [ ] **Step 6: Run the new tests**
-
-```
-bundle exec rspec spec/unit/manifest/two_phase_load_spec.rb -f doc
-```
-
-Expected: all 3 examples pass.
-
-- [ ] **Step 7: Run the full suite to confirm no regressions**
-
-```
-bundle exec rspec --format progress
-```
-
-Expected: same pass count as baseline.
-
-- [ ] **Step 8: Commit**
-
-```bash
-git add lib/textus/manifest.rb lib/textus/manifest/data.rb \
-        lib/textus/manifest/policy.rb \
-        spec/unit/manifest/two_phase_load_spec.rb
-git commit -m "refactor: two-phase Manifest.build — derived_entry? now correct during Phase 2"
-```
-
----
-
-## Task 2: WriteStep for delete — DEFAULT_DELETE
-
-Extend `write_step.rb` with `DeleteContext`, step modules for the delete pipeline, and `DEFAULT_DELETE`. Update `Writer#delete` to use it.
-
-**Files:**
-- Modify: `lib/textus/store/entry/write_step.rb` — add `DeleteContext` + step modules + `DEFAULT_DELETE`
-- Modify: `lib/textus/store/entry/writer.rb` — replace `delete` body with step-chain
-- Modify: `spec/unit/store/entry/write_step_spec.rb` — extend with delete coverage
-
-**Interfaces:**
-- Consumes: `WriteStep::WriteDeps` (already exists from put pipeline)
-- Produces: `WriteStep::DeleteContext`, `WriteStep::DEFAULT_DELETE` (7 steps)
-- `Writer#delete(key, mentry: nil, if_etag: nil)` — signature unchanged, behaviour unchanged
-
----
-
-- [ ] **Step 1: Extend write_step_spec.rb with delete tests**
-
-```ruby
-# Add inside RSpec.describe Textus::Store::Entry::WriteStep do
-describe "DeleteContext" do
-  it "holds key, mentry, if_etag inputs and path, etag_before outputs" do
-    ctx = described_class::DeleteContext.new(
-      key: "knowledge.demo", mentry: nil, if_etag: nil,
-      path: nil, etag_before: nil,
-    )
-    expect(ctx.key).to eq("knowledge.demo")
-    expect(ctx.path).to be_nil
-    expect(ctx.etag_before).to be_nil
-  end
-
-  it "supports immutable update via #with" do
-    ctx = described_class::DeleteContext.new(
-      key: "knowledge.demo", mentry: nil, if_etag: nil,
-      path: nil, etag_before: nil,
-    )
-    expect(ctx.with(path: "/tmp/demo.md").path).to eq("/tmp/demo.md")
-    expect(ctx.path).to be_nil
-  end
-end
-
-describe "DEFAULT_DELETE" do
-  it "contains exactly the expected steps in order" do
-    names = described_class::DEFAULT_DELETE.map(&:name).map { |n| n.split("::").last }
-    expect(names).to eq(%w[
-      ResolvePath AssertExists ReadEtagBefore CheckEtag
-      DeleteFile PruneParents AppendDeleteAudit
-    ])
-  end
-end
-```
-
-- [ ] **Step 2: Run to verify it fails**
-
-```
-bundle exec rspec spec/unit/store/entry/write_step_spec.rb -e "DeleteContext" -f doc
-bundle exec rspec spec/unit/store/entry/write_step_spec.rb -e "DEFAULT_DELETE" -f doc
-```
-
-Expected: `NameError: uninitialized constant ...::DeleteContext`
-
----
-
-- [ ] **Step 3: Add DeleteContext and delete steps to write_step.rb**
-
-Append inside `module WriteStep` in `lib/textus/store/entry/write_step.rb`:
-
-```ruby
-DeleteContext = Data.define(
-  :key, :mentry, :if_etag,   # inputs (mentry accepted for symmetry, not used)
-  :path,                      # from ResolvePath (reused from put pipeline)
-  :etag_before,               # from ReadEtagBefore
-) do
-  def with(**attrs) = self.class.new(**to_h, **attrs)
-end
-
-module AssertExists
-  def self.call(ctx, deps)
-    return ctx if deps.file_store.exists?(ctx.path)
-
-    raise UnknownKey.new(ctx.key, suggestions: deps.manifest.resolver.suggestions_for(ctx.key))
-  end
-end
-
-module ReadEtagBefore
-  def self.call(ctx, deps)
-    etag_before = deps.file_store.etag(ctx.path)
-    ctx.with(etag_before:)
-  end
-end
-
-module DeleteFile
-  def self.call(ctx, deps)
-    deps.file_store.delete(ctx.path)
-    ctx
-  end
-end
-
-module PruneParents
-  def self.call(ctx, deps)
-    floor = deps.layout.lane_floor(ctx.path)
-    if floor
-      dir = File.dirname(ctx.path)
-      while dir.start_with?("#{floor}/") && deps.file_store.dir_empty?(dir)
-        deps.file_store.rmdir(dir)
-        dir = File.dirname(dir)
-      end
-    end
-    ctx
-  rescue SystemCallError
-    ctx
-  end
-end
-
-module AppendDeleteAudit
-  def self.call(ctx, deps)
-    extras = deps.call.correlation_id ? { "correlation_id" => deps.call.correlation_id } : nil
-    deps.audit_log.append(
-      role:        deps.call.role,
-      verb:        "key_delete",
-      key:         ctx.key,
-      etag_before: ctx.etag_before,
-      etag_after:  nil,
-      extras:      extras,
-    )
-    ctx
-  end
-end
-
-# CheckEtag is reused from the put pipeline — it reads ctx.path and ctx.if_etag,
-# raising EtagMismatch if the guard fails. DeleteContext has both fields.
-
-DEFAULT_DELETE = [
-  ResolvePath,      # key → path (module shared with put pipeline)
-  AssertExists,     # raises UnknownKey unless file_store.exists?(path)
-  ReadEtagBefore,   # etag_before = file_store.etag(path)
-  CheckEtag,        # raises EtagMismatch if if_etag given and mismatches
-  DeleteFile,       # file_store.delete(path)
-  PruneParents,     # remove now-empty ancestor directories
-  AppendDeleteAudit, # audit_log.append(verb: "key_delete", ...)
-].freeze
-```
-
-- [ ] **Step 4: Replace Writer#delete body**
-
-In `lib/textus/store/entry/writer.rb`, replace the existing `delete` method:
-
-```ruby
-def delete(key, mentry: nil, if_etag: nil)
-  ctx = WriteStep::DeleteContext.new(
-    key:, mentry:, if_etag:,
-    path: nil, etag_before: nil,
-  )
-  deps = WriteStep::WriteDeps.new(
-    file_store: @file_store, manifest: @manifest, schemas: @schemas,
-    audit_log: @audit_log, call: @call, reader: @reader, layout: @layout,
-  )
-  WriteStep::DEFAULT_DELETE.reduce(ctx) { |c, step| step.call(c, deps) }
-  nil
-end
-```
-
-- [ ] **Step 5: Run write_step spec and conformance suite**
-
-```
-bundle exec rspec spec/unit/store/entry/write_step_spec.rb -f doc
-bundle exec rspec spec/conformance/write/ -f progress
-```
-
-Expected: all pass.
-
-- [ ] **Step 6: Run full suite**
-
-```
-bundle exec rspec --format progress
-```
-
-- [ ] **Step 7: Commit**
-
-```bash
-git add lib/textus/store/entry/write_step.rb \
-        lib/textus/store/entry/writer.rb \
-        spec/unit/store/entry/write_step_spec.rb
-git commit -m "refactor: decompose Writer#delete into WriteStep::DEFAULT_DELETE chain"
-```
-
----
-
-## Task 3: WriteStep for move — DEFAULT_MOVE
-
-Same pattern as Task 2 for `move`. `MoveContext` has more fields (two paths, envelope) and DEFAULT_MOVE has 10 steps.
-
-**Files:**
-- Modify: `lib/textus/store/entry/write_step.rb` — add `MoveContext` + move step modules + `DEFAULT_MOVE`
-- Modify: `lib/textus/store/entry/writer.rb` — replace `move` body with step-chain
-- Modify: `spec/unit/store/entry/write_step_spec.rb` — extend with move coverage
-
-**Interfaces:**
-- Consumes: `WriteStep::WriteDeps` (reused); `CheckEtag` (reused — reads `ctx.if_etag` and `ctx.etag_before`)
-- Produces: `WriteStep::MoveContext`, `WriteStep::DEFAULT_MOVE` (10 steps)
-- `Writer#move(from_key:, to_key:, new_mentry:, if_etag: nil) → Envelope` — signature unchanged
-
----
-
-- [ ] **Step 1: Extend write_step_spec.rb with move tests**
-
-```ruby
-# Add inside RSpec.describe Textus::Store::Entry::WriteStep do
-describe "MoveContext" do
-  it "holds all inputs and computed fields" do
-    ctx = described_class::MoveContext.new(
-      from_key: "knowledge.alpha", to_key: "knowledge.beta",
-      new_mentry: nil, if_etag: nil,
-      from_path: nil, to_path: nil,
-      etag_before: nil, etag_after: nil, envelope: nil,
-    )
-    expect(ctx.from_key).to eq("knowledge.alpha")
-    expect(ctx.from_path).to be_nil
-    expect(ctx.envelope).to be_nil
-  end
-
-  it "supports immutable update via #with" do
-    ctx = described_class::MoveContext.new(
-      from_key: "knowledge.alpha", to_key: "knowledge.beta",
-      new_mentry: nil, if_etag: nil,
-      from_path: nil, to_path: nil,
-      etag_before: nil, etag_after: nil, envelope: nil,
-    )
-    updated = ctx.with(from_path: "/tmp/alpha.md")
-    expect(updated.from_path).to eq("/tmp/alpha.md")
-    expect(ctx.from_path).to be_nil
-  end
-end
-
-describe "DEFAULT_MOVE" do
-  it "contains exactly the expected steps in order" do
-    names = described_class::DEFAULT_MOVE.map(&:name).map { |n| n.split("::").last }
-    expect(names).to eq(%w[
-      ResolvePaths AssertSourceExists ReadMoveEtagBefore CheckMoveEtag
-      MoveFile PruneSourceParents RewriteBasename
-      ReadEtagAfter ReadEnvelope AppendMoveAudit
-    ])
-  end
-end
-```
-
-- [ ] **Step 2: Run to verify it fails**
-
-```
-bundle exec rspec spec/unit/store/entry/write_step_spec.rb -e "MoveContext" -f doc
-bundle exec rspec spec/unit/store/entry/write_step_spec.rb -e "DEFAULT_MOVE" -f doc
-```
-
-Expected: `NameError: uninitialized constant ...::MoveContext`
-
----
-
-- [ ] **Step 3: Add MoveContext and move steps to write_step.rb**
-
-Append inside `module WriteStep` in `lib/textus/store/entry/write_step.rb`:
-
-```ruby
-MoveContext = Data.define(
-  :from_key, :to_key, :new_mentry, :if_etag,   # inputs
-  :from_path, :to_path,                          # from ResolvePaths
-  :etag_before,                                  # from ReadMoveEtagBefore
-  :etag_after,                                   # from ReadEtagAfter
-  :envelope,                                     # from ReadEnvelope
-) do
-  def with(**attrs) = self.class.new(**to_h, **attrs)
-end
-
-module ResolvePaths
-  def self.call(ctx, deps)
-    from_path = deps.manifest.resolver.resolve(ctx.from_key).path
-    to_path   = deps.manifest.resolver.resolve(ctx.to_key).path
-    ctx.with(from_path:, to_path:)
-  end
-end
-
-module AssertSourceExists
-  def self.call(ctx, deps)
-    return ctx if deps.file_store.exists?(ctx.from_path)
-
-    raise UnknownKey.new(
-      ctx.from_key,
-      suggestions: deps.manifest.resolver.suggestions_for(ctx.from_key),
-    )
-  end
-end
-
-module ReadMoveEtagBefore
-  def self.call(ctx, deps)
-    etag_before = deps.file_store.etag(ctx.from_path)
-    ctx.with(etag_before:)
-  end
-end
-
-module CheckMoveEtag
-  # Identical logic to CheckEtag but reads from ctx.from_path's etag_before
-  def self.call(ctx, _deps)
-    if ctx.if_etag && (ctx.etag_before != ctx.if_etag)
-      raise EtagMismatch.new(ctx.from_key, ctx.if_etag, ctx.etag_before)
-    end
-
-    ctx
-  end
-end
-
-module MoveFile
-  def self.call(ctx, deps)
-    deps.file_store.mv(ctx.from_path, ctx.to_path)
-    ctx
-  end
-end
-
-module PruneSourceParents
-  def self.call(ctx, deps)
-    floor = deps.layout.lane_floor(ctx.from_path)
-    if floor
-      dir = File.dirname(ctx.from_path)
-      while dir.start_with?("#{floor}/") && deps.file_store.dir_empty?(dir)
-        deps.file_store.rmdir(dir)
-        dir = File.dirname(dir)
-      end
-    end
-    ctx
-  rescue SystemCallError
-    ctx
-  end
-end
-
-module RewriteBasename
-  def self.call(ctx, _deps)
-    basename = ctx.to_key.split(".").last
-    Format.for(ctx.new_mentry.format).rewrite_name(ctx.to_path, basename)
-    ctx
-  end
-end
-
-module ReadEtagAfter
-  def self.call(ctx, _deps)
-    etag_after = Value::Etag.for_file(ctx.to_path)
-    ctx.with(etag_after:)
-  end
-end
-
-module ReadEnvelope
-  def self.call(ctx, deps)
-    envelope = deps.reader.read(ctx.to_key)
-    ctx.with(envelope:)
-  end
-end
-
-module AppendMoveAudit
-  def self.call(ctx, deps)
-    extras = {
-      "from_key"  => ctx.from_key, "to_key"    => ctx.to_key,
-      "from_path" => ctx.from_path, "to_path"   => ctx.to_path,
-      "uid"       => ctx.envelope.uid,
-    }
-    extras["correlation_id"] = deps.call.correlation_id if deps.call.correlation_id
-    deps.audit_log.append(
-      role:        deps.call.role,
-      verb:        "key_mv",
-      key:         ctx.to_key,
-      etag_before: ctx.etag_before,
-      etag_after:  ctx.etag_after,
-      extras:      extras,
-    )
-    ctx
-  end
-end
-
-DEFAULT_MOVE = [
-  ResolvePaths,        # from_key/to_key → from_path/to_path
-  AssertSourceExists,  # raises UnknownKey unless from_path exists
-  ReadMoveEtagBefore,  # etag_before = file_store.etag(from_path)
-  CheckMoveEtag,       # raises EtagMismatch if if_etag given and mismatches
-  MoveFile,            # file_store.mv(from_path, to_path)
-  PruneSourceParents,  # remove now-empty ancestor dirs on the source side
-  RewriteBasename,     # Format.rewrite_name(to_path, basename)
-  ReadEtagAfter,       # etag_after = Value::Etag.for_file(to_path)
-  ReadEnvelope,        # reader.read(to_key) → envelope
-  AppendMoveAudit,     # audit_log.append(verb: "key_mv", ...)
-].freeze
-```
-
-- [ ] **Step 4: Replace Writer#move body**
-
-In `lib/textus/store/entry/writer.rb`, replace the existing `move` method:
-
-```ruby
-def move(from_key:, to_key:, new_mentry:, if_etag: nil)
-  ctx = WriteStep::MoveContext.new(
-    from_key:, to_key:, new_mentry:, if_etag:,
-    from_path: nil, to_path: nil,
-    etag_before: nil, etag_after: nil, envelope: nil,
-  )
-  deps = WriteStep::WriteDeps.new(
-    file_store: @file_store, manifest: @manifest, schemas: @schemas,
-    audit_log: @audit_log, call: @call, reader: @reader, layout: @layout,
-  )
-  ctx = WriteStep::DEFAULT_MOVE.reduce(ctx) { |c, step| step.call(c, deps) }
-  ctx.envelope
-end
-```
-
-- [ ] **Step 5: Run write_step spec and mv conformance spec**
-
-```
-bundle exec rspec spec/unit/store/entry/write_step_spec.rb -f doc
-bundle exec rspec spec/conformance/write/mv_spec.rb -f doc
-```
-
-Expected: all pass.
-
-- [ ] **Step 6: Run full suite**
-
-```
-bundle exec rspec --format progress
-```
-
-- [ ] **Step 7: Commit**
-
-```bash
-git add lib/textus/store/entry/write_step.rb \
-        lib/textus/store/entry/writer.rb \
-        spec/unit/store/entry/write_step_spec.rb
-git commit -m "refactor: decompose Writer#move into WriteStep::DEFAULT_MOVE chain"
-```
diff --git a/.textus/data/scratchpad/notes/0007-spec-2-manifest-init-writestep-completion.md b/.textus/data/scratchpad/notes/0007-spec-2-manifest-init-writestep-completion.md
deleted file mode 100644
index 56103179d..000000000
--- a/.textus/data/scratchpad/notes/0007-spec-2-manifest-init-writestep-completion.md
+++ /dev/null
@@ -1,349 +0,0 @@
----
-title: 'Spec 2: Manifest Init Hardening + WriteStep Completion'
-uid: 8db8fa1fa6e2d257
----
-# Spec 2: Manifest Init Hardening + WriteStep Completion
-
-**Date:** 2026-06-30  
-**Status:** Approved  
-**Scope:** Fix the fragile 3-step manifest initialization order; extend WriteStep pattern to `delete` and `move`.
-
----
-
-## Problem
-
-### Manifest initialization
-
-`Manifest.load` has an implicit 3-step ordering constraint: `Data` must be built before `Policy`, `Policy` must be built before entry validators, and `derived_entry?` always returns false during construction (because Policy isn't complete yet). Nothing in the code enforces or documents this order — it is a runtime invariant discovered only when violated.
-
-### WriteStep gap
-
-`Writer#put` was decomposed into `WriteStep::DEFAULT_PUT` in the previous refactor, making the put pipeline inspectable and each step individually testable. `Writer#delete` and `Writer#move` were left with the old sequential-local-variable structure. They have the same problems `put` had: hard to test in isolation, impossible to skip or reorder steps, internal logic invisible from outside.
-
----
-
-## Goals
-
-- `Manifest.load` has two named, structural phases. Phase 2 cannot start until Phase 1 returns. The init order becomes a compile-time constraint, not a runtime convention.
-- `Writer#delete` and `Writer#move` follow the same pattern as `Writer#put`: named step modules, reduce over a constant, each step individually testable.
-- `WriteDeps` is reused unchanged across all three pipelines (put, delete, move).
-
----
-
-## Architecture
-
-### Part A: Two-phase `Manifest.load`
-
-`Manifest.load` becomes a two-pass factory. The class constructor `Manifest.new` becomes a simple value constructor — no logic, no ordering.
-
-```ruby
-module Textus
-  class Manifest
-    # Phase 1: structural data + authority policy — no cross-entry validation
-    # Phase 2: entries — validators now have a fully-formed Policy
-    def self.load(root)
-      raw = YAML.safe_load(File.read(File.join(root, "manifest.yaml")), symbolize_names: false)
-      Schema.validate!(raw)
-
-      # Phase 1
-      data   = Manifest::Data.new(raw)
-      policy = Manifest::Policy.new(data)
-
-      # Phase 2 (Policy is complete — validators may call policy.derived_entry? safely)
-      resolver = Manifest::Resolver.new(data, root)
-      rules    = Manifest::Rules.new(data)
-      entries  = Manifest::Entry::Parser.parse(raw.fetch("entries", []), policy:, data:)
-
-      new(data:, policy:, resolver:, rules:, entries:)
-    end
-
-    def self.parse(yaml_text, root:)
-      # Same two-phase pattern for the test helper path
-      raw = YAML.safe_load(yaml_text, symbolize_names: false)
-      # ... same as load but without file I/O ...
-    end
-
-    # Plain value constructor — no logic
-    def initialize(data:, policy:, resolver:, rules:, entries:)
-      @data     = data
-      @policy   = policy
-      @resolver = resolver
-      @rules    = rules
-      @entries  = entries
-    end
-
-    attr_reader :data, :policy, :resolver, :rules, :entries
-  end
-end
-```
-
-**What changes:**
-- `Manifest::Data` no longer needs to know about `Policy` during its own construction.
-- `Manifest::Entry::Parser.parse` receives `policy:` and `data:` as keyword args. It can call `policy.derived_entry?` freely because Phase 1 is complete.
-- `derived_entry?` works correctly during entry construction — no more always-false race condition.
-- `Manifest.new` is now a boring keyword-arg constructor. It cannot be called with a partial state.
-
-**What stays the same:**
-- `Manifest::Data`, `Manifest::Policy`, `Manifest::Resolver`, `Manifest::Rules` internal APIs unchanged.
-- All callers of `Manifest.load` and `Manifest.parse` unchanged — same return type, same attribute names.
-
-### Part B: WriteStep for `delete` and `move`
-
-#### `DeleteContext` and `DEFAULT_DELETE`
-
-```ruby
-module Textus::Store::Entry::WriteStep
-  DeleteContext = Data.define(
-    :key, :mentry, :if_etag,   # inputs
-    :path,                      # from ResolvePath
-    :etag_before,               # from ReadEtagBefore
-  ) do
-    def with(**attrs) = self.class.new(**to_h, **attrs)
-  end
-
-  module AssertExists
-    def self.call(ctx, deps)
-      return ctx if deps.file_store.exists?(ctx.path)
-      raise UnknownKey.new(ctx.key, suggestions: deps.manifest.resolver.suggestions_for(ctx.key))
-    end
-  end
-
-  module ReadEtagBefore
-    def self.call(ctx, deps)
-      etag_before = deps.file_store.etag(ctx.path)
-      ctx.with(etag_before:)
-    end
-  end
-
-  module DeleteFile
-    def self.call(ctx, deps)
-      deps.file_store.delete(ctx.path)
-      ctx
-    end
-  end
-
-  module PruneParents
-    def self.call(ctx, deps)
-      floor = deps.layout.lane_floor(ctx.path)
-      if floor
-        dir = File.dirname(ctx.path)
-        while dir.start_with?("#{floor}/") && deps.file_store.dir_empty?(dir)
-          deps.file_store.rmdir(dir)
-          dir = File.dirname(dir)
-        end
-      end
-      ctx
-    rescue SystemCallError
-      ctx
-    end
-  end
-
-  module AppendDeleteAudit
-    def self.call(ctx, deps)
-      extras = deps.call.correlation_id ? { "correlation_id" => deps.call.correlation_id } : nil
-      deps.audit_log.append(
-        role: deps.call.role, verb: "key_delete", key: ctx.key,
-        etag_before: ctx.etag_before, etag_after: nil,
-        extras:
-      )
-      ctx
-    end
-  end
-
-  DEFAULT_DELETE = [
-    ResolvePath,      # key → path (reused from put pipeline)
-    AssertExists,     # raises UnknownKey unless file exists
-    ReadEtagBefore,   # etag_before = file_store.etag(path)
-    CheckEtag,        # raises EtagMismatch if if_etag given and mismatches (reused from put)
-    DeleteFile,       # file_store.delete(path)
-    PruneParents,     # remove now-empty ancestor directories
-    AppendDeleteAudit,# audit_log.append(verb: "key_delete", ...)
-  ].freeze
-end
-```
-
-#### `MoveContext` and `DEFAULT_MOVE`
-
-```ruby
-module Textus::Store::Entry::WriteStep
-  MoveContext = Data.define(
-    :from_key, :to_key, :new_mentry, :if_etag,   # inputs
-    :from_path, :to_path,                          # from ResolvePaths
-    :etag_before,                                  # from ReadEtagBefore
-    :etag_after,                                   # from ReadEtagAfter
-    :envelope,                                     # from ReadEnvelope
-  ) do
-    def with(**attrs) = self.class.new(**to_h, **attrs)
-  end
-
-  module ResolvePaths
-    def self.call(ctx, deps)
-      from_path = deps.manifest.resolver.resolve(ctx.from_key).path
-      to_path   = deps.manifest.resolver.resolve(ctx.to_key).path
-      ctx.with(from_path:, to_path:)
-    end
-  end
-
-  module AssertSourceExists
-    def self.call(ctx, deps)
-      return ctx if deps.file_store.exists?(ctx.from_path)
-      raise UnknownKey.new(ctx.from_key, suggestions: deps.manifest.resolver.suggestions_for(ctx.from_key))
-    end
-  end
-
-  module ReadMoveEtagBefore
-    def self.call(ctx, deps)
-      etag_before = deps.file_store.etag(ctx.from_path)
-      ctx.with(etag_before:)
-    end
-  end
-
-  module MoveFile
-    def self.call(ctx, deps)
-      deps.file_store.mv(ctx.from_path, ctx.to_path)
-      ctx
-    end
-  end
-
-  module PruneSourceParents
-    # Same logic as PruneParents but operates on from_path
-    def self.call(ctx, deps)
-      floor = deps.layout.lane_floor(ctx.from_path)
-      if floor
-        dir = File.dirname(ctx.from_path)
-        while dir.start_with?("#{floor}/") && deps.file_store.dir_empty?(dir)
-          deps.file_store.rmdir(dir)
-          dir = File.dirname(dir)
-        end
-      end
-      ctx
-    rescue SystemCallError
-      ctx
-    end
-  end
-
-  module RewriteBasename
-    def self.call(ctx, _deps)
-      basename = ctx.to_key.split(".").last
-      Format.for(ctx.new_mentry.format).rewrite_name(ctx.to_path, basename)
-      ctx
-    end
-  end
-
-  module ReadEtagAfter
-    def self.call(ctx, deps)
-      etag_after = Value::Etag.for_file(ctx.to_path)
-      ctx.with(etag_after:)
-    end
-  end
-
-  module ReadEnvelope
-    def self.call(ctx, deps)
-      envelope = deps.reader.read(ctx.to_key)
-      ctx.with(envelope:)
-    end
-  end
-
-  module AppendMoveAudit
-    def self.call(ctx, deps)
-      extras = {
-        "from_key"  => ctx.from_key, "to_key"   => ctx.to_key,
-        "from_path" => ctx.from_path, "to_path"  => ctx.to_path,
-        "uid"       => ctx.envelope.uid,
-      }
-      extras["correlation_id"] = deps.call.correlation_id if deps.call.correlation_id
-      deps.audit_log.append(
-        role: deps.call.role, verb: "key_mv", key: ctx.to_key,
-        etag_before: ctx.etag_before, etag_after: ctx.etag_after,
-        extras:
-      )
-      ctx
-    end
-  end
-
-  DEFAULT_MOVE = [
-    ResolvePaths,        # from_key/to_key → from_path/to_path
-    AssertSourceExists,  # raises UnknownKey unless from_path exists
-    ReadMoveEtagBefore,  # etag_before = file_store.etag(from_path)
-    CheckEtag,           # raises EtagMismatch if if_etag given and mismatches (reused from put)
-    MoveFile,            # file_store.mv(from_path, to_path)
-    PruneSourceParents,  # remove now-empty ancestor dirs from source side
-    RewriteBasename,     # Format.rewrite_name(to_path, basename)
-    ReadEtagAfter,       # etag_after = Value::Etag.for_file(to_path)
-    ReadEnvelope,        # reader.read(to_key) → envelope
-    AppendMoveAudit,     # audit_log.append(verb: "key_mv", ...)
-  ].freeze
-end
-```
-
-#### Updated `Writer#delete` and `Writer#move`
-
-Both become structurally identical to `Writer#put`:
-
-```ruby
-def delete(key, mentry: nil, if_etag: nil)
-  ctx = WriteStep::DeleteContext.new(
-    key:, mentry:, if_etag:,
-    path: nil, etag_before: nil
-  )
-  deps = WriteStep::WriteDeps.new(
-    file_store: @file_store, manifest: @manifest, schemas: @schemas,
-    audit_log: @audit_log, call: @call, reader: @reader, layout: @layout
-  )
-  WriteStep::DEFAULT_DELETE.reduce(ctx) { |c, step| step.call(c, deps) }
-  nil
-end
-
-def move(from_key:, to_key:, new_mentry:, if_etag: nil)
-  ctx = WriteStep::MoveContext.new(
-    from_key:, to_key:, new_mentry:, if_etag:,
-    from_path: nil, to_path: nil,
-    etag_before: nil, etag_after: nil, envelope: nil
-  )
-  deps = WriteStep::WriteDeps.new(
-    file_store: @file_store, manifest: @manifest, schemas: @schemas,
-    audit_log: @audit_log, call: @call, reader: @reader, layout: @layout
-  )
-  ctx = WriteStep::DEFAULT_MOVE.reduce(ctx) { |c, step| step.call(c, deps) }
-  ctx.envelope
-end
-```
-
-**Reused steps across pipelines:**
-- `ResolvePath` — reused in delete (single key → path)
-- `CheckEtag` — reused in both delete and move (if_etag guard logic is identical)
-
----
-
-## Files
-
-### Modified
-- `lib/textus/manifest.rb` — two-phase `load` + `parse`; `initialize` becomes plain constructor
-- `lib/textus/store/entry/write_step.rb` — add `DeleteContext`, `MoveContext`, new step modules, `DEFAULT_DELETE`, `DEFAULT_MOVE`
-- `lib/textus/store/entry/writer.rb` — replace `delete` and `move` bodies with step-chain pattern
-
-### Tests
-- `spec/unit/manifest/two_phase_load_spec.rb` — derived_entry? works in Phase 2; Policy available to validators
-- `spec/unit/store/entry/write_step_spec.rb` — extend existing spec with DeleteContext, MoveContext, DEFAULT_DELETE, DEFAULT_MOVE step order and .call interface
-- Integration: existing `spec/conformance/write/mv_spec.rb` + delete conformance specs cover end-to-end
-
----
-
-## Error Handling
-
-| Scenario | Step | Behaviour |
-|---|---|---|
-| Key doesn't exist (delete) | `AssertExists` | Raises `UnknownKey` with resolver suggestions |
-| Key doesn't exist (move from) | `AssertSourceExists` | Raises `UnknownKey` with resolver suggestions |
-| Etag mismatch | `CheckEtag` | Raises `EtagMismatch` (same as put — reused step) |
-| Prune fails (race / non-empty dir) | `PruneParents` / `PruneSourceParents` | `rescue SystemCallError → ctx` — best-effort, never fatal |
-| Manifest Phase 1 validation fails | `Schema.validate!` | Raises `SchemaViolation` before Phase 2 starts |
-
----
-
-## Testing Strategy
-
-- `Manifest.load` two-phase: a fixture with a derived entry; assert `derived_entry?` returns true for it in the loaded result (was always false before the fix).
-- Each new WriteStep module tested with a synthetic context + fake deps (FileStore double, AuditLog spy).
-- `DEFAULT_DELETE` and `DEFAULT_MOVE` step-order tests match the put pattern in the existing `write_step_spec.rb`.
-- Integration: existing mv and delete conformance specs must continue to pass with no behavioural change.
diff --git a/.textus/data/scratchpad/notes/0008-plan-3-rules-tracing.md b/.textus/data/scratchpad/notes/0008-plan-3-rules-tracing.md
deleted file mode 100644
index ea22be0e7..000000000
--- a/.textus/data/scratchpad/notes/0008-plan-3-rules-tracing.md
+++ /dev/null
@@ -1,467 +0,0 @@
----
-title: Rules System Debugging — Resolution Tracing Implementation Plan
-uid: e673a7d0b2892938
----
-# Rules System Debugging — Resolution Tracing Implementation Plan
-
-> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
-
-**Goal:** Add rule resolution tracing to `Manifest::Rules` and expose it as a new `rule_trace` verb on CLI and MCP.
-
-**Architecture:** `Manifest::Rules#for(key)` is refactored to delegate to `for_with_trace(key)`, which returns `[RuleSet, RuleTrace]`. `RuleTrace` is a `Data.define` capturing every pattern tested, which matched, and which won. A new `rule_trace` verb is registered in `VerbRegistry`, a handler module added to `Handlers::Maintenance`, a contract added to `Dispatch::Contracts`, and a row added to `Dispatch::Assembler::HANDLER_MANIFEST`.
-
-**Tech Stack:** Ruby 3.x, Data.define, RSpec, bundle exec rspec
-
-## Global Constraints
-
-- No Co-Authored-By trailers in commits
-- All tests: `bundle exec rspec`; lint: `bundle exec rubocop -A`
-- Stage specific files only, never `git add -A`
-
----
-
-## File Map
-
-### New
-- `lib/textus/manifest/rule_trace.rb` — `Manifest::RuleTrace = Data.define(...)`
-- `lib/textus/handlers/maintenance/rule_trace.rb` — handler module
-- `spec/unit/manifest/rules_trace_spec.rb`
-- `spec/unit/handlers/maintenance/rule_trace_spec.rb`
-- `spec/conformance/read/rule_trace_verb_spec.rb`
-
-### Modified
-- `lib/textus/manifest/rules.rb` — `for` delegates to `for_with_trace`; `for_with_trace` added; `pick` refactored to expose specificity
-- `lib/textus/dispatch/contracts.rb` — add `RuleTrace = Data.define(:key)`
-- `lib/textus/verb_registry.rb` — register `:rule_trace` VerbSpec
-- `lib/textus/dispatch/assembler.rb` — add `RuleTrace` row to `HANDLER_MANIFEST`
-
----
-
-## Task 1: RuleTrace value object + Rules#for_with_trace
-
-**Files:**
-- Create: `lib/textus/manifest/rule_trace.rb`
-- Modify: `lib/textus/manifest/rules.rb`
-- Create: `spec/unit/manifest/rules_trace_spec.rb`
-
-**Interfaces:**
-- Produces: `Textus::Manifest::RuleTrace` (Data.define with 4 fields)
-- `Manifest::Rules#for_with_trace(key) → [RuleSet, RuleTrace]`
-- `Manifest::Rules#for(key) → RuleSet` (unchanged behaviour)
-
----
-
-- [ ] **Step 1: Write the failing tests**
-
-```ruby
-# spec/unit/manifest/rules_trace_spec.rb
-require "spec_helper"
-
-RSpec.describe "Manifest::Rules#for_with_trace" do
-  # Manifest with two overlapping rules: "decisions.*" (more specific) and "*" (catchall)
-  let(:rules) do
-    Textus::Manifest::Rules.parse([
-      { "match" => "decisions.*", "retain" => "90d" },
-      { "match" => "*",           "fresh_within" => "7d" },
-      { "match" => "knowledge.*"  },
-    ])
-  end
-
-  describe "RuleTrace" do
-    it "is a Data.define with key, candidates, winners, ruleset_fields" do
-      expect(Textus::Manifest::RuleTrace.members).to contain_exactly(
-        :key, :candidates, :winners, :ruleset_fields,
-      )
-    end
-  end
-
-  describe "#for_with_trace" do
-    let(:key) { "decisions.adr-0001" }
-    let(:result) { rules.for_with_trace(key) }
-    let(:ruleset) { result.first }
-    let(:trace)   { result.last }
-
-    it "returns a two-element array [RuleSet, RuleTrace]" do
-      expect(result.size).to eq(2)
-      expect(ruleset).to be_a(Textus::Manifest::Rules::RuleSet)
-      expect(trace).to be_a(Textus::Manifest::RuleTrace)
-    end
-
-    it "trace.key equals the queried key" do
-      expect(trace.key).to eq(key)
-    end
-
-    it "candidates covers every rule block including non-matching ones" do
-      expect(trace.candidates.size).to eq(3)  # decisions.*, *, knowledge.*
-      decisions_candidate = trace.candidates.find { |c| c["pattern"] == "decisions.*" }
-      knowledge_candidate = trace.candidates.find { |c| c["pattern"] == "knowledge.*" }
-      expect(decisions_candidate["matched"]).to be(true)
-      expect(knowledge_candidate["matched"]).to be(false)
-      expect(knowledge_candidate["specificity"]).to eq(0)
-    end
-
-    it "winners contains only matched blocks, sorted highest-specificity first" do
-      expect(trace.winners.map { |w| w["pattern"] }).to eq(["decisions.*", "*"])
-    end
-
-    it "ruleset_fields matches the RuleSet returned by for(key)" do
-      expected_ruleset = rules.for(key)
-      expect(trace.ruleset_fields).to eq(expected_ruleset.to_h)
-    end
-
-    it "#for(key) returns the same RuleSet as for_with_trace(key).first (non-regression)" do
-      via_for       = rules.for(key)
-      via_trace, _  = rules.for_with_trace(key)
-      expect(via_for).to eq(via_trace)
-    end
-
-    it "specificity in candidates matches the scoring used to pick winners" do
-      # decisions.* has specificity 11 (1 literal segment = 10, 1 wildcard = 1)
-      # * has specificity 1 (1 wildcard)
-      # The winner is decisions.* (higher specificity)
-      winning_pattern = trace.winners.first["pattern"]
-      expect(winning_pattern).to eq("decisions.*")
-    end
-  end
-end
-```
-
-- [ ] **Step 2: Run to verify it fails**
-
-```
-bundle exec rspec spec/unit/manifest/rules_trace_spec.rb -f doc
-```
-
-Expected: `NameError: uninitialized constant Textus::Manifest::RuleTrace`
-
----
-
-- [ ] **Step 3: Create RuleTrace**
-
-```ruby
-# lib/textus/manifest/rule_trace.rb
-module Textus
-  class Manifest
-    # Captures every decision made during Rules#for_with_trace resolution.
-    #
-    # candidates — Array of { "pattern" => String, "matched" => Boolean, "specificity" => Integer }
-    #   Every rule block tested, including non-matching ones (specificity 0 for non-matches).
-    #
-    # winners — Array of { "pattern" => String, "specificity" => Integer, "fields" => Hash }
-    #   Matched blocks that contributed to the RuleSet, sorted highest-specificity first.
-    #
-    # ruleset_fields — Hash
-    #   The merged result: identical to RuleSet#to_h for the same key.
-    RuleTrace = Data.define(:key, :candidates, :winners, :ruleset_fields)
-  end
-end
-```
-
-- [ ] **Step 4: Add for_with_trace to Manifest::Rules**
-
-In `lib/textus/manifest/rules.rb`, refactor `for` to call `for_with_trace`, and add `for_with_trace`:
-
-```ruby
-def for(key)
-  for_with_trace(key).first
-end
-
-def for_with_trace(key)
-  candidates = @blocks.map do |b|
-    matched     = Textus::Manifest::Policy::Matcher.matches?(b.match, key)
-    specificity = matched ? Textus::Manifest::Policy::Matcher.specificity(b.match) : 0
-    { "pattern" => b.match, "matched" => matched, "specificity" => specificity }
-  end
-
-  winning_blocks = @blocks
-    .select  { |b| Textus::Manifest::Policy::Matcher.matches?(b.match, key) }
-    .sort_by { |b| [-Textus::Manifest::Policy::Matcher.specificity(b.match), b.match.length, b.match] }
-
-  ruleset = build_ruleset_from(winning_blocks, key)
-
-  trace = Manifest::RuleTrace.new(
-    key:,
-    candidates:,
-    winners: winning_blocks.map do |b|
-      {
-        "pattern"     => b.match,
-        "specificity" => Textus::Manifest::Policy::Matcher.specificity(b.match),
-        "fields"      => PICK_FIELDS.each_with_object({}) { |f, h| h[f.to_s] = b.public_send(f) if b.public_send(f) },
-      }
-    end,
-    ruleset_fields: ruleset.to_h,
-  )
-
-  [ruleset, trace]
-end
-```
-
-Add `build_ruleset_from` as a private helper that replaces the existing inline slot-building logic:
-
-```ruby
-private
-
-def build_ruleset_from(winning_blocks, key)
-  slots = PICK_FIELDS.to_h { |f| [f, []] }
-  # All blocks (not just winners) contribute their fields to the slots pool
-  @blocks.each do |b|
-    next unless Textus::Manifest::Policy::Matcher.matches?(b.match, key)
-    slots.each_key { |slot| slots[slot] << b if b.public_send(slot) }
-  end
-  RuleSet.new(**slots.to_h { |slot, blocks| [slot, pick(blocks, slot, key)] })
-end
-```
-
-Add `require_relative "rule_trace"` to `lib/textus/manifest/rules.rb` (or to `lib/textus/manifest.rb`).
-
-- [ ] **Step 5: Run the new tests**
-
-```
-bundle exec rspec spec/unit/manifest/rules_trace_spec.rb -f doc
-```
-
-Expected: all examples pass.
-
-- [ ] **Step 6: Run full suite to confirm non-regression**
-
-```
-bundle exec rspec --format progress
-```
-
-- [ ] **Step 7: Commit**
-
-```bash
-git add lib/textus/manifest/rule_trace.rb \
-        lib/textus/manifest/rules.rb \
-        spec/unit/manifest/rules_trace_spec.rb
-git commit -m "feat: add Manifest::RuleTrace and Rules#for_with_trace — resolution tracing"
-```
-
----
-
-## Task 2: rule_trace verb — contract, handler, VerbRegistry, HANDLER_MANIFEST
-
-Wire the new trace capability into the dispatch pipeline and expose it on CLI + MCP.
-
-**Files:**
-- Modify: `lib/textus/dispatch/contracts.rb` — add `RuleTrace = Data.define(:key)`
-- Create: `lib/textus/handlers/maintenance/rule_trace.rb` — handler module
-- Modify: `lib/textus/verb_registry.rb` — register `:rule_trace` VerbSpec
-- Modify: `lib/textus/dispatch/assembler.rb` — add `RuleTrace` row to `HANDLER_MANIFEST`
-- Create: `spec/conformance/read/rule_trace_verb_spec.rb`
-
-**Interfaces:**
-- Consumes: `Manifest::RuleTrace` and `Rules#for_with_trace` from Task 1
-- Produces: `store.rule(:rule_trace, key: "decisions.adr-0001") → Hash` with keys "key", "candidates", "winners", "ruleset_fields"
-
----
-
-- [ ] **Step 1: Write the conformance test**
-
-```ruby
-# spec/conformance/read/rule_trace_verb_spec.rb
-require "spec_helper"
-
-RSpec.describe "rule_trace verb" do
-  include_context "textus_store_fixture"
-
-  before do
-    FileUtils.mkdir_p(File.join(root, "data", "decisions"))
-    File.write(File.join(root, "manifest.yaml"), <<~YAML)
-      version: textus/4
-      lanes:
-        - { name: decisions, kind: canon }
-      entries:
-        - key: decisions.adr-0001
-          path: decisions/adr-0001.md
-          lane: decisions
-          owner: human:self
-          kind: leaf
-      rules:
-        - match: "decisions.*"
-          retain: "90d"
-        - match: "*"
-          fresh_within: "7d"
-    YAML
-  end
-
-  let(:store) { Textus::Store.new(root) }
-
-  it "returns a trace with candidates, winners, and ruleset_fields" do
-    result = store.rule(:rule_trace, key: "decisions.adr-0001")
-
-    expect(result["key"]).to eq("decisions.adr-0001")
-    expect(result["candidates"]).to be_an(Array)
-    expect(result["candidates"].size).to eq(2)
-
-    decisions_candidate = result["candidates"].find { |c| c["pattern"] == "decisions.*" }
-    expect(decisions_candidate["matched"]).to be(true)
-    expect(decisions_candidate["specificity"]).to be > 0
-
-    star_candidate = result["candidates"].find { |c| c["pattern"] == "*" }
-    expect(star_candidate["matched"]).to be(true)
-
-    expect(result["winners"].first["pattern"]).to eq("decisions.*")
-    expect(result["ruleset_fields"].key?("retain")).to be(true)
-  end
-
-  it "includes non-matching candidates with matched: false" do
-    File.write(File.join(root, "manifest.yaml"), <<~YAML)
-      version: textus/4
-      lanes:
-        - { name: decisions, kind: canon }
-      entries:
-        - { key: decisions.foo, path: decisions/foo.md, lane: decisions, owner: human:self, kind: leaf }
-      rules:
-        - match: "knowledge.*"
-          retain: "30d"
-        - match: "decisions.*"
-          retain: "90d"
-    YAML
-    store2 = Textus::Store.new(root)
-    result = store2.rule(:rule_trace, key: "decisions.foo")
-
-    knowledge_candidate = result["candidates"].find { |c| c["pattern"] == "knowledge.*" }
-    expect(knowledge_candidate["matched"]).to be(false)
-    expect(knowledge_candidate["specificity"]).to eq(0)
-  end
-
-  it "is accessible via CLI as 'textus rule trace KEY'" do
-    out = StringIO.new
-    err = StringIO.new
-    code = Textus::Surface::CLI.run(
-      ["rule", "trace", "decisions.adr-0001"],
-      stdin: StringIO.new, stdout: out, stderr: err, cwd: File.dirname(root)
-    )
-    expect(code).to be_an(Integer)
-    parsed = JSON.parse(out.string)
-    expect(parsed["key"]).to eq("decisions.adr-0001")
-  end
-end
-```
-
-- [ ] **Step 2: Run to verify it fails**
-
-```
-bundle exec rspec spec/conformance/read/rule_trace_verb_spec.rb -f doc
-```
-
-Expected: failures related to missing `:rule_trace` verb or handler.
-
----
-
-- [ ] **Step 3: Add RuleTrace contract**
-
-In `lib/textus/dispatch/contracts.rb`, after `RuleLint`:
-
-```ruby
-RuleTrace = Data.define(:key)
-```
-
-- [ ] **Step 4: Create handler module**
-
-```ruby
-# lib/textus/handlers/maintenance/rule_trace.rb
-module Textus
-  module Handlers
-    module Maintenance
-      module RuleTrace
-        HANDLES = Dispatch::Contracts::RuleTrace
-        NEEDS   = %i[manifest].freeze
-
-        def self.call(command, _call, deps)
-          _, trace = deps.manifest.rules.for_with_trace(command.key)
-          Value::Result.success(trace.to_h)
-        end
-      end
-    end
-  end
-end
-```
-
-- [ ] **Step 5: Register rule_trace in VerbRegistry**
-
-In `lib/textus/verb_registry.rb`, after the `rule_lint` registration block:
-
-```ruby
-# ── rule_trace ──────────────────────────────────────────────
-register VerbSpec.new(
-  :rule_trace,
-  "Trace rule resolution for a key — shows every pattern tested, which matched, and which won.",
-  [ArgSpec.arg(name: :key, required: true, positional: true,
-               description: "dotted key whose rule resolution you want to trace")],
-  %i[cli mcp],
-  { default: ->(v, _) { v.is_a?(Hash) ? v : v.to_h } },
-  "rule trace",
-  nil,
-  :read,
-)
-```
-
-Also add `:rule_trace` to `VERB_TO_CONTRACT` in VerbRegistry:
-
-```ruby
-rule_trace: Dispatch::Contracts::RuleTrace,
-```
-
-And add `:rule_trace` to `RULE_VERBS` in VerbRegistry:
-
-```ruby
-RULE_VERBS = %i[rule_explain rule_list schema_show rule_lint rule_trace].freeze
-```
-
-- [ ] **Step 6: Add row to HANDLER_MANIFEST**
-
-In `lib/textus/dispatch/assembler.rb`, in `HANDLER_MANIFEST`, after the `RuleLint` row:
-
-```ruby
-[Contracts::RuleTrace,
- Handlers::Maintenance::RuleTrace,
- { manifest: :manifest }],
-```
-
-- [ ] **Step 7: Run the conformance test**
-
-```
-bundle exec rspec spec/conformance/read/rule_trace_verb_spec.rb -f doc
-```
-
-Expected: all examples pass.
-
-- [ ] **Step 8: Run the assembler completeness spec**
-
-```
-bundle exec rspec spec/unit/dispatch/assembler_spec.rb -f doc
-```
-
-Expected: all 3 pass (the new `RuleTrace` contract is now in HANDLER_MANIFEST).
-
-- [ ] **Step 9: Run full suite**
-
-```
-bundle exec rspec --format progress
-```
-
-Expected: same pass count baseline.
-
-- [ ] **Step 10: Rubocop**
-
-```
-bundle exec rubocop lib/textus/dispatch/contracts.rb \
-                    lib/textus/handlers/maintenance/rule_trace.rb \
-                    lib/textus/verb_registry.rb \
-                    lib/textus/dispatch/assembler.rb
-```
-
-Fix any offenses.
-
-- [ ] **Step 11: Commit**
-
-```bash
-git add lib/textus/dispatch/contracts.rb \
-        lib/textus/handlers/maintenance/rule_trace.rb \
-        lib/textus/verb_registry.rb \
-        lib/textus/dispatch/assembler.rb \
-        spec/conformance/read/rule_trace_verb_spec.rb
-git commit -m "feat: rule_trace verb — expose Rules#for_with_trace via CLI+MCP"
-```
diff --git a/.textus/data/scratchpad/notes/0009-spec-3-rules-tracing.md b/.textus/data/scratchpad/notes/0009-spec-3-rules-tracing.md
deleted file mode 100644
index 4dd384691..000000000
--- a/.textus/data/scratchpad/notes/0009-spec-3-rules-tracing.md
+++ /dev/null
@@ -1,201 +0,0 @@
----
-title: 'Spec 3: Rules System Debugging — Resolution Tracing'
-uid: 13a45efeac2f6dd5
----
-# Spec 3: Rules System Debugging — Resolution Tracing
-
-**Date:** 2026-06-30  
-**Status:** Approved  
-**Scope:** Add rule resolution tracing to `Manifest::Rules`, surface it as a new `rule_trace` verb on CLI and MCP.
-
----
-
-## Problem
-
-`rules.for("decisions.adr-0001")` is a black box. It runs glob matching, picks the most-specific winning rules, and returns a `RuleSet` with no record of how it got there. When an entry has unexpected lifecycle behaviour (wrong retain policy, publish gated unexpectedly, schema validator not firing), there is no way to ask "which rules matched and why did that one win?" The `rule_explain` verb shows the *result*, not the *reasoning*.
-
----
-
-## Goals
-
-- `Manifest::Rules` exposes a tracing path that captures every decision made during resolution: which patterns were tested, which matched, which won, what the final RuleSet carries.
-- The trace is a plain `Data.define` value — serializable, inspectable in tests, returned by a new verb.
-- `for(key)` is unchanged. No existing callers are affected.
-- New `rule_trace` verb surfaces the trace on CLI (`:cli`) and MCP (`:mcp`) in the `:rule` domain.
-
----
-
-## Architecture
-
-### 1. `RuleTrace` value object
-
-```ruby
-module Textus::Manifest
-  RuleTrace = Data.define(
-    :key,            # String — the key that was resolved
-    :candidates,     # Array<Hash> — every rule block tested; see schema below
-    :winners,        # Array<Hash> — blocks that matched, sorted by specificity desc
-    :ruleset_fields, # Hash — the merged fields of the final RuleSet
-  )
-  # candidates element schema:
-  #   { "pattern" => String, "matched" => Boolean, "specificity" => Integer }
-  #
-  # winners element schema:
-  #   { "pattern" => String, "specificity" => Integer, "fields" => Hash }
-end
-```
-
-`candidates` covers every block defined in the manifest — including non-matching ones. This answers "why did block X not apply?" as well as "why did block Y win?". `specificity` is 0 for non-matching blocks.
-
-### 2. `Manifest::Rules#for_with_trace`
-
-`for(key)` is refactored to call `for_with_trace(key)` internally, returning only the `RuleSet`. No callers change.
-
-```ruby
-class Textus::Manifest::Rules
-  # Unchanged public interface — delegates to for_with_trace
-  def for(key)
-    for_with_trace(key).first
-  end
-
-  # New — returns [RuleSet, RuleTrace]
-  def for_with_trace(key)
-    candidates = @blocks.map do |block|
-      matched      = block.pattern.match?(key)
-      specificity  = matched ? block.pattern.specificity(key) : 0
-      { "pattern" => block.pattern.to_s, "matched" => matched, "specificity" => specificity }
-    end
-
-    winning_blocks = @blocks
-      .select  { |b| b.pattern.match?(key) }
-      .sort_by { |b| -b.pattern.specificity(key) }
-
-    ruleset = RuleSet.merge(winning_blocks.map(&:fields))
-
-    trace = RuleTrace.new(
-      key:,
-      candidates:,
-      winners: winning_blocks.map do |b|
-        { "pattern" => b.pattern.to_s, "specificity" => b.pattern.specificity(key), "fields" => b.fields }
-      end,
-      ruleset_fields: ruleset.to_h,
-    )
-
-    [ruleset, trace]
-  end
-end
-```
-
-`Manifest::Pattern#specificity(key)` is a new method (or promoted from private) that returns an integer score representing how specific the pattern match is. Higher = wins over less-specific patterns. The existing most-specific-wins logic must use the same score — `specificity` in the trace must be the same number used to pick winners.
-
-### 3. New `rule_trace` verb
-
-Registered in `VerbRegistry` alongside `rule_explain` and `rule_list`. Fits the `rule` domain (already routing `:rule_explain`, `:rule_list`, `:schema_show`, `:rule_lint`).
-
-```ruby
-# In VerbRegistry:
-register VerbSpec.new(
-  :rule_trace,
-  "Trace rule resolution for a key — shows every pattern tested, which matched, and which won.",
-  [ArgSpec.arg(name: :key, required: true, positional: true,
-               description: "dotted key whose rule resolution you want to trace")],
-  %i[cli mcp],
-  { default: ->(trace, _) { trace.to_h } },
-  "rule trace",
-  nil,
-  :read
-)
-```
-
-The handler (`Handlers::Maintenance::RuleTrace`) calls `manifest.rules.for_with_trace(key)` and returns the `RuleTrace` as the result value. The default view serializes it to a plain hash.
-
-```ruby
-module Textus::Handlers::Maintenance::RuleTrace
-  HANDLES = Dispatch::Contracts::RuleTrace
-  NEEDS   = %i[manifest].freeze
-
-  def self.call(command, _call, deps)
-    _, trace = deps.manifest.rules.for_with_trace(command.key)
-    Value::Result.success(trace)
-  end
-end
-```
-
-New contract:
-
-```ruby
-Dispatch::Contracts::RuleTrace = Data.define(:key)
-```
-
-### 4. CLI output
-
-`textus rule trace decisions.adr-0001` emits JSON by default:
-
-```json
-{
-  "key": "decisions.adr-0001",
-  "candidates": [
-    { "pattern": "decisions.*", "matched": true,  "specificity": 2 },
-    { "pattern": "knowledge.*", "matched": false, "specificity": 0 },
-    { "pattern": "*",           "matched": true,  "specificity": 1 }
-  ],
-  "winners": [
-    { "pattern": "decisions.*", "specificity": 2, "fields": { "retain": "90d" } },
-    { "pattern": "*",           "specificity": 1, "fields": { "fresh_within": "7d" } }
-  ],
-  "ruleset_fields": { "retain": "90d", "fresh_within": "7d" }
-}
-```
-
-Reading the output: candidates with `"matched": false` explain why a rule did not apply. `winners` is sorted highest-specificity-first, showing the precedence order. `ruleset_fields` is the merged result — the `retain` from `decisions.*` won over any `retain` in `*`.
-
----
-
-## Specificity scoring
-
-`Pattern#specificity(key)` must return a consistent integer that reflects the existing "most specific wins" semantics. The exact scoring formula is implementation-defined (e.g. character length of the matched portion, segment count of the pattern). The only constraint: the score used to sort `winning_blocks` in `for_with_trace` must be identical to the score used in the existing `for` implementation — otherwise the trace would show a different winner than the actual behaviour.
-
-If the existing `for` does not expose a public `specificity` method, the implementation of `for_with_trace` must extract and expose it to satisfy this constraint.
-
----
-
-## Files
-
-### New
-- `lib/textus/manifest/rule_trace.rb` — `RuleTrace = Data.define(...)`
-- `lib/textus/handlers/maintenance/rule_trace.rb` — handler module
-
-### Modified
-- `lib/textus/manifest/rules.rb` — `for` delegates to `for_with_trace`; `for_with_trace` added
-- `lib/textus/manifest/pattern.rb` — `specificity(key)` promoted to public
-- `lib/textus/dispatch/contracts.rb` — `RuleTrace = Data.define(:key)`
-- `lib/textus/verb_registry.rb` — register `:rule_trace` verb
-
-### Tests
-- `spec/unit/manifest/rules_spec.rb` — extend with `for_with_trace` examples:
-  - Returns a `RuleTrace` as second element
-  - `candidates` includes non-matching blocks with `matched: false`
-  - `winners` sorted by specificity descending
-  - `ruleset_fields` matches `for(key).to_h`
-  - `for(key)` returns the same RuleSet as before (non-regression)
-- `spec/unit/handlers/maintenance/rule_trace_spec.rb` — handler unit test with synthetic manifest
-- `spec/conformance/read/rule_trace_verb_spec.rb` — end-to-end: store with known rules → `rule_trace` returns expected candidates and winners
-
----
-
-## Error Handling
-
-| Scenario | Behaviour |
-|---|---|
-| Key not declared in manifest (unknown key) | Handler calls `for_with_trace` normally — the trace will show zero winners and no matching patterns. Returns a valid `RuleTrace` with empty `winners`. Does not raise. |
-| Empty rules block in manifest | `for_with_trace` returns `[RuleSet.empty, RuleTrace.new(key:, candidates: [], winners: [], ruleset_fields: {})]` |
-
-No new error classes needed. `rule_trace` is a read verb — it cannot fail with auth or etag errors.
-
----
-
-## Testing Strategy
-
-- Unit test `for_with_trace` directly against a `Rules` instance built from a fixture manifest with 3+ rule blocks (overlapping patterns, varying specificity).
-- Assert: (a) `for(key)` result equals `for_with_trace(key).first`; (b) `candidates` count equals total rule blocks; (c) `winners` is a subset of `candidates` where `matched: true`; (d) `winners` is sorted highest-specificity-first; (e) `ruleset_fields` equals the RuleSet merged from winners.
-- Conformance spec: a store with `decisions.*` and `*` rules; `rule_trace "decisions.foo"` returns `decisions.*` as winner over `*`.
diff --git a/.textus/data/scratchpad/notes/0010-implementation-plan-0121-0124.md b/.textus/data/scratchpad/notes/0010-implementation-plan-0121-0124.md
deleted file mode 100644
index c16fcdb8e..000000000
--- a/.textus/data/scratchpad/notes/0010-implementation-plan-0121-0124.md
+++ /dev/null
@@ -1,102 +0,0 @@
----
-uid: 3e9dc36460ab164c
----
-# Implementation Plan: ADRs 0121–0124
-
-## Ordering
-
-The 4 ADRs have one dependency edge: **C3 (MCP session resilience) is prerequisite to C1 (graph verb surfacing)** — the graph verb needs a stable connection to surface on MCP. Otherwise they are independent.
-
-**Recommended order:** C3 → C1 → C2 → C4
-- C3: MCP session resilience (smallest change, enables stable foundation)
-- C1: Knowledge links (largest change, builds on stable MCP)
-- C2: Proposal diff (medium change, independent)
-- C4: Workflow parallel (medium change, independent)
-
----
-
-## C3 — MCP Session Resilience (ADR 0123)
-
-**Files touched:** `lib/textus/surface/mcp/server.rb`, `lib/textus/store/cursor.rb`
-
-### Steps
-
-1. **Add checkpoint interval config** to manifest's `worker_config` (default 30s).
-2. **Background thread in MCP::Server#initialize** that loops: sleep(interval) → `Cursor.write(@store.cursor)`.
-3. **Modify Store#build_session!** to check cursor file before defaulting to `latest_seq`.
-4. **Add `contract_drifted` field to pulse response** — check etag before returning, attach boolean + current etag.
-5. **Remove hard ContractDrift error for writes** — replace with soft warning in response.
-6. **Update default audit `keep:` to never-expire** — change default from 5 to a high value.
-7. **Add doctor check** for nearing retention limit with active cursors.
-
-**Tests:** Existing cursor_spec, MCP server_spec, pulse_entries_spec.
-
----
-
-## C1 — Knowledge Links (ADR 0121)
-
-**Files touched:** `lib/textus/links/link_edge_store.rb`, `lib/textus/store.rb`, `lib/textus/port/store.rb` (SQLite), `lib/textus/verb_registry.rb`, `lib/textus/handlers/read/`, `lib/textus/surface/`
-
-### Steps
-
-1. **Add `link_edges(from_key TEXT, to_key TEXT)` table** to `Port::Store.setup!` (existing store.db).
-2. **Replace LinkEdgeStore** in-memory Hash with SQLite-backed adapter implementing `record + dependents_of`.
-3. **Wire into Store#build_ctx** — replace `Links::LinkEdgeStore.new` with SQLite-backed version.
-4. **Add background sweep job** for catching missed edges (enumerate published entries, scan for textus:KEY URIs, insert missing edges).
-5. **Register `graph` verb** in VerbRegistry — `neighbors(key)` and `reachable(key, depth=N)`.
-6. **Write Graph handler** — SQLite queries for neighbors (direct links) and reachable (recursive CTE or BFS in Ruby).
-7. **Backfill `rdeps`** to query both manifest-produced deps AND `link_edges` table — unified response.
-8. **Register new CLI/MCP surfaces** — auto-generated from verb spec.
-
-**Tests:** New link_edge_store_spec (SQLite), graph_handler_spec, rdeps_spec.
-
----
-
-## C2 — Proposal Diff (ADR 0122)
-
-**Files touched:** `lib/textus/verb_registry.rb`, `lib/textus/handlers/read/diff_proposal.rb`, `lib/textus/handlers/write/accept_proposal.rb`, `lib/textus/handlers/write/reject_proposal.rb`
-
-### Steps
-
-1. **Write diff engine** — pure Ruby Myers diff for body lines (markdown/text), structural diff for meta/schema.
-2. **Register `diff` verb** in VerbRegistry — takes `pending_key`, returns diff envelope.
-3. **Write DiffProposal handler** — reads proposal, reads target, computes diff, returns result.
-4. **Add `--dry-run` to `accept` contract** — optional boolean arg.
-5. **Modify AcceptProposal handler** — when `dry_run: true`, compute diff and return without promoting.
-6. **Add `--reason` to `reject` contract** — optional string arg.
-7. **Modify RejectProposal handler** — emit `:proposal_rejected` with reason, write audit log with reason, optionally write scratchpad note.
-8. **Surfaced to CLI and MCP** — auto-generated.
-
-**Tests:** Diff engine spec (pure function), diff_handler_spec, accept_dry_run_spec, reject_reason_spec.
-
----
-
-## C4 — Workflow Parallel Steps (ADR 0124)
-
-**Files touched:** `lib/textus/workflow/dsl.rb`, `lib/textus/workflow/runner.rb`, `textus.gemspec`
-
-### Steps
-
-1. **Add concurrent-ruby dependency** to gemspec (`s.add_dependency "concurrent-ruby", "~> 1.3"`).
-2. **Add `Parallel` Data class** to Workflow::DSL.
-3. **Add `parallel` method** to Definition — captures block, collects steps into Parallel.
-4. **Modify Workflow::Runner** to pattern-match on `Parallel` vs `Step`:
-   - `Parallel` → execute steps concurrently via `Concurrent::Promises.future` + `zip(*futures).value!`
-   - Collect errors, raise `ParallelStepFailed` if any fail.
-5. **Add worker_config.pool_size** to manifest for thread pool size.
-6. **Add timeout support** for parallel steps (inherit per-step timeout from existing DSL).
-
-**Tests:** Workflow DSL spec (parallel block parsing), Runner spec (concurrent execution, error collection), conformance spec for existing workflows (unchanged).
-
----
-
-## Summary
-
-| ADR | Files changed | Est. LOC | Dependencies |
-|---|---|---|---|
-| C3 | 3 source + 1 config | ~100 | None |
-| C1 | 6 source + 1 migration | ~250 | C3 (for MCP surface) |
-| C2 | 4 source | ~200 | None |
-| C4 | 3 source + gemspec | ~140 | concurrent-ruby gem |
-
-Total: ~690 LOC across 4 ADRs. C1 is the largest change; C3 is the smallest.
diff --git a/.textus/data/scratchpad/notes/0011-parked-arch-candidates.md b/.textus/data/scratchpad/notes/0011-parked-arch-candidates.md
deleted file mode 100644
index 50cb61e2b..000000000
--- a/.textus/data/scratchpad/notes/0011-parked-arch-candidates.md
+++ /dev/null
@@ -1,20 +0,0 @@
----
-name: parked-arch-candidates
-uid: b122a9288522f848
----
-# Parked — architecture review 2026-06-30
-
-Candidates 5, 6, 7 — set aside while 1-4 are explored.
-
-## 5 — Read Path Caching
-`lib/textus/store/entry/reader.rb` — every `get` = FS read + YAML parse. No cache.
-Optional SQLite read-through cache keyed by (key, etag). Trivial invalidation (etag changes on write).
-⚠ Contradicts Rule 08 (no hidden side-effects on read) but cache is read-through, not mutation.
-
-## 6 — CLI UX: Human-readable output
-`lib/textus/surface/cli.rb` — JSON-only. No `--format=text`. No progress for `drain`. No tab completion.
-Add `--format=text|json`. Text mode: `get` prints body, `list` prints table.
-
-## 7 — Audit Log Index
-`lib/textus/port/audit_log.rb` — NDJSON scan-only filtering. No index.
-Mirror to SQLite with indexed columns. Speculative — revisit if query perf becomes pain.
diff --git a/.textus/data/scratchpad/notes/0012-verb-registry-standardization-plan.md b/.textus/data/scratchpad/notes/0012-verb-registry-standardization-plan.md
deleted file mode 100644
index 2cf3af240..000000000
--- a/.textus/data/scratchpad/notes/0012-verb-registry-standardization-plan.md
+++ /dev/null
@@ -1,876 +0,0 @@
----
-uid: '08b43cb02e8331f5'
----
-# Verb Registry Standardization Implementation Plan
-
-> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers-ruby:subagent-driven-development (recommended) or superpowers-ruby:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
-
-**Goal:** Close four concrete standardization gaps found in an API/interface audit of `Textus::VerbRegistry` / `Dispatch::Contracts` / `Value::Result`: an MCP/CLI surface-parity gap on six verbs, an internal contract-naming inconsistency, a mixed-intent `jobs` verb, and a `Result.extract` path that silently downgrades typed errors (including a currently-unreachable `Textus::CursorExpired`) to a generic `ActionError`.
-
-**Architecture:** No new layers. Every change is a projection-level or contract-level edit inside the existing `VerbRegistry` → `Dispatch::Contracts` → `HandlerResolver`/`Pipeline` → `Value::Result` pipeline described in ADR 0131 and ADR 0125. Task 3 (jobs split) follows the exact `key_*` / `rule_*` precedent already in the registry (multi-word verb → auto-derived CLI group).
-
-**Tech Stack:** Ruby 3.x, RSpec, the existing `Textus::Dispatch` pipeline (no new gems).
-
----
-
-## Before you start
-
-Run the full suite once to get a clean baseline:
-
-```bash
-bundle exec rspec
-```
-
-Expected: all green (per project memory, this environment has 4 known pre-existing CLI-conformance failures unrelated to this work — note them now so you don't chase them later).
-
-Work through tasks in order. Each task is independently committable and independently revertable.
-
----
-
-### Task 1: Expose `uid`, `blame`, `audit`, `rule_list`, `published`, `doctor` over MCP
-
-**Why this is safe:** `Store#method_missing` dispatches every verb in `VerbRegistry::DOMAIN_VERBS` (built from `ENTRY_VERBS + OPS_VERBS + RULE_VERBS`, independent of `surfaces`) through the same `Dispatch::Pipeline`. The CLI already calls these six verbs this way. Adding `:mcp` to `surfaces` only changes whether `MCP::Catalog.specs`/`.build_tools` advertises the tool — no use-case, pipeline, or Store change is needed.
-
-**Files:**
-- Modify: `lib/textus/verb_registry.rb` (six `register VerbSpec.new(...)` calls)
-- Test: `spec/integration/surface/mcp/catalog_dispatch_spec.rb`
-
-- [ ] **Step 1: Write the failing tests**
-
-Add to the bottom of `spec/integration/surface/mcp/catalog_dispatch_spec.rb` (before the final `end`):
-
-```ruby
-  # ── Newly-exposed observability verbs (verb-registry standardization) ──────
-
-  describe ".call('uid', ...)" do
-    it "returns the entry's stable uid" do
-      result = described_class.call("uid", store: human_store, args: { "key" => "identity.self" })
-      expect(result).to be_a(String)
-      expect(result).not_to be_empty
-    end
-  end
-
-  describe ".call('blame', ...)" do
-    it "returns an array of audit rows annotated with git info" do
-      result = described_class.call("blame", store: human_store, args: { "key" => "identity.self" })
-      expect(result).to be_an(Array)
-    end
-  end
-
-  describe ".call('audit', ...)" do
-    it "returns an array of audit rows" do
-      result = described_class.call("audit", store: human_store, args: {})
-      expect(result).to be_an(Array)
-    end
-  end
-
-  describe ".call('rule_list', ...)" do
-    it "returns an array of rule blocks" do
-      result = described_class.call("rule_list", store: human_store, args: {})
-      expect(result).to be_an(Array)
-    end
-  end
-
-  describe ".call('published', ...)" do
-    it "returns an array of published entries" do
-      result = described_class.call("published", store: human_store, args: {})
-      expect(result).to be_an(Array)
-    end
-  end
-
-  describe ".call('doctor', ...)" do
-    it "returns a health-check result hash" do
-      result = described_class.call("doctor", store: human_store, args: {})
-      expect(result).to include("ok")
-    end
-  end
-
-  it "advertises all six previously CLI-only verbs as MCP tool names" do
-    expect(Textus::Surface::MCP::Catalog.names).to include(
-      "uid", "blame", "audit", "rule_list", "published", "doctor",
-    )
-  end
-```
-
-- [ ] **Step 2: Run the tests to verify they fail**
-
-Run: `bundle exec rspec spec/integration/surface/mcp/catalog_dispatch_spec.rb -e "uid" -e "blame" -e "audit" -e "rule_list" -e "published" -e "doctor" -e "previously CLI-only"`
-Expected: FAIL with `Textus::Surface::MCP::ToolError: unknown tool: uid` (and similarly for the other five, plus the aggregate `names` example)
-
-- [ ] **Step 3: Flip each verb's `surfaces` from `[:cli]` to `%i[cli mcp]`**
-
-In `lib/textus/verb_registry.rb`, six one-line changes (only the `surfaces` argument — the 2nd positional array argument to `VerbSpec.new` — changes on each):
-
-```ruby
-    # ── uid ──────────────────────────────────────────────
-    register VerbSpec.new(
-      :uid, "Return the stable UID of an entry without reading its body.",
-      [ArgSpec.arg(name: :key, required: true, positional: true, description: "entry key")],
-      %i[cli mcp], { cli: ->(uid, inputs) { { "key" => inputs[:key], "uid" => uid } }, default: identity }, "key uid", nil, :read
-    )
-```
-
-```ruby
-    # ── blame ────────────────────────────────────────────
-    register VerbSpec.new(
-      :blame, "Annotate audit rows with the git commit that introduced each file state.",
-      [ArgSpec.arg(name: :key, required: true, positional: true, description: "entry key to blame"),
-       ArgSpec.arg(name: :limit, type: Integer,
-                   description: "maximum number of audit rows to return")],
-      %i[cli mcp], {
-        cli: ->(rows, inputs) { { "verb" => "blame", "key" => inputs[:key], "rows" => rows } },
-        default: identity,
-      }, "blame", nil, :read
-    )
-```
-
-```ruby
-    # ── audit ────────────────────────────────────────────
-    register VerbSpec.new(
-      :audit, "Query the audit log with optional filters.",
-      [ArgSpec.arg(name: :key, description: "filter to rows for this key"),
-       ArgSpec.arg(name: :lane, description: "filter to keys in this lane"),
-       ArgSpec.arg(name: :role, description: "filter to rows written under this role"),
-       ArgSpec.arg(name: :verb, description: "filter to rows for this verb"),
-       ArgSpec.arg(name: :since,
-                   description: "ISO-8601 timestamp or relative offset (e.g. 1h, 30m)"),
-       ArgSpec.arg(name: :seq_since, type: Integer,
-                   description: "return rows with seq > this cursor value"),
-       ArgSpec.arg(name: :correlation_id,
-                   description: "filter to rows with this correlation_id"),
-       ArgSpec.arg(name: :limit, type: Integer,
-                   description: "maximum number of rows to return")],
-      %i[cli mcp], { cli: ->(rows, _) { { "verb" => "audit", "rows" => rows } }, default: identity }, "audit", nil, :read
-    )
-```
-
-```ruby
-    # ── rule_list ────────────────────────────────────────
-    register VerbSpec.new(
-      :rule_list, "List every rule block in the manifest.",
-      [], %i[cli mcp], { cli: ->(p, _) { { "verb" => "rule_list", "policies" => p } }, default: identity }, "rule list", nil, :read
-    )
-```
-
-```ruby
-    # ── published ────────────────────────────────────────
-    register VerbSpec.new(
-      :published, "List all entries that declare a publish target.",
-      [], %i[cli mcp], { default: identity }, "published", nil, :read
-    )
-```
-
-```ruby
-    # ── doctor ───────────────────────────────────────────
-    register VerbSpec.new(
-      :doctor, "Run health checks on the textus store.",
-      [ArgSpec.arg(name: :checks, type: Array,
-                   description: "subset of check names to run (default: all)")],
-      %i[cli mcp], { default: identity }, "doctor", nil, :read
-    )
-```
-
-- [ ] **Step 4: Run the tests to verify they pass**
-
-Run: `bundle exec rspec spec/integration/surface/mcp/catalog_dispatch_spec.rb`
-Expected: all PASS
-
-- [ ] **Step 5: Run the full-catalog conformance suite**
-
-Run: `bundle exec rspec spec/conformance/surface/mcp/integration_spec.rb`
-Expected: PASS — this spec compares `tools/list` output against `Catalog.names` dynamically, so no fixture list needs updating.
-
-- [ ] **Step 6: Run the full suite and commit**
-
-```bash
-bundle exec rspec
-bundle exec rubocop lib/textus/verb_registry.rb spec/integration/surface/mcp/catalog_dispatch_spec.rb
-git add lib/textus/verb_registry.rb spec/integration/surface/mcp/catalog_dispatch_spec.rb
-git commit -m "feat(verbs): expose uid, blame, audit, rule_list, published, doctor over MCP"
-```
-
----
-
-### Task 2: Rename `Dispatch::Contracts::MoveKey` → `MvKey` for naming consistency
-
-**Why:** Every other prefix/bulk contract in this family already abbreviates "move" to "mv" (`DataMv`, `KeyMvPrefix`) to match the wire-facing verb symbols (`key_mv`, `data_mv`, `key_mv_prefix`). `MoveKey` is the one contract class spelling the word out, which reads as accidental drift to anyone scanning `contracts.rb` top-to-bottom. This is an internal Ruby class rename only — the wire verb name (`key_mv`) and CLI path (`key mv`) do not change, so there is no consumer-facing break.
-
-**Files:**
-- Modify: `lib/textus/dispatch/contracts.rb:12`
-- Modify: `lib/textus/verb_registry.rb:67`
-- Modify: `lib/textus/dispatch/middleware/audit_index.rb:15`
-- Modify: `lib/textus/use_cases/write/move_key.rb:5`
-- Test: existing suites (no new spec file needed — this is a pure rename with full existing coverage)
-
-- [ ] **Step 1: Confirm current coverage exists (no new test needed)**
-
-Run: `bundle exec rspec -e "key mv" -e "key_mv"`
-Expected: PASS (existing `key_mv` behavior specs establish the safety net for this rename)
-
-- [ ] **Step 2: Rename the contract class**
-
-In `lib/textus/dispatch/contracts.rb`, change:
-
-```ruby
-      MoveKey = Data.define(:old_key, :new_key, :if_etag, :dry_run)
-```
-
-to:
-
-```ruby
-      MvKey = Data.define(:old_key, :new_key, :if_etag, :dry_run)
-```
-
-- [ ] **Step 3: Update the three call sites**
-
-In `lib/textus/verb_registry.rb`, change:
-
-```ruby
-      key_mv: Dispatch::Contracts::MoveKey,
-```
-
-to:
-
-```ruby
-      key_mv: Dispatch::Contracts::MvKey,
-```
-
-In `lib/textus/dispatch/middleware/audit_index.rb`, change:
-
-```ruby
-          Contracts::MoveKey,
-```
-
-to:
-
-```ruby
-          Contracts::MvKey,
-```
-
-In `lib/textus/use_cases/write/move_key.rb`, change:
-
-```ruby
-        HANDLES = Dispatch::Contracts::MoveKey
-```
-
-to:
-
-```ruby
-        HANDLES = Dispatch::Contracts::MvKey
-```
-
-(Leave the enclosing Ruby module name `UseCases::Write::MoveKey` and the file name `move_key.rb` as-is — this rename is scoped to the wire-contract class only, not the use-case module that implements it.)
-
-- [ ] **Step 4: Run the full suite**
-
-Run: `bundle exec rspec`
-Expected: all PASS (a stale reference to `Contracts::MoveKey` anywhere would raise `NameError` at boot, since `HandlerResolver.eager_load!` requires every use-case file)
-
-- [ ] **Step 5: Grep for any missed reference**
-
-Run: `grep -rn "Contracts::MoveKey" lib/ spec/`
-Expected: no output
-
-- [ ] **Step 6: Commit**
-
-```bash
-bundle exec rubocop lib/textus/dispatch/contracts.rb lib/textus/verb_registry.rb lib/textus/dispatch/middleware/audit_index.rb lib/textus/use_cases/write/move_key.rb
-git add lib/textus/dispatch/contracts.rb lib/textus/verb_registry.rb lib/textus/dispatch/middleware/audit_index.rb lib/textus/use_cases/write/move_key.rb
-git commit -m "refactor(contracts): rename MoveKey to MvKey for naming consistency with DataMv/KeyMvPrefix"
-```
-
----
-
-### Task 3: Split the `jobs` verb into `jobs_list` / `jobs_retry` / `jobs_purge`
-
-**Why:** `jobs` today is one verb that both lists jobs (read) and mutates queue state via an untyped `action: "retry"|"purge"` string (write) — the one place in the registry where a single verb's `category` (`:maintenance`) doesn't tell you whether a call is safe to retry or has side effects. Splitting it also gives `jobs` the same multi-word-verb → auto-derived-CLI-group treatment already used for `key_*` (`Group::Key`) and `rule_*` (`Group::Rule`), so `textus jobs list|retry|purge` becomes structurally consistent with `textus key delete|mv|mv-prefix|delete-prefix|uid`. This is a breaking CLI/MCP change (`jobs` the bare verb goes away) — acceptable per this project's current fast-dev, breaking-changes-OK posture.
-
-**Files:**
-- Create: `lib/textus/use_cases/ops/jobs_list.rb`
-- Create: `lib/textus/use_cases/ops/jobs_retry.rb`
-- Create: `lib/textus/use_cases/ops/jobs_purge.rb`
-- Delete: `lib/textus/use_cases/ops/jobs_action.rb`
-- Modify: `lib/textus/dispatch/contracts.rb` (replace `JobsAction` with three contracts)
-- Modify: `lib/textus/verb_registry.rb` (replace the `jobs` registration with three registrations; update `VERB_TO_CONTRACT` and `OPS_VERBS`)
-- Modify: `lib/textus/surface/cli.rb` (help text)
-- Modify: `spec/conformance/surface/cli/contract_spec.rb` (verb table + group subcommand table)
-- Test: `spec/integration/use_cases/ops/jobs_spec.rb` (new)
-
-- [ ] **Step 1: Write the failing use-case tests**
-
-Create `spec/integration/use_cases/ops/jobs_spec.rb`:
-
-```ruby
-require "spec_helper"
-
-RSpec.describe "jobs_list / jobs_retry / jobs_purge use cases" do
-  include_context "textus_store_fixture"
-
-  let(:manifest_yaml) do
-    <<~YAML
-      version: textus/4
-      lanes:
-        - { name: knowledge, kind: canon }
-      entries:
-        - { key: knowledge.note, path: knowledge/note.md, lane: knowledge, owner: human:self, kind: leaf }
-    YAML
-  end
-
-  before do
-    FileUtils.mkdir_p(File.join(root, "data/knowledge"))
-    FileUtils.mkdir_p(File.join(root, "schemas"))
-    File.write(File.join(root, "manifest.yaml"), manifest_yaml)
-    FileUtils.mkdir_p(audit_dir_path(root))
-    File.write(audit_log_path(root), "")
-  end
-
-  let(:store) { Textus::Store.new(root) }
-  let(:queue) { Textus::Store::Jobs::Queue.new(store: store.job_store) }
-
-  it "jobs_list returns queued job ids for a state without mutating anything" do
-    store.enqueue(type: "materialize", args: { "key" => "knowledge.note" })
-    result = store.jobs_list(state: "ready")
-    expect(result["jobs"]).to be_an(Array)
-    expect(result["jobs"].size).to eq(1)
-  end
-
-  it "jobs_retry re-queues a dead-lettered job by id" do
-    # NOTE (fixed during quality verification): Queue#list returns an array of
-    # job-id strings, not hashes — an earlier draft of this test called
-    # `.first["id"]` on that string (String#[] with a substring argument),
-    # which silently returned nil and never exercised a real retry. Build an
-    # actually dead-lettered job instead: max_attempts: 1 + one queue.fail
-    # call moves it straight to "failed".
-    job = Textus::Store::Jobs::Queue::Job.new(
-      type: "materialize", args: { "key" => "knowledge.note" }, role: "automation", max_attempts: 1,
-    )
-    queue.enqueue(job)
-    leased = queue.lease(worker_id: "spec-worker", lease_ttl: 5)
-    queue.fail(leased, error: "boom") # attempts (1) >= max_attempts (1): dead-lettered
-    expect(store.jobs_list(state: "failed")["jobs"]).to eq([job.id])
-
-    result = store.jobs_retry(job_id: job.id)
-
-    expect(result["ok"]).to be(true)
-    expect(store.jobs_list(state: "ready")["jobs"]).to eq([job.id])
-    expect(store.jobs_list(state: "failed")["jobs"]).to eq([])
-  end
-
-  it "jobs_purge removes every job in a state" do
-    store.enqueue(type: "materialize", args: { "key" => "knowledge.note" })
-    result = store.jobs_purge(state: "ready")
-    expect(result["ok"]).to be(true)
-    expect(store.jobs_list(state: "ready")["jobs"]).to eq([])
-  end
-end
-```
-
-- [ ] **Step 2: Run the tests to verify they fail**
-
-Run: `bundle exec rspec spec/integration/use_cases/ops/jobs_spec.rb`
-Expected: FAIL with `NoMethodError: unknown verb: jobs_list` (and similarly for `jobs_retry`/`jobs_purge`)
-
-- [ ] **Step 3: Replace the `JobsAction` contract with three contracts**
-
-In `lib/textus/dispatch/contracts.rb`, change:
-
-```ruby
-      JobsAction = Data.define(:state, :action, :job_id)
-```
-
-to:
-
-```ruby
-      JobsList = Data.define(:state)
-
-      JobsRetry = Data.define(:job_id)
-
-      JobsPurge = Data.define(:state)
-```
-
-- [ ] **Step 4: Replace the `jobs_action.rb` use case with three focused use cases**
-
-Delete `lib/textus/use_cases/ops/jobs_action.rb`.
-
-Create `lib/textus/use_cases/ops/jobs_list.rb`:
-
-```ruby
-# frozen_string_literal: true
-
-module Textus
-  module UseCases
-    module Ops
-      module JobsList
-        HANDLES = Dispatch::Contracts::JobsList
-        NEEDS = %i[job_store].freeze
-
-        def self.call(command, _call, deps)
-          queue = Textus::Store::Jobs::Queue.new(store: deps.job_store)
-          Value::Result.success("protocol" => Textus::PROTOCOL, "ok" => true,
-                                "state" => command.state, "jobs" => queue.list(command.state))
-        end
-      end
-    end
-  end
-end
-```
-
-Create `lib/textus/use_cases/ops/jobs_retry.rb`:
-
-```ruby
-# frozen_string_literal: true
-
-module Textus
-  module UseCases
-    module Ops
-      module JobsRetry
-        HANDLES = Dispatch::Contracts::JobsRetry
-        NEEDS = %i[job_store].freeze
-
-        def self.call(command, _call, deps)
-          queue = Textus::Store::Jobs::Queue.new(store: deps.job_store)
-          queue.retry_failed(command.job_id)
-          Value::Result.success("protocol" => Textus::PROTOCOL, "ok" => true, "job_id" => command.job_id)
-        end
-      end
-    end
-  end
-end
-```
-
-Create `lib/textus/use_cases/ops/jobs_purge.rb`:
-
-```ruby
-# frozen_string_literal: true
-
-module Textus
-  module UseCases
-    module Ops
-      module JobsPurge
-        HANDLES = Dispatch::Contracts::JobsPurge
-        NEEDS = %i[job_store].freeze
-
-        def self.call(command, _call, deps)
-          queue = Textus::Store::Jobs::Queue.new(store: deps.job_store)
-          queue.purge(command.state)
-          Value::Result.success("protocol" => Textus::PROTOCOL, "ok" => true,
-                                "state" => command.state, "jobs" => queue.list(command.state))
-        end
-      end
-    end
-  end
-end
-```
-
-- [ ] **Step 5: Replace the `jobs` registration with three registrations**
-
-In `lib/textus/verb_registry.rb`, remove `jobs: Dispatch::Contracts::JobsAction,` from `VERB_TO_CONTRACT` and replace with:
-
-```ruby
-      jobs_list: Dispatch::Contracts::JobsList,
-      jobs_retry: Dispatch::Contracts::JobsRetry,
-      jobs_purge: Dispatch::Contracts::JobsPurge,
-```
-
-Change `OPS_VERBS` from:
-
-```ruby
-    OPS_VERBS = %i[
-      boot drain doctor pulse jobs enqueue data_mv
-      key_mv_prefix key_delete_prefix published
-    ].freeze
-```
-
-to:
-
-```ruby
-    OPS_VERBS = %i[
-      boot drain doctor pulse jobs_list jobs_retry jobs_purge enqueue data_mv
-      key_mv_prefix key_delete_prefix published
-    ].freeze
-```
-
-Replace the `# ── jobs ──` registration block:
-
-```ruby
-    # ── jobs ─────────────────────────────────────────────
-    register VerbSpec.new(
-      :jobs, "List queued jobs by state; retry a dead-lettered job or purge.",
-      [ArgSpec.arg(name: :state, default: "ready",
-                   description: "ready|leased|done|failed"),
-       ArgSpec.arg(name: :action, description: "retry|purge (optional)"),
-       ArgSpec.arg(name: :job_id, description: "job id (required for action=retry)")],
-      %i[cli mcp], { default: identity }, "jobs", nil, :maintenance
-    )
-```
-
-with three registrations:
-
-```ruby
-    # ── jobs_list ────────────────────────────────────────
-    register VerbSpec.new(
-      :jobs_list, "List queued jobs by state.",
-      [ArgSpec.arg(name: :state, default: "ready",
-                   description: "ready|leased|done|failed")],
-      %i[cli mcp], { default: identity }, "jobs list", nil, :read
-    )
-
-    # ── jobs_retry ───────────────────────────────────────
-    register VerbSpec.new(
-      :jobs_retry, "Re-queue a dead-lettered job by id.",
-      [ArgSpec.arg(name: :job_id, required: true, positional: true, description: "job id to retry")],
-      %i[cli mcp], { default: identity }, "jobs retry", nil, :write
-    )
-
-    # ── jobs_purge ───────────────────────────────────────
-    register VerbSpec.new(
-      :jobs_purge, "Delete every job in a state.",
-      [ArgSpec.arg(name: :state, required: true, positional: true, description: "ready|leased|done|failed")],
-      %i[cli mcp], { default: identity }, "jobs purge", nil, :write
-    )
-```
-
-- [ ] **Step 6: Run the use-case tests to verify they pass**
-
-Run: `bundle exec rspec spec/integration/use_cases/ops/jobs_spec.rb`
-Expected: all PASS
-
-- [ ] **Step 7: Update the CLI help text**
-
-In `lib/textus/surface/cli.rb`, in `print_help`, change:
-
-```ruby
-            textus drain [PREFIX] --as=ROLE
-            textus watch
-            textus jobs
-```
-
-to:
-
-```ruby
-            textus drain [PREFIX] --as=ROLE
-            textus watch
-            textus jobs {list,retry,purge}
-```
-
-- [ ] **Step 8: Update the CLI conformance fixture table**
-
-In `spec/conformance/surface/cli/contract_spec.rb`, change:
-
-```ruby
-      "jobs" => Textus::Surface::CLI::Verb::GenJobs,
-```
-
-to:
-
-```ruby
-      "jobs" => Textus::Surface::CLI::Group::Jobs,
-```
-
-Then, in the same file, the existing `"group subcommand tables are auto-derived from parent_group"` example already asserts `Group::Key`, `Group::Rule`, `Group::Data`, and `Group::Schema` and sits right at this repo's `RSpec/ExampleLength` ceiling (25 lines, per `.rubocop.yml`). Rather than push it over that ratchet, add the `Jobs` assertion as its own example immediately after it:
-
-```ruby
-  it "the jobs group subcommand table is auto-derived from parent_group" do
-    expect(Textus::Surface::CLI::Group::Jobs.subcommands).to eq(
-      "list" => Textus::Surface::CLI::Verb::GenJobsList,
-      "purge" => Textus::Surface::CLI::Verb::GenJobsPurge,
-      "retry" => Textus::Surface::CLI::Verb::GenJobsRetry,
-    )
-  end
-```
-
-- [ ] **Step 9: Run the CLI conformance suite**
-
-Run: `bundle exec rspec spec/conformance/surface/cli/contract_spec.rb`
-Expected: all PASS
-
-- [ ] **Step 10: Grep for any other reference to the old bare `jobs` verb**
-
-Run: `grep -rn '"jobs"\|:jobs\b\|Verb::GenJobs\b\|Contracts::JobsAction\|JobsAction' lib/ spec/ docs/reference docs/how-to 2>/dev/null`
-Expected: no output (aside from this plan file and unrelated matches like `"jobs_list"`)
-
-- [ ] **Step 11: Run the full suite and commit**
-
-```bash
-bundle exec rspec
-bundle exec rubocop lib/textus/dispatch/contracts.rb lib/textus/verb_registry.rb lib/textus/surface/cli.rb lib/textus/use_cases/ops/jobs_list.rb lib/textus/use_cases/ops/jobs_retry.rb lib/textus/use_cases/ops/jobs_purge.rb spec/integration/use_cases/ops/jobs_spec.rb spec/conformance/surface/cli/contract_spec.rb
-git add lib/textus/dispatch/contracts.rb lib/textus/verb_registry.rb lib/textus/surface/cli.rb \
-        lib/textus/use_cases/ops/jobs_list.rb lib/textus/use_cases/ops/jobs_retry.rb lib/textus/use_cases/ops/jobs_purge.rb \
-        spec/integration/use_cases/ops/jobs_spec.rb spec/conformance/surface/cli/contract_spec.rb
-git rm lib/textus/use_cases/ops/jobs_action.rb
-git commit -m "refactor(jobs): split jobs into jobs_list/jobs_retry/jobs_purge, matching key_*/rule_* group convention"
-```
-
----
-
-### Task 4: Preserve typed errors through `Value::Result.extract`, and fix the dead `Textus::CursorExpired` path
-
-**Why:** `Result.extract` always re-raises failures as a generic `Textus::ActionError` with `exit_code: 1`, regardless of what `code:` was passed to `Result.failure`. Concretely, `move_key.rb`, `enqueue_job.rb`, `ingest_entry.rb`, and others pass `:usage_error` as the code — semantically a `UsageError` (`exit_code: 2`) — but it always surfaces as `ActionError` (`exit_code: 1`). Worse: `audit_entries.rb`'s cursor-expiry check passes `:cursor_expired`, which is supposed to become `Textus::CursorExpired` — a class with a dedicated JSON-RPC error code (`-32002`) that both `MCP::Catalog#call` and `MCP::Server#dispatch` specifically rescue and re-raise unwrapped. Because that path always produces `ActionError` instead, **`Textus::CursorExpired` is never actually raised anywhere in the codebase today** — its JSON-RPC handling is dead code, and MCP agents calling `audit` with a stale `seq_since` get a generic tool error instead of the `-32002` signal ADR 0123's session-resilience contract depends on.
-
-The fix adds an opt-in `Value::Result.from_error(err)` constructor that carries the real exception through, and updates `audit_entries.rb` to use it. Existing `Result.failure(code, message)` call sites are untouched — this is additive, not a behavior change for anyone not using the new path.
-
-**Files:**
-- Modify: `lib/textus/value/result.rb`
-- Modify: `lib/textus/use_cases/read/audit_entries.rb`
-- Test: `spec/unit/value/result_spec.rb` (new)
-- Test: `spec/unit/use_cases/read/audit_entries_spec.rb` (new)
-
-- [ ] **Step 1: Write the failing `Value::Result` unit tests**
-
-Create `spec/unit/value/result_spec.rb`:
-
-```ruby
-require "spec_helper"
-
-RSpec.describe Textus::Value::Result do
-  describe ".from_error" do
-    it "wraps a Textus::Error instance as a failed Result carrying the original exception" do
-      err = Textus::UsageError.new("bad input", hint: "fix your input")
-      result = described_class.from_error(err)
-
-      expect(result.success?).to be(false)
-      expect(result.error[:code]).to eq("usage")
-      expect(result.error[:message]).to eq("bad input")
-    end
-  end
-
-  describe ".extract" do
-    it "raises the original exception type for a Result built with .from_error" do
-      err = Textus::UsageError.new("bad input")
-      result = described_class.from_error(err)
-
-      expect { described_class.extract(result) }.to raise_error(Textus::UsageError, "bad input")
-    end
-
-    it "still raises a generic ActionError for a Result built with .failure (unchanged behavior)" do
-      result = described_class.failure(:something_wrong, "it broke")
-
-      expect { described_class.extract(result) }.to raise_error(Textus::ActionError, "it broke")
-    end
-
-    it "preserves the raised exception's exit_code" do
-      err = Textus::UsageError.new("bad input")
-      result = described_class.from_error(err)
-
-      begin
-        described_class.extract(result)
-      rescue Textus::UsageError => e
-        expect(e.exit_code).to eq(2)
-      end
-    end
-  end
-end
-```
-
-- [ ] **Step 2: Run the tests to verify they fail**
-
-Run: `bundle exec rspec spec/unit/value/result_spec.rb`
-Expected: FAIL with `NoMethodError: undefined method 'from_error' for Textus::Value::Result:Class`
-
-- [ ] **Step 3: Implement `Result.from_error` and update `Result.extract`**
-
-Replace the full contents of `lib/textus/value/result.rb`:
-
-```ruby
-module Textus
-  module Value
-    # rubocop:disable Lint/ConstantDefinitionInBlock
-    Result = Data.define(:ok, :value, :error) do
-      def self.success(value) = new(ok: true, value: value, error: nil)
-
-      def self.failure(code, message, details: {})
-        new(ok: false, value: nil, error: { code: code, message: message, details: details })
-      end
-
-      # Wraps an already-constructed Textus::Error so .extract can re-raise the
-      # exact type (and its exit_code/hint/JSONRPC behavior) instead of
-      # collapsing every failure into a generic ActionError.
-      def self.from_error(err)
-        new(ok: false, value: nil, error: { code: err.code, message: err.message, details: err.details, exception: err })
-      end
-
-      def self.extract(result)
-        case result
-        when self
-          if result.success?
-            result.value
-          else
-            err = result.error
-            raise err[:exception] if err[:exception]
-
-            raise Textus::ActionError.new(err[:code] || :error, err[:message] || "action failed", details: err[:details] || {})
-          end
-        else
-          result
-        end
-      end
-
-      def success? = ok
-      def failure? = !ok
-
-      def unwrap
-        raise Result::UnwrapError.new(error[:code], error[:message], details: error[:details]) unless ok
-
-        value
-      end
-
-      class UnwrapError < StandardError
-        attr_reader :code, :details
-
-        def initialize(code, message, details: {})
-          super(message)
-          @code = code
-          @details = details
-        end
-      end
-    end
-    # rubocop:enable Lint/ConstantDefinitionInBlock
-  end
-end
-```
-
-- [ ] **Step 4: Run the `Result` tests to verify they pass**
-
-Run: `bundle exec rspec spec/unit/value/result_spec.rb`
-Expected: all PASS
-
-- [ ] **Step 5: Write the failing `audit_entries` cursor-expiry test**
-
-Create `spec/unit/use_cases/read/audit_entries_spec.rb`:
-
-```ruby
-require "spec_helper"
-
-RSpec.describe Textus::UseCases::Read::AuditEntries do
-  let(:audit_log) do
-    Class.new do
-      def min_available_seq = 20
-      def scan(**) = []
-    end.new
-  end
-  let(:deps) { Data.define(:manifest, :audit_log).new(manifest: nil, audit_log: audit_log) }
-  let(:command) do
-    Textus::Dispatch::Contracts::AuditEntries.new(
-      key: nil, lane: nil, role: nil, verb: nil, since: nil,
-      seq_since: 3, correlation_id: nil, limit: nil,
-    )
-  end
-
-  it "returns a Result that raises the real Textus::CursorExpired when seq_since is below the retention window" do
-    result = described_class.call(command, nil, deps)
-
-    expect(result.success?).to be(false)
-    expect { Textus::Value::Result.extract(result) }.to raise_error(Textus::CursorExpired) do |err|
-      expect(err.requested).to eq(3)
-      expect(err.min_available).to eq(20)
-    end
-  end
-
-  it "returns a success Result of rows when seq_since is within the retention window" do
-    command_ok = Textus::Dispatch::Contracts::AuditEntries.new(
-      key: nil, lane: nil, role: nil, verb: nil, since: nil,
-      seq_since: 25, correlation_id: nil, limit: nil,
-    )
-    result = described_class.call(command_ok, nil, deps)
-
-    expect(result.success?).to be(true)
-    expect(Textus::Value::Result.extract(result)).to eq([])
-  end
-end
-```
-
-- [ ] **Step 6: Run the test to verify it fails**
-
-Run: `bundle exec rspec spec/unit/use_cases/read/audit_entries_spec.rb`
-Expected: FAIL — `Textus::Value::Result.extract(result)` raises `Textus::ActionError`, not `Textus::CursorExpired`
-
-- [ ] **Step 7: Fix `audit_entries.rb` to raise the real error type**
-
-In `lib/textus/use_cases/read/audit_entries.rb`, change:
-
-```ruby
-        def self.check_cursor_expiry(seq_since, deps)
-          return unless seq_since
-
-          min = deps.audit_log.min_available_seq
-          return unless min && seq_since < min - 1
-
-          Value::Result.failure(:cursor_expired, "requested seq #{seq_since} is below minimum available #{min}",
-                                details: { requested: seq_since, min_available: min })
-        end
-```
-
-to:
-
-```ruby
-        def self.check_cursor_expiry(seq_since, deps)
-          return unless seq_since
-
-          min = deps.audit_log.min_available_seq
-          return unless min && seq_since < min - 1
-
-          Value::Result.from_error(Textus::CursorExpired.new(requested: seq_since, min_available: min))
-        end
-```
-
-- [ ] **Step 8: Run the test to verify it passes**
-
-Run: `bundle exec rspec spec/unit/use_cases/read/audit_entries_spec.rb`
-Expected: all PASS
-
-- [ ] **Step 9: Confirm the existing CLI cursor-expiry spec still passes**
-
-Run: `bundle exec rspec spec/conformance/surface/cli/audit_seq_since_spec.rb`
-Expected: all PASS (the existing assertion `stderr).to match(/cursor.*expired/i)` matches even more precisely now, since the real `CursorExpired#message` reads "audit cursor expired: ...")
-
-- [ ] **Step 10: Add an MCP-level regression test proving the JSON-RPC code is now reachable**
-
-This depends on Task 1 (audit must be MCP-exposed). Add to `spec/integration/surface/mcp/catalog_dispatch_spec.rb`, inside (or after) the `.call('audit', ...)` describe block added in Task 1:
-
-```ruby
-  describe ".call('audit', ...) with an expired cursor" do
-    it "raises Textus::CursorExpired, not a generic ToolError, so the MCP server can emit JSONRPC -32002" do
-      # NOTE (fixed during quality verification): stub the specific audit_log
-      # instance the store already exposes, not allow_any_instance_of — this
-      # repo's RSpec/AnyInstance cop bans the any-instance form, and stubbing
-      # the real instance is just as direct here (Store#audit_log returns the
-      # same object the pipeline dispatches against).
-      allow(human_store.audit_log).to receive(:min_available_seq).and_return(20)
-
-      expect do
-        described_class.call("audit", store: human_store, args: { "seq_since" => 3 })
-      end.to raise_error(Textus::CursorExpired)
-    end
-  end
-```
-
-- [ ] **Step 11: Run the full suite and commit**
-
-```bash
-bundle exec rspec
-bundle exec rubocop lib/textus/value/result.rb lib/textus/use_cases/read/audit_entries.rb spec/unit/value/result_spec.rb spec/unit/use_cases/read/audit_entries_spec.rb spec/integration/surface/mcp/catalog_dispatch_spec.rb
-git add lib/textus/value/result.rb lib/textus/use_cases/read/audit_entries.rb \
-        spec/unit/value/result_spec.rb spec/unit/use_cases/read/audit_entries_spec.rb \
-        spec/integration/surface/mcp/catalog_dispatch_spec.rb
-git commit -m "fix(errors): Result.from_error preserves typed exceptions; audit cursor-expiry now raises real CursorExpired"
-```
-
----
-
-## Self-review notes (for whoever executes this plan)
-
-- **Task ordering matters:** Task 1 must land before Task 4's Step 10 (the MCP-level `audit` regression test needs `audit` already exposed over MCP).
-- **Task 3 is the highest-risk task** (verb rename, breaking CLI/MCP change). If you want a lower-risk subset of this plan, Tasks 1, 2, and 4 can ship independently and are strictly additive/internal.
-- **Not in scope for this plan:** broader documentation sweeps (`docs/reference/*`, `CHANGELOG.md` entries, ADR authoring). If this work should be recorded as a decision per this repo's ADR discipline, write that up separately per the `documentation-and-adrs` skill after these tasks land — this plan is implementation only.
-
----
-
-## Post-implementation verification notes (2026-07-02)
-
-This plan was executed, then re-verified against the actual diff (full suite green is not sufficient evidence on its own — a weak assertion can pass without testing anything). Findings and fixes, all within this plan's existing scope — nothing new was introduced:
-
-1. **False-positive test (Task 3):** the original `jobs_retry` test read the job id via `store.jobs_list(state: "ready")["jobs"].first["id"]`. `Queue#list` returns an array of plain ID strings, not hashes, so `.first["id"]` (String#[] with a substring arg) silently returned `nil`. `jobs_retry` unconditionally returns `"ok" => true` regardless of whether any row matched, so the test passed without ever exercising a retry. Fixed as shown above — build a genuinely dead-lettered job via `Queue::Job.new(max_attempts: 1)` + `queue.fail`, and assert the actual state transition.
-2. **Real latent bug surfaced by Task 1:** exposing `doctor` over MCP triggered `NoMethodError: undefined method 'dispatch' for nil` in `Doctor::Check::ProposalTargets`. Root cause: `Dispatch::HandlerResolver.build` snapshots `NEEDS` deps at build time, and `DoctorStore`'s `NEEDS` includes `:pipeline` — but the container passed to that first build (`partial` in `Store::Builder#call`) always has `pipeline: nil` (the pipeline doesn't exist yet at that point). Every doctor check that dispatches a sub-verb (like `ProposalTargets` calling `list`/`get`) was silently broken before Task 1 too — it just never fired because none of the CLI-only doctor specs exercised a pending-proposal fixture. Fixed in `lib/textus/store/builder.rb` by building the registry twice: once against `partial` to get a working interim pipeline, then wiring that into the container and rebuilding the registry so `:pipeline` resolves to a real value. (An earlier draft of this fix worked but left a stray `puts "DEBUG: ..."` in `doctor_store.rb`, an unused `pipeline_present?` method on `Infrastructure`, trailing whitespace, and redundant kwargs in `builder.rb` — all removed; `doctor_store.rb` and `infrastructure.rb` end up byte-identical to their pre-plan state, only `builder.rb` carries the real fix.)
-3. **Style regressions caught by rubocop, not by the test suite:** a leading extra space + trailing blank line inside `AuditIndex::INDEXED_CONTRACTS` from the `MvKey` rename; `Metrics/ModuleLength`'s max (350, a comment-pinned ratchet tied to `VerbRegistry`'s prior 313-line count) needed bumping to 380 with an updated comment (371 lines) rather than being silently exceeded; the CLI conformance suite's `"group subcommand tables..."` example would have exceeded `RSpec/ExampleLength`'s 25-line ratchet (a value this repo's own `.rubocop.yml` comment says is deliberately not meant to be loosened) — split into its own example instead, as reflected in Task 3 Step 8 above; trailing commas and `allow_any_instance_of` (banned by `RSpec/AnyInstance`) in the new specs.
-
-Final state: `bundle exec rspec` → 1433 examples, 0 failures, 1 pre-existing pending; `bundle exec rubocop` on every touched file → clean except one pre-existing, unrelated `Lint/UnusedMethodArgument` on `AuditIndex#call`'s `container:` param (confirmed present on `HEAD` before this work).
diff --git a/.textus/manifest.yaml b/.textus/manifest.yaml
index a00dc97c0..00e84eeb0 100644
--- a/.textus/manifest.yaml
+++ b/.textus/manifest.yaml
@@ -27,8 +27,13 @@ data:
     - key: knowledge.reference
   scratchpad:
     - key: scratchpad.proposals
+      naming: sequential
       tracked: false
     - key: scratchpad.sessions
+      naming: dated
+      tracked: false
+    - key: scratchpad.issues
+      naming: sequential
       tracked: false
   raw:
     - key: raw
diff --git a/.textus/templates/docs/meta/orientation.erb b/.textus/templates/docs/meta/orientation.erb
index 950475e1c..1c93426ff 100644
--- a/.textus/templates/docs/meta/orientation.erb
+++ b/.textus/templates/docs/meta/orientation.erb
@@ -1,67 +1,70 @@
-<!--
-This file is the orientation any agent (Claude Code, Cursor, etc.) reads on
-session start. It is the projection of textus over `.textus/data/`. Do
-not edit by hand — edit the source under `.textus/data/` and run
-`textus drain`.
-
-→ Context store: `.textus/` (textus, protocol <%= boot["protocol"] %>).
-→ Talk to it over MCP (`.mcp.json` wires the `textus` server; tools are `mcp__textus__*`) or the `textus` CLI.
-→ Run `textus boot` for the catalog + write flows; `textus get artifacts.docs.index` for the docs map.
-→ Write authority by zone:
-<% Array(boot["lanes"]).each do |z| -%>    - **<%= z["name"] %>** (<%= Array(z["writers"]).join(" ") %>)<%= z["purpose"] ? " — #{z["purpose"]}" : "" %>
-<% end -%>
-→ Agent protocol (from `textus boot`):
-<% if (r = boot.dig("agent_protocol", "recipes", "read")) -%>   • **read** — <%= r["purpose"] %>
-<% Array(r["steps"]).each do |s| -%>     `<%= s %>`
-<% end -%><% end -%><% if (r = boot.dig("agent_protocol", "recipes", "write")) -%>   • **write** — <%= r["purpose"] %>
-<% Array(r["steps"]).each do |s| -%>     `<%= s %>`
-<% end -%><% end -%>
-→ Knowledge pipeline:
-   • INPUT → LOOP → OUTPUT
-   • Loop nodes: <%= Array(boot.dig("loop", "nodes")).join(" → ") %>
-   • Loop behavior excerpt:
-<% Array(boot.dig("loop", "excerpt")&.lines).each do |line| -%>     <%= line.chomp %>
-<% end -%>   • Write to the right node — evidence logs decisions, execution points to judgment patterns-->
+# textus — Agent Protocol
+
+Every session follows **INPUT → LOOP → OUTPUT**. Execute these commands in order.
+
+## INPUT (session start — run these 3 commands)
+
+1. `textus session_open --as=agent`
+   → Returns `{session_id, status, boot}` — boot gives lanes, verbs, loop structure.
+
+2. `textus get knowledge.loop.constraint.protocol.0014-data-flow`
+   → Read the data flow diagram. Understand write → EventEmitter → Queue → Consumer flow.
+
+3. `textus get knowledge.loop.judgment.engineering.0009-conventions`
+   → Read folder structure, naming conventions, and training instructions.
+
+## LOOP (during the session — check nodes before acting)
+
+| If you are about to... | Check this node first | Command |
+|---|---|---|
+| Write code or change architecture | `constraint.repo` | `textus list --prefix=knowledge.loop.constraint.repo` |
+| Touch protocol or surface | `constraint.protocol` | `textus list --prefix=knowledge.loop.constraint.protocol` |
+| Use an existing pattern | `judgment.engineering` | `textus list --prefix=knowledge.loop.judgment.engineering` |
+| Make a permanent decision | `evidence` (ADRs) | `textus get artifacts.decisions.log` |
+| Follow a procedure | `execution` | `textus list --prefix=knowledge.loop.execution` |
+| End a session | `feedback` | `textus get knowledge.loop.feedback` |
+
+If you skip a node, record why in session notes.
+
+## OUTPUT (session end — run these 3 commands)
 
+1. `textus session_close <id> --as=agent`
+   → Pass `nodes_checked` listing which loop nodes you actually checked.
 
-# <%= project["name"] %>
+2. `textus get scratchpad.sessions.<id>.feedback`
+   → Read the auto-generated feedback. Compare against `knowledge.loop.feedback.*`.
 
-> <%= project["description"] %>
+3. `textus drain --as=automation`
+   → Re-publish artifacts (updates AGENTS.md, docs, boot).
+
+---
+
+> **Context store:** `.textus/` (textus, protocol <%= boot["protocol"] %>).
+> **MCP:** `.mcp.json` wires the `textus` server.
+> **Write authority:** <% Array(boot["lanes"]).each do |z| -%><%= z["name"] %> (<%= Array(z["writers"]).join(", ") %>) <% end -%>
+> **Loop:** <%= Array(boot.dig("loop", "nodes")).join(" → ") %>
+
+<%= project["description"] %>
 
 <% if project["has_commands"] -%>
 ## Developer Commands
 <%= project["commands"] %>
 <% end -%>
 
-<!-- Generated by textus from .textus/data/. Do not edit by hand. -->
-
 ## Runbooks
 <% runbooks.each do |rb| -%>
 - **<%= rb["name"] %>** — <%= rb["description"] %>
 <% end -%>
 
-## Procedures
-<% runbooks.select { |rb| rb["schema"] == "execution/procedure" }.each do |rb| -%>
-- **<%= rb["name"] %>** — <%= rb["description"] %>
-<% end -%>
-
-## Feedback Criteria
-
-The feedback node (`knowledge.loop.feedback.*`) defines when the agent should
-generate feedback or propose upstream changes. Review criteria before proposing:
-- `textus list --lane=knowledge --prefix=knowledge.loop.feedback`
-
 ## Session Lifecycle
 
-- **begin** — `session_open` creates a workspace directory under `scratchpad.sessions.*` with `notes/`, `scripts/`, `output/`
-- **end** — `session_close <id>` seals the session and auto-writes a feedback entry to `scratchpad.sessions.<id>.feedback`
-- **feedback → canon** — propose the feedback entry to `knowledge.loop.feedback` to close the loop: `textus propose scratchpad.sessions.<id>.feedback --target=knowledge.loop.feedback.<slug>`
+- **begin** — `session_open` creates a workspace.
+- **end** — `session_close <id>` seals the session with feedback.
+- **feedback → canon** — propose feedback to `knowledge.loop.feedback` to close the loop.
 
 ## Docs
 
-Full documentation is canon — authored under `.textus/data/knowledge/` and published to `docs/`. Read the map with `textus get artifacts.docs.index`; the decision log index is `textus get artifacts.decisions.log`. Sections: how-to · reference · explanation · cookbook · decisions.
-
-The decision log (`docs/decisions.md`) is generated — do not hand-edit it; edit the source ADR under `.textus/data/knowledge/evidence/` and run `textus drain`.
+Read the map with `textus get artifacts.docs.index`; decision log: `textus get artifacts.decisions.log`.
 
 <!-- headroom:rtk-instructions -->
 # RTK (Rust Token Killer) - Token-Optimized Commands
diff --git a/.textus/templates/docs/reference/conventions.erb b/.textus/templates/docs/reference/conventions.erb
index 7a54417bc..85dfa5926 100644
--- a/.textus/templates/docs/reference/conventions.erb
+++ b/.textus/templates/docs/reference/conventions.erb
@@ -39,7 +39,6 @@ Files mirror the `lib/textus/` namespace tree:
 
 - Domain errors inherit from `Textus::Error` (not `StandardError`)
 - Surface-specific errors fold into core errors where possible (e.g. `CursorExpired`)
-- Result types (`Textus::Value::Result`) for operation outcomes — `success?` / `failure?`
 - Validation at system edge, not in write path
 
 ## Dependency Management
diff --git a/.textus/workflows/config/config.rb b/.textus/workflows/config/config.rb
index b50749c4e..8efaae3ef 100644
--- a/.textus/workflows/config/config.rb
+++ b/.textus/workflows/config/config.rb
@@ -18,6 +18,9 @@
         "textus" => {
           "command" => "bundle", "args" => %w[exec exe/textus --root .textus mcp serve],
         },
+        "codebase-memory" => {
+          "command" => "codebase-memory-mcp", "args" => [],
+        },
       },
       "lsp" => {
         "yaml-ls" => { "command" => %w[node_modules/.bin/yaml-language-server --stdio], "extensions" => %w[yml yaml] },
@@ -25,7 +28,10 @@
         "marksman" => { "command" => %w[marksman serve], "extensions" => ["md"] },
         "ruby-lsp" => { "command" => %w[bundle exec ruby-lsp], "extensions" => %w[rb erb builder rake ru] },
       },
-      "mcp" => { "textus" => { "type" => "local", "command" => %w[bundle exec exe/textus mcp serve], "enabled" => true } },
+      "mcp" => {
+        "textus" => { "type" => "local", "command" => %w[bundle exec exe/textus mcp serve], "enabled" => true },
+        "codebase-memory" => { "type" => "local", "command" => ["codebase-memory-mcp"], "enabled" => true },
+      },
       "permission" => {
         "edit" => {
           "*" => "allow",
diff --git a/.textus/workflows/config/doctors.rb b/.textus/workflows/config/doctors.rb
index 155171a2c..c20ed26ab 100644
--- a/.textus/workflows/config/doctors.rb
+++ b/.textus/workflows/config/doctors.rb
@@ -417,6 +417,36 @@
     issues
   end
 
+  # ── Session protocol compliance ─────────────────────────────────────
+  check "session-protocol" do |ctx|
+    issues = []
+    ctx.manifest.resolver.enumerate.each do |row|
+      next unless row[:key].to_s.start_with?("scratchpad.sessions.")
+      next unless row[:key].to_s.end_with?(".feedback")
+      next unless row[:path] && File.file?(row[:path])
+
+      feedback = begin
+        JSON.parse(File.read(row[:path]))
+      rescue JSON::ParserError
+        next
+      end
+      next unless feedback["signal"] == "session_closed"
+
+      checked = Array(feedback["nodes_checked"]).map(&:to_s)
+      next if checked.include?("constraint.repo")
+
+      session_key = row[:key].sub(/\.feedback\z/, ".session")
+      issues << {
+        "code" => "session.skipped_constraint",
+        "level" => "info",
+        "subject" => session_key,
+        "message" => "session closed without checking constraint.repo",
+        "fix" => "review the session; if it authored new entries, you may have missed hard limits",
+      }
+    end
+    issues
+  end
+
   # ── Stale reviewed stamp (was doctor_stale_reviewed_stamp.rb) ──
   check "reviewed-stamp" do |ctx|
     stamp_re = /\*\*reviewed\*\*\s+\d{4}-\d{2}\s+\(v(\d+\.\d+(?:\.\d+)?)\)/
diff --git a/AGENTS.md b/AGENTS.md
index d4309d39a..08734dc93 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -1,33 +1,49 @@
-<!--
-This file is the orientation any agent (Claude Code, Cursor, etc.) reads on
-session start. It is the projection of textus over `.textus/data/`. Do
-not edit by hand — edit the source under `.textus/data/` and run
-`textus drain`.
-
-→ Context store: `.textus/` (textus, protocol textus/4).
-→ Talk to it over MCP (`.mcp.json` wires the `textus` server; tools are `mcp__textus__*`) or the `textus` CLI.
-→ Run `textus boot` for the catalog + write flows; `textus get artifacts.docs.index` for the docs map.
-→ Write authority by zone:
-    - **knowledge** (human) — the maintained source of truth about the repo
-    - **scratchpad** (human agent) — the agent's own durable scratchpad (working memory)
-    - **artifacts** (automation) — machine-maintained computed outputs
-    - **raw** (human agent automation) — ingested external source material (write-once)
-→ Agent protocol (from `textus boot`):
-→ Knowledge pipeline:
-   • INPUT → LOOP → OUTPUT
-   • Loop nodes: intent → constraint.repo → constraint.protocol → judgment.engineering → judgment.agent-behavior → evidence → execution → feedback
-   • Loop behavior excerpt:
-     # Operating inside the Loop
-     
-     This repo's `knowledge.*` zones are the Loop model, exhaustively: `intent`
-     (why), `constraint.repo`/`constraint.protocol` (hard limits — engineering
-     principles vs. wire contract), `judgment.engineering`/`judgment.agent-behavior`
-   • Write to the right node — evidence logs decisions, execution points to judgment patterns-->
-
-
-# textus
-
-> A coordination space for humans, AI, and automation — durable, multi-writer repo memory that survives the session, the model, and the vendor.
+# textus — Agent Protocol
+
+Every session follows **INPUT → LOOP → OUTPUT**. Execute these commands in order.
+
+## INPUT (session start — run these 3 commands)
+
+1. `textus session_open --as=agent`
+   → Returns `{session_id, status, boot}` — boot gives lanes, verbs, loop structure.
+
+2. `textus get knowledge.loop.constraint.protocol.0014-data-flow`
+   → Read the data flow diagram. Understand write → EventEmitter → Queue → Consumer flow.
+
+3. `textus get knowledge.loop.judgment.engineering.0009-conventions`
+   → Read folder structure, naming conventions, and training instructions.
+
+## LOOP (during the session — check nodes before acting)
+
+| If you are about to... | Check this node first | Command |
+|---|---|---|
+| Write code or change architecture | `constraint.repo` | `textus list --prefix=knowledge.loop.constraint.repo` |
+| Touch protocol or surface | `constraint.protocol` | `textus list --prefix=knowledge.loop.constraint.protocol` |
+| Use an existing pattern | `judgment.engineering` | `textus list --prefix=knowledge.loop.judgment.engineering` |
+| Make a permanent decision | `evidence` (ADRs) | `textus get artifacts.decisions.log` |
+| Follow a procedure | `execution` | `textus list --prefix=knowledge.loop.execution` |
+| End a session | `feedback` | `textus get knowledge.loop.feedback` |
+
+If you skip a node, record why in session notes.
+
+## OUTPUT (session end — run these 3 commands)
+
+1. `textus session_close <id> --as=agent`
+   → Pass `nodes_checked` listing which loop nodes you actually checked.
+
+2. `textus get scratchpad.sessions.<id>.feedback`
+   → Read the auto-generated feedback. Compare against `knowledge.loop.feedback.*`.
+
+3. `textus drain --as=automation`
+   → Re-publish artifacts (updates AGENTS.md, docs, boot).
+
+---
+
+> **Context store:** `.textus/` (textus, protocol textus/4).
+> **MCP:** `.mcp.json` wires the `textus` server.
+> **Write authority:** knowledge (human) scratchpad (human, agent) artifacts (automation) raw (human, agent, automation) > **Loop:** intent → constraint.repo → constraint.protocol → judgment.engineering → judgment.agent-behavior → evidence → execution → feedback
+
+A coordination space for humans, AI, and automation — durable, multi-writer repo memory that survives the session, the model, and the vendor.
 
 ## Developer Commands
 - **test**: `bundle exec rspec`
@@ -37,8 +53,6 @@ not edit by hand — edit the source under `.textus/data/` and run
 - **help**: `bundle exec exe/textus --help`
 - **drain**: `bundle exec exe/textus drain --as=automation`
 
-<!-- Generated by textus from .textus/data/. Do not edit by hand. -->
-
 ## Runbooks
 - **doctor** — Read and act on doctor workflow reports to keep the store healthy.
 - **session** — Begin and end agent sessions, review feedback, propose changes to canon.
@@ -47,28 +61,15 @@ not edit by hand — edit the source under `.textus/data/` and run
 - **adr** — Add an Architecture Decision Record for a load-bearing decision.
 - **quickstart** — Four-command demo of the role-gated propose→accept flow, plus full store walkthrough and protocol reference.
 
-## Procedures
-- **doctor** — Read and act on doctor workflow reports to keep the store healthy.
-- **session** — Begin and end agent sessions, review feedback, propose changes to canon.
-- **deploy** — Cut a textus release — bump version, update lockfile, tag, publish.
-
-## Feedback Criteria
-
-The feedback node (`knowledge.loop.feedback.*`) defines when the agent should
-generate feedback or propose upstream changes. Review criteria before proposing:
-- `textus list --lane=knowledge --prefix=knowledge.loop.feedback`
-
 ## Session Lifecycle
 
-- **begin** — `session_open` creates a workspace directory under `scratchpad.sessions.*` with `notes/`, `scripts/`, `output/`
-- **end** — `session_close <id>` seals the session and auto-writes a feedback entry to `scratchpad.sessions.<id>.feedback`
-- **feedback → canon** — propose the feedback entry to `knowledge.loop.feedback` to close the loop: `textus propose scratchpad.sessions.<id>.feedback --target=knowledge.loop.feedback.<slug>`
+- **begin** — `session_open` creates a workspace.
+- **end** — `session_close <id>` seals the session with feedback.
+- **feedback → canon** — propose feedback to `knowledge.loop.feedback` to close the loop.
 
 ## Docs
 
-Full documentation is canon — authored under `.textus/data/knowledge/` and published to `docs/`. Read the map with `textus get artifacts.docs.index`; the decision log index is `textus get artifacts.decisions.log`. Sections: how-to · reference · explanation · cookbook · decisions.
-
-The decision log (`docs/decisions.md`) is generated — do not hand-edit it; edit the source ADR under `.textus/data/knowledge/evidence/` and run `textus drain`.
+Read the map with `textus get artifacts.docs.index`; decision log: `textus get artifacts.decisions.log`.
 
 <!-- headroom:rtk-instructions -->
 # RTK (Rust Token Killer) - Token-Optimized Commands
diff --git a/CHANGELOG.md b/CHANGELOG.md
index cbd2cc063..041096568 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,6 +8,276 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## Unreleased
 
+- refactor: replace hand-written Session delegations with Forwardable
+- refactor: extract merge_issues helper in Definition#check
+- refactor: split VerbRegistry into per-verb files under verb_registry/verbs/
+- refactor: move MovePipeline emit_event dedup guards into shared Pipeline.emit_event
+- refactor: extract shared CheckEtag/ResolvePath into Pipeline module
+- chore: remove vestigial Materialize workflow
+- refactor(workflow): eliminate Materialize re-dispatch and deepen Runner
+- refactor(workflow): extract shared Consumer and decouple event emission from pipeline
+- feat: wire TTL scheduler + refactor Workflow module ownership
+- style: fix rubocop safe autocorrects and update Lint/UnusedMethodArgument excludes for refactored handlers
+- fix: deps/rdeps/graph category  -> read (sed artifact from ac02cb77c)
+- refactor: pull serialize_for_put up to Format::Base
+- docs: update ADR-0133 to Accepted
+- docs: update ADR-0133 to Accepted, add session handoff
+- refactor: extract shared ContextWith module for pipeline context objects
+- refactor: extract handler response hash builder into Concern
+- refactor: bundle StoreEngine dependencies into WriteDeps
+- refactor: simplify store_engine pipelines — remove dead code, extract shared helpers
+- refactor: extract domain logic from handlers and MCP server into testable service objects
+- refactor: eliminate double-resolve, push move orchestration into pipeline, remove dead code
+- refactor(store-engine): Standardize StoreEngine method signatures to all-keyword args
+- refactor: consolidate config workflows, fix renderer trigger, add pipeline
+- refactor: remove redundant lane/kind/nested/owner from manifest schema
+- refactor: strip path/publish/source from manifest, remove dead code
+- refactor: move system verb routing from Gate override hash to VerbSpec#system?
+- refactor: StoreEngine + Handlers::Read/Write/System split
+- fix: skip tracked:false entries in doctor manifest check, fix schema ref
+- fix: correct doctor schema parsing, commit generated artifacts
+- refactor: consolidate lane/role docs workflows, fix nested schema loading
+- refactor: split HandlerContext into ReadOps/WriteOps/System capability interfaces
+- test: add unit tests for Diff module (body, meta, schema, summary)
+- refactor: remove dead publish code, inline Mode+None into publish.rb, inline VAR_RE into tree.rb
+- refactor: fold StepScope and Context into Runner as inner classes
+- refactor: inline Workflow::Loader into Registry
+- refactor: inline Workflow::Pattern into DSL::Definition
+- feat: workflow DSL redesign — on/save/notify, priority routing, doctor consolidation
+- feat: track ingested_at, ingest_count, duplicated_at in raw lane ingest flow
+- chore: regenerate boot artifact and orientation docs after dogfood flow changes
+- chore: remove stale boot cache
+- fix: update orientation template and boot.rb for procedures and feedback criteria
+- refactor: move propose/accept/reject handlers from proposal lane to scratchpad lane
+- chore: remove proposals lane from V4::LANES
+- chore: regenerate artifacts after dogfood flow changes
+- fix: materialize workflow — use container.workflow_registry
+- feat: add shape validation for execution sub-families
+- feat: add procedure entries — doctor, session, deploy
+- refactor: move execution entries to runbook/ subdirectory
+- feat: add execution schemas — runbook, checklist, procedure
+- feat: add feedback criteria entries — protocol-gap, repetitive-task, intent-drift
+- refactor: feedback node becomes criteria — move solid-audit to judgment.engineering
+- refactor: update orientation template — remove propose recipe
+- refactor: clean up scratchpad — replace notes/scripts with proposals
+- refactor: remove proposals lane (folded into scratchpad)
+- feat: surface session_open/session_close in agent boot catalog
+- docs: dogfood flow implementation plan
+- docs: dogfood flow design — session lifecycle, feedback criteria, execution zone
+- fix: dogfood audit — orientation keys, doctor cascade, session lifecycle
+- refactor: remove legacy store files, aliases, and dual code paths
+- refactor: reorganize infra/store with Base, split concerns, standardize API
+- docs: lock store naming conventions into knowledge loop
+- refactor: consolidate drain/watch around shared Async::Queue
+- refactor: consolidate dual paths and fix silent error swallowing
+- feat: add code-pattern entries to knowledge loop (0011-0014)
+- refactor: remove dead parameters from handlers, Data.define, and pipeline
+- fix: replace role-based event suppression with self-loop detection via Engine::IN_FLIGHT
+- fix: prevent infinite event loop — skip workflow event emission for automation-role writes
+- fix: update etag spec for layout-object API, remove naming-check debug output
+- refactor: merge overlapping doctor checks (sentinels+orphaned, schema+unowned, manifest+templates+schemas)
+- refactor: extract build_lanes/build_roles helpers, simplify 5 workflows
+- refactor: collapse 8 static-template workflows into 1 generic render workflow
+- fix: optimize naming-check to only scan naming-constrained entries directly
+- fix: use resolver.enumerate instead of Dir.children in naming-check (respects ignore patterns)
+- fix: reconnect event pipeline, move EventEmitter, add workflow_spec verb, remove published/schema verbs
+- fix: reorder knowledge loop keys and restore execution schema
+- feat: add boot_refresh produce workflow, fix guard clause
+- fix: renumber duplicate ADRs 0117/0120/0121/0125 → 0131-0134, fill stub reference docs
+- chore: remove stale hand-authored doc not produced by any workflow
+- fix: remove dead doctor CLI declaration, fix pattern-crossrefs and Workflow::Context#read
+- fix: update .textus dogfood workflows for store API and clean stale artifacts
+- style: fix 133 rubocop offenses (trailing whitespace, alignment, hash alignment, etc.)
+- refactor: migrate flat-file stores to Infra::Store with SQLite-backed sub-stores
+- refactor: remove dead code (Doctor, Retention, TraceBuffer, SequelAdapter, 3 error classes, spec redirects)
+- refactor: fix drain container crash, remove thread-local registry, delete ScopedContext
+- refactor: collapse Container structs, unify Publisher, remove EventStore Interface
+- refactor: unify result shape, remove views, deepen VerbSpec
+- refactor: replace error hashes with exceptions in handlers and gate
+- fix: drop stale contract check, add new verbs to CLI catalog and snapshot
+- refactor: move Container/Builder/WritePipeline/Retention from infra/store/ to protocol/
+- cleanup: remove dead VERB_TO_CONTRACT, Binder.command, Value::Result wrap, move human helpers to lanes/, delete agent/ and human/ dirs
+- refactor: remove Value::Result wrapping from Gate dispatch
+- cleanup: remove dead Binder.command method and Pending data class
+- cleanup: remove dead VERB_TO_CONTRACT lookup table
+- fix(scratchpad): use body for session storage, fix call forwarding
+- feat(lanes): add Knowledge/Scratchpad handlers, remove old Human/Agent stubs
+- refactor: move lane namespaces under Textus::Lanes:: (Ingest, Proposal, Artifact)
+- refactor: move Gate::Builtin to Protocol::Handlers, add HandlerContext, update handlers to use ctx
+- feat(protocol): add HandlerContext — restricted container view for handlers
+- fix: add spec_helper constant stubs for Manifest/Envelope/Call/Entry/Mentry/Container
+- cleanup: remove unused value types (Command, Trace)
+- feat(protocol): add Session class with method_missing, replace Store in CLI/MCP surfaces
+- feat(protocol): add Session class, replace Store facade in CLI and MCP surfaces
+- refactor: move store classes into protocol/ (event_store, entry_store, cursor, freshness, trace_buffer)
+- cleanup: move binder+contracts from dispatch/ to protocol/, remove empty dispatch/ dir
+- cleanup: remove use_cases/ and dispatch/ middleware/pipeline after migration
+- refactor(gate): route un-laned verbs to Gate::Builtin, remove pipeline path
+- feat(protocol): add Gate::Builtin with 20 internal handler methods
+- feat(proposal): add Proposal::Handlers with propose/accept/reject/diff
+- refactor(human): move proposal handlers to Proposal lane (was Human lane)
+- cleanup: remove migrated proposal use cases (propose/accept/reject/diff)
+- feat(protocol): wire propose/accept/reject/diff verbs to Human lane
+- feat(human): add Handlers.diff for proposal diff preview
+- feat(human): add Handlers.reject for proposal rejection
+- feat(human): add Handlers.accept for proposal acceptance with dry-run
+- feat(human): add Handlers.propose for proposal creation
+- cleanup: remove migrated UseCases::Ops::IngestEntry
+- feat(protocol): wire ingest verb to Ingest lane via VerbSpec lane: field
+- feat(ingest): rebuild Handlers with real ingest orchestration
+- feat(ingest): rebuild Resolver with real supersede logic
+- feat(ingest): add EntryTypes sub-modules for link/asset/text content builders
+- feat(ingest): add IndexRebuilder for event store index rebuild
+- feat(ingest): add Dedup for content hash and URL duplicate detection
+- feat(ingest): add KeyBuilder for key derivation and content hashing
+- feat(protocol): Gate dispatches directly to lane handlers when VerbSpec has lane
+- feat(protocol): add Lane.handler_for to resolve lane name to handler module
+- feat(protocol): add lane: field to VerbSpec
+- feat(infra): add Store::Index::Lookup and Store::Index::Builder classes
+- Implement Protocol::Manifest and related schema components
+- Add core infrastructure for Textus event processing and storage
+- Refactor Textus to use Protocol namespace
+- refactor: remove dead code, fix Gate authorization, drop audit_events table
+- chore: remove accidentally committed backup files
+- phase(cleanup): remove orphaned SqliteAdapter — Phase 5
+- phase(surface): update Watcher to use Protocol::Async and Infra::Locks — Phase 4
+- phase(lanes): add scoped Workflow::ScopedContext — Phase 3 complete
+- feat(human): create Textus::Human with LOOP Runner, Freeform, and handlers
+- feat(agent): create Textus::Agent with Session, Workspace, Runner, Evidence, and handlers
+- feat(artifact): create Textus::Artifact with cache, lifecycle, and handlers
+- feat(ingest): create Textus::Ingest with resolver, entry types, and handlers
+- phase(protocol): add Gate, Async, wire into Builder — Phase 2 complete
+- feat(protocol): add Protocol::Manifest alias for Textus::Manifest
+- phase(protocol): move Index, Links, Audit, Envelope to Protocol:: namespace with forwarding facades
+- phase(protocol): move Layout, Key, Schema to Protocol:: namespace with forwarding facades
+- feat(protocol): move Format strategies to Protocol::Format with forwarding facades
+- chore: ignore headroom backup file
+- feat(infra): wire Infra::FileStore, Infra::Database, Infra::Clock in Store::Builder
+- feat(infra): extract Infra::Locks with BuildLock and WatcherLock
+- feat(infra): extract Infra::Clock with now method
+- feat(infra): extract Infra::Database with table setup, FTS5, and transaction support
+- feat(infra): extract Infra::FileStore with 17 methods matching current FileSystem interface
+- refactor: hard-cut legacy workflow step syntax
+- fix: add lsp defaults to opencode workflow config
+- fix: restore workflow artifact generation and docs publish
+- fix: harden publish/parser and resolve lint regressions
+- docs: mark ADR-0125 container/double-emission notes superseded
+- refactor: group port by concern (storage vs concurrency)
+- refactor: rename store/jobs and fold materialize into workflow/instances
+- fix: protect .textus/data canon from direct agent writes
+- fix: remove stale jobs CLI help text
+- refactor: extract MCP contract-drift annotation from Server#dispatch
+- refactor: fold entry indexing into the synchronous write path
+- fix: wire Consumer and EventEmitter callers to EventStore
+- refactor: Produce::EventEmitter depends on EventStore
+- fix: Events::Consumer retry path delegates to EventStore and RetryPolicy
+- refactor: trim Store::EventStore to only own the events table
+- fix: add Store::EntryIndex and correct entries FTS indexing/search
+- refactor: extract Events::RetryPolicy as its own decision object
+- fix: rename db -> database in consumer.rb; move ADR 0127 to .textus via textus put; add ADR 0129 DependencyAdapter gate
+- style: fix rubocop enable directives in write_pipeline and event_store
+- fix: missing keyword database in converge_now drain call
+- docs: add ADR 0127 — interface consolidation decisions
+- chore: remove legacy code — Entry::Reader/Writer refs, dead LinkEdgeStore spec
+- fix: drain_store call recursion, boot protocol key, backward compat methods
+- fix: use respond_to? in HandlerResolver, fix BootStore Infrastructure ref
+- style: fix remaining rubocop offenses
+- fix: Boot.CLI_VERBS uses Catalog.build
+- style: fix all rubocop offenses
+- refactor: route ports through FileSystem, split Boot
+- feat: add Events middleware, convert all use cases to classes
+- fix: add trace_buffer/reader/writer accessors to Container, update specs
+- refactor: create Store::LinkGraph, rewire Builder to Container
+- refactor: create Store::EntryStore, retire Entry::Reader + Entry::Writer
+- feat: add Store::Container with grouped components
+- refactor: split Port::Store into Port::Database + Port::EventStore
+- refactor: create Port::FileSystem + Store::FileSystem, retire Storage/
+- refactor: split WriteStep into write_pipeline/ directory
+- refactor: extract VerbSpec into verb_registry/verb_spec.rb
+- refactor: extract ArgSpec into verb_registry/arg_spec.rb
+- fix: skip publish in Runner when data is nil, remove publish from system workflows that manage their own output; fix pulse_entries, LinkEdgeStore, CLI verbs catalog, specs for architecture changes; all 1014 tests pass
+- feat: implement new event system with Sequel-backed events table, Workflow DSL handles, Registry, EventEmitter, Consumer, Materialize/Index workflows, rewire Builder/Infrastructure/Watcher/Drain/LinkEdgeStore
+- refactor: remove Event::Bus, Event module, CascadeSubscriber, Store::Jobs namespace
+- refactor: remove write-time schema validation from WriteStep and Writer
+- refactor: remove rule system from manifest, data.rb, contracts, verb registry, CLI, auth, publisher, ttl evaluator, retention sweep
+- refactor: remove enqueue verb
+- refactor: remove doctor verb and module
+- feat: add sequel gem and SequelAdapter dependency adapter
+- refactor: move knowledge sections under knowledge.loop.* — clean separation of loop vs reference data
+- refactor: streamline conformance fixture — drop project-specific entries, align with repo shape
+- refactor(init): use consolidated entries for project-agnostic scaffold
+- refactor: align init and fixture entry names with .textus/manifest.yaml
+- refactor: add naming/schema governance to repo manifest entries
+- refactor: complete manifest entry simplification — align init, fixtures, helpers to repo shape
+- refactor(test-support): match repo entry shape; remove migrate_legacy_manifest
+- refactor: simplify repo manifest entries; fix resolve_format for explicit path override
+- refactor(init): simplify DEFAULT_MANIFEST and AGENT_ENTRIES — match repo entry shape
+- refactor: delete IgnoreMatcher; remove ignore system from Resolver, SubtreeMirror, Tree, schema, validators
+- refactor(nested): remove ignore/ignored? — no longer read from manifest
+- refactor(base): remove ignore/ignored? stubs; make schema/naming optional
+- refactor(parser): stop reading schema/naming/ignore/publish/source from manifest; infer kind/format from disk
+- docs: design doc for manifest entry simplification
+- feat: protocol textus/4 — manifest data: shape, roles/lanes hardcoded
+- refactor(manifest): drop owner from envelope and where output
+- refactor(manifest): Entry::Parser infers kind from lane+disk shape, adds naming:, drops owner:/format:
+- refactor(manifest): Data.parse reads data: grouped-by-lane, rejects stale roles:/lanes:/owner:
+- refactor(manifest): repoint write-gating predicates to Protocol::V4::LANES writers
+- refactor(manifest): Domain::Lane and Policy read writers from Protocol::V4::LANES directly
+- feat(manifest): add Textus::Protocol::V4 fixed lane/naming table
+- test: relax build-lock drain soft-miss assertion
+- chore: satisfy pre-push rubocop naming rules
+- chore: clean up lint warnings in workflow and jobs code
+- refactor(doctor): batch-port remaining class checks to workflows
+- refactor(doctor): port PublishTreeIndexOverlap check to a workflow
+- refactor(doctor): port OrphanedPublishTargets check to a workflow
+- refactor(doctor): port SchemaViolations check to a workflow
+- refactor(doctor): port UnownedSchemaFields check to a workflow
+- refactor(doctor): port AuditLog check to a workflow
+- refactor(doctor): port Sentinels check to a workflow
+- refactor(doctor): port IllegalKeys check to a workflow
+- refactor(doctor): port SchemaParseError check to a workflow
+- refactor(doctor): port ProtocolVersion check to a workflow
+- refactor(loop): renumber scratchpad.notes to NNNN-topic-slug.md, scaffold sessions/scripts
+- feat(workflow): add shape() DSL primitive, check_naming helper, loop-shape workflow
+- feat(loop): add loop summary to boot orientation output
+- feat(loop): add Loop node table to explanation concepts template
+- refactor(loop): realign task 6/7 identity and readme extraction
+- refactor(loop): fold knowledge.readme fragments into intent
+- refactor(loop): fold knowledge.project into intent section
+- refactor(loop): retire knowledge.architecture into loop sections
+- feat(loop): add knowledge.feedback zone
+- refactor(loop): split knowledge.patterns into judgment.engineering/.agent-behavior
+- refactor(loop): split knowledge.rules/specs into constraint.repo/.protocol
+- refactor(verbs): standardize verb-registry surfaces, naming, jobs split, error typing
+- refactor(architecture): deepen v2 — flatten jobs ceremony, extract publisher/validator/stepscope, delete facade
+- feat(architecture): integrate container's writer and reader into use cases and workflow runner
+- docs(architecture): sync docs to phase 3 refactor — Infrastructure container, workflow DSL surface, no Registry/Collector/Publisher
+- refactor(architecture): deepen phase 3 — Writer port, single Infrastructure, manifest→workflow boundary
+- Revert "feat(federation): add federation sync workflow — auto-mirrors remote store entries on drain"
+- feat(federation): add federation sync workflow — auto-mirrors remote store entries on drain
+- feat(workflow): migrate 4 more Doctor checks to validation workflows
+- feat(workflow): migrate Doctor::RuleAmbiguity to self-contained validation workflow
+- feat(workflow): add validate step type, multi-key matching, and validation workflow POC
+- chore: revert solid-process POC (gem not mature enough)
+- refactor(specs): remove 6 redundant files, simplify 5 overlapping specs, drop 6 dead refs
+- feat(pipeline): enforce cross-reference chain — decisions→architecture, patterns→decisions, runbooks→patterns
+- chore: regenerate changelog
+- chore: track knowledge.architecture entries and manifest
+- feat(patterns): add unified-dispatch, middleware-chain, handler-needs, store-builder + agent training
+- docs: document 6 intentional Reader/Writer bypass sites (P3)
+- refactor: drop Ctx alias, rename ctx.rb → infrastructure.rb
+- refactor: clean up P0-P2 anti-patterns — HANDLES_ALL, boot.rb layering, InfrastructureProxy rename, Store::Builder
+- feat(knowledge): enforce pipeline structure with conformance spec + agent protocol
+- feat(observability): Trace middleware — auto-instrumented dispatch with ring buffer (Phase 5)
+- feat(conformance): verb completeness, downward layer import, port contract guards (Phase 4)
+- feat(ports): formal port interfaces with conformance verification (Phase 3)
+- feat(domain): extract Domain::Key, Domain::Lane, Domain::Envelope — pure domain layer (Phase 2)
+- feat: land ADR-0120, ADR-0121, ADR-0125 — unified dispatch, bounded use cases, interface hygiene
+- refactor: remove unused handler modules and simplify dispatch logic
+- docs: refresh generated changelog and skills feed
+- refactor: simplify entry read handlers and pulse fallback
+- fix: align trigger catalog and etag conformance guards
+- docs: add dependency adoption gate guidance
 - docs: add architecture patterns for triggers and adapters
 - refactor: centralize trigger vocabulary in TriggerCatalog
 - refactor: add dependency adapter modules for runtime deps
diff --git a/CLAUDE.md b/CLAUDE.md
index d4309d39a..08734dc93 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -1,33 +1,49 @@
-<!--
-This file is the orientation any agent (Claude Code, Cursor, etc.) reads on
-session start. It is the projection of textus over `.textus/data/`. Do
-not edit by hand — edit the source under `.textus/data/` and run
-`textus drain`.
-
-→ Context store: `.textus/` (textus, protocol textus/4).
-→ Talk to it over MCP (`.mcp.json` wires the `textus` server; tools are `mcp__textus__*`) or the `textus` CLI.
-→ Run `textus boot` for the catalog + write flows; `textus get artifacts.docs.index` for the docs map.
-→ Write authority by zone:
-    - **knowledge** (human) — the maintained source of truth about the repo
-    - **scratchpad** (human agent) — the agent's own durable scratchpad (working memory)
-    - **artifacts** (automation) — machine-maintained computed outputs
-    - **raw** (human agent automation) — ingested external source material (write-once)
-→ Agent protocol (from `textus boot`):
-→ Knowledge pipeline:
-   • INPUT → LOOP → OUTPUT
-   • Loop nodes: intent → constraint.repo → constraint.protocol → judgment.engineering → judgment.agent-behavior → evidence → execution → feedback
-   • Loop behavior excerpt:
-     # Operating inside the Loop
-     
-     This repo's `knowledge.*` zones are the Loop model, exhaustively: `intent`
-     (why), `constraint.repo`/`constraint.protocol` (hard limits — engineering
-     principles vs. wire contract), `judgment.engineering`/`judgment.agent-behavior`
-   • Write to the right node — evidence logs decisions, execution points to judgment patterns-->
-
-
-# textus
-
-> A coordination space for humans, AI, and automation — durable, multi-writer repo memory that survives the session, the model, and the vendor.
+# textus — Agent Protocol
+
+Every session follows **INPUT → LOOP → OUTPUT**. Execute these commands in order.
+
+## INPUT (session start — run these 3 commands)
+
+1. `textus session_open --as=agent`
+   → Returns `{session_id, status, boot}` — boot gives lanes, verbs, loop structure.
+
+2. `textus get knowledge.loop.constraint.protocol.0014-data-flow`
+   → Read the data flow diagram. Understand write → EventEmitter → Queue → Consumer flow.
+
+3. `textus get knowledge.loop.judgment.engineering.0009-conventions`
+   → Read folder structure, naming conventions, and training instructions.
+
+## LOOP (during the session — check nodes before acting)
+
+| If you are about to... | Check this node first | Command |
+|---|---|---|
+| Write code or change architecture | `constraint.repo` | `textus list --prefix=knowledge.loop.constraint.repo` |
+| Touch protocol or surface | `constraint.protocol` | `textus list --prefix=knowledge.loop.constraint.protocol` |
+| Use an existing pattern | `judgment.engineering` | `textus list --prefix=knowledge.loop.judgment.engineering` |
+| Make a permanent decision | `evidence` (ADRs) | `textus get artifacts.decisions.log` |
+| Follow a procedure | `execution` | `textus list --prefix=knowledge.loop.execution` |
+| End a session | `feedback` | `textus get knowledge.loop.feedback` |
+
+If you skip a node, record why in session notes.
+
+## OUTPUT (session end — run these 3 commands)
+
+1. `textus session_close <id> --as=agent`
+   → Pass `nodes_checked` listing which loop nodes you actually checked.
+
+2. `textus get scratchpad.sessions.<id>.feedback`
+   → Read the auto-generated feedback. Compare against `knowledge.loop.feedback.*`.
+
+3. `textus drain --as=automation`
+   → Re-publish artifacts (updates AGENTS.md, docs, boot).
+
+---
+
+> **Context store:** `.textus/` (textus, protocol textus/4).
+> **MCP:** `.mcp.json` wires the `textus` server.
+> **Write authority:** knowledge (human) scratchpad (human, agent) artifacts (automation) raw (human, agent, automation) > **Loop:** intent → constraint.repo → constraint.protocol → judgment.engineering → judgment.agent-behavior → evidence → execution → feedback
+
+A coordination space for humans, AI, and automation — durable, multi-writer repo memory that survives the session, the model, and the vendor.
 
 ## Developer Commands
 - **test**: `bundle exec rspec`
@@ -37,8 +53,6 @@ not edit by hand — edit the source under `.textus/data/` and run
 - **help**: `bundle exec exe/textus --help`
 - **drain**: `bundle exec exe/textus drain --as=automation`
 
-<!-- Generated by textus from .textus/data/. Do not edit by hand. -->
-
 ## Runbooks
 - **doctor** — Read and act on doctor workflow reports to keep the store healthy.
 - **session** — Begin and end agent sessions, review feedback, propose changes to canon.
@@ -47,28 +61,15 @@ not edit by hand — edit the source under `.textus/data/` and run
 - **adr** — Add an Architecture Decision Record for a load-bearing decision.
 - **quickstart** — Four-command demo of the role-gated propose→accept flow, plus full store walkthrough and protocol reference.
 
-## Procedures
-- **doctor** — Read and act on doctor workflow reports to keep the store healthy.
-- **session** — Begin and end agent sessions, review feedback, propose changes to canon.
-- **deploy** — Cut a textus release — bump version, update lockfile, tag, publish.
-
-## Feedback Criteria
-
-The feedback node (`knowledge.loop.feedback.*`) defines when the agent should
-generate feedback or propose upstream changes. Review criteria before proposing:
-- `textus list --lane=knowledge --prefix=knowledge.loop.feedback`
-
 ## Session Lifecycle
 
-- **begin** — `session_open` creates a workspace directory under `scratchpad.sessions.*` with `notes/`, `scripts/`, `output/`
-- **end** — `session_close <id>` seals the session and auto-writes a feedback entry to `scratchpad.sessions.<id>.feedback`
-- **feedback → canon** — propose the feedback entry to `knowledge.loop.feedback` to close the loop: `textus propose scratchpad.sessions.<id>.feedback --target=knowledge.loop.feedback.<slug>`
+- **begin** — `session_open` creates a workspace.
+- **end** — `session_close <id>` seals the session with feedback.
+- **feedback → canon** — propose feedback to `knowledge.loop.feedback` to close the loop.
 
 ## Docs
 
-Full documentation is canon — authored under `.textus/data/knowledge/` and published to `docs/`. Read the map with `textus get artifacts.docs.index`; the decision log index is `textus get artifacts.decisions.log`. Sections: how-to · reference · explanation · cookbook · decisions.
-
-The decision log (`docs/decisions.md`) is generated — do not hand-edit it; edit the source ADR under `.textus/data/knowledge/evidence/` and run `textus drain`.
+Read the map with `textus get artifacts.docs.index`; decision log: `textus get artifacts.decisions.log`.
 
 <!-- headroom:rtk-instructions -->
 # RTK (Rust Token Killer) - Token-Optimized Commands
diff --git a/CONTEXT.md b/CONTEXT.md
index 8122f8cb2..994874b13 100644
--- a/CONTEXT.md
+++ b/CONTEXT.md
@@ -59,3 +59,19 @@ _Avoid_: Cursor file, checkpoint file, seq file
 **Loop State**:
 The current knowledge pipeline phase (intent, constraint, judgment, evidence, execution, feedback) returned in `pulse` output as an advisory label. Not a state machine — agents read it to decide what to work on.
 _Avoid_: Loop driver, pipeline state, workflow phase
+
+**Workflow Consumer**:
+The module that executes a single workflow event row and handles its lifecycle (success completion, retry with backoff, dead-letter failure). Shared between the drain loop and the watcher to avoid duplicate retry logic.
+_Avoid_: Job runner, event handler
+
+**Workflow EventEmitter**:
+The module that observes store mutations and dispatches workflow events to the Workflow Queue. Replaces in-pipeline event emission so the store engine does not need to know about the workflow registry.
+_Avoid_: Event hook, pipeline step, workflow enqueuer
+
+**QueryContext**:
+A per-invocation value exposing only read-side operations (read, resolve, list, exists?, mentry_for) plus read-only container metadata (manifest, schemas, layout, link_store, entry_index). Injected by Gate into read-category handlers. Separates query from command at the seam — a read handler cannot accidentally write.
+_Avoid_: Context, god object, handler context bag
+
+**CommandContext**:
+A per-invocation value extending QueryContext with write-side operations (put, delete, move) and infrastructure access (audit_log, cursor_store, workflow_queue, file_system, workflows, workflow_registry). Injected by Gate into write- and maintenance-category handlers. Satisfies CQS: the caller's verb category determines which context type they see.
+_Avoid_: Context, god object, handler context bag
diff --git a/Rakefile b/Rakefile
index 8281788ac..02b9e97ee 100644
--- a/Rakefile
+++ b/Rakefile
@@ -3,3 +3,10 @@ require "rspec/core/rake_task"
 RSpec::Core::RakeTask.new(:spec)
 
 task default: :spec
+
+namespace :codebase_memory do
+  desc "Start codebase-memory-mcp graph visualization UI at http://localhost:9749"
+  task :ui do
+    exec "codebase-memory-mcp", "--ui=true", "--port=9749"
+  end
+end
diff --git a/bin/db b/bin/db
index d58321ff1..72374c150 100755
--- a/bin/db
+++ b/bin/db
@@ -1,16 +1,23 @@
-#!/usr/bin/env bash
-set -euo pipefail
+#!/usr/bin/env ruby
+# bin/db — open the .textus store.db in sqlite3
+#
+# Usage:  bin/db [sqlite3 args...]
+#   No args  → interactive sqlite3 shell
+#   With args → runs as `sqlite3 -header -column <args>`
 
-ROOT="$(cd "$(dirname "$0")/.." && pwd)"
-DB="$ROOT/.textus/db/store.db"
+require "fileutils"
 
-if [ ! -f "$DB" ]; then
-  echo "no store.db at $DB" >&2
+ROOT = File.expand_path("..", __dir__)
+DB   = File.join(ROOT, ".textus/db/store.db")
+
+unless File.exist?(DB)
+  warn "no store.db at #{DB}"
   exit 1
-fi
+end
 
-if [ $# -eq 0 ]; then
-  sqlite3 "$DB"
+sqlite = %w[sqlite3 -header -column]
+if ARGV.empty?
+  exec(*sqlite, DB)
 else
-  sqlite3 "$DB" -header -column "$@"
-fi
+  exec(*sqlite, DB, *ARGV)
+end
diff --git a/bin/smoke b/bin/smoke
new file mode 100755
index 000000000..ce99c5f50
--- /dev/null
+++ b/bin/smoke
@@ -0,0 +1,196 @@
+#!/usr/bin/env ruby
+# bin/smoke — simulate an agent session end-to-end against .textus
+#
+# Foundation — agent session protocol is INPUT → LOOP → OUTPUT.
+# This script exercises each node with real textus CLI calls.
+#
+# Usage:  bin/smoke            # run full session flow
+#         bin/smoke --clean    # remove all smoke-test artifacts
+#
+# Conventions:
+#   - Each step is an assert_on a real CLI command (no internal APIs)
+#   - Steps grouped by protocol phase: INPUT / LOOP / OUTPUT
+#   - Cleanup removes both registered keys AND files on disk
+#   - Log is human-readable, timestamped, append-only
+
+require "fileutils"
+require "json"
+require "open3"
+require "time"
+
+ROOT   = File.expand_path("..", __dir__)
+LOG    = File.join(ROOT, "bin/smoke.log")
+CMD    = %w[bundle exec exe/textus].freeze
+STORE  = File.join(ROOT, ".textus")
+DIRS   = %w[data/scratchpad/sessions data/scratchpad/proposals].freeze
+MARKER = File.join(ROOT, "bin/.smoke-sids")
+TARGET = %w[
+  knowledge.loop.intent.0001-north-star
+  knowledge.loop.constraint.protocol.0014-data-flow
+  knowledge.loop.judgment.engineering.0009-conventions
+].freeze
+
+@results = []
+
+def run(*, stdin: nil)
+  env = { "TEXTUS_ROOT" => STORE, "TEXTUS_ROLE" => "agent" }
+  out, _, status = Open3.capture3(env, *CMD, *, stdin_data: stdin)
+  [out.strip, status.success?]
+end
+
+def parse_json(out)
+  begin
+    JSON.parse(out)
+  rescue StandardError
+    nil
+  end
+end
+
+def assert(label, cmd, *flags, key: nil, **)
+  print "  #{label} … "
+  out, ok = run(cmd, *flags, **)
+  data = parse_json(out)
+  val  = key ? data&.dig(*key) : ok
+  if val
+    puts "\u2713"
+    @results << ["PASS", label]
+  else
+    puts "FAIL"
+    @results << ["FAIL", label, out]
+  end
+end
+
+# ── cleanup ──────────────────────────────────────────────────────────────────
+if ARGV.include?("--clean")
+  out, = run("list", "--prefix=scratchpad")
+  all = parse_json(out) || []
+
+  smoke = all.select { |e| e["key"]&.include?("smoke-test-") }
+  sids = smoke.filter_map { |e| e["key"][/smoke-test-([a-f0-9-]+)/, 1] }.uniq
+
+  # Also read marker file for orphaned SIDs (proposals already deleted)
+  if File.exist?(MARKER)
+    sids += File.read(MARKER).lines.map(&:strip).reject(&:empty?)
+    sids.uniq!
+  end
+
+  session = all.select { |e| sids.any? { |s| e["key"]&.include?(s) } }
+
+  deleted_keys = 0
+  (smoke + session).each do |e|
+    print "  #{e["key"]} … "
+    run("key", "delete", e["key"])
+    deleted_keys += 1
+    puts "\u2713"
+  end
+
+  deleted_dirs = 0
+  sids.each do |sid|
+    dir = File.join(STORE, "data/scratchpad/sessions", sid)
+    next unless File.directory?(dir)
+
+    print "  sessions/#{sid} … "
+    FileUtils.rm_rf(dir)
+    deleted_dirs += 1
+    puts "\u2713"
+  end
+
+  FileUtils.rm_f(MARKER)
+
+  orphaned = 0
+  Dir.glob(File.join(STORE, "data/scratchpad/sessions/*")).each do |d|
+    next unless File.directory?(d)
+
+    sid = File.basename(d)
+    next if sids.include?(sid)
+
+    print "  orphan sessions/#{sid} … "
+    FileUtils.rm_rf(d)
+    orphaned += 1
+    puts "\u2713"
+  end
+
+  total = deleted_keys + deleted_dirs + orphaned
+  File.write(LOG, "clean #{Time.now.utc.iso8601}\ndeleted #{total} items\n")
+  puts "\n  cleaned #{total} items (#{smoke.size} props, #{session.size} sess, #{deleted_dirs} marker, #{orphaned} orphan)"
+  exit 0
+end
+
+# ── run ─────────────────────────────────────────────────────────────────────
+File.write(LOG, "smoke #{Time.now.utc.iso8601}\n\n")
+puts "bin/smoke — #{CMD.join(" ")}"
+puts
+
+DIRS.each { |d| FileUtils.mkdir_p(File.join(STORE, d)) }
+
+# ── INPUT: orient the agent ─────────────────────────────────────────────────
+puts "[INPUT] orient"
+out, = run("session", "open", "--as=agent")
+data = parse_json(out)
+sid  = data&.dig("session_id") || "?"
+puts "  session open … #{sid == "?" ? "FAIL" : "✓"}"
+@results << (sid == "?" ? ["FAIL", "session open", out] : ["PASS", "session open"])
+
+assert("boot", "boot", key: %w[protocol])
+
+TARGET.each do |key|
+  assert("get #{key.split(".").last}", "get", key, key: %w[etag])
+end
+
+assert("list procedures", "list", "--prefix=knowledge.loop.execution") do |data|
+  data.is_a?(Array) && data.length.positive?
+end
+
+# ── LOOP: agent works ────────────────────────────────────────────────────────
+puts "[LOOP] work"
+proposal = JSON.generate({
+                           _meta: { name: "smoke-test-#{sid}",
+                                    proposal: { target_key: "scratchpad.sessions.#{sid}.smoke", action: "put" } },
+                           body: "Smoke test entry — safe to delete.\n",
+                         })
+assert("propose", "propose", "smoke-test-#{sid}", "--stdin", "--as=agent",
+       stdin: proposal, key: %w[key])
+
+SCRIPTS = {
+  "check" => { body: "echo 'agent bash script'\n", fmt: "bash" },
+  "task" => { body: "puts 'agent ruby script'\n", fmt: "ruby" },
+  "query" => { body: "print('agent python script')\n", fmt: "python" },
+  "report" => { body: "console.log('agent js script')\n", fmt: "javascript" },
+}.freeze
+
+SCRIPTS.each do |name, s|
+  payload = JSON.generate({ _meta: { name: name }, body: s[:body] })
+  assert("write scripts/#{name}", "put",
+         "scratchpad.sessions.#{sid}.scripts.#{name}", "--stdin", "--as=agent",
+         "--as-format=#{s[:fmt]}", stdin: payload, key: %w[etag])
+end
+
+# ── OUTPUT: seal, publish, verify ───────────────────────────────────────────
+puts "[OUTPUT] seal"
+assert("session close", "session", "close", "--session-id=#{sid}", "--as=agent",
+       "--nodes-checked=intent,constraint.repo,constraint.protocol," \
+       "judgment.engineering,judgment.agent-behavior,evidence,execution,feedback",
+       key: %w[status])
+
+assert("drain", "drain", "--as=automation", key: %w[ok])
+
+assert("audit", "audit", "--limit=5")
+
+File.open(MARKER, "a") { |f| f.puts sid }
+
+# ── summary ──────────────────────────────────────────────────────────────────
+puts "\n── summary ──"
+pass = @results.count { |r| r[0] == "PASS" }
+fail = @results.count { |r| r[0] == "FAIL" }
+
+@results.each do |status, msg, _detail|
+  sym = status == "PASS" ? "\u2713" : "\u2717"
+  puts "  #{sym} #{msg}"
+end
+
+puts "  pass: #{pass}  fail: #{fail}"
+puts "  log:  #{LOG}"
+
+File.open(LOG, "a") { |f| f.puts "result: #{pass} passed / #{fail} failed\n---\n" }
+
+exit(fail.positive? ? 1 : 0)
diff --git a/lib/textus.rb b/lib/textus.rb
index 375bcdadb..097e1e399 100644
--- a/lib/textus.rb
+++ b/lib/textus.rb
@@ -27,6 +27,7 @@ module MCP
 loader.ignore(File.expand_path("textus/surface/mcp/errors.rb", __dir__))
 loader.ignore(File.expand_path("textus/init/templates", __dir__))
 loader.ignore(File.expand_path("textus/protocol/init/templates", __dir__))
+loader.ignore(File.expand_path("textus/protocol/verb_registry/verbs", __dir__))
 loader.setup
 loader.eager_load
 
diff --git a/lib/textus/infra/store/workflow_queue.rb b/lib/textus/infra/store/workflow_queue.rb
index 848b50cb2..1c2e4462b 100644
--- a/lib/textus/infra/store/workflow_queue.rb
+++ b/lib/textus/infra/store/workflow_queue.rb
@@ -27,7 +27,7 @@ def pending?(event_type:, key:)
           table(:workflow_events)
             .where(event_type: event_type.to_s, key: key)
             .where(state: %w[pending processing])
-            .count > 0
+            .any?
         end
 
         def mark_processing(event_id)
diff --git a/lib/textus/lanes/scratchpad/handlers.rb b/lib/textus/lanes/scratchpad/handlers.rb
index 3f3603c0e..91d4024d9 100644
--- a/lib/textus/lanes/scratchpad/handlers.rb
+++ b/lib/textus/lanes/scratchpad/handlers.rb
@@ -12,13 +12,17 @@ def session_open(ctx:, call:)
           uuid = SecureRandom.uuid
           key = "scratchpad.sessions.#{uuid}.session"
 
-          base = File.join(ctx.layout.lane_path("scratchpad"), "sessions", uuid)
-          %w[scripts notes output].each { |d| FileUtils.mkdir_p(File.join(base, d)) }
-
           content = { "session_id" => uuid, "created_at" => Time.now.utc.iso8601, "status" => "active" }
           ctx.put(key:, meta: {}, body: JSON.generate(content), content: nil, call:)
 
-          { "session_id" => uuid, "status" => "active", "workspace" => base }
+          boot = begin
+            Textus::Protocol::Boot.build(container: ctx.container)
+          rescue StandardError
+            nil
+          end
+          result = { "session_id" => uuid, "status" => "active" }
+          result["boot"] = boot if boot
+          result
         end
 
         def parent_mentry(ctx)
@@ -54,7 +58,8 @@ def accept(pending_key:, ctx:, call:, dry_run: false)
 
           case action
           when "put"
-            ctx.put(key: target, meta: env.meta["_meta"] || {}, body: env.body, content: nil, call:)
+            target_meta = env.meta.to_h.except("proposal")
+            ctx.put(key: target, meta: target_meta, body: env.body, content: env.content, call:)
           when "delete"
             ctx.delete(key: target, call:)
           else
@@ -107,7 +112,7 @@ def diff(pending_key:, ctx:, call:)
           result
         end
 
-        def session_close(session_id:, ctx:, call:)
+        def session_close(session_id:, ctx:, call:, nodes_checked: nil)
           key = "scratchpad.sessions.#{session_id}.session"
           env = ctx.read(key:)
           raise Textus::UsageError.new("session not found: #{session_id}") unless env
@@ -125,6 +130,7 @@ def session_close(session_id:, ctx:, call:)
             "summary" => "Session #{session_id[0..8]} sealed after #{duration}. " \
                          "Created at #{current["created_at"]}, closed at #{Time.now.utc.iso8601}.",
           }
+          feedback["nodes_checked"] = nodes_checked if nodes_checked
           ctx.put(key: feedback_key, meta: {}, body: JSON.generate(feedback), content: nil, call:)
 
           { "session_id" => session_id, "status" => "sealed", "feedback_key" => feedback_key }
diff --git a/lib/textus/lanes/scratchpad/verbs.rb b/lib/textus/lanes/scratchpad/verbs.rb
index 09ce7a96e..d08df43b2 100644
--- a/lib/textus/lanes/scratchpad/verbs.rb
+++ b/lib/textus/lanes/scratchpad/verbs.rb
@@ -18,7 +18,9 @@ module Verbs
   Textus::Protocol::VerbRegistry::VerbSpec.new(
     verb: :session_close, summary: "Seal an active session by ID.",
     args: [Textus::Protocol::VerbRegistry::ArgSpec.arg(name: :session_id, required: true,
-                                                       description: "UUID of the session to close")],
+                                                       description: "UUID of the session to close"),
+           Textus::Protocol::VerbRegistry::ArgSpec.arg(name: :nodes_checked, type: Array,
+                                                       description: "list of loop nodes checked during the session")],
     surfaces: %i[cli mcp], category: :write,
     lane: :scratchpad
   ),
diff --git a/lib/textus/protocol/async.rb b/lib/textus/protocol/async.rb
deleted file mode 100644
index 01494e6ae..000000000
--- a/lib/textus/protocol/async.rb
+++ /dev/null
@@ -1,50 +0,0 @@
-module Textus
-  module Protocol
-    module Async
-      class Queue
-        def initialize(workflow_queue, retry_policy: Workflow::RetryPolicy.new)
-          @workflow_queue = workflow_queue
-          @retry_policy = retry_policy
-        end
-
-        def enqueue(workflow_type, key, lane:, payload: nil, scheduled_at: nil)
-          @workflow_queue.push(
-            event_type: "workflow", workflow_type:,
-            key:, lane:,
-            payload: payload,
-            scheduled_at: scheduled_at || Time.now.utc
-          )
-        end
-
-        def consume_one(registry:, container:, call:)
-          row = @workflow_queue.pop
-          return nil unless row
-
-          @workflow_queue.mark_processing(row[:id])
-          workflow = registry.for(row[:workflow_type])
-          Textus::Workflow::Runner.new(workflow, container:, call:).run(row[:key])
-          @workflow_queue.complete(row[:id])
-          row.merge(state: "done")
-        rescue StandardError => e
-          handle_failure(row, e)
-        end
-
-        private
-
-        def handle_failure(row, error)
-          retry_count = (row[:retry_count] || 0) + 1
-          max_attempts = row[:max_attempts] || 3
-          decision = @retry_policy.decide(retry_count:, max_attempts:)
-
-          if decision.terminal?
-            @workflow_queue.fail(row[:id], retry_count:, error: error.message)
-            row.merge(state: "failed", error: error.message)
-          else
-            @workflow_queue.reschedule(row[:id], retry_count:, delay: decision.delay, error: error.message)
-            row.merge(state: "retrying")
-          end
-        end
-      end
-    end
-  end
-end
diff --git a/lib/textus/protocol/boot.rb b/lib/textus/protocol/boot.rb
index c7fb34e4b..0e09b9a83 100644
--- a/lib/textus/protocol/boot.rb
+++ b/lib/textus/protocol/boot.rb
@@ -23,8 +23,20 @@ def self.build(container:)
         envelope.merge(
           "catalog" => Catalog.build,
           "agent_protocol" => Protocol.build(manifest),
+          "schemas" => build_schemas(container.schemas),
         )
       end
+
+      def self.build_schemas(registry)
+        return [] unless registry
+
+        registry.all.map do |s|
+          h = { "name" => s.name, "required" => s.required, "optional" => s.optional }
+          h["fields"] = s.fields unless s.fields.empty?
+          h["evolution"] = s.evolution unless s.evolution.empty?
+          h
+        end
+      end
     end
   end
 end
diff --git a/lib/textus/protocol/builder.rb b/lib/textus/protocol/builder.rb
index 1984b641e..5c10259f8 100644
--- a/lib/textus/protocol/builder.rb
+++ b/lib/textus/protocol/builder.rb
@@ -2,43 +2,9 @@ module Textus
   module Protocol
     class Builder
       def call(root)
-        manifest    = Manifest.load(root)
-        layout      = Protocol::Layout.new(root)
-        database    = Infra::Database.new(layout:).setup!
-        file_system = Infra::FileSystem.new
-        schemas     = Protocol::Schema::Registry.new(layout.schemas_dir)
-
-        store       = Infra::Store.new(database:, file_system:)
-        workflows   = Workflow::Registry.load_all(root)
-        workflows.push(Textus::Workflow::Instances::Materialize)
-        workflow_registry = Workflow::Registry.new(workflows)
-
-        store_engine = StoreEngine.new(
-          file_system:, manifest:, layout:, store:, workflow_registry:,
-        )
-
-        ttl_evaluator = Protocol::Freshness::TtlEvaluator.new(
-          manifest:,
-          file_stat: file_system,
-          clock: Infra::Clock.new,
-        )
-
-        container = Container.new(
-          store:, layout:,
-          manifest:, schemas:,
-          workflows:, workflow_registry:,
-          root:, ttl_evaluator:
-        )
-
-        gate = Protocol::Gate.new(
-          manifest:,
-          resolver: manifest.resolver,
-          container:,
-          store_engine:,
-        )
-
-        container.gate = gate
-        container
+        infra = Infrastructure.new.call(root)
+        domain = Domain.new.call(root, layout: infra.layout)
+        Runtime.new.call(infra:, domain:, root:).container
       end
     end
   end
diff --git a/lib/textus/protocol/builder/domain.rb b/lib/textus/protocol/builder/domain.rb
new file mode 100644
index 000000000..ca8c6aca4
--- /dev/null
+++ b/lib/textus/protocol/builder/domain.rb
@@ -0,0 +1,17 @@
+module Textus
+  module Protocol
+    class Builder
+      class Domain
+        Components = Data.define(:manifest, :schemas, :workflows, :workflow_registry)
+
+        def call(root, layout:)
+          manifest = Manifest.load(root)
+          schemas = Schema::Registry.new(layout.schemas_dir)
+          workflows = Workflow::Registry.load_all(root)
+          workflow_registry = Workflow::Registry.new(workflows)
+          Components.new(manifest:, schemas:, workflows:, workflow_registry:)
+        end
+      end
+    end
+  end
+end
diff --git a/lib/textus/protocol/builder/infrastructure.rb b/lib/textus/protocol/builder/infrastructure.rb
new file mode 100644
index 000000000..67e0bdc0d
--- /dev/null
+++ b/lib/textus/protocol/builder/infrastructure.rb
@@ -0,0 +1,17 @@
+module Textus
+  module Protocol
+    class Builder
+      class Infrastructure
+        Components = Data.define(:database, :file_system, :store, :layout)
+
+        def call(root)
+          layout = Layout.new(root)
+          database = Infra::Database.new(layout:).setup!
+          file_system = Infra::FileSystem.new
+          store = Infra::Store.new(database:, file_system:)
+          Components.new(database:, file_system:, store:, layout:)
+        end
+      end
+    end
+  end
+end
diff --git a/lib/textus/protocol/builder/runtime.rb b/lib/textus/protocol/builder/runtime.rb
new file mode 100644
index 000000000..8cebd852d
--- /dev/null
+++ b/lib/textus/protocol/builder/runtime.rb
@@ -0,0 +1,47 @@
+module Textus
+  module Protocol
+    class Builder
+      class Runtime
+        Components = Data.define(:store_engine, :gate, :ttl_evaluator, :container)
+
+        def call(infra:, domain:, root:)
+          event_emitter = Textus::Workflow::EventEmitter.new(
+            infra.store.workflow_queue,
+            registry: domain.workflow_registry,
+          )
+
+          store_engine = StoreEngine.new(
+            file_system: infra.file_system, manifest: domain.manifest,
+            layout: infra.layout, store: infra.store,
+            event_emitter:, schemas: domain.schemas
+          )
+
+          ttl_evaluator = Freshness::TtlEvaluator.new(
+            manifest: domain.manifest,
+            file_stat: infra.file_system,
+            clock: Infra::Clock.new,
+          )
+
+          container = Container.new(
+            store: infra.store, layout: infra.layout,
+            manifest: domain.manifest, schemas: domain.schemas,
+            workflows: domain.workflows,
+            workflow_registry: domain.workflow_registry,
+            store_engine: store_engine,
+            root:, ttl_evaluator:
+          )
+
+          gate = Gate.new(
+            manifest: domain.manifest,
+            resolver: domain.manifest.resolver,
+            container:,
+            store_engine:,
+          )
+
+          container.gate = gate
+          Components.new(store_engine:, gate:, ttl_evaluator:, container:)
+        end
+      end
+    end
+  end
+end
diff --git a/lib/textus/protocol/container.rb b/lib/textus/protocol/container.rb
index 7fb3ed1c3..2e46229b3 100644
--- a/lib/textus/protocol/container.rb
+++ b/lib/textus/protocol/container.rb
@@ -2,11 +2,11 @@ module Textus
   module Protocol
     class Container
       attr_accessor :gate
-      attr_reader :store, :layout, :manifest, :schemas, :workflows, :workflow_registry, :root, :ttl_evaluator
+      attr_reader :store, :layout, :manifest, :schemas, :workflows, :workflow_registry, :root, :ttl_evaluator, :store_engine
 
       def initialize(store:, layout:, manifest:, schemas:,
                      workflows:, workflow_registry: nil,
-                     root: nil, gate: nil, ttl_evaluator: nil)
+                     root: nil, gate: nil, ttl_evaluator: nil, store_engine: nil)
         @store = store
         @layout = layout
         @manifest = manifest
@@ -16,6 +16,7 @@ def initialize(store:, layout:, manifest:, schemas:,
         @root = root
         @gate = gate
         @ttl_evaluator = ttl_evaluator
+        @store_engine = store_engine
       end
     end
   end
diff --git a/lib/textus/protocol/format.rb b/lib/textus/protocol/format.rb
index c97ee6b94..54798f91a 100644
--- a/lib/textus/protocol/format.rb
+++ b/lib/textus/protocol/format.rb
@@ -8,6 +8,11 @@ module Format
         "json" => -> { Protocol::Format::Json },
         "yaml" => -> { Protocol::Format::Yaml },
         "text" => -> { Protocol::Format::Text },
+        "script" => -> { Protocol::Format::Script },
+        "bash" => -> { Protocol::Format::Bash },
+        "ruby" => -> { Protocol::Format::Ruby },
+        "python" => -> { Protocol::Format::Python },
+        "javascript" => -> { Protocol::Format::Javascript },
       }.freeze
 
       @registry = nil
@@ -26,6 +31,13 @@ def self.registry
         ".yaml" => "yaml",
         ".yml" => "yaml",
         ".txt" => "text",
+        ".rb" => "ruby",
+        ".py" => "python",
+        ".sh" => "bash",
+        ".js" => "javascript",
+        ".pl" => "script",
+        ".rs" => "script",
+        ".exs" => "script",
       }.freeze
 
       def self.for(format)
diff --git a/lib/textus/protocol/format/base.rb b/lib/textus/protocol/format/base.rb
index 679ee0bb2..f91d307f3 100644
--- a/lib/textus/protocol/format/base.rb
+++ b/lib/textus/protocol/format/base.rb
@@ -66,6 +66,8 @@ def self.format_name
 
         def self.validate_raw_entry!(_parsed, _lane); end
 
+        def self.nested_ext(_segment = nil) = extensions.first
+
         def self.serialize_for_put(meta:, body:, content:, path:)
           _ = path
           _ = content
diff --git a/lib/textus/protocol/format/bash.rb b/lib/textus/protocol/format/bash.rb
new file mode 100644
index 000000000..b77a1134a
--- /dev/null
+++ b/lib/textus/protocol/format/bash.rb
@@ -0,0 +1,10 @@
+module Textus
+  module Protocol
+    module Format
+      class Bash < Script
+        def self.extensions = [".sh"]
+        def self.nested_ext(*) = ".sh"
+      end
+    end
+  end
+end
diff --git a/lib/textus/protocol/format/javascript.rb b/lib/textus/protocol/format/javascript.rb
new file mode 100644
index 000000000..6ae565664
--- /dev/null
+++ b/lib/textus/protocol/format/javascript.rb
@@ -0,0 +1,10 @@
+module Textus
+  module Protocol
+    module Format
+      class Javascript < Script
+        def self.extensions = [".js"]
+        def self.nested_ext(*) = ".js"
+      end
+    end
+  end
+end
diff --git a/lib/textus/protocol/format/python.rb b/lib/textus/protocol/format/python.rb
new file mode 100644
index 000000000..4309eec15
--- /dev/null
+++ b/lib/textus/protocol/format/python.rb
@@ -0,0 +1,10 @@
+module Textus
+  module Protocol
+    module Format
+      class Python < Script
+        def self.extensions = [".py"]
+        def self.nested_ext(*) = ".py"
+      end
+    end
+  end
+end
diff --git a/lib/textus/protocol/format/ruby.rb b/lib/textus/protocol/format/ruby.rb
new file mode 100644
index 000000000..1b98f4c0d
--- /dev/null
+++ b/lib/textus/protocol/format/ruby.rb
@@ -0,0 +1,10 @@
+module Textus
+  module Protocol
+    module Format
+      class Ruby < Script
+        def self.extensions = [".rb"]
+        def self.nested_ext(*) = ".rb"
+      end
+    end
+  end
+end
diff --git a/lib/textus/protocol/format/script.rb b/lib/textus/protocol/format/script.rb
new file mode 100644
index 000000000..9a8f405fd
--- /dev/null
+++ b/lib/textus/protocol/format/script.rb
@@ -0,0 +1,55 @@
+module Textus
+  module Protocol
+    module Format
+      class Script < Base
+        EXTENSIONS = %w[.rb .py .sh .js .pl .rs .exs].freeze
+
+        def self.parse(raw, path: nil)
+          raw = raw.dup.force_encoding(Encoding::UTF_8)
+          raise BadFrontmatter.new(path, "entry is not valid UTF-8") unless raw.valid_encoding?
+
+          { "_meta" => {}, "body" => raw, "content" => nil }
+        end
+
+        def self.serialize(meta:, body:, content: nil)
+          _ = meta
+          _ = content
+          b = body.to_s
+          b += "\n" unless b.empty? || b.end_with?("\n")
+          b
+        end
+
+        def self.extensions = EXTENSIONS
+        def self.nested_glob = "**/*"
+        def self.nested_ext(*) = ""
+        def self.enforce_name_match!(_path, _meta); end
+
+        def self.rewrite_name(_path, _basename)
+          false
+        end
+
+        def self.validate_path_extension(path, nested)
+          ext = File.extname(path)
+          if nested
+            return if ext == ""
+
+            raise UsageError.new("nested script path must not have an extension")
+          end
+
+          return if EXTENSIONS.include?(ext) || ext == ""
+
+          raise UsageError.new("script format requires #{EXTENSIONS.join(" | ")} extension (got #{ext.inspect})")
+        end
+
+        def self.validate_raw_entry!(_parsed, lane)
+          nil unless lane == "scratchpad"
+        end
+
+        def self.data_to_payload(data)
+          data = data.transform_keys(&:to_s) if data.is_a?(Hash)
+          { meta: data["_meta"] || {}, body: (data["body"] || "").to_s, content: nil }
+        end
+      end
+    end
+  end
+end
diff --git a/lib/textus/protocol/gate.rb b/lib/textus/protocol/gate.rb
index a3e666427..52ce8a859 100644
--- a/lib/textus/protocol/gate.rb
+++ b/lib/textus/protocol/gate.rb
@@ -7,12 +7,13 @@ class Gate
         maintenance: Handlers::System,
       }.freeze
 
-      def initialize(manifest:, resolver:, container:, store_engine:, async: nil)
+      def initialize(manifest:, resolver:, container:, store_engine:, policy: nil, async: nil)
         @manifest = manifest
         @resolver = resolver
         @container = container
         @store_engine = store_engine
         @async = async
+        @policy = policy || manifest.policy
       end
 
       def dispatch(role, verb, params = {}, call: nil)
@@ -24,7 +25,8 @@ def dispatch(role, verb, params = {}, call: nil)
 
         call_obj = call || Value::Call.build(role:, correlation_id: SecureRandom.uuid)
         bound = Protocol::Binder.bind(spec, params)
-        ctx = Handlers::Context.new(@container, store_engine: @store_engine, call: call_obj)
+        ctx_class = spec.read? && !spec.system? ? Handlers::QueryContext : Handlers::CommandContext
+        ctx = ctx_class.new(@store_engine, @container, call_obj)
 
         handler = spec.lane ? Lane.handler_for(spec.lane) : handler_group(spec)
         handler.public_send(verb, **bound, ctx:, call: call_obj)
@@ -41,17 +43,14 @@ def handler_group(spec)
       def authorize!(role, _verb, key, spec)
         return true unless spec&.write?
 
-        lane = key&.split(".")&.first || spec.lane&.to_s
+        key_lane = key&.split(".")&.first
+        lane = key_lane || spec.lane&.to_s
         return true unless lane
 
-        zone = Textus::Protocol::V4::LANES[lane]
-        return true unless zone
+        lane_map = Textus::Protocol::V4::LANES[lane]
+        return true unless lane_map
 
-        writers = zone[:writers] || []
-        allowed = writers.map(&:to_sym).include?(role)
-        raise Textus::WriteForbidden.new(key, lane, holders: writers) unless allowed
-
-        true
+        @policy.allowed!(role:, lane:, key:)
       end
 
       def error(code, message)
diff --git a/lib/textus/protocol/handlers.rb b/lib/textus/protocol/handlers.rb
deleted file mode 100644
index 485223e92..000000000
--- a/lib/textus/protocol/handlers.rb
+++ /dev/null
@@ -1,6 +0,0 @@
-module Textus
-  module Protocol
-    module Handlers
-    end
-  end
-end
diff --git a/lib/textus/protocol/handlers/command_context.rb b/lib/textus/protocol/handlers/command_context.rb
new file mode 100644
index 000000000..d1e13c7db
--- /dev/null
+++ b/lib/textus/protocol/handlers/command_context.rb
@@ -0,0 +1,19 @@
+module Textus
+  module Protocol
+    module Handlers
+      class CommandContext < QueryContext
+        # StoreEngine delegation (write side)
+        def put(...)    = @store_engine.put(...)
+        def delete(...) = @store_engine.delete(...)
+        def move(...)   = @store_engine.move(...)
+
+        # Infrastructure (ops, drain, pulse)
+        def audit_log         = @container.store.audit_log
+        def workflow_queue    = @container.store.workflow_queue
+        def file_system       = @container.store.file_system
+        def workflows         = @container.workflows
+        def workflow_registry = @container.workflow_registry
+      end
+    end
+  end
+end
diff --git a/lib/textus/protocol/handlers/context.rb b/lib/textus/protocol/handlers/context.rb
deleted file mode 100644
index 51081bb55..000000000
--- a/lib/textus/protocol/handlers/context.rb
+++ /dev/null
@@ -1,37 +0,0 @@
-module Textus
-  module Protocol
-    module Handlers
-      class Context
-        def initialize(container, store_engine:, call:)
-          @container = container
-          @store_engine = store_engine
-          @call = call
-        end
-
-        attr_reader :call, :container, :store_engine
-
-        def manifest  = @container.manifest
-        def layout    = @container.layout
-        def schemas   = @container.schemas
-        def workflows = @container.workflows
-        def workflow_registry = @container.workflow_registry
-
-        def audit_log      = @container.store.audit_log
-        def cursor_store   = @container.store.cursor_store
-        def link_store     = @container.store.link_store
-        def workflow_queue = @container.store.workflow_queue
-        def entry_index    = @container.store.entry_index
-        def file_system    = @container.store.file_system
-
-        def read(key:)       = @store_engine.read(key:)
-        def resolve(key:)    = @store_engine.resolve(key:)
-        def list(...)        = @store_engine.list(...)
-        def exists?(key:)    = @store_engine.exists?(key:)
-        def mentry_for(key:) = @store_engine.mentry_for(key:)
-        def put(...)         = @store_engine.put(...)
-        def delete(...)      = @store_engine.delete(...)
-        def move(...)        = @store_engine.move(...)
-      end
-    end
-  end
-end
diff --git a/lib/textus/protocol/handlers/ops/bulk_planner.rb b/lib/textus/protocol/handlers/ops/bulk_planner.rb
index 0036da536..0ed351fcc 100644
--- a/lib/textus/protocol/handlers/ops/bulk_planner.rb
+++ b/lib/textus/protocol/handlers/ops/bulk_planner.rb
@@ -3,6 +3,12 @@ module Protocol
     module Handlers
       module Ops
         class BulkPlanner
+          Plan = Data.define(:steps, :warnings) do
+            def to_h
+              { "steps" => steps, "warnings" => warnings }
+            end
+          end
+
           def plan_mv(from_prefix:, to_prefix:, ctx:)
             raise Textus::UsageError.new("from_prefix and to_prefix required") unless from_prefix && to_prefix
 
@@ -14,7 +20,7 @@ def plan_mv(from_prefix:, to_prefix:, ctx:)
               tail = row["key"].delete_prefix("#{from_prefix}.")
               { "op" => "mv", "from" => row["key"], "to" => "#{to_prefix}.#{tail}" }
             end
-            Textus::Protocol::Retention::Plan.new(steps:, warnings:)
+            Plan.new(steps:, warnings:)
           end
 
           def plan_delete(prefix:, ctx:)
@@ -23,7 +29,7 @@ def plan_delete(prefix:, ctx:)
             leaves = ctx.list(prefix:)
             warnings = leaves.empty? ? ["no keys under #{prefix}"] : []
             steps = leaves.map { |row| { "op" => "delete", "key" => row["key"] } }
-            Textus::Protocol::Retention::Plan.new(steps:, warnings:)
+            Plan.new(steps:, warnings:)
           end
         end
       end
diff --git a/lib/textus/protocol/handlers/ops/data_mv.rb b/lib/textus/protocol/handlers/ops/data_mv.rb
index affcf2e64..9fcd6eee7 100644
--- a/lib/textus/protocol/handlers/ops/data_mv.rb
+++ b/lib/textus/protocol/handlers/ops/data_mv.rb
@@ -5,6 +5,12 @@ module Protocol
     module Handlers
       module Ops
         class DataMv
+          Plan = Data.define(:steps, :warnings) do
+            def to_h
+              { "steps" => steps, "warnings" => warnings }
+            end
+          end
+
           def call(from:, to:, ctx:, dry_run: false)
             raise Textus::UsageError.new("from and to required") unless from && to
             raise Textus::UsageError.new("data lane '#{from}' not declared") unless ctx.manifest.data.declared_lane_kinds.key?(from)
@@ -15,7 +21,7 @@ def call(from:, to:, ctx:, dry_run: false)
             affected_keys = ctx.manifest.data.entries.select { |e| e.lane == from }.map(&:key)
             steps = [{ "op" => "rename_zone", "from" => from, "to" => to }]
             steps += affected_keys.map { |k| { "op" => "mv", "from" => k, "to" => "#{to}#{k[from.length..]}" } }
-            plan = Textus::Protocol::Retention::Plan.new(steps:, warnings: [])
+            plan = Plan.new(steps:, warnings: [])
             return plan.to_h if dry_run
 
             rewrite_manifest!(from:, to:, ctx:)
diff --git a/lib/textus/protocol/handlers/ops/git_blame.rb b/lib/textus/protocol/handlers/ops/git_blame.rb
index 7dfac5c46..761b5abd7 100644
--- a/lib/textus/protocol/handlers/ops/git_blame.rb
+++ b/lib/textus/protocol/handlers/ops/git_blame.rb
@@ -11,7 +11,7 @@ def call(key:, ctx:)
             return nil unless path && git_tracked?(path, root:)
 
             audit_rows = ctx.audit_log.list(key:)
-            audit_rows.each_with_object({}) { |row, h| h[row["ts"]] = git_commit_at(path, timestamp: row["ts"], root:) }
+            audit_rows.to_h { |row| [row["ts"], git_commit_at(path, timestamp: row["ts"], root:)] }
           end
 
           private
diff --git a/lib/textus/protocol/handlers/ops/pulse_coordinator.rb b/lib/textus/protocol/handlers/ops/pulse_coordinator.rb
index 05cc51300..4a8827c17 100644
--- a/lib/textus/protocol/handlers/ops/pulse_coordinator.rb
+++ b/lib/textus/protocol/handlers/ops/pulse_coordinator.rb
@@ -26,8 +26,7 @@ def call(role:, ctx:, since: nil)
           private
 
           def pulse_index_etag(ctx)
-            path = ctx.resolve(key: "artifacts.system.index").path
-            File.exist?(path) ? ctx.file_system.etag(path) : nil
+            ctx.etag_for("artifacts.system.index")
           rescue Textus::Error
             nil
           end
diff --git a/lib/textus/protocol/handlers/ops/source_expander.rb b/lib/textus/protocol/handlers/ops/source_expander.rb
index ae6141072..6ef573217 100644
--- a/lib/textus/protocol/handlers/ops/source_expander.rb
+++ b/lib/textus/protocol/handlers/ops/source_expander.rb
@@ -23,7 +23,7 @@ def expand_one(src, ctx:, depth:)
             stored_etag = src["etag"]
             res = ctx.resolve(key:)
             path = res.path
-            current_etag = ctx.file_system.exists?(path) ? ctx.file_system.etag(path) : nil
+            current_etag = File.exist?(path) ? ctx.file_system.etag(path) : nil
             suspended = stored_etag && current_etag ? stored_etag != current_etag : false
             result = src.merge("suspended" => suspended)
             child_env = ctx.read(key:)
diff --git a/lib/textus/protocol/handlers/query_context.rb b/lib/textus/protocol/handlers/query_context.rb
new file mode 100644
index 000000000..9a00824bf
--- /dev/null
+++ b/lib/textus/protocol/handlers/query_context.rb
@@ -0,0 +1,41 @@
+module Textus
+  module Protocol
+    module Handlers
+      class QueryContext
+        def initialize(store_engine, container, call)
+          @store_engine = store_engine
+          @container = container
+          @call = call
+        end
+
+        attr_reader :call, :store_engine, :container
+
+        # StoreEngine delegation (read side)
+        def read(key:)       = @store_engine.read(key:)
+        def resolve(key:)    = @store_engine.resolve(key:)
+        def list(...)        = @store_engine.list(...)
+        def exists?(key:)    = @store_engine.exists?(key:)
+        def mentry_for(key:) = @store_engine.mentry_for(key:)
+
+        # Narrow file queries (avoid raw file_system access)
+        def file_exists?(key)
+          path = @store_engine.resolve(key:).path
+          @store_engine.file_system.exists?(path)
+        end
+
+        def etag_for(key)
+          path = @store_engine.resolve(key:).path
+          @store_engine.file_system.etag(path) if @store_engine.file_system.exists?(path)
+        end
+
+        # Container metadata (read-only)
+        def manifest     = @container.manifest
+        def schemas      = @container.schemas
+        def layout       = @container.layout
+        def link_store   = @container.store.link_store
+        def entry_index  = @container.store.entry_index
+        def cursor_store = @container.store.cursor_store
+      end
+    end
+  end
+end
diff --git a/lib/textus/protocol/handlers/read.rb b/lib/textus/protocol/handlers/read.rb
index debad510a..cfc4f788b 100644
--- a/lib/textus/protocol/handlers/read.rb
+++ b/lib/textus/protocol/handlers/read.rb
@@ -3,7 +3,8 @@ module Protocol
     module Handlers
       module Read
         include Concern
-        extend self
+
+        module_function
 
         def get(key:, ctx:, call:)
           env = ctx.read(key:)
diff --git a/lib/textus/protocol/handlers/system.rb b/lib/textus/protocol/handlers/system.rb
index d350330ac..e6f03cdf9 100644
--- a/lib/textus/protocol/handlers/system.rb
+++ b/lib/textus/protocol/handlers/system.rb
@@ -16,6 +16,10 @@ def boot(ctx:, call:)
           Textus::Protocol::Boot.build(container: proxy)
         end
 
+        def schema_list(ctx:, call:)
+          Textus::Protocol::Boot.build_schemas(ctx.schemas)
+        end
+
         def audit(ctx:, call:, key: nil, lane: nil, role: nil, verb: nil, since: nil, seq_since: nil, correlation_id: nil, limit: nil)
           Ops::AuditFilter.new.call(
             ctx:,
@@ -51,22 +55,31 @@ def workflow_spec(name:, ctx:, call:)
             end,
             "priority" => wf.priority,
             "max_attempts" => wf.max_attempts,
-            "ttl" => wf.ttl ? wf.ttl.to_s : nil,
+            "ttl" => wf.ttl&.to_s,
             "on_expire" => wf.on_expire
           }
         end
 
         def drain(ctx:, call:)
           registry = ctx.workflow_registry || Textus::Workflow::Registry.new(ctx.workflows)
-          result = Textus::Workflow::Engine.new(
-            registry:,
-            workflow_queue: ctx.workflow_queue,
-            container: ctx.container,
-            call:,
-            reader: ->(key:) { ctx.read(key:) },
-          ).run
-          response(ok: result[:failed].zero?,
-                   completed: result[:completed], failed: result[:failed])
+          reader = ->(key:) { ctx.read(key:) }
+
+          Textus::Workflow::Scheduler.new(
+            registry:, workflow_queue: ctx.workflow_queue, reader:,
+          ).seed_expired
+
+          consumer = Textus::Workflow::Consumer.new(registry:, container: ctx.container, call:)
+          completed = 0
+          failed = 0
+          loop do
+            row = ctx.workflow_queue.pop
+            break unless row
+
+            result = consumer.consume(row, ctx.workflow_queue)
+            result[:state] == "done" ? completed += 1 : failed += 1
+          end
+
+          response(ok: failed.zero?, completed:, failed:)
         end
 
         private
diff --git a/lib/textus/protocol/handlers/write.rb b/lib/textus/protocol/handlers/write.rb
index e9e60d1a7..08d62e163 100644
--- a/lib/textus/protocol/handlers/write.rb
+++ b/lib/textus/protocol/handlers/write.rb
@@ -3,10 +3,11 @@ module Protocol
     module Handlers
       module Write
         include Concern
-        extend self
 
-        def put(key:, ctx:, call:, meta: nil, body: nil, content: nil, if_etag: nil)
-          env = ctx.put(key:, meta: meta || {}, body:, content:, if_etag:, call:)
+        module_function
+
+        def put(key:, ctx:, call:, meta: nil, body: nil, content: nil, if_etag: nil, format: nil)
+          env = ctx.put(key:, meta: meta || {}, body:, content:, if_etag:, call:, format:)
           response(ok: true, key:, uid: env.uid, etag: env.etag)
         end
 
@@ -14,7 +15,10 @@ def delete(key:, ctx:, call:, if_etag: nil)
           ctx.delete(key:, if_etag:, call:)
           response(ok: true, key:, deleted: true)
         end
-        alias key_delete delete
+
+        def key_delete(key:, ctx:, call:, if_etag: nil)
+          delete(key:, ctx:, call:, if_etag:)
+        end
 
         def move(old_key:, new_key:, ctx:, call:, if_etag: nil, dry_run: false)
           mctx = ctx.move(from_key: old_key, to_key: new_key, call:, if_etag:, dry_run:)
diff --git a/lib/textus/protocol/key/distance.rb b/lib/textus/protocol/key/distance.rb
deleted file mode 100644
index fb94caaa4..000000000
--- a/lib/textus/protocol/key/distance.rb
+++ /dev/null
@@ -1,51 +0,0 @@
-module Textus
-  module Protocol
-    module Key
-      class Distance
-        MAX_LEN = 200
-
-        def self.shared_prefix_segments(left, right)
-          asegs = left.split(".")
-          bsegs = right.split(".")
-          n = [asegs.length, bsegs.length].min
-          i = 0
-          i += 1 while i < n && asegs[i] == bsegs[i]
-          i
-        end
-
-        def self.levenshtein(left, right)
-          return nil if left.length > MAX_LEN || right.length > MAX_LEN
-          return right.length if left.empty?
-          return left.length if right.empty?
-
-          prev = (0..right.length).to_a
-          curr = Array.new(right.length + 1, 0)
-          (1..left.length).each do |i|
-            curr[0] = i
-            (1..right.length).each do |j|
-              cost = left[i - 1] == right[j - 1] ? 0 : 1
-              curr[j] = [
-                curr[j - 1] + 1,
-                prev[j] + 1,
-                prev[j - 1] + cost,
-              ].min
-            end
-            prev, curr = curr, prev
-          end
-          prev[right.length]
-        end
-
-        def self.suggest(requested, candidates, limit: 5)
-          return [] if requested.nil? || requested.empty?
-
-          scored = candidates.first(200).map do |k|
-            prefix = shared_prefix_segments(requested, k)
-            dist = levenshtein(requested, k) || Float::INFINITY
-            [k, prefix, dist]
-          end
-          scored.sort_by { |(_, prefix, dist)| [-prefix, dist] }.first(limit).map(&:first)
-        end
-      end
-    end
-  end
-end
diff --git a/lib/textus/protocol/lane.rb b/lib/textus/protocol/lane.rb
index ba711382b..6ef96aa66 100644
--- a/lib/textus/protocol/lane.rb
+++ b/lib/textus/protocol/lane.rb
@@ -7,30 +7,6 @@ def self.handler_for(lane_name)
       rescue NameError
         raise ArgumentError.new("no handler for lane: #{lane_name}")
       end
-
-      PROPOSALS_WRITERS = %w[human agent].freeze
-
-      module_function
-
-      def writers_for(lane_name)
-        return PROPOSALS_WRITERS if lane_name == "proposals"
-
-        Textus::Protocol::V4::LANES.dig(lane_name, :writers) || []
-      end
-
-      def proposer_role
-        proposers = writers_for("proposals")
-        authors = writers_for("knowledge")
-        (proposers - authors).first || proposers.first
-      end
-
-      def actor_for(lane_name)
-        writers_for(lane_name).first
-      end
-
-      def propose_lane_for(role)
-        writers_for("proposals").include?(role) ? "scratchpad.proposals" : nil
-      end
     end
   end
 end
diff --git a/lib/textus/protocol/manifest/entry/parser.rb b/lib/textus/protocol/manifest/entry/parser.rb
index 4c744cc4d..61e27d1a3 100644
--- a/lib/textus/protocol/manifest/entry/parser.rb
+++ b/lib/textus/protocol/manifest/entry/parser.rb
@@ -44,7 +44,7 @@ def self.infer_kind(key, _raw, root:)
           private_class_method :infer_kind
 
           def self.resolve_format(key, kind, root, declared)
-            return "markdown" if kind == :nested
+            return declared || "markdown" if kind == :nested
 
             dir = root ? File.join(root, "data", key.split(".").join("/")) : nil
             if dir
diff --git a/lib/textus/protocol/manifest/policy.rb b/lib/textus/protocol/manifest/policy.rb
index 108e2fc18..d06068f58 100644
--- a/lib/textus/protocol/manifest/policy.rb
+++ b/lib/textus/protocol/manifest/policy.rb
@@ -2,6 +2,8 @@ module Textus
   module Protocol
     class Manifest
       class Policy
+        PROPOSALS_WRITERS = %w[human agent].freeze
+
         def initialize(data)
           @data    = data
           @entries = nil
@@ -9,18 +11,37 @@ def initialize(data)
 
         attr_writer :entries
 
-        def writers_for(lane_name)
-          Protocol::Lane.writers_for(lane_name)
+        # ── Authorization ──
+
+        def allowed?(role:, lane:)
+          writers_for(lane).map(&:to_sym).include?(role.to_sym)
         end
 
-        def proposer_role
-          Protocol::Lane.proposer_role
+        def allowed!(role:, lane:, key: nil)
+          return true if allowed?(role:, lane:)
+
+          raise Textus::WriteForbidden.new(key, lane, holders: writers_for(lane))
+        end
+
+        def writers_for(lane_name)
+          return PROPOSALS_WRITERS if lane_name == "proposals"
+
+          lane_map = Textus::Protocol::V4::LANES[lane_name]
+          lane_map ? Array(lane_map[:writers]) : []
         end
 
         def actor_for(lane_name)
-          Protocol::Lane.actor_for(lane_name)
+          writers_for(lane_name).first
+        end
+
+        def proposer_role
+          proposers = writers_for("proposals")
+          authors = writers_for("knowledge")
+          (proposers - authors).first || proposers.first
         end
 
+        # ── Existing methods (unchanged) ──
+
         def derived_entry?(key)
           entry = Array(@entries).find { |e| e.key == key }
           entry && entry.lane == "artifacts"
@@ -39,7 +60,8 @@ def queue_lane?(lane_name)
         end
 
         def propose_lane_for(role)
-          Protocol::Lane.propose_lane_for(role)
+          proposers = writers_for("proposals")
+          proposers.include?(role) ? "scratchpad.proposals" : nil
         end
       end
     end
diff --git a/lib/textus/protocol/manifest/resolver.rb b/lib/textus/protocol/manifest/resolver.rb
index eb7764273..0f9041e89 100644
--- a/lib/textus/protocol/manifest/resolver.rb
+++ b/lib/textus/protocol/manifest/resolver.rb
@@ -4,6 +4,8 @@ class Manifest
       class Resolver
         Resolution = ::Data.define(:entry, :path, :remaining)
 
+        MAX_DISTANCE_LEN = 200
+
         def initialize(data)
           @data = data
         end
@@ -21,7 +23,7 @@ def suggestions_for(key)
           candidates = enumerate.map { |r| r[:key] }
           candidates.concat(@data.entries.reject { |e| nested_entry?(e) }.map(&:key))
           candidates.uniq!
-          Protocol::Key::Distance.suggest(key, candidates, limit: 5)
+          suggest(key, candidates, limit: 5)
         rescue StandardError
           []
         end
@@ -36,6 +38,17 @@ def enumerate(prefix: nil, include_keyless: false)
 
         private
 
+        def suggest(requested, candidates, limit: 5)
+          return [] if requested.nil? || requested.empty?
+
+          scored = candidates.first(200).map do |k|
+            prefix = self.class.shared_prefix_segments(requested, k)
+            dist = self.class.levenshtein(requested, k) || Float::INFINITY
+            [k, prefix, dist]
+          end
+          scored.sort_by { |(_, prefix, dist)| [-prefix, dist] }.first(limit).map(&:first)
+        end
+
         def nested_entry?(entry)
           entry.nested?
         end
@@ -44,9 +57,10 @@ def build_path(entry, remaining)
           if remaining.empty?
             resolve_leaf_path(entry)
           else
-            primary_ext = Textus::Protocol::Format.for(entry.format).extensions.first
+            fmt = Textus::Protocol::Format.for(entry.format)
             base = Textus::Protocol::Key::Path.normalize_relative_path(entry.path)
-            File.join(@data.root, base, *remaining) + primary_ext
+            path = File.join(@data.root, base, *remaining)
+            path + fmt.nested_ext(remaining.last)
           end
         end
 
@@ -102,6 +116,40 @@ def resolve_leaf_path(entry)
         def nested_glob(format)
           Textus::Protocol::Format.for(format).nested_glob
         end
+        class << self
+          private
+
+          def shared_prefix_segments(left, right)
+            asegs = left.split(".")
+            bsegs = right.split(".")
+            n = [asegs.length, bsegs.length].min
+            i = 0
+            i += 1 while i < n && asegs[i] == bsegs[i]
+            i
+          end
+
+          def levenshtein(left, right)
+            return nil if left.length > MAX_DISTANCE_LEN || right.length > MAX_DISTANCE_LEN
+            return right.length if left.empty?
+            return left.length if right.empty?
+
+            prev = (0..right.length).to_a
+            curr = Array.new(right.length + 1, 0)
+            (1..left.length).each do |i|
+              curr[0] = i
+              (1..right.length).each do |j|
+                cost = left[i - 1] == right[j - 1] ? 0 : 1
+                curr[j] = [
+                  curr[j - 1] + 1,
+                  prev[j] + 1,
+                  prev[j - 1] + cost,
+                ].min
+              end
+              prev, curr = curr, prev
+            end
+            prev[right.length]
+          end
+        end
       end
     end
   end
diff --git a/lib/textus/protocol/manifest/schema.rb b/lib/textus/protocol/manifest/schema.rb
index 28a54f9a0..ba68c2201 100644
--- a/lib/textus/protocol/manifest/schema.rb
+++ b/lib/textus/protocol/manifest/schema.rb
@@ -1,25 +1,39 @@
 module Textus
   module Protocol
     class Manifest
-      # The manifest schema. Its data is split across Schema::Vocabulary (the
-      # coordination vocabulary) and Schema::Keys (key whitelists + FIELD_REGISTRY)
-      # as of ADR 0109; the validation walk lives in Schema::Validator (ADR 0107).
-      # The constants are re-exported here so callers keep saying `Schema::LANES`.
       module Schema
-        # Re-export the vocabulary.
-        LANES              = Vocabulary::LANES
-        LANE_KINDS         = Vocabulary::LANE_KINDS
-        CAPABILITIES       = Vocabulary::CAPABILITIES
-        KIND_REQUIRES_VERB = Vocabulary::KIND_REQUIRES_VERB
-        # Re-export the keys.
-        ROOT_KEYS             = Keys::ROOT_KEYS
-        LANE_KEYS             = Keys::LANE_KEYS
-        ENTRY_KEYS            = Keys::ENTRY_KEYS
-        AUDIT_KEYS            = Keys::AUDIT_KEYS
-        OWNER_SUBJECT_PATTERN = Keys::OWNER_SUBJECT_PATTERN
+        # The closed coordination vocabulary (ADR 0028; five in 0033; unified in
+        # 0034; the quarantine + derived ZONE-KINDS folded into one `machine` kind
+        # in ADR 0091). Each kind pairs with the capability that authorizes
+        # originating bytes in it.
+        LANES = {
+          "canon" => "author",
+          "workspace" => "keep",
+          "machine" => "converge",
+          "queue" => "propose",
+          "raw" => "ingest",
+        }.freeze
 
-        # Public entry point — the validation walk lives in Schema::Validator (ADR 0107).
+        LANE_KINDS         = LANES.keys.freeze
+        CAPABILITIES       = LANES.values.uniq.freeze
+        KIND_REQUIRES_VERB = LANES
+
+        # Key whitelists and rule-field registry (ADR 0109).
+        ROOT_KEYS  = %w[version roles owner lanes entries data audit worker].freeze
+        LANE_KEYS  = %w[name kind owner desc].freeze
+        ENTRY_KEYS = %w[key schema format naming tracked].freeze
+        AUDIT_KEYS = %w[max_size keep].freeze
+
+        OWNER_SUBJECT_PATTERN = /\A[a-z][a-z0-9_-]*\z/
+
+        # Public entry point — structural validation then semantic checks.
         def self.validate!(raw) = Validator.validate!(raw)
+
+        def self.walk(raw, allowed, path)
+          raw.each_key do |k|
+            raise BadManifest.new("unknown key '#{k}' at '#{path}'") unless allowed.include?(k)
+          end
+        end
       end
     end
   end
diff --git a/lib/textus/protocol/manifest/schema/contract.rb b/lib/textus/protocol/manifest/schema/contract.rb
index d6a655f6f..353e5595f 100644
--- a/lib/textus/protocol/manifest/schema/contract.rb
+++ b/lib/textus/protocol/manifest/schema/contract.rb
@@ -9,7 +9,7 @@ module Schema
           optional(:lanes).value(:array).each do
             hash do
               required(:name).value(:string)
-              required(:kind).value(included_in?: Vocabulary::LANE_KINDS)
+              required(:kind).value(included_in?: LANE_KINDS)
               optional(:owner).value(:string)
               optional(:desc).value(:string)
             end
diff --git a/lib/textus/protocol/manifest/schema/keys.rb b/lib/textus/protocol/manifest/schema/keys.rb
deleted file mode 100644
index 312ebb57a..000000000
--- a/lib/textus/protocol/manifest/schema/keys.rb
+++ /dev/null
@@ -1,24 +0,0 @@
-module Textus
-  module Protocol
-    class Manifest
-      module Schema
-        # The manifest's key whitelists and the rule-field registry — the schema's
-        # data tables (ADR 0109; the vocabulary lives in Schema::Vocabulary).
-        module Keys
-          ROOT_KEYS  = %w[version roles owner lanes entries data audit worker].freeze
-          LANE_KEYS  = %w[name kind owner desc].freeze
-          ENTRY_KEYS = %w[
-            key schema format naming tracked
-          ].freeze
-          AUDIT_KEYS = %w[max_size keep].freeze
-          # Syntactic shape of an `owner:` subject token (the `patrick` in
-          # `human:patrick`) — the subject half of the owner-validation rule below.
-          # Role supplies the archetype set (Role::NAMES); this pattern is the
-          # owner-specific part, so it lives with the rule that composes them
-          # (ADR 0045 D1). Acting-role *names* are gated by Role::NAMES, not a regex.
-          OWNER_SUBJECT_PATTERN = /\A[a-z][a-z0-9_-]*\z/
-        end
-      end
-    end
-  end
-end
diff --git a/lib/textus/protocol/manifest/schema/semantics.rb b/lib/textus/protocol/manifest/schema/semantics.rb
deleted file mode 100644
index 52cfc0ed5..000000000
--- a/lib/textus/protocol/manifest/schema/semantics.rb
+++ /dev/null
@@ -1,23 +0,0 @@
-# frozen_string_literal: true
-
-module Textus
-  module Protocol
-    class Manifest
-      module Schema
-        # Cross-field checks called by Validator.validate!
-        # AFTER the structural dry-schema Contract passes. Operates on the raw hash.
-        module Semantics
-          module_function
-
-          def check!(raw); end
-
-          def walk(raw, allowed, path)
-            raw.each_key do |k|
-              raise BadManifest.new("unknown key '#{k}' at '#{path}'") unless allowed.include?(k)
-            end
-          end
-        end
-      end
-    end
-  end
-end
diff --git a/lib/textus/protocol/manifest/schema/validator.rb b/lib/textus/protocol/manifest/schema/validator.rb
index d1374d139..069997854 100644
--- a/lib/textus/protocol/manifest/schema/validator.rb
+++ b/lib/textus/protocol/manifest/schema/validator.rb
@@ -13,7 +13,7 @@ def validate!(raw)
             raise BadManifest.new("manifest must be a hash") unless raw.is_a?(Hash)
 
             # Root unknown-key check before Contract so it fires even when lanes: is empty.
-            Semantics.walk(raw, ROOT_KEYS, "$")
+            Schema.walk(raw, ROOT_KEYS, "$")
 
             result = Contract.call(raw)
             raise BadManifest.new(format_first_error(result.errors.messages)) unless result.success?
@@ -23,8 +23,6 @@ def validate!(raw)
             elsif Array(raw["lanes"]).empty?
               raise BadManifest.new("manifest must declare lanes:")
             end
-
-            Semantics.check!(raw)
           end
 
           # Format the first dry-schema error to match the legacy path-prefixed style:
diff --git a/lib/textus/protocol/manifest/schema/vocabulary.rb b/lib/textus/protocol/manifest/schema/vocabulary.rb
deleted file mode 100644
index c05a4a946..000000000
--- a/lib/textus/protocol/manifest/schema/vocabulary.rb
+++ /dev/null
@@ -1,27 +0,0 @@
-module Textus
-  module Protocol
-    class Manifest
-      module Schema
-        # The closed coordination vocabulary (ADR 0028; five in 0033; unified in
-        # 0034; the quarantine + derived ZONE-KINDS folded into one `machine` kind
-        # in ADR 0091). Each kind pairs with the capability that authorizes
-        # originating bytes in it. ONE source of truth; the derived constants below
-        # cannot drift. A BIJECTION again (0090 had two kinds → the converge capability; 0091
-        # collapses them, so kind ↔ capability is 1:1).
-        module Vocabulary
-          LANES = {
-            "canon" => "author",
-            "workspace" => "keep",
-            "machine" => "converge",
-            "queue" => "propose",
-            "raw" => "ingest",
-          }.freeze
-
-          LANE_KINDS         = LANES.keys.freeze
-          CAPABILITIES       = LANES.values.uniq.freeze
-          KIND_REQUIRES_VERB = LANES
-        end
-      end
-    end
-  end
-end
diff --git a/lib/textus/protocol/produce.rb b/lib/textus/protocol/produce.rb
deleted file mode 100644
index 33cd37cf5..000000000
--- a/lib/textus/protocol/produce.rb
+++ /dev/null
@@ -1,6 +0,0 @@
-module Textus
-  module Protocol
-    module Produce
-    end
-  end
-end
diff --git a/lib/textus/protocol/retention/plan.rb b/lib/textus/protocol/retention/plan.rb
deleted file mode 100644
index 358937b45..000000000
--- a/lib/textus/protocol/retention/plan.rb
+++ /dev/null
@@ -1,11 +0,0 @@
-module Textus
-  module Protocol
-    module Retention
-      Plan = Data.define(:steps, :warnings) do
-        def to_h
-          { "steps" => steps, "warnings" => warnings }
-        end
-      end
-    end
-  end
-end
diff --git a/lib/textus/protocol/session.rb b/lib/textus/protocol/session.rb
index d9af80db1..d3c191086 100644
--- a/lib/textus/protocol/session.rb
+++ b/lib/textus/protocol/session.rb
@@ -1,10 +1,18 @@
+require "forwardable"
+
 module Textus
   module Protocol
     class Session
+      extend Forwardable
+
       attr_reader :context, :bridge
 
       DOMAIN_VERBS = (VerbRegistry::ENTRY_VERBS + VerbRegistry::OPS_VERBS).to_set.freeze
 
+      def_delegators :context, :role, :cursor, :correlation_id, :contract_etag, :propose_lane
+      def_delegator  :context, :dry_run, :dry_run?
+      def_delegators :bridge, :root, :container, :store, :manifest, :schemas, :layout, :workflows, :gate, :ttl_evaluator
+
       def self.open(root, role: Value::Role::DEFAULT, correlation_id: nil, dry_run: false)
         root = File.expand_path(root)
         container = Protocol::Builder.new.call(root)
@@ -26,25 +34,6 @@ def initialize(bridge:, context:)
         @context = context
       end
 
-      # Context-derived
-      def role = context.role
-      def cursor = context.cursor
-      def correlation_id = context.correlation_id
-      def contract_etag = context.contract_etag
-      def propose_lane = context.propose_lane
-      def dry_run? = context.dry_run
-
-      # Bridge-derived
-      def root = bridge.root
-      def container = bridge.container
-      def store = bridge.store
-      def manifest = bridge.manifest
-      def schemas = bridge.schemas
-      def layout = bridge.layout
-      def workflows = bridge.workflows
-      def gate = bridge.gate
-      def ttl_evaluator = bridge.ttl_evaluator
-
       def method_missing(name, *args, **kwargs)
         if DOMAIN_VERBS.include?(name)
           raise ArgumentError.new("#{name} accepts keyword arguments only") unless args.empty?
diff --git a/lib/textus/protocol/store_engine.rb b/lib/textus/protocol/store_engine.rb
index 62037dd2f..ef7b9faea 100644
--- a/lib/textus/protocol/store_engine.rb
+++ b/lib/textus/protocol/store_engine.rb
@@ -1,12 +1,13 @@
 module Textus
   module Protocol
     class StoreEngine
-      def initialize(file_system:, manifest:, layout:, store:, workflow_registry: nil)
+      def initialize(file_system:, manifest:, layout:, store:, event_emitter: nil, schemas: nil)
         @file_system = file_system
         @manifest = manifest
         @layout = layout
         @store = store
-        @workflow_registry = workflow_registry
+        @event_emitter = event_emitter
+        @schemas = schemas
       end
 
       def read(key:)
@@ -42,20 +43,33 @@ def list(prefix: nil, lane: nil, q: nil, schema: nil)
       def resolve(key:)   = @manifest.resolver.resolve(key)
       def mentry_for(key:)= resolve(key:).entry
 
-      def put(key:, meta:, body:, content:, call:, if_etag: nil)
+      def put(key:, meta:, body:, content:, call:, if_etag: nil, format: nil)
         result = resolve(key:)
         payload = Value::Payload.new(meta: meta || {}, body:, content:)
         deps = build_deps(reader: nil, call:)
-        PutPipeline.call(key, mentry: result.entry, path: result.path, payload:, if_etag:, deps:)
+
+        if format
+          fmt_mod = Textus::Protocol::Format.for(format)
+          path = result.path.sub(/\.[^.]+$/, "") + fmt_mod.nested_ext(result.remaining.last)
+          PutPipeline.call(key, mentry: result.entry, path:, payload:, if_etag:, deps:, fmt: format)
+        else
+          PutPipeline.call(key, mentry: result.entry, path: result.path, payload:, if_etag:, deps:)
+        end
       end
 
       def delete(key:, call:, if_etag: nil)
-        deps = build_deps(reader: nil, call:)
+        deps = Pipeline::DeleteDeps.new(
+          file_system: @file_system, manifest: @manifest, store: @store,
+          layout: @layout, event_emitter: @event_emitter, call:
+        )
         DeletePipeline.call(key, if_etag:, deps:)
       end
 
       def move(from_key:, to_key:, call:, if_etag: nil, dry_run: false)
-        deps = build_deps(reader: self, call:)
+        deps = Pipeline::MoveDeps.new(
+          file_system: @file_system, manifest: @manifest, store: @store,
+          layout: @layout, event_emitter: @event_emitter, reader: self, call:
+        )
         MovePipeline.call(from_key:, to_key:, if_etag:, dry_run:, deps:)
       end
 
@@ -64,7 +78,7 @@ def move(from_key:, to_key:, call:, if_etag: nil, dry_run: false)
       def build_deps(reader:, call:)
         Pipeline::WriteDeps.new(
           file_system: @file_system, manifest: @manifest, store: @store,
-          layout: @layout, workflow_registry: @workflow_registry, reader:, call:
+          layout: @layout, event_emitter: @event_emitter, schemas: @schemas, reader:, call:
         )
       end
     end
diff --git a/lib/textus/protocol/store_engine/delete_pipeline.rb b/lib/textus/protocol/store_engine/delete_pipeline.rb
index 74b76e8c2..709222eb0 100644
--- a/lib/textus/protocol/store_engine/delete_pipeline.rb
+++ b/lib/textus/protocol/store_engine/delete_pipeline.rb
@@ -2,69 +2,14 @@ module Textus
   module Protocol
     class StoreEngine
       module DeletePipeline
-        module ResolvePath
-          def self.call(ctx, deps)
-            path = deps.manifest.resolver.resolve(ctx.key).path
-            ctx.with(path:)
-          end
-        end
-
-        module CheckEtag
-          def self.call(ctx, deps)
-            etag_before = deps.file_system.exists?(ctx.path) ? deps.file_system.etag(ctx.path) : nil
-            raise Textus::EtagMismatch.new(ctx.key, ctx.if_etag, etag_before) if ctx.if_etag && (etag_before != ctx.if_etag)
-
-            ctx.with(etag_before:)
-          end
-        end
-
-        module AssertExists
-          def self.call(ctx, deps)
-            return ctx if deps.file_system.exists?(ctx.path)
-
-            raise Textus::UnknownKey.new(ctx.key, suggestions: deps.manifest.resolver.suggestions_for(ctx.key))
-          end
-        end
-
-        module DeleteFile
-          def self.call(ctx, deps)
-            deps.file_system.delete(ctx.path)
-            ctx
-          end
-        end
-
-        module PruneParents
-          def self.call(ctx, deps)
-            Pipeline.prune_parents(ctx.path, deps)
-            ctx
-          end
-        end
-
-        module AppendDeleteAudit
-          def self.call(ctx, deps)
-            deps.audit_log.append(
-              role: deps.call.role, verb: "key_delete", key: ctx.key,
-              etag_before: ctx.etag_before, etag_after: nil,
-              correlation_id: deps.call.correlation_id
-            )
-            ctx
-          end
-        end
-
-        module DeindexEntry
-          def self.call(ctx, deps)
-            deps.entry_index.remove(key: ctx.key)
-            ctx
-          end
-        end
-
-        module EmitWorkflowEvent
-          def self.call(ctx, deps)
-            Pipeline.emit_event(ctx, deps,
-                                event_type: "entry.deleted", pending_key: ctx.key,
-                                emit_key: ctx.key)
-          end
-        end
+        require_relative "delete_pipeline/resolve_path"
+        require_relative "delete_pipeline/assert_exists"
+        require_relative "delete_pipeline/check_etag"
+        require_relative "delete_pipeline/delete_file"
+        require_relative "delete_pipeline/prune_parents"
+        require_relative "delete_pipeline/append_audit"
+        require_relative "delete_pipeline/deindex_entry"
+        require_relative "delete_pipeline/emit_workflow_event"
 
         STEPS = [
           ResolvePath,
@@ -72,7 +17,7 @@ def self.call(ctx, deps)
           CheckEtag,
           DeleteFile,
           PruneParents,
-          AppendDeleteAudit,
+          AppendAudit,
           EmitWorkflowEvent,
           DeindexEntry,
         ].freeze
diff --git a/lib/textus/protocol/store_engine/delete_pipeline/append_audit.rb b/lib/textus/protocol/store_engine/delete_pipeline/append_audit.rb
new file mode 100644
index 000000000..9ce7171c6
--- /dev/null
+++ b/lib/textus/protocol/store_engine/delete_pipeline/append_audit.rb
@@ -0,0 +1,18 @@
+module Textus
+  module Protocol
+    class StoreEngine
+      module DeletePipeline
+        module AppendAudit
+          def self.call(ctx, deps)
+            deps.audit_log.append(
+              role: deps.call.role, verb: "key_delete", key: ctx.key,
+              etag_before: ctx.etag_before, etag_after: nil,
+              correlation_id: deps.call.correlation_id
+            )
+            ctx
+          end
+        end
+      end
+    end
+  end
+end
diff --git a/lib/textus/protocol/store_engine/delete_pipeline/assert_exists.rb b/lib/textus/protocol/store_engine/delete_pipeline/assert_exists.rb
new file mode 100644
index 000000000..eeca55606
--- /dev/null
+++ b/lib/textus/protocol/store_engine/delete_pipeline/assert_exists.rb
@@ -0,0 +1,15 @@
+module Textus
+  module Protocol
+    class StoreEngine
+      module DeletePipeline
+        module AssertExists
+          def self.call(ctx, deps)
+            return ctx if deps.file_system.exists?(ctx.path)
+
+            raise Textus::UnknownKey.new(ctx.key, suggestions: deps.manifest.resolver.suggestions_for(ctx.key))
+          end
+        end
+      end
+    end
+  end
+end
diff --git a/lib/textus/protocol/store_engine/delete_pipeline/check_etag.rb b/lib/textus/protocol/store_engine/delete_pipeline/check_etag.rb
new file mode 100644
index 000000000..f3bac93c9
--- /dev/null
+++ b/lib/textus/protocol/store_engine/delete_pipeline/check_etag.rb
@@ -0,0 +1,13 @@
+module Textus
+  module Protocol
+    class StoreEngine
+      module DeletePipeline
+        module CheckEtag
+          def self.call(ctx, deps)
+            Pipeline.check_etag(ctx, deps)
+          end
+        end
+      end
+    end
+  end
+end
diff --git a/lib/textus/protocol/store_engine/delete_pipeline/deindex_entry.rb b/lib/textus/protocol/store_engine/delete_pipeline/deindex_entry.rb
new file mode 100644
index 000000000..f7f732afd
--- /dev/null
+++ b/lib/textus/protocol/store_engine/delete_pipeline/deindex_entry.rb
@@ -0,0 +1,14 @@
+module Textus
+  module Protocol
+    class StoreEngine
+      module DeletePipeline
+        module DeindexEntry
+          def self.call(ctx, deps)
+            deps.entry_index.remove(key: ctx.key)
+            ctx
+          end
+        end
+      end
+    end
+  end
+end
diff --git a/lib/textus/protocol/store_engine/delete_pipeline/delete_file.rb b/lib/textus/protocol/store_engine/delete_pipeline/delete_file.rb
new file mode 100644
index 000000000..81a6a7d3f
--- /dev/null
+++ b/lib/textus/protocol/store_engine/delete_pipeline/delete_file.rb
@@ -0,0 +1,14 @@
+module Textus
+  module Protocol
+    class StoreEngine
+      module DeletePipeline
+        module DeleteFile
+          def self.call(ctx, deps)
+            deps.file_system.delete(ctx.path)
+            ctx
+          end
+        end
+      end
+    end
+  end
+end
diff --git a/lib/textus/protocol/store_engine/delete_pipeline/emit_workflow_event.rb b/lib/textus/protocol/store_engine/delete_pipeline/emit_workflow_event.rb
new file mode 100644
index 000000000..d64216068
--- /dev/null
+++ b/lib/textus/protocol/store_engine/delete_pipeline/emit_workflow_event.rb
@@ -0,0 +1,15 @@
+module Textus
+  module Protocol
+    class StoreEngine
+      module DeletePipeline
+        module EmitWorkflowEvent
+          def self.call(ctx, deps)
+            Pipeline.emit_event(ctx, deps,
+                                event_type: "entry.deleted", pending_key: ctx.key,
+                                emit_key: ctx.key)
+          end
+        end
+      end
+    end
+  end
+end
diff --git a/lib/textus/protocol/store_engine/delete_pipeline/prune_parents.rb b/lib/textus/protocol/store_engine/delete_pipeline/prune_parents.rb
new file mode 100644
index 000000000..c3a387d53
--- /dev/null
+++ b/lib/textus/protocol/store_engine/delete_pipeline/prune_parents.rb
@@ -0,0 +1,14 @@
+module Textus
+  module Protocol
+    class StoreEngine
+      module DeletePipeline
+        module PruneParents
+          def self.call(ctx, deps)
+            Pipeline.prune_parents(ctx.path, deps)
+            ctx
+          end
+        end
+      end
+    end
+  end
+end
diff --git a/lib/textus/protocol/store_engine/delete_pipeline/resolve_path.rb b/lib/textus/protocol/store_engine/delete_pipeline/resolve_path.rb
new file mode 100644
index 000000000..80a6f9845
--- /dev/null
+++ b/lib/textus/protocol/store_engine/delete_pipeline/resolve_path.rb
@@ -0,0 +1,13 @@
+module Textus
+  module Protocol
+    class StoreEngine
+      module DeletePipeline
+        module ResolvePath
+          def self.call(ctx, deps)
+            ctx.with(path: Pipeline.resolve_path(ctx.key, deps))
+          end
+        end
+      end
+    end
+  end
+end
diff --git a/lib/textus/protocol/store_engine/move_pipeline.rb b/lib/textus/protocol/store_engine/move_pipeline.rb
index 406921c61..a5d50abc0 100644
--- a/lib/textus/protocol/store_engine/move_pipeline.rb
+++ b/lib/textus/protocol/store_engine/move_pipeline.rb
@@ -2,163 +2,22 @@ module Textus
   module Protocol
     class StoreEngine
       module MovePipeline
-        module ValidateKeys
-          def self.call(ctx, _deps)
-            Textus::Protocol::Manifest::Data.validate_key!(ctx.from_key)
-            Textus::Protocol::Manifest::Data.validate_key!(ctx.to_key)
-            raise Textus::UsageError.new("old and new keys are identical") if ctx.from_key == ctx.to_key
-
-            ctx
-          end
-        end
-
-        module ResolvePaths
-          def self.call(ctx, deps)
-            from_result = deps.manifest.resolver.resolve(ctx.from_key)
-            to_result   = deps.manifest.resolver.resolve(ctx.to_key)
-            ctx.with(from_path: from_result.path, to_path: to_result.path,
-                     from_entry: from_result.entry, to_entry: to_result.entry)
-          end
-        end
-
-        module AssertSourceExists
-          def self.call(ctx, deps)
-            return ctx if deps.file_system.exists?(ctx.from_path)
-
-            raise Textus::UnknownKey.new(
-              ctx.from_key,
-              suggestions: deps.manifest.resolver.suggestions_for(ctx.from_key),
-            )
-          end
-        end
-
-        module AssertTargetNotExists
-          def self.call(ctx, deps)
-            return ctx unless ctx.to_path && deps.file_system.exists?(ctx.to_path)
-
-            raise Textus::UsageError.new("target '#{ctx.to_key}' already exists")
-          end
-        end
-
-        module CheckCrossZone
-          def self.call(ctx, _deps)
-            return ctx if ctx.from_entry.lane == ctx.to_entry.lane
-
-            raise Textus::UsageError.new(
-              "cross-zone moves forbidden (#{ctx.from_entry.lane} \u2192 #{ctx.to_entry.lane})",
-            )
-          end
-        end
-
-        module EnsureUid
-          def self.call(ctx, deps)
-            return ctx if Textus::Infra::Store::Envelope::Meta::NO_META_FORMATS.include?(ctx.from_entry.format)
-            return ctx unless ctx.from_path && deps.file_system.exists?(ctx.from_path)
-
-            raw = deps.file_system.read(ctx.from_path)
-            parsed = Textus::Protocol::Format.for(ctx.from_entry.format).parse(raw, path: ctx.from_path)
-            meta = parsed["_meta"] || {}
-            return ctx if meta["uid"].is_a?(String) && !meta["uid"].empty?
-
-            new_meta = Textus::Infra::Store::Envelope::Meta.inject_all(
-              meta, parsed["content"], {},
-              format: ctx.from_entry.format
-            ).first
-            bytes, = Textus::Protocol::Format.for(ctx.from_entry.format).serialize_for_put(
-              meta: new_meta, body: parsed["body"] || "", content: parsed["content"], path: ctx.from_path,
-            )
-            deps.file_system.write(ctx.from_path, bytes)
-            ctx
-          end
-        end
-
-        module ReadMoveEtagBefore
-          def self.call(ctx, deps)
-            etag_before = deps.file_system.etag(ctx.from_path)
-            ctx.with(etag_before:)
-          end
-        end
-
-        module CheckMoveEtag
-          def self.call(ctx, _deps)
-            return ctx unless ctx.if_etag
-
-            raise Textus::EtagMismatch.new(ctx.from_key, ctx.if_etag, ctx.etag_before) if ctx.etag_before != ctx.if_etag
-
-            ctx
-          end
-        end
-
-        module MoveFile
-          def self.call(ctx, deps)
-            deps.file_system.mv(ctx.from_path, ctx.to_path)
-            ctx
-          end
-        end
-
-        module PruneSourceParents
-          def self.call(ctx, deps)
-            Pipeline.prune_parents(ctx.from_path, deps)
-            ctx
-          end
-        end
-
-        module RewriteBasename
-          def self.call(ctx, _deps)
-            basename = ctx.to_key.split(".").last
-            Textus::Protocol::Format.for(ctx.to_entry.format).rewrite_name(ctx.to_path, basename)
-            ctx
-          end
-        end
-
-        module ReadEtagAfter
-          def self.call(ctx, _deps)
-            etag_after = Textus::Value::Etag.for_file(ctx.to_path)
-            ctx.with(etag_after:)
-          end
-        end
-
-        module ReadEnvelope
-          def self.call(ctx, deps)
-            envelope = deps.reader.read(key: ctx.to_key)
-            ctx.with(envelope:)
-          end
-        end
-
-        module AppendMoveAudit
-          def self.call(ctx, deps)
-            deps.audit_log.append(
-              role: deps.call.role, verb: "key_mv", key: ctx.to_key,
-              etag_before: ctx.etag_before, etag_after: ctx.etag_after,
-              correlation_id: deps.call.correlation_id
-            )
-            ctx
-          end
-        end
-
-        module ReindexEntry
-          def self.call(ctx, deps)
-            deps.entry_index.remove(key: ctx.from_key)
-            content = ctx.envelope.content ? ctx.envelope.content.to_json : ctx.envelope.body
-            deps.entry_index.record(
-              key: ctx.to_key, lane: ctx.to_entry.lane, format: ctx.to_entry.format,
-              schema: ctx.to_entry.schema, content: content
-            )
-            ctx
-          end
-        end
-
-        module EmitWorkflowEvent
-          def self.call(ctx, deps)
-            return ctx unless deps.workflow_registry
-            return ctx if deps.store.workflow_queue.pending?(event_type: "entry.moved", key: ctx.from_key)
-            return ctx if deps.store.workflow_queue.pending?(event_type: "entry.moved", key: ctx.to_key)
-
-            Pipeline.emit_event(ctx, deps,
-                                event_type: "entry.moved", pending_key: ctx.from_key,
-                                emit_key: ctx.to_key, emit_lane: ctx.to_entry.lane)
-          end
-        end
+        require_relative "move_pipeline/validate_keys"
+        require_relative "move_pipeline/resolve_paths"
+        require_relative "move_pipeline/assert_source_exists"
+        require_relative "move_pipeline/assert_target_not_exists"
+        require_relative "move_pipeline/check_cross_zone"
+        require_relative "move_pipeline/ensure_uid"
+        require_relative "move_pipeline/read_etag_before"
+        require_relative "move_pipeline/check_etag"
+        require_relative "move_pipeline/move_file"
+        require_relative "move_pipeline/prune_parents"
+        require_relative "move_pipeline/rewrite_basename"
+        require_relative "move_pipeline/read_etag_after"
+        require_relative "move_pipeline/read_envelope"
+        require_relative "move_pipeline/append_audit"
+        require_relative "move_pipeline/reindex_entry"
+        require_relative "move_pipeline/emit_workflow_event"
 
         VALIDATION_STEPS = [
           ValidateKeys,
@@ -167,17 +26,17 @@ def self.call(ctx, deps)
           AssertTargetNotExists,
           CheckCrossZone,
           EnsureUid,
-          ReadMoveEtagBefore,
-          CheckMoveEtag,
+          ReadEtagBefore,
+          CheckEtag,
         ].freeze
 
         MUTATE_STEPS = [
           MoveFile,
-          PruneSourceParents,
+          PruneParents,
           RewriteBasename,
           ReadEtagAfter,
           ReadEnvelope,
-          AppendMoveAudit,
+          AppendAudit,
           EmitWorkflowEvent,
           ReindexEntry,
         ].freeze
diff --git a/lib/textus/protocol/store_engine/move_pipeline/append_audit.rb b/lib/textus/protocol/store_engine/move_pipeline/append_audit.rb
new file mode 100644
index 000000000..935c75a06
--- /dev/null
+++ b/lib/textus/protocol/store_engine/move_pipeline/append_audit.rb
@@ -0,0 +1,18 @@
+module Textus
+  module Protocol
+    class StoreEngine
+      module MovePipeline
+        module AppendAudit
+          def self.call(ctx, deps)
+            deps.audit_log.append(
+              role: deps.call.role, verb: "key_mv", key: ctx.to_key,
+              etag_before: ctx.etag_before, etag_after: ctx.etag_after,
+              correlation_id: deps.call.correlation_id
+            )
+            ctx
+          end
+        end
+      end
+    end
+  end
+end
diff --git a/lib/textus/protocol/store_engine/move_pipeline/assert_source_exists.rb b/lib/textus/protocol/store_engine/move_pipeline/assert_source_exists.rb
new file mode 100644
index 000000000..a7ef82275
--- /dev/null
+++ b/lib/textus/protocol/store_engine/move_pipeline/assert_source_exists.rb
@@ -0,0 +1,15 @@
+module Textus
+  module Protocol
+    class StoreEngine
+      module MovePipeline
+        module AssertSourceExists
+          def self.call(ctx, deps)
+            return ctx if deps.file_system.exists?(ctx.from_path)
+
+            raise UnknownKey.new(ctx.from_key, suggestions: deps.manifest.resolver.suggestions_for(ctx.from_key))
+          end
+        end
+      end
+    end
+  end
+end
diff --git a/lib/textus/protocol/store_engine/move_pipeline/assert_target_not_exists.rb b/lib/textus/protocol/store_engine/move_pipeline/assert_target_not_exists.rb
new file mode 100644
index 000000000..9faf4de6a
--- /dev/null
+++ b/lib/textus/protocol/store_engine/move_pipeline/assert_target_not_exists.rb
@@ -0,0 +1,15 @@
+module Textus
+  module Protocol
+    class StoreEngine
+      module MovePipeline
+        module AssertTargetNotExists
+          def self.call(ctx, deps)
+            return ctx unless ctx.to_path && deps.file_system.exists?(ctx.to_path)
+
+            raise UsageError.new("target '#{ctx.to_key}' already exists")
+          end
+        end
+      end
+    end
+  end
+end
diff --git a/lib/textus/protocol/store_engine/move_pipeline/check_cross_zone.rb b/lib/textus/protocol/store_engine/move_pipeline/check_cross_zone.rb
new file mode 100644
index 000000000..d85325e3d
--- /dev/null
+++ b/lib/textus/protocol/store_engine/move_pipeline/check_cross_zone.rb
@@ -0,0 +1,15 @@
+module Textus
+  module Protocol
+    class StoreEngine
+      module MovePipeline
+        module CheckCrossZone
+          def self.call(ctx, _deps)
+            return ctx if ctx.from_entry.lane == ctx.to_entry.lane
+
+            raise UsageError.new("cross-zone moves forbidden (#{ctx.from_entry.lane} → #{ctx.to_entry.lane})")
+          end
+        end
+      end
+    end
+  end
+end
diff --git a/lib/textus/protocol/store_engine/move_pipeline/check_etag.rb b/lib/textus/protocol/store_engine/move_pipeline/check_etag.rb
new file mode 100644
index 000000000..cbeff0cc2
--- /dev/null
+++ b/lib/textus/protocol/store_engine/move_pipeline/check_etag.rb
@@ -0,0 +1,16 @@
+module Textus
+  module Protocol
+    class StoreEngine
+      module MovePipeline
+        module CheckEtag
+          def self.call(ctx, _deps)
+            return ctx unless ctx.if_etag
+            raise EtagMismatch.new(ctx.from_key, ctx.if_etag, ctx.etag_before) if ctx.etag_before != ctx.if_etag
+
+            ctx
+          end
+        end
+      end
+    end
+  end
+end
diff --git a/lib/textus/protocol/store_engine/move_pipeline/emit_workflow_event.rb b/lib/textus/protocol/store_engine/move_pipeline/emit_workflow_event.rb
new file mode 100644
index 000000000..92f2569f8
--- /dev/null
+++ b/lib/textus/protocol/store_engine/move_pipeline/emit_workflow_event.rb
@@ -0,0 +1,16 @@
+module Textus
+  module Protocol
+    class StoreEngine
+      module MovePipeline
+        module EmitWorkflowEvent
+          def self.call(ctx, deps)
+            Pipeline.emit_event(ctx, deps,
+                                event_type: "entry.moved", pending_key: ctx.from_key,
+                                emit_key: ctx.to_key, emit_lane: ctx.to_entry.lane,
+                                pending_keys: [ctx.from_key, ctx.to_key])
+          end
+        end
+      end
+    end
+  end
+end
diff --git a/lib/textus/protocol/store_engine/move_pipeline/ensure_uid.rb b/lib/textus/protocol/store_engine/move_pipeline/ensure_uid.rb
new file mode 100644
index 000000000..8a2a0410a
--- /dev/null
+++ b/lib/textus/protocol/store_engine/move_pipeline/ensure_uid.rb
@@ -0,0 +1,27 @@
+module Textus
+  module Protocol
+    class StoreEngine
+      module MovePipeline
+        module EnsureUid
+          def self.call(ctx, deps)
+            return ctx if Infra::Store::Envelope::Meta::NO_META_FORMATS.include?(ctx.from_entry.format)
+            return ctx unless ctx.from_path && deps.file_system.exists?(ctx.from_path)
+
+            raw = deps.file_system.read(ctx.from_path)
+            parsed = Format.for(ctx.from_entry.format).parse(raw, path: ctx.from_path)
+            meta = parsed["_meta"] || {}
+            return ctx if meta["uid"].is_a?(String) && !meta["uid"].empty?
+
+            new_meta = Infra::Store::Envelope::Meta.inject_all(meta, parsed["content"], {},
+                                                               format: ctx.from_entry.format).first
+            bytes, = Format.for(ctx.from_entry.format).serialize_for_put(
+              meta: new_meta, body: parsed["body"] || "", content: parsed["content"], path: ctx.from_path,
+            )
+            deps.file_system.write(ctx.from_path, bytes)
+            ctx
+          end
+        end
+      end
+    end
+  end
+end
diff --git a/lib/textus/protocol/store_engine/move_pipeline/move_file.rb b/lib/textus/protocol/store_engine/move_pipeline/move_file.rb
new file mode 100644
index 000000000..694428a70
--- /dev/null
+++ b/lib/textus/protocol/store_engine/move_pipeline/move_file.rb
@@ -0,0 +1,14 @@
+module Textus
+  module Protocol
+    class StoreEngine
+      module MovePipeline
+        module MoveFile
+          def self.call(ctx, deps)
+            deps.file_system.mv(ctx.from_path, ctx.to_path)
+            ctx
+          end
+        end
+      end
+    end
+  end
+end
diff --git a/lib/textus/protocol/store_engine/move_pipeline/prune_parents.rb b/lib/textus/protocol/store_engine/move_pipeline/prune_parents.rb
new file mode 100644
index 000000000..0e288b1f1
--- /dev/null
+++ b/lib/textus/protocol/store_engine/move_pipeline/prune_parents.rb
@@ -0,0 +1,14 @@
+module Textus
+  module Protocol
+    class StoreEngine
+      module MovePipeline
+        module PruneParents
+          def self.call(ctx, deps)
+            Pipeline.prune_parents(ctx.from_path, deps)
+            ctx
+          end
+        end
+      end
+    end
+  end
+end
diff --git a/lib/textus/protocol/store_engine/move_pipeline/read_envelope.rb b/lib/textus/protocol/store_engine/move_pipeline/read_envelope.rb
new file mode 100644
index 000000000..9a358cc78
--- /dev/null
+++ b/lib/textus/protocol/store_engine/move_pipeline/read_envelope.rb
@@ -0,0 +1,14 @@
+module Textus
+  module Protocol
+    class StoreEngine
+      module MovePipeline
+        module ReadEnvelope
+          def self.call(ctx, deps)
+            envelope = deps.reader.read(key: ctx.to_key)
+            ctx.with(envelope:)
+          end
+        end
+      end
+    end
+  end
+end
diff --git a/lib/textus/protocol/store_engine/move_pipeline/read_etag_after.rb b/lib/textus/protocol/store_engine/move_pipeline/read_etag_after.rb
new file mode 100644
index 000000000..0875c4b58
--- /dev/null
+++ b/lib/textus/protocol/store_engine/move_pipeline/read_etag_after.rb
@@ -0,0 +1,13 @@
+module Textus
+  module Protocol
+    class StoreEngine
+      module MovePipeline
+        module ReadEtagAfter
+          def self.call(ctx, _deps)
+            ctx.with(etag_after: Value::Etag.for_file(ctx.to_path))
+          end
+        end
+      end
+    end
+  end
+end
diff --git a/lib/textus/protocol/store_engine/move_pipeline/read_etag_before.rb b/lib/textus/protocol/store_engine/move_pipeline/read_etag_before.rb
new file mode 100644
index 000000000..b36f07e5a
--- /dev/null
+++ b/lib/textus/protocol/store_engine/move_pipeline/read_etag_before.rb
@@ -0,0 +1,13 @@
+module Textus
+  module Protocol
+    class StoreEngine
+      module MovePipeline
+        module ReadEtagBefore
+          def self.call(ctx, deps)
+            ctx.with(etag_before: deps.file_system.etag(ctx.from_path))
+          end
+        end
+      end
+    end
+  end
+end
diff --git a/lib/textus/protocol/store_engine/move_pipeline/reindex_entry.rb b/lib/textus/protocol/store_engine/move_pipeline/reindex_entry.rb
new file mode 100644
index 000000000..d46f33b84
--- /dev/null
+++ b/lib/textus/protocol/store_engine/move_pipeline/reindex_entry.rb
@@ -0,0 +1,19 @@
+module Textus
+  module Protocol
+    class StoreEngine
+      module MovePipeline
+        module ReindexEntry
+          def self.call(ctx, deps)
+            deps.entry_index.remove(key: ctx.from_key)
+            content = ctx.envelope.content ? ctx.envelope.content.to_json : ctx.envelope.body
+            deps.entry_index.record(
+              key: ctx.to_key, lane: ctx.to_entry.lane, format: ctx.to_entry.format,
+              schema: ctx.to_entry.schema, content: content
+            )
+            ctx
+          end
+        end
+      end
+    end
+  end
+end
diff --git a/lib/textus/protocol/store_engine/move_pipeline/resolve_paths.rb b/lib/textus/protocol/store_engine/move_pipeline/resolve_paths.rb
new file mode 100644
index 000000000..35fef0c09
--- /dev/null
+++ b/lib/textus/protocol/store_engine/move_pipeline/resolve_paths.rb
@@ -0,0 +1,16 @@
+module Textus
+  module Protocol
+    class StoreEngine
+      module MovePipeline
+        module ResolvePaths
+          def self.call(ctx, deps)
+            from_result = deps.manifest.resolver.resolve(ctx.from_key)
+            to_result   = deps.manifest.resolver.resolve(ctx.to_key)
+            ctx.with(from_path: from_result.path, to_path: to_result.path,
+                     from_entry: from_result.entry, to_entry: to_result.entry)
+          end
+        end
+      end
+    end
+  end
+end
diff --git a/lib/textus/protocol/store_engine/move_pipeline/rewrite_basename.rb b/lib/textus/protocol/store_engine/move_pipeline/rewrite_basename.rb
new file mode 100644
index 000000000..946a922c1
--- /dev/null
+++ b/lib/textus/protocol/store_engine/move_pipeline/rewrite_basename.rb
@@ -0,0 +1,15 @@
+module Textus
+  module Protocol
+    class StoreEngine
+      module MovePipeline
+        module RewriteBasename
+          def self.call(ctx, _deps)
+            basename = ctx.to_key.split(".").last
+            Format.for(ctx.to_entry.format).rewrite_name(ctx.to_path, basename)
+            ctx
+          end
+        end
+      end
+    end
+  end
+end
diff --git a/lib/textus/protocol/store_engine/move_pipeline/validate_keys.rb b/lib/textus/protocol/store_engine/move_pipeline/validate_keys.rb
new file mode 100644
index 000000000..322208525
--- /dev/null
+++ b/lib/textus/protocol/store_engine/move_pipeline/validate_keys.rb
@@ -0,0 +1,17 @@
+module Textus
+  module Protocol
+    class StoreEngine
+      module MovePipeline
+        module ValidateKeys
+          def self.call(ctx, _deps)
+            Manifest::Data.validate_key!(ctx.from_key)
+            Manifest::Data.validate_key!(ctx.to_key)
+            raise UsageError.new("old and new keys are identical") if ctx.from_key == ctx.to_key
+
+            ctx
+          end
+        end
+      end
+    end
+  end
+end
diff --git a/lib/textus/protocol/store_engine/pipeline.rb b/lib/textus/protocol/store_engine/pipeline.rb
index b2f3db099..4e6de0572 100644
--- a/lib/textus/protocol/store_engine/pipeline.rb
+++ b/lib/textus/protocol/store_engine/pipeline.rb
@@ -10,21 +10,35 @@ def with(**attrs) = self.class.new(**to_h, **attrs)
           :key, :mentry, :payload, :if_etag,
           :path, :existing_env, :meta, :content,
           :bytes, :eff_meta, :eff_body, :eff_content,
-          :etag_before, :envelope
+          :etag_before, :envelope, :fmt
         ) do
           include ContextWith
+
+          def format = fmt || mentry.format
         end
 
-        WriteDeps = Data.define(:file_system, :manifest, :store, :call, :reader, :layout, :workflow_registry) do
+        WriteDeps = Data.define(:file_system, :manifest, :store, :call, :reader, :layout, :event_emitter, :schemas) do
           def audit_log    = store.audit_log
           def entry_index  = store.entry_index
           def file_store   = store.file_store
         end
 
+        DeleteDeps = Data.define(:file_system, :manifest, :store, :call, :layout, :event_emitter) do
+          def audit_log    = store.audit_log
+          def entry_index  = store.entry_index
+          def workflow_queue = store.workflow_queue
+        end
+
         DeleteContext = Data.define(:key, :if_etag, :path, :etag_before) do
           include ContextWith
         end
 
+        MoveDeps = Data.define(:file_system, :manifest, :store, :call, :reader, :layout, :event_emitter) do
+          def audit_log    = store.audit_log
+          def entry_index  = store.entry_index
+          def workflow_queue = store.workflow_queue
+        end
+
         MoveContext = Data.define(:from_key, :to_key, :if_etag,
                                   :from_path, :to_path, :from_entry, :to_entry,
                                   :etag_before, :etag_after, :envelope, :dry_run) do
@@ -33,6 +47,17 @@ def file_store   = store.file_store
 
         module_function
 
+        def resolve_path(key, deps)
+          deps.manifest.resolver.resolve(key).path
+        end
+
+        def check_etag(ctx, deps)
+          etag_before = deps.file_system.exists?(ctx.path) ? deps.file_system.etag(ctx.path) : nil
+          raise Textus::EtagMismatch.new(ctx.key, ctx.if_etag, etag_before) if ctx.if_etag && (etag_before != ctx.if_etag)
+
+          ctx.with(etag_before:)
+        end
+
         def prune_parents(path, deps)
           floor = deps.layout.lane_floor(path)
           return unless floor
@@ -46,16 +71,12 @@ def prune_parents(path, deps)
           # race: dir may have been emptied by another writer
         end
 
-        def emit_event(ctx, deps, event_type:, pending_key:, emit_key:, emit_lane: nil)
-          return ctx unless deps.workflow_registry
+        def emit_event(ctx, deps, event_type:, pending_key:, emit_key:, emit_lane: nil, pending_keys: [])
+          return ctx unless deps.event_emitter
           return ctx if deps.store.workflow_queue.pending?(event_type:, key: pending_key)
+          return ctx if pending_keys.any? { |k| deps.store.workflow_queue.pending?(event_type:, key: k) }
 
-          Textus::Workflow::Queue.new(
-            deps.store.workflow_queue,
-            registry: deps.workflow_registry,
-            container: deps,
-            call: deps.call,
-          ).enqueue(event_type:, key: emit_key, lane: emit_lane || "artifacts")
+          deps.event_emitter.emit(event_type:, key: emit_key, lane: emit_lane || "artifacts")
           ctx
         rescue StandardError => e
           warn "textus: emit_workflow_event(#{event_type}, #{emit_key}) failed: #{e.message}"
diff --git a/lib/textus/protocol/store_engine/put_pipeline.rb b/lib/textus/protocol/store_engine/put_pipeline.rb
index eede6a6c2..7dc9b061d 100644
--- a/lib/textus/protocol/store_engine/put_pipeline.rb
+++ b/lib/textus/protocol/store_engine/put_pipeline.rb
@@ -2,138 +2,14 @@ module Textus
   module Protocol
     class StoreEngine
       module PutPipeline
-        module ReadExisting
-          def self.call(ctx, deps)
-            return ctx.with(existing_env: nil) unless ctx.path && deps.file_system.exists?(ctx.path)
+        STEPS = [Validate, Prepare, Write, Emit].freeze
 
-            raw = deps.file_system.read(ctx.path)
-            parsed = Textus::Protocol::Format.for(ctx.mentry.format).parse(raw, path: ctx.path)
-            envelope = Textus::Protocol::Envelope.build(
-              key: ctx.key, mentry: ctx.mentry, path: ctx.path,
-              meta: parsed["_meta"] || {},
-              body: parsed["body"] || "",
-              content: parsed["content"],
-              etag: Textus::Value::Etag.for_file(ctx.path)
-            )
-            ctx.with(existing_env: envelope)
-          end
-        end
-
-        module InjectMeta
-          def self.call(ctx, deps)
-            existing_meta = ctx.existing_env ? ctx.existing_env.meta : {}
-            raw_meta = ctx.payload.meta || {}
-            meta, content = Textus::Infra::Store::Envelope::Meta.inject_all(
-              raw_meta, ctx.payload.content, existing_meta,
-              format: ctx.mentry.format,
-              etag_for: method(:resolve_source_etag).curry.call(deps)
-            )
-            ctx.with(meta:, content:)
-          end
-
-          def self.resolve_source_etag(deps, key)
-            path = deps.manifest.resolver.resolve(key).path
-            return nil unless deps.file_system.exists?(path)
-
-            Textus::Value::Etag.for_file(path)
-          rescue Textus::Error
-            nil
-          end
-        end
-
-        module Serialize
-          def self.call(ctx, _deps)
-            bytes, eff_meta, eff_body, eff_content =
-              Textus::Protocol::Format.for(ctx.mentry.format).serialize_for_put(
-                meta: ctx.meta, body: ctx.payload.body,
-                content: ctx.content, path: ctx.path
-              )
-            ctx.with(bytes:, eff_meta:, eff_body:, eff_content:)
-          end
-        end
-
-        module ValidateInput
-          def self.call(ctx, _deps)
-            fmt = Textus::Protocol::Format.for(ctx.mentry.format)
-            fmt.enforce_name_match!(ctx.path, ctx.payload.meta)
-            fmt.validate_raw_entry!(
-              { "_meta" => ctx.payload.meta, "content" => ctx.payload.content },
-              ctx.mentry.lane,
-            )
-            ctx
-          end
-        end
-
-        module CheckEtag
-          def self.call(ctx, deps)
-            etag_before = deps.file_system.exists?(ctx.path) ? deps.file_system.etag(ctx.path) : nil
-            raise Textus::EtagMismatch.new(ctx.key, ctx.if_etag, etag_before) if ctx.if_etag && (etag_before != ctx.if_etag)
-
-            ctx.with(etag_before:)
-          end
-        end
-
-        module WriteBytes
-          def self.call(ctx, deps)
-            deps.file_system.write(ctx.path, ctx.bytes)
-            ctx
-          end
-        end
-
-        module BuildEnvelope
-          def self.call(ctx, _deps)
-            envelope = Textus::Protocol::Envelope.build(
-              key: ctx.key, mentry: ctx.mentry, path: ctx.path,
-              meta: ctx.eff_meta, body: ctx.eff_body,
-              etag: Textus::Value::Etag.for_bytes(ctx.bytes),
-              content: ctx.eff_content
-            )
-            ctx.with(envelope:)
-          end
-        end
-
-        module AppendAudit
-          def self.call(ctx, deps)
-            deps.audit_log.append(
-              role: deps.call.role, verb: "put", key: ctx.key,
-              etag_before: ctx.etag_before, etag_after: ctx.envelope.etag,
-              correlation_id: deps.call.correlation_id
-            )
-            ctx
-          end
-        end
-
-        module IndexEntry
-          def self.call(ctx, deps)
-            content = ctx.eff_content ? ctx.eff_content.to_json : ctx.eff_body
-            deps.entry_index.record(
-              key: ctx.key, lane: ctx.mentry.lane, format: ctx.mentry.format,
-              schema: ctx.mentry.schema, content: content
-            )
-            ctx
-          end
-        end
-
-        module EmitWorkflowEvent
-          def self.call(ctx, deps)
-            Pipeline.emit_event(ctx, deps,
-                                event_type: "entry.written", pending_key: ctx.key,
-                                emit_key: ctx.key, emit_lane: ctx.mentry.lane)
-          end
-        end
-
-        STEPS = [
-          ValidateInput,
-          ReadExisting, InjectMeta, Serialize,
-          CheckEtag, WriteBytes, BuildEnvelope, AppendAudit, EmitWorkflowEvent, IndexEntry
-        ].freeze
-
-        def self.call(key, mentry:, path:, payload:, deps:, if_etag: nil)
+        def self.call(key, mentry:, path:, payload:, deps:, if_etag: nil, fmt: nil)
           ctx = Pipeline::WriteContext.new(
             key:, mentry:, payload:, if_etag:,
             path:, existing_env: nil, meta: nil, content: nil,
             bytes: nil, eff_meta: nil, eff_body: nil, eff_content: nil,
-            etag_before: nil, envelope: nil
+            etag_before: nil, envelope: nil, fmt:
           )
           STEPS.reduce(ctx) { |c, step| step.call(c, deps) }.envelope
         end
diff --git a/lib/textus/protocol/store_engine/put_pipeline/emit.rb b/lib/textus/protocol/store_engine/put_pipeline/emit.rb
new file mode 100644
index 000000000..838c9c8dd
--- /dev/null
+++ b/lib/textus/protocol/store_engine/put_pipeline/emit.rb
@@ -0,0 +1,39 @@
+module Textus
+  module Protocol
+    class StoreEngine
+      module PutPipeline
+        module Emit
+          def self.call(ctx, deps)
+            ctx = append_audit(ctx, deps)
+            ctx = index_entry(ctx, deps)
+            emit_workflow_event(ctx, deps)
+          end
+
+          def self.append_audit(ctx, deps)
+            deps.audit_log.append(
+              role: deps.call.role, verb: "put", key: ctx.key,
+              etag_before: ctx.etag_before, etag_after: ctx.envelope.etag,
+              correlation_id: deps.call.correlation_id
+            )
+            ctx
+          end
+
+          def self.index_entry(ctx, deps)
+            content = ctx.eff_content ? ctx.eff_content.to_json : ctx.eff_body
+            deps.entry_index.record(
+              key: ctx.key, lane: ctx.mentry.lane, format: ctx.format,
+              schema: ctx.mentry.schema, content: content
+            )
+            ctx
+          end
+
+          def self.emit_workflow_event(ctx, deps)
+            Pipeline.emit_event(ctx, deps,
+                                event_type: "entry.written", pending_key: ctx.key,
+                                emit_key: ctx.key, emit_lane: ctx.mentry.lane)
+          end
+        end
+      end
+    end
+  end
+end
diff --git a/lib/textus/protocol/store_engine/put_pipeline/prepare.rb b/lib/textus/protocol/store_engine/put_pipeline/prepare.rb
new file mode 100644
index 000000000..ec22d7667
--- /dev/null
+++ b/lib/textus/protocol/store_engine/put_pipeline/prepare.rb
@@ -0,0 +1,59 @@
+module Textus
+  module Protocol
+    class StoreEngine
+      module PutPipeline
+        module Prepare
+          def self.call(ctx, deps)
+            ctx = read_existing(ctx, deps)
+            ctx = inject_meta(ctx, deps)
+            serialize(ctx, deps)
+          end
+
+          def self.read_existing(ctx, deps)
+            return ctx.with(existing_env: nil) unless ctx.path && deps.file_system.exists?(ctx.path)
+
+            raw = deps.file_system.read(ctx.path)
+            parsed = Textus::Protocol::Format.for(ctx.format).parse(raw, path: ctx.path)
+            envelope = Textus::Protocol::Envelope.build(
+              key: ctx.key, mentry: ctx.mentry, path: ctx.path,
+              meta: parsed["_meta"] || {},
+              body: parsed["body"] || "",
+              content: parsed["content"],
+              etag: Textus::Value::Etag.for_file(ctx.path)
+            )
+            ctx.with(existing_env: envelope)
+          end
+
+          def self.inject_meta(ctx, deps)
+            existing_meta = ctx.existing_env ? ctx.existing_env.meta : {}
+            raw_meta = ctx.payload.meta || {}
+            meta, content = Textus::Infra::Store::Envelope::Meta.inject_all(
+              raw_meta, ctx.payload.content, existing_meta,
+              format: ctx.format,
+              etag_for: method(:resolve_source_etag).curry.call(deps)
+            )
+            ctx.with(meta:, content:)
+          end
+
+          def self.resolve_source_etag(deps, key)
+            path = deps.manifest.resolver.resolve(key).path
+            return nil unless deps.file_system.exists?(path)
+
+            Textus::Value::Etag.for_file(path)
+          rescue Textus::Error
+            nil
+          end
+
+          def self.serialize(ctx, _deps)
+            bytes, eff_meta, eff_body, eff_content =
+              Textus::Protocol::Format.for(ctx.format).serialize_for_put(
+                meta: ctx.meta, body: ctx.payload.body,
+                content: ctx.content, path: ctx.path
+              )
+            ctx.with(bytes:, eff_meta:, eff_body:, eff_content:)
+          end
+        end
+      end
+    end
+  end
+end
diff --git a/lib/textus/protocol/store_engine/put_pipeline/validate.rb b/lib/textus/protocol/store_engine/put_pipeline/validate.rb
new file mode 100644
index 000000000..ca3cc4bb0
--- /dev/null
+++ b/lib/textus/protocol/store_engine/put_pipeline/validate.rb
@@ -0,0 +1,43 @@
+module Textus
+  module Protocol
+    class StoreEngine
+      module PutPipeline
+        module Validate
+          def self.call(ctx, deps)
+            ctx = validate_input(ctx, deps)
+            validate_schema(ctx, deps)
+          end
+
+          def self.validate_input(ctx, _deps)
+            fmt = Textus::Protocol::Format.for(ctx.format)
+            fmt.enforce_name_match!(ctx.path, ctx.payload.meta)
+            fmt.validate_raw_entry!(
+              { "_meta" => ctx.payload.meta, "content" => ctx.payload.content },
+              ctx.mentry.lane,
+            )
+            ctx
+          end
+
+          def self.validate_schema(ctx, deps)
+            schema_name = ctx.mentry.schema
+            return ctx unless schema_name && deps.respond_to?(:schemas) && deps.schemas
+
+            schema = deps.schemas.fetch_or_nil(schema_name)
+            return ctx unless schema
+
+            case ctx.mentry.lane
+            when "scratchpad"
+              begin
+                schema.validate!(ctx.payload.meta || {})
+              rescue Textus::SchemaViolation # rubocop:disable Lint/SuppressedException
+              end
+            else
+              schema.validate!(ctx.payload.meta || {})
+            end
+            ctx
+          end
+        end
+      end
+    end
+  end
+end
diff --git a/lib/textus/protocol/store_engine/put_pipeline/write.rb b/lib/textus/protocol/store_engine/put_pipeline/write.rb
new file mode 100644
index 000000000..2a9ecbc24
--- /dev/null
+++ b/lib/textus/protocol/store_engine/put_pipeline/write.rb
@@ -0,0 +1,34 @@
+module Textus
+  module Protocol
+    class StoreEngine
+      module PutPipeline
+        module Write
+          def self.call(ctx, deps)
+            ctx = check_etag(ctx, deps)
+            ctx = write_bytes(ctx, deps)
+            build_envelope(ctx, deps)
+          end
+
+          def self.check_etag(ctx, deps)
+            Pipeline.check_etag(ctx, deps)
+          end
+
+          def self.write_bytes(ctx, deps)
+            deps.file_system.write(ctx.path, ctx.bytes)
+            ctx
+          end
+
+          def self.build_envelope(ctx, _deps)
+            envelope = Textus::Protocol::Envelope.build(
+              key: ctx.key, mentry: ctx.mentry, path: ctx.path,
+              meta: ctx.eff_meta, body: ctx.eff_body,
+              etag: Textus::Value::Etag.for_bytes(ctx.bytes),
+              content: ctx.eff_content
+            )
+            ctx.with(envelope:)
+          end
+        end
+      end
+    end
+  end
+end
diff --git a/lib/textus/protocol/verb_registry.rb b/lib/textus/protocol/verb_registry.rb
index da50b3fab..088ada172 100644
--- a/lib/textus/protocol/verb_registry.rb
+++ b/lib/textus/protocol/verb_registry.rb
@@ -16,14 +16,11 @@ def self.for(verb) = VERBS[verb]
       def self.positional_for(verb) = POSITIONAL[verb] || []
       def self.summary_for(verb) = VERBS[verb]&.summary
       def self.registered = VERBS.values
-      def self.contract_class_for(_verb) = nil
-
-      VERB_TO_CONTRACT = {}.freeze
-      CONTRACT_TO_VERB = {}.freeze
 
       ENTRY_VERBS = %i[
         get put list key_delete key_mv propose accept reject
         audit blame where uid deps rdeps graph diff ingest loop
+        session_open session_close
       ].freeze
 
       OPS_VERBS = %i[
@@ -34,211 +31,9 @@ def self.contract_class_for(_verb) = nil
       VERB_DOMAIN = ENTRY_VERBS.to_h { |v| [v, :entry] }
                                .merge(OPS_VERBS.to_h { |v| [v, :ops] }).freeze
 
-      def self.contract_to_verb(_klass) = nil
-      def self.contract_to_verb!(klass) = raise "contract lookup removed: #{klass}"
-
-      # ── get ──────────────────────────────────────────────
-      register VerbSpec.new(
-        :get, "Read one entry — on-disk read with freshness verdict.",
-        [ArgSpec.arg(name: :key, required: true, positional: true,
-                     description: "dotted entry key to read, e.g. 'knowledge.project'")],
-        %i[cli mcp], :read
-      )
-
-      # ── put ──────────────────────────────────────────────
-      register VerbSpec.new(
-        :put, "Create or update an entry. Schema-validated. Returns {uid, etag}.",
-        [ArgSpec.arg(name: :key, required: true, positional: true,
-                     description: "dotted entry key, e.g. 'knowledge.project'; must resolve to a zone the role may write"),
-         ArgSpec.arg(name: :meta, type: Hash, wire_name: :_meta,
-                     description: "frontmatter; reads back as `_meta`. Schema-validated — call `schema KEY` first"),
-         ArgSpec.arg(name: :body,
-                     description: "markdown/text payload for md entries; use `content` for json/yaml"),
-         ArgSpec.arg(name: :content, type: Hash,
-                     description: "structured payload for json/yaml-format entries; omit (use `body`) for markdown entries"),
-         ArgSpec.arg(name: :if_etag,
-                     description: "optimistic-concurrency guard; write rejected if entry changed since")],
-        %i[cli mcp], :write
-      )
-
-      # ── list ─────────────────────────────────────────────
-      register VerbSpec.new(
-        :list, "List keys filtered by lane and/or prefix.",
-        [ArgSpec.arg(name: :prefix,
-                     description: "restrict to keys starting with this dotted prefix, e.g. 'knowledge.execution'"),
-         ArgSpec.arg(name: :lane,
-                     description: "restrict to one lane by name (see `boot` lanes)"),
-         ArgSpec.arg(name: :q,
-                     description: "full-text search query over entry content (FTS5)"),
-         ArgSpec.arg(name: :schema,
-                     description: "filter to entries whose schema matches this name")],
-        %i[cli mcp], :read
-      )
-
-      # ── delete ───────────────────────────────────────────
-      register VerbSpec.new(
-        :key_delete, "Delete one entry by key. Returns {ok, key, deleted}.",
-        [ArgSpec.arg(name: :key, required: true, positional: true,
-                     description: "dotted entry key to delete"),
-         ArgSpec.arg(name: :if_etag,
-                     description: "optimistic-concurrency guard: etag you last read")],
-        %i[cli mcp], :write
-      )
-
-      # ── move ─────────────────────────────────────────────
-      register VerbSpec.new(
-        :key_mv, "Rename one entry (same zone + format). Refuses if target exists.",
-        [ArgSpec.arg(name: :old_key, required: true, positional: true, description: "current dotted key"),
-         ArgSpec.arg(name: :new_key, required: true, positional: true,
-                     description: "new dotted key (same zone and format)"),
-         ArgSpec.arg(name: :dry_run, type: :boolean,
-                     description: "when true, returns planned move without applying")],
-        %i[cli mcp], :write
-      )
-
-      # ── ingest ───────────────────────────────────────────
-      register VerbSpec.new(
-        verb: :ingest, summary: "Capture external source material into the raw lane. Write-once.",
-        args: [ArgSpec.arg(name: :kind, required: true, positional: true,
-                           description: "source kind: url | file | asset"),
-               ArgSpec.arg(name: :slug, required: true,
-                           description: "human slug for the key suffix (kebab-case)"),
-               ArgSpec.arg(name: :url, description: "remote URL (required when kind=url)"),
-               ArgSpec.arg(name: :path,
-                           description: "local file path (required when kind=file or kind=asset)"),
-               ArgSpec.arg(name: :lane,
-                           description: "asset group subdirectory (required when kind=asset)"),
-               ArgSpec.arg(name: :label, description: "human label stored in source.label")],
-        surfaces: %i[cli mcp], category: :write,
-        lane: :ingest
-      )
-
-      # ── where ────────────────────────────────────────────
-      register VerbSpec.new(
-        :where, "Resolve a key to its zone, owner, and path without reading the body.",
-        [ArgSpec.arg(name: :key, required: true, positional: true, description: "dotted key to locate")],
-        %i[cli mcp], :read
-      )
-
-      # ── uid ──────────────────────────────────────────────
-      register VerbSpec.new(
-        :uid, "Return the stable UID of an entry without reading its body.",
-        [ArgSpec.arg(name: :key, required: true, positional: true, description: "entry key")],
-        %i[cli mcp], :read
-      )
-
-      # ── blame ────────────────────────────────────────────
-      register VerbSpec.new(
-        :blame, "Annotate audit rows with the git commit that introduced each file state.",
-        [ArgSpec.arg(name: :key, required: true, positional: true, description: "entry key to blame"),
-         ArgSpec.arg(name: :limit, type: Integer,
-                     description: "maximum number of audit rows to return")],
-        %i[cli mcp], :read
-      )
-
-      # ── audit ────────────────────────────────────────────
-      register VerbSpec.new(
-        :audit, "Query the audit log with optional filters.",
-        [ArgSpec.arg(name: :key, description: "filter to rows for this key"),
-         ArgSpec.arg(name: :lane, description: "filter to keys in this lane"),
-         ArgSpec.arg(name: :role, description: "filter to rows written under this role"),
-         ArgSpec.arg(name: :verb, description: "filter to rows for this verb"),
-         ArgSpec.arg(name: :since,
-                     description: "ISO-8601 timestamp or relative offset (e.g. 1h, 30m)"),
-         ArgSpec.arg(name: :seq_since, type: Integer,
-                     description: "return rows with seq > this cursor value"),
-         ArgSpec.arg(name: :correlation_id,
-                     description: "filter to rows with this correlation_id"),
-         ArgSpec.arg(name: :limit, type: Integer,
-                     description: "maximum number of rows to return")],
-        %i[cli mcp], :read
-      )
-
-      # ── deps ─────────────────────────────────────────────
-      register VerbSpec.new(
-        :deps, "List the keys a derived entry depends on.",
-        [ArgSpec.arg(name: :key, required: true, positional: true,
-                     description: "dotted key of the derived entry whose source keys you want")],
-        %i[cli mcp], :read
-      )
-
-      # ── rdeps ────────────────────────────────────────────
-      register VerbSpec.new(
-        :rdeps, "List the derived entries that depend on a key (reverse deps).",
-        [ArgSpec.arg(name: :key, required: true, positional: true,
-                     description: "dotted key whose dependents you want")],
-        %i[cli mcp], :read
-      )
-
-      # ── graph ────────────────────────────────────────────
-      register VerbSpec.new(
-        :graph, "Query the link graph — neighbors (direct links) or reachable (transitive, with optional depth limit).",
-        [ArgSpec.arg(name: :key, required: true, positional: true,
-                     description: "entry key to query"),
-         ArgSpec.arg(name: :depth, type: Integer,
-                     description: "max traversal depth for reachable query (unlimited when omitted)")],
-        %i[cli mcp], :read
-      )
-
-      # ── pulse ────────────────────────────────────────────
-      register VerbSpec.new(
-        :pulse, "Delta since cursor — changed entries, pending proposals, index freshness.",
-        [ArgSpec.arg(name: :since, type: Integer,
-                     description: "audit seq to diff from; defaults to the session cursor")],
-        %i[cli mcp], :read
-      )
-
-      # ── schema_show ──────────────────────────────────────
-      register VerbSpec.new(
-        :schema_show, "Return the schema (field shape) for an entry's family.",
-        [ArgSpec.arg(name: :key, required: true, positional: true,
-                     description: "any key in the family whose schema you want")],
-        %i[cli mcp], :read
-      )
-
-      # ── boot ─────────────────────────────────────────────
-      register VerbSpec.new(
-        :boot, "Return the orientation contract: lanes, agent_quickstart, agent_protocol.",
-        [], %i[cli mcp], :read
-      )
-
-      # ── data_mv ──────────────────────────────────────────
-      register VerbSpec.new(
-        :data_mv, "Rename a data lane — manifest + files. Refuses if destination exists.",
-        [ArgSpec.arg(name: :from, required: true, positional: true, description: "current data lane name"),
-         ArgSpec.arg(name: :to, required: true, positional: true, description: "new data lane name"),
-         ArgSpec.arg(name: :dry_run, type: :boolean, default: false,
-                     description: "when true, returns planned zone move without applying")],
-        %i[cli mcp], :write
-      )
-
-      # ── key_mv_prefix ────────────────────────────────────
-      register VerbSpec.new(
-        :key_mv_prefix, "Bulk-rename every leaf key under from_prefix to to_prefix.",
-        [ArgSpec.arg(name: :from_prefix, required: true, positional: true,
-                     description: "dotted prefix whose leaf keys are renamed"),
-         ArgSpec.arg(name: :to_prefix, required: true, positional: true,
-                     description: "dotted prefix the keys are renamed to"),
-         ArgSpec.arg(name: :dry_run, type: :boolean, default: false,
-                     description: "when true, returns planned moves without applying")],
-        %i[cli mcp], :write
-      )
-
-      # ── key_delete_prefix ────────────────────────────────
-      register VerbSpec.new(
-        :key_delete_prefix, "Bulk-delete every leaf key under prefix.",
-        [ArgSpec.arg(name: :prefix, required: true, positional: true,
-                     description: "every leaf key under this dotted prefix is deleted"),
-         ArgSpec.arg(name: :dry_run, type: :boolean, default: false,
-                     description: "when true, returns keys that would be deleted without deleting")],
-        %i[cli mcp], :write
-      )
+      require_relative "verb_registry/core_verbs"
+      CoreVerbs.each_value { |spec| register(spec) }
 
-      # ── drain ────────────────────────────────────────────
-      register VerbSpec.new(
-        :drain, "Seed materialize + sweep jobs then drain the queue to empty.",
-        [], %i[cli mcp], :maintenance
-      )
       require_relative "../lanes/knowledge/verbs"
       require_relative "../lanes/scratchpad/verbs"
       require_relative "../lanes/artifact/verbs"
diff --git a/lib/textus/protocol/verb_registry/arg_spec.rb b/lib/textus/protocol/verb_registry/arg_spec.rb
index 508d944cc..5b2e1e108 100644
--- a/lib/textus/protocol/verb_registry/arg_spec.rb
+++ b/lib/textus/protocol/verb_registry/arg_spec.rb
@@ -7,14 +7,12 @@ module VerbRegistry
       ) do
         def wire = wire_name || name
 
-        # rubocop:disable Metrics/ParameterLists
         def self.arg(name:, type: String, required: false, positional: false,
                      description: nil, wire_name: nil,
                      default: nil, source: nil, coerce: nil, cli_default: nil)
           new(name:, type:, required:, positional:,
               description:, wire_name:, default:, source:, coerce:, cli_default:)
         end
-        # rubocop:enable Metrics/ParameterLists
       end
     end
   end
diff --git a/lib/textus/protocol/verb_registry/core_verbs.rb b/lib/textus/protocol/verb_registry/core_verbs.rb
new file mode 100644
index 000000000..9752c70fa
--- /dev/null
+++ b/lib/textus/protocol/verb_registry/core_verbs.rb
@@ -0,0 +1,166 @@
+# frozen_string_literal: true
+
+module Textus
+  module Protocol
+    module VerbRegistry
+      CoreVerbs = {
+        audit: VerbSpec.new(
+          :audit, "Query the audit log with optional filters.",
+          [ArgSpec.arg(name: :key, description: "filter to rows for this key"),
+           ArgSpec.arg(name: :lane, description: "filter to keys in this lane"),
+           ArgSpec.arg(name: :role, description: "filter to rows written under this role"),
+           ArgSpec.arg(name: :verb, description: "filter to rows for this verb"),
+           ArgSpec.arg(name: :since, description: "ISO-8601 timestamp or relative offset (e.g. 1h, 30m)"),
+           ArgSpec.arg(name: :seq_since, type: Integer, description: "return rows with seq > this cursor value"),
+           ArgSpec.arg(name: :correlation_id, description: "filter to rows with this correlation_id"),
+           ArgSpec.arg(name: :limit, type: Integer, description: "maximum number of rows to return")],
+          %i[cli mcp], :read
+        ),
+
+        blame: VerbSpec.new(
+          :blame, "Annotate audit rows with the git commit that introduced each file state.",
+          [ArgSpec.arg(name: :key, required: true, positional: true, description: "entry key to blame"),
+           ArgSpec.arg(name: :limit, type: Integer, description: "maximum number of audit rows to return")],
+          %i[cli mcp], :read
+        ),
+
+        boot: VerbSpec.new(
+          :boot, "Return the orientation contract: lanes, agent_quickstart, agent_protocol.",
+          [], %i[cli mcp], :read
+        ),
+
+        data_mv: VerbSpec.new(
+          :data_mv, "Rename a data lane — manifest + files. Refuses if destination exists.",
+          [ArgSpec.arg(name: :from, required: true, positional: true, description: "current data lane name"),
+           ArgSpec.arg(name: :to, required: true, positional: true, description: "new data lane name"),
+           ArgSpec.arg(name: :dry_run, type: :boolean, default: false,
+                       description: "when true, returns planned zone move without applying")],
+          %i[cli mcp], :write
+        ),
+
+        deps: VerbSpec.new(
+          :deps, "List the keys a derived entry depends on.",
+          [ArgSpec.arg(name: :key, required: true, positional: true, description: "dotted key of the derived entry whose source keys you want")],
+          %i[cli mcp], :read
+        ),
+
+        drain: VerbSpec.new(
+          :drain, "Seed materialize + sweep jobs then drain the queue to empty.",
+          [], %i[cli mcp], :maintenance
+        ),
+
+        get: VerbSpec.new(
+          :get, "Read one entry — on-disk read with freshness verdict.",
+          [ArgSpec.arg(name: :key, required: true, positional: true, description: "dotted entry key to read, e.g. 'knowledge.project'")],
+          %i[cli mcp], :read
+        ),
+
+        graph: VerbSpec.new(
+          :graph, "Query the link graph — neighbors (direct links) or reachable (transitive, with optional depth limit).",
+          [ArgSpec.arg(name: :key, required: true, positional: true, description: "entry key to query"),
+           ArgSpec.arg(name: :depth, type: Integer, description: "max traversal depth for reachable query (unlimited when omitted)")],
+          %i[cli mcp], :read
+        ),
+
+        ingest: VerbSpec.new(
+          verb: :ingest, summary: "Capture external source material into the raw lane. Write-once.",
+          args: [ArgSpec.arg(name: :kind, required: true, positional: true, description: "source kind: url | file | asset"),
+                 ArgSpec.arg(name: :slug, required: true, description: "human slug for the key suffix (kebab-case)"),
+                 ArgSpec.arg(name: :url, description: "remote URL (required when kind=url)"),
+                 ArgSpec.arg(name: :path, description: "local file path (required when kind=file or kind=asset)"),
+                 ArgSpec.arg(name: :lane, description: "asset group subdirectory (required when kind=asset)"),
+                 ArgSpec.arg(name: :label, description: "human label stored in source.label")],
+          surfaces: %i[cli mcp], category: :write, lane: :ingest
+        ),
+
+        key_delete: VerbSpec.new(
+          :key_delete, "Delete one entry by key. Returns {ok, key, deleted}.",
+          [ArgSpec.arg(name: :key, required: true, positional: true, description: "dotted entry key to delete"),
+           ArgSpec.arg(name: :if_etag, description: "optimistic-concurrency guard: etag you last read")],
+          %i[cli mcp], :write
+        ),
+
+        key_delete_prefix: VerbSpec.new(
+          :key_delete_prefix, "Bulk-delete every leaf key under prefix.",
+          [ArgSpec.arg(name: :prefix, required: true, positional: true, description: "every leaf key under this dotted prefix is deleted"),
+           ArgSpec.arg(name: :dry_run, type: :boolean, default: false,
+                       description: "when true, returns keys that would be deleted without deleting")],
+          %i[cli mcp], :write
+        ),
+
+        key_mv: VerbSpec.new(
+          :key_mv, "Rename one entry (same zone + format). Refuses if target exists.",
+          [ArgSpec.arg(name: :old_key, required: true, positional: true, description: "current dotted key"),
+           ArgSpec.arg(name: :new_key, required: true, positional: true, description: "new dotted key (same zone and format)"),
+           ArgSpec.arg(name: :dry_run, type: :boolean, description: "when true, returns planned move without applying")],
+          %i[cli mcp], :write
+        ),
+
+        key_mv_prefix: VerbSpec.new(
+          :key_mv_prefix, "Bulk-rename every leaf key under from_prefix to to_prefix.",
+          [ArgSpec.arg(name: :from_prefix, required: true, positional: true, description: "dotted prefix whose leaf keys are renamed"),
+           ArgSpec.arg(name: :to_prefix, required: true, positional: true, description: "dotted prefix the keys are renamed to"),
+           ArgSpec.arg(name: :dry_run, type: :boolean, default: false, description: "when true, returns planned moves without applying")],
+          %i[cli mcp], :write
+        ),
+
+        list: VerbSpec.new(
+          :list, "List keys filtered by lane and/or prefix.",
+          [ArgSpec.arg(name: :prefix, description: "restrict to keys starting with this dotted prefix, e.g. 'knowledge.execution'"),
+           ArgSpec.arg(name: :lane, description: "restrict to one lane by name (see `boot` lanes)"),
+           ArgSpec.arg(name: :q, description: "full-text search query over entry content (FTS5)"),
+           ArgSpec.arg(name: :schema, description: "filter to entries whose schema matches this name")],
+          %i[cli mcp], :read
+        ),
+
+        pulse: VerbSpec.new(
+          :pulse, "Delta since cursor — changed entries, pending proposals, index freshness.",
+          [ArgSpec.arg(name: :since, type: Integer, description: "audit seq to diff from; defaults to the session cursor")],
+          %i[cli mcp], :read
+        ),
+
+        put: VerbSpec.new(
+          :put, "Create or update an entry. Schema-validated. Returns {uid, etag}.",
+          [ArgSpec.arg(name: :key, required: true, positional: true, description: "dotted entry key, e.g. 'knowledge.project'; must resolve to a zone the role may write"),
+           ArgSpec.arg(name: :meta, type: Hash, wire_name: :_meta,
+                       description: "frontmatter; reads back as `_meta`. Schema-validated — call `schema KEY` first"),
+           ArgSpec.arg(name: :body, description: "markdown/text payload for md entries; use `content` for json/yaml"),
+           ArgSpec.arg(name: :content, type: Hash,
+                       description: "structured payload for json/yaml-format entries; omit (use `body`) for markdown entries"),
+           ArgSpec.arg(name: :if_etag, description: "optimistic-concurrency guard; write rejected if entry changed since"),
+           ArgSpec.arg(name: :format, description: "override entry format for this write (e.g. script)")],
+          %i[cli mcp], :write
+        ),
+
+        rdeps: VerbSpec.new(
+          :rdeps, "List the derived entries that depend on a key (reverse deps).",
+          [ArgSpec.arg(name: :key, required: true, positional: true, description: "dotted key whose dependents you want")],
+          %i[cli mcp], :read
+        ),
+
+        schema_list: VerbSpec.new(
+          :schema_list, "List all registered schemas with their fields.",
+          [], %i[cli mcp], :read
+        ),
+
+        schema_show: VerbSpec.new(
+          :schema_show, "Return the schema (field shape) for an entry's family.",
+          [ArgSpec.arg(name: :key, required: true, positional: true, description: "any key in the family whose schema you want")],
+          %i[cli mcp], :read
+        ),
+
+        uid: VerbSpec.new(
+          :uid, "Return the stable UID of an entry without reading its body.",
+          [ArgSpec.arg(name: :key, required: true, positional: true, description: "entry key")],
+          %i[cli mcp], :read
+        ),
+
+        where: VerbSpec.new(
+          :where, "Resolve a key to its zone, owner, and path without reading the body.",
+          [ArgSpec.arg(name: :key, required: true, positional: true, description: "dotted key to locate")],
+          %i[cli mcp], :read
+        ),
+      }.freeze
+    end
+  end
+end
diff --git a/lib/textus/surface/cli/verb/put.rb b/lib/textus/surface/cli/verb/put.rb
index dd3ddd509..12811d42b 100644
--- a/lib/textus/surface/cli/verb/put.rb
+++ b/lib/textus/surface/cli/verb/put.rb
@@ -6,6 +6,7 @@ class Put < Runner::Base
           self.spec = Textus::Protocol::VerbRegistry.for(:put)
           option :as_flag, "--as=ROLE"
           option :use_stdin, "--stdin"
+          option :as_format, "--as-format=FORMAT"
 
           def invoke(store)
             key = positional.shift or raise UsageError.new("put requires a key")
@@ -15,6 +16,7 @@ def invoke(store)
             Textus::Protocol::VerbRegistry.for(:put)
             inputs = { key: key, meta: payload["_meta"] || {}, body: payload["body"] || "",
                        content: nil, if_etag: payload["if_etag"] }
+            inputs[:format] = as_format if as_format
             s = store.with_role(resolved_role(store))
             emit(s.put(**inputs))
           end
diff --git a/lib/textus/surface/watcher.rb b/lib/textus/surface/watcher.rb
index cdb2c816a..2b02171b6 100644
--- a/lib/textus/surface/watcher.rb
+++ b/lib/textus/surface/watcher.rb
@@ -5,15 +5,24 @@ module Surface
     class Watcher
       def initialize(container:)
         @container = container
-        @queue = Protocol::Async::Queue.new(container.store.workflow_queue)
         @registry = Textus::Workflow::Registry.new(container.workflows)
       end
 
       def tick
         call = Textus::Value::Call.build(role: Textus::Value::Role::AUTOMATION, correlation_id: SecureRandom.uuid)
+
+        Textus::Workflow::Scheduler.new(
+          registry: @registry,
+          workflow_queue: @container.store.workflow_queue,
+          reader: ->(key:) { @container.store_engine.read(key:) },
+        ).seed_expired
+
+        consumer = Textus::Workflow::Consumer.new(registry: @registry, container: @container, call:)
         loop do
-          row = @queue.consume_one(registry: @registry, container: @container, call:)
+          row = @container.store.workflow_queue.pop
           break unless row
+
+          consumer.consume(row, @container.store.workflow_queue)
         end
       end
 
diff --git a/lib/textus/value/outcome.rb b/lib/textus/value/outcome.rb
deleted file mode 100644
index 9d6ef451d..000000000
--- a/lib/textus/value/outcome.rb
+++ /dev/null
@@ -1,13 +0,0 @@
-module Textus
-  module Value
-    module Outcome
-      Completed = Data.define(:details) do
-        def kind = :completed
-      end
-
-      DeadLettered = Data.define(:error) do
-        def kind = :dead_lettered
-      end
-    end
-  end
-end
diff --git a/lib/textus/value/result.rb b/lib/textus/value/result.rb
deleted file mode 100644
index 4d2fbc57b..000000000
--- a/lib/textus/value/result.rb
+++ /dev/null
@@ -1,55 +0,0 @@
-module Textus
-  module Value
-    # rubocop:disable Lint/ConstantDefinitionInBlock
-    Result = Data.define(:ok, :value, :error) do
-      def self.success(value) = new(ok: true, value: value, error: nil)
-
-      def self.failure(code, message, details: {})
-        new(ok: false, value: nil, error: { code: code, message: message, details: details })
-      end
-
-      # Wraps an already-constructed Textus::Error so .extract can re-raise the
-      # exact type (and its exit_code/hint/JSONRPC behavior) instead of
-      # collapsing every failure into a generic ActionError.
-      def self.from_error(err)
-        new(ok: false, value: nil, error: { code: err.code, message: err.message, details: err.details, exception: err })
-      end
-
-      def self.extract(result)
-        case result
-        when self
-          if result.success?
-            result.value
-          else
-            err = result.error
-            raise err[:exception] if err[:exception]
-
-            raise Textus::ActionError.new(err[:code] || :error, err[:message] || "action failed", details: err[:details] || {})
-          end
-        else
-          result
-        end
-      end
-
-      def success? = ok
-      def failure? = !ok
-
-      def unwrap
-        raise Result::UnwrapError.new(error[:code], error[:message], details: error[:details]) unless ok
-
-        value
-      end
-
-      class UnwrapError < StandardError
-        attr_reader :code, :details
-
-        def initialize(code, message, details: {})
-          super(message)
-          @code = code
-          @details = details
-        end
-      end
-    end
-    # rubocop:enable Lint/ConstantDefinitionInBlock
-  end
-end
diff --git a/lib/textus/workflow.rb b/lib/textus/workflow.rb
index d5c46c503..8e18536f9 100644
--- a/lib/textus/workflow.rb
+++ b/lib/textus/workflow.rb
@@ -12,7 +12,7 @@ def initialize(step_name, cause)
 
     class NotFound < Textus::Error
       def initialize(key)
-        super(:workflow_not_found, "no workflow matches key '#{key}'; add a .textus/workflows/*.rb file with match: '#{key}'")
+        super(:workflow_not_found, "no workflow matches key '#{key}'; add a .textus/workflows/*.rb file with on: '#{key}'")
       end
     end
   end
diff --git a/lib/textus/workflow/consumer.rb b/lib/textus/workflow/consumer.rb
new file mode 100644
index 000000000..d6d8648f8
--- /dev/null
+++ b/lib/textus/workflow/consumer.rb
@@ -0,0 +1,39 @@
+module Textus
+  module Workflow
+    class Consumer
+      BACKOFF_DELAYS = [10, 30, 60].freeze
+
+      def initialize(registry:, container:, call:)
+        @registry = registry
+        @container = container
+        @call = call
+      end
+
+      def consume(row, workflow_queue)
+        workflow_queue.mark_processing(row[:id])
+        workflow = @registry.for(row[:workflow_type])
+        Runner.new(workflow, container: @container, call: @call).run(row[:key])
+        workflow_queue.complete(row[:id])
+        row.merge(state: "done")
+      rescue StandardError => e
+        handle_failure(row, workflow_queue, e)
+      end
+
+      private
+
+      def handle_failure(row, workflow_queue, error)
+        retry_count = (row[:retry_count] || 0) + 1
+        max_attempts = row[:max_attempts] || 3
+
+        if retry_count >= max_attempts
+          workflow_queue.fail(row[:id], retry_count:, error: error.message)
+          row.merge(state: "failed", error: error.message)
+        else
+          index = [retry_count - 1, BACKOFF_DELAYS.length - 1].min
+          workflow_queue.reschedule(row[:id], retry_count:, delay: BACKOFF_DELAYS[index], error: error.message)
+          row.merge(state: "retrying")
+        end
+      end
+    end
+  end
+end
diff --git a/lib/textus/workflow/dsl.rb b/lib/textus/workflow/dsl.rb
index 8560693e2..afb73f088 100644
--- a/lib/textus/workflow/dsl.rb
+++ b/lib/textus/workflow/dsl.rb
@@ -6,11 +6,13 @@ module DSL
       PublishTarget = Data.define(:to, :template, :tree, :inject_boot)
 
       class Definition
-        include Textus::Workflow::Helpers
+        include StepBuilder
+        include PatternMatcher
+        include Lifecycle
 
         attr_reader :name, :steps, :on_patterns, :save_to, :notify_keys,
                     :publish_block, :publish_targets,
-                    :handled_events, :workflow_type, :ttl, :priority, :max_attempts
+                    :handled_events, :workflow_type
 
         def self.register(defn)
           @definitions ||= []
@@ -51,7 +53,7 @@ def type
         def max_attempts(n = nil)
           return @max_attempts if n.nil?
 
-          @max_attempts = n.to_i
+          @max_attempts = max_attempts_value(n)
         end
 
         # ── Trigger ──
@@ -60,75 +62,13 @@ def on(*patterns)
         end
 
         # ── Steps ──
-        def step(name, callable = nil, timeout: nil, &block)
-          if callable.is_a?(Hash)
-            raise ArgumentError.new(
-              "step :#{name} no longer accepts options hash; pass timeout: keyword instead",
-            )
-          end
+        def step(name, callable = nil, timeout: nil, &)
+          @steps << build_step(name, callable, timeout:, &)
+        end
 
-          resolved = if callable.respond_to?(:call)
-                       callable
-                     elsif block
-                       block
-                     else
-                       raise ArgumentError.new("step :#{name} requires a block or a callable (got neither)")
-                     end
-
-          @steps << Step.new(name: name, callable: resolved, timeout: timeout)
-        end
-
-        def check(name, naming: nil, scope: nil, &block)
-          if naming
-            raise ArgumentError.new("check :#{name} requires a scope: for naming checks") unless scope
-
-            @steps << Step.new(
-              name: :"check_#{name}",
-              callable: lambda do |data, ctx|
-                entries = ctx.container.manifest.resolver.enumerate.select do |row|
-                  match_pattern?(scope, row[:key].to_s)
-                end
-
-                new_issues = check_naming(
-                  entries,
-                  pattern: naming,
-                  code: "check.#{name}",
-                  fix: "rename to match #{naming.inspect}",
-                )
-                existing_issues = Array(data&.dig("content", "issues"))
-                issues = existing_issues + new_issues
-
-                {
-                  "content" => {
-                    "ok" => issues.empty?,
-                    "issues" => issues,
-                    "count" => issues.size,
-                  },
-                }
-              end,
-              timeout: nil,
-            )
-          elsif block
-            @steps << Step.new(
-              name: :"check_#{name}",
-              callable: lambda do |data, ctx|
-                issues = block.call(ctx) || []
-                existing_issues = Array(data&.dig("content", "issues"))
-                all = existing_issues + issues
-
-                {
-                  "content" => {
-                    "ok" => all.empty?,
-                    "issues" => all,
-                    "count" => all.size,
-                  },
-                }
-              end,
-              timeout: nil,
-            )
-          else
-            raise ArgumentError.new("check :#{name} requires naming: or a block")
-          end
+        def check(name, naming: nil, scope: nil, &)
+          callable = build_check(name, naming:, scope:, &)
+          @steps << Step.new(name: :"check_#{name}", callable: callable, timeout: nil)
         end
 
         def parallel(&)
@@ -136,7 +76,7 @@ def parallel(&)
           @steps = []
           instance_eval(&)
           parallel_steps = @steps.dup
-          @steps = saved << Parallel.new(steps: parallel_steps)
+          @steps = saved << build_parallel(parallel_steps)
         end
 
         # ── Output ──
@@ -162,25 +102,18 @@ def notify(key)
         def priority(n = nil)
           return @priority if n.nil?
 
-          @priority = n.to_i
+          @priority = priority_value(n)
         end
 
         # ── Lifecycle ──
         def every(cadence = :__no_arg__)
-          return @ttl if cadence == :__no_arg__
-
-          @ttl = Textus::Value::Duration.seconds(cadence)
+          @ttl = ttl_value(cadence)
         end
 
-        alias_method :ttl, :every
+        alias ttl every
 
         def on_expire(action = :__no_arg__)
-          return @on_expire if action == :__no_arg__
-
-          sym = action.to_s.to_sym
-          raise ArgumentError.new("on_expire must be one of drop|archive, got #{action.inspect}") unless %i[drop archive].include?(sym)
-
-          @on_expire = sym
+          @on_expire = expire_action(action)
         end
 
         # ── Matching (internal) ──
@@ -193,21 +126,6 @@ def match?(key)
         def multi_match?
           @on_patterns&.any? { |p| p.end_with?("**") }
         end
-
-        private
-
-        def match_pattern?(pattern, key)
-          if pattern.end_with?(".**")
-            prefix = pattern.delete_suffix(".**")
-            key.start_with?("#{prefix}.")
-          elsif pattern.end_with?(".*")
-            prefix = pattern.delete_suffix(".*")
-            suffix = key.delete_prefix("#{prefix}.")
-            key != suffix && !suffix.include?(".")
-          else
-            key == pattern
-          end
-        end
       end
     end
   end
diff --git a/lib/textus/workflow/dsl/lifecycle.rb b/lib/textus/workflow/dsl/lifecycle.rb
new file mode 100644
index 000000000..319763413
--- /dev/null
+++ b/lib/textus/workflow/dsl/lifecycle.rb
@@ -0,0 +1,32 @@
+module Textus
+  module Workflow
+    module DSL
+      module Lifecycle
+        VALID_EXPIRE_ACTIONS = %i[drop archive].freeze
+
+        def ttl_value(cadence)
+          return nil if cadence == :__no_arg__
+
+          Textus::Value::Duration.seconds(cadence)
+        end
+
+        def expire_action(action = :__no_arg__)
+          return nil if action == :__no_arg__
+
+          sym = action.to_s.to_sym
+          raise ArgumentError.new("on_expire must be one of drop|archive, got #{action.inspect}") unless VALID_EXPIRE_ACTIONS.include?(sym)
+
+          sym
+        end
+
+        def max_attempts_value(n)
+          n.to_i
+        end
+
+        def priority_value(n)
+          n.to_i
+        end
+      end
+    end
+  end
+end
diff --git a/lib/textus/workflow/dsl/pattern_matcher.rb b/lib/textus/workflow/dsl/pattern_matcher.rb
new file mode 100644
index 000000000..84644b291
--- /dev/null
+++ b/lib/textus/workflow/dsl/pattern_matcher.rb
@@ -0,0 +1,20 @@
+module Textus
+  module Workflow
+    module DSL
+      module PatternMatcher
+        def match_pattern?(pattern, key)
+          if pattern.end_with?(".**")
+            prefix = pattern.delete_suffix(".**")
+            key.start_with?("#{prefix}.")
+          elsif pattern.end_with?(".*")
+            prefix = pattern.delete_suffix(".*")
+            suffix = key.delete_prefix("#{prefix}.")
+            key != suffix && !suffix.include?(".")
+          else
+            key == pattern
+          end
+        end
+      end
+    end
+  end
+end
diff --git a/lib/textus/workflow/dsl/step_builder.rb b/lib/textus/workflow/dsl/step_builder.rb
new file mode 100644
index 000000000..1e973a817
--- /dev/null
+++ b/lib/textus/workflow/dsl/step_builder.rb
@@ -0,0 +1,56 @@
+module Textus
+  module Workflow
+    module DSL
+      module StepBuilder
+        def build_step(name, callable = nil, timeout: nil, &block)
+          if callable.is_a?(Hash)
+            raise ArgumentError.new(
+              "step :#{name} no longer accepts options hash; pass timeout: keyword instead",
+            )
+          end
+
+          resolved = if callable.respond_to?(:call)
+                       callable
+                     elsif block
+                       block
+                     else
+                       raise ArgumentError.new("step :#{name} requires a block or a callable (got neither)")
+                     end
+
+          Step.new(name: name, callable: resolved, timeout: timeout)
+        end
+
+        def build_check(name, naming: nil, scope: nil, &block)
+          merge = lambda { |data, new_issues|
+            existing = Array(data&.dig("content", "issues"))
+            all = existing + new_issues
+            { "content" => { "ok" => all.empty?, "issues" => all, "count" => all.size } }
+          }
+
+          if naming
+            raise ArgumentError.new("check :#{name} requires a scope: for naming checks") unless scope
+
+            lambda { |data, ctx|
+              entries = ctx.container.manifest.resolver.enumerate.select do |row|
+                match_pattern?(scope, row[:key].to_s)
+              end
+              new_issues = check_naming(
+                entries, pattern: naming, code: "check.#{name}",
+                         fix: "rename to match #{naming.inspect}"
+              )
+              merge.call(data, new_issues)
+            }
+          elsif block
+            ->(data, ctx) { merge.call(data, block.call(ctx) || []) }
+          else
+            raise ArgumentError.new("check :#{name} requires naming: or a block")
+          end
+        end
+
+        def build_parallel(steps)
+          Parallel.new(steps: steps)
+        end
+      end
+    end
+  end
+end
diff --git a/lib/textus/workflow/engine.rb b/lib/textus/workflow/engine.rb
deleted file mode 100644
index a5b7d2385..000000000
--- a/lib/textus/workflow/engine.rb
+++ /dev/null
@@ -1,28 +0,0 @@
-module Textus
-  module Workflow
-    class Engine
-      def initialize(registry:, workflow_queue:, container:, call:, reader:)
-        @registry = registry
-        @workflow_queue = workflow_queue
-        @container = container
-        @call = call
-        @reader = reader
-      end
-
-      def run
-        Scheduler.new(
-          registry: @registry,
-          workflow_queue: @workflow_queue,
-          reader: @reader,
-        ).seed_expired
-
-        Queue.new(
-          @workflow_queue,
-          registry: @registry,
-          container: @container,
-          call: @call,
-        ).drain
-      end
-    end
-  end
-end
diff --git a/lib/textus/workflow/event_emitter.rb b/lib/textus/workflow/event_emitter.rb
new file mode 100644
index 000000000..d1ae7f748
--- /dev/null
+++ b/lib/textus/workflow/event_emitter.rb
@@ -0,0 +1,21 @@
+module Textus
+  module Workflow
+    class EventEmitter
+      def initialize(workflow_queue, registry:)
+        @workflow_queue = workflow_queue
+        @registry = registry
+      end
+
+      def emit(event_type:, key:, lane: "artifacts")
+        workflows = @registry.workflows_for(event_type)
+        workflows.each do |wf|
+          @workflow_queue.push(
+            event_type: event_type.to_s, workflow_type: wf.type,
+            key:, lane:, max_attempts: wf.max_attempts
+          )
+        end
+        workflows.size
+      end
+    end
+  end
+end
diff --git a/lib/textus/workflow/instances/materialize.rb b/lib/textus/workflow/instances/materialize.rb
deleted file mode 100644
index fad9a98bb..000000000
--- a/lib/textus/workflow/instances/materialize.rb
+++ /dev/null
@@ -1,37 +0,0 @@
-# frozen_string_literal: true
-
-module Textus
-  module Workflow
-    module Instances
-      Materialize = Textus::Workflow::DSL::Definition.new("materialize").tap do |wf|
-        wf.handles "entry.written", "entry.deleted", "entry.moved",
-                   "proposal.accepted", "proposal.rejected"
-        wf.priority 10
-        wf.max_attempts 3
-        wf.step :converge do |data, ctx|
-          registry = ctx.container.workflow_registry || Textus::Workflow::Registry.new(ctx.workflows)
-          workflows = registry.workflows_for_key(ctx.key)
-          if workflows.any?
-            workflows.each { |wf| Textus::Workflow::Runner.new(wf, container: ctx.container, call: ctx.call).run(ctx.key) }
-          else
-            entry = ctx.container.manifest.resolver.resolve(ctx.key).entry
-            if entry.publish_tree || !Array(entry.publish_to).empty?
-              es = Textus::Protocol::StoreEngine.new(
-                file_system: ctx.container.store.file_system,
-                manifest: ctx.container.manifest,
-                layout: ctx.container.layout,
-                store: ctx.container.store,
-              )
-              pctx = Textus::Protocol::Manifest::Entry::Base::PublishContext.new(
-                container: ctx.container, call: ctx.call,
-                reader: ->(key:) { es.read(key:) }
-              )
-              entry.publish_via(pctx)
-            end
-          end
-          data
-        end
-      end
-    end
-  end
-end
diff --git a/lib/textus/workflow/publisher.rb b/lib/textus/workflow/publisher.rb
index ed2aa7b6b..6f27a0b6d 100644
--- a/lib/textus/workflow/publisher.rb
+++ b/lib/textus/workflow/publisher.rb
@@ -2,15 +2,9 @@ module Textus
   module Workflow
     class Publisher
       def initialize(container:, call:)
-        @container = container
-        @call      = call
-        @store_engine = Protocol::StoreEngine.new(
-          file_system: container.store.file_system,
-          manifest: container.manifest,
-          layout: container.layout,
-          store: container.store,
-          workflow_registry: container.workflow_registry,
-        )
+        @container    = container
+        @call         = call
+        @store_engine = container.store_engine
       end
 
       def publish(key, data, ctx, definition)
diff --git a/lib/textus/workflow/queue.rb b/lib/textus/workflow/queue.rb
deleted file mode 100644
index b61e79dce..000000000
--- a/lib/textus/workflow/queue.rb
+++ /dev/null
@@ -1,66 +0,0 @@
-module Textus
-  module Workflow
-    class Queue
-      def initialize(workflow_queue, registry:, container:, call:)
-        @workflow_queue = workflow_queue
-        @registry = registry
-        @container = container
-        @call = call
-        @retry_policy = RetryPolicy.new
-      end
-
-      def enqueue(event_type:, key:, lane:, payload: nil)
-        workflows = @registry.workflows_for(event_type)
-        return 0 if workflows.empty?
-
-        workflows.each do |wf|
-          @workflow_queue.push(
-            event_type: event_type.to_s, workflow_type: wf.type,
-            key:, lane:, payload:,
-            max_attempts: wf.max_attempts,
-          )
-        end
-        workflows.size
-      end
-
-      def drain
-        completed = 0
-        failed = 0
-
-        loop do
-          row = @workflow_queue.pop
-          break unless row
-
-          @workflow_queue.mark_processing(row[:id])
-          execute(row)
-          @workflow_queue.complete(row[:id])
-          completed += 1
-        rescue StandardError => e
-          handle_failure(row, e)
-          failed += 1
-        end
-
-        { completed:, failed: }
-      end
-
-      private
-
-      def execute(row)
-        workflow = @registry.for(row[:workflow_type])
-        Runner.new(workflow, container: @container, call: @call).run(row[:key])
-      end
-
-      def handle_failure(row, error)
-        retry_count = (row[:retry_count] || 0) + 1
-        max_attempts = row[:max_attempts] || 3
-        decision = @retry_policy.decide(retry_count:, max_attempts:)
-
-        if decision.terminal?
-          @workflow_queue.fail(row[:id], retry_count:, error: error.message)
-        else
-          @workflow_queue.reschedule(row[:id], retry_count:, delay: decision.delay, error: error.message)
-        end
-      end
-    end
-  end
-end
diff --git a/lib/textus/workflow/registry.rb b/lib/textus/workflow/registry.rb
index 9120c008f..8920ed848 100644
--- a/lib/textus/workflow/registry.rb
+++ b/lib/textus/workflow/registry.rb
@@ -39,11 +39,6 @@ def for(workflow_type)
       def match_for_key(key)
         @definitions.find { |wf| wf.match?(key) }
       end
-
-      def workflows_for_key(key)
-        @definitions.select { |wf| wf.match?(key) }
-                    .sort_by(&:priority)
-      end
     end
   end
 end
diff --git a/lib/textus/workflow/retry_policy.rb b/lib/textus/workflow/retry_policy.rb
deleted file mode 100644
index ef6e28c6c..000000000
--- a/lib/textus/workflow/retry_policy.rb
+++ /dev/null
@@ -1,22 +0,0 @@
-module Textus
-  module Workflow
-    class RetryPolicy
-      DEFAULT_BACKOFF_DELAYS = [10, 30, 60].freeze
-
-      Decision = Data.define(:terminal, :delay) do
-        def terminal? = terminal
-      end
-
-      def initialize(backoff_delays: DEFAULT_BACKOFF_DELAYS)
-        @backoff_delays = backoff_delays
-      end
-
-      def decide(retry_count:, max_attempts:)
-        return Decision.new(terminal: true, delay: nil) if retry_count >= max_attempts
-
-        index = [retry_count - 1, @backoff_delays.length - 1].min
-        Decision.new(terminal: false, delay: @backoff_delays[index])
-      end
-    end
-  end
-end
diff --git a/lib/textus/workflow/runner.rb b/lib/textus/workflow/runner.rb
index cf1c4f82e..5dc02fa88 100644
--- a/lib/textus/workflow/runner.rb
+++ b/lib/textus/workflow/runner.rb
@@ -1,6 +1,3 @@
-require "timeout"
-require "concurrent"
-
 module Textus
   module Workflow
     class ParallelStepFailed < Textus::Error
@@ -14,32 +11,15 @@ def initialize(failures)
     end
 
     class Runner
-      DEFAULT_TIMEOUT = 30
-      CONCURRENCY_ADAPTER = Textus::Infra::Adapters::ConcurrencyAdapter.new
-
       Context = Data.define(:key, :entry, :config, :lane, :container, :call) do
-        def manifest    = container.manifest
-        def layout      = container.layout
-        def schemas     = container.schemas
-        def file_system = container.store.file_system
-        def read(key)   = Textus::Protocol::StoreEngine.new(file_system:, manifest:, layout:, store: container.store).read(key:)
-        def repo_root   = File.dirname(container.root)
-        def store_root  = container.root
-      end
-
-      class StepScope
-        include Textus::Workflow::Helpers
-
-        def initialize(data, ctx, _runner)
-          @data = data
-          @ctx  = ctx
-          @container = ctx.container
-          @call = ctx.call
-        end
-
-        def call(callable)
-          instance_exec(@data, @ctx, &callable)
-        end
+        def store_engine = container.store_engine
+        def manifest     = container.manifest
+        def layout       = container.layout
+        def file_system  = container.store.file_system
+        def schemas      = container.schemas
+        def read(key)    = store_engine.read(key:)
+        def repo_root    = File.dirname(container.root)
+        def store_root   = container.root
       end
 
       def initialize(definition, container:, call:)
@@ -47,20 +27,12 @@ def initialize(definition, container:, call:)
         @container  = container
         @call       = call
         @publisher  = Publisher.new(container: container, call: call)
+        @step_executor = StepExecutor.new
       end
 
       def run(key)
-        ctx  = build_context(key)
-        data = execute_steps(ctx)
-        @publisher.publish(key, data, ctx, @definition) if data
-        data
-      end
-
-      private
-
-      def build_context(key)
         res = @container.manifest.resolver.resolve(key)
-        Context.new(
+        ctx = Context.new(
           key: key,
           entry: res.entry,
           config: {}.freeze,
@@ -68,59 +40,10 @@ def build_context(key)
           container: @container,
           call: @call,
         )
-      end
-
-      def execute_steps(ctx)
-        data = nil
-        @definition.steps.each { |step| data = execute_one(step, data, ctx) }
+        data = @step_executor.execute(@definition.steps, ctx)
+        @publisher.publish(key, data, ctx, @definition) if data
         data
       end
-
-      def execute_one(step, data, ctx)
-        case step
-        when DSL::Step then execute_single(step, data, ctx)
-        when DSL::Parallel then execute_parallel(step, ctx)
-        else raise ArgumentError.new("unknown step type: #{step.class}")
-        end
-      end
-
-      def execute_single(step, data, ctx)
-        scope = StepScope.new(data, ctx, self)
-        timeout = step.timeout || DEFAULT_TIMEOUT
-        Timeout.timeout(timeout) { scope.call(step.callable) }
-      rescue Timeout::Error => e
-        raise StepFailed.new(step.name, e)
-      rescue Textus::Error
-        raise
-      rescue StandardError => e
-        raise StepFailed.new(step.name, e)
-      end
-
-      def execute_parallel(parallel, ctx)
-        scope = StepScope.new(nil, ctx, self)
-        promises = parallel.steps.map do |step|
-          CONCURRENCY_ADAPTER.future do
-            timeout = step.timeout || DEFAULT_TIMEOUT
-            Timeout.timeout(timeout) { scope.call(step.callable) }
-          end
-        end
-
-        results = CONCURRENCY_ADAPTER.zip_futures(*promises).value!
-        failures = []
-        outputs = {}
-        results.each_with_index do |result, i|
-          step = parallel.steps[i]
-          if result.fulfilled?
-            outputs[step.name] = result.value!
-          else
-            failures << { step: step.name, error: result.reason.message }
-          end
-        end
-
-        raise ParallelStepFailed.new(failures) unless failures.empty?
-
-        outputs
-      end
     end
   end
 end
diff --git a/lib/textus/workflow/scheduler.rb b/lib/textus/workflow/scheduler.rb
index 0096d75c8..0ea171f67 100644
--- a/lib/textus/workflow/scheduler.rb
+++ b/lib/textus/workflow/scheduler.rb
@@ -19,7 +19,7 @@ def seed_expired
           unless entry
             @workflow_queue.push(
               event_type: "workflow", workflow_type: wf.type,
-              key: wf.save_to, lane: lane,
+              key: wf.save_to, lane: lane
             )
             seeded += 1
             next
@@ -34,7 +34,7 @@ def seed_expired
 
           @workflow_queue.push(
             event_type: "workflow", workflow_type: wf.type,
-            key: wf.save_to, lane: lane,
+            key: wf.save_to, lane: lane
           )
           seeded += 1
         end
diff --git a/lib/textus/workflow/step_executor.rb b/lib/textus/workflow/step_executor.rb
new file mode 100644
index 000000000..63789c29f
--- /dev/null
+++ b/lib/textus/workflow/step_executor.rb
@@ -0,0 +1,78 @@
+require "timeout"
+require "concurrent"
+
+module Textus
+  module Workflow
+    class StepExecutor
+      DEFAULT_TIMEOUT = 30
+      CONCURRENCY_ADAPTER = Textus::Infra::Adapters::ConcurrencyAdapter.new
+
+      class StepScope
+        include Textus::Workflow::StepHelpers
+
+        def initialize(data, ctx)
+          @data = data
+          @ctx  = ctx
+        end
+
+        def call(callable)
+          instance_exec(@data, @ctx, &callable)
+        end
+      end
+
+      def execute(steps, ctx)
+        data = nil
+        steps.each { |step| data = execute_one(step, data, ctx) }
+        data
+      end
+
+      private
+
+      def execute_one(step, data, ctx)
+        case step
+        when DSL::Step then execute_single(step, data, ctx)
+        when DSL::Parallel then execute_parallel(step, ctx)
+        else raise ArgumentError.new("unknown step type: #{step.class}")
+        end
+      end
+
+      def execute_single(step, data, ctx)
+        scope = StepScope.new(data, ctx)
+        timeout = step.timeout || DEFAULT_TIMEOUT
+        Timeout.timeout(timeout) { scope.call(step.callable) }
+      rescue Timeout::Error => e
+        raise StepFailed.new(step.name, e)
+      rescue Textus::Error
+        raise
+      rescue StandardError => e
+        raise StepFailed.new(step.name, e)
+      end
+
+      def execute_parallel(parallel, ctx)
+        scope = StepScope.new(nil, ctx)
+        promises = parallel.steps.map do |step|
+          CONCURRENCY_ADAPTER.future do
+            timeout = step.timeout || DEFAULT_TIMEOUT
+            Timeout.timeout(timeout) { scope.call(step.callable) }
+          end
+        end
+
+        results = CONCURRENCY_ADAPTER.zip_futures(*promises).value!
+        failures = []
+        outputs = {}
+        results.each_with_index do |result, i|
+          step = parallel.steps[i]
+          if result.fulfilled?
+            outputs[step.name] = result.value!
+          else
+            failures << { step: step.name, error: result.reason.message }
+          end
+        end
+
+        raise ParallelStepFailed.new(failures) unless failures.empty?
+
+        outputs
+      end
+    end
+  end
+end
diff --git a/lib/textus/workflow/step_helpers.rb b/lib/textus/workflow/step_helpers.rb
new file mode 100644
index 000000000..da4ceab8f
--- /dev/null
+++ b/lib/textus/workflow/step_helpers.rb
@@ -0,0 +1,102 @@
+# frozen_string_literal: true
+
+require "net/http"
+require "json"
+require "erb"
+
+module Textus
+  module Workflow
+    module StepHelpers
+      def fetch_json(url, headers: {})
+        uri = URI(url)
+        http = Net::HTTP.new(uri.host, uri.port)
+        http.use_ssl = uri.scheme == "https"
+        http.open_timeout = 5
+        http.read_timeout = 30
+
+        request = Net::HTTP::Get.new(uri)
+        headers.each { |k, v| request[k] = v }
+        request["Accept"] ||= "application/json"
+
+        response = http.request(request)
+        raise "HTTP #{response.code} for #{url}" unless response.is_a?(Net::HTTPOK)
+
+        JSON.parse(response.body)
+      end
+
+      def render_template(name, data)
+        path = @container.layout.template_path(name)
+        raise "template not found: #{name}" unless File.exist?(path)
+
+        template = File.read(path)
+        ctx = Textus::Protocol::Produce::Render::Context.new(
+          container: @container, call: @call,
+          key: @ctx&.key, entry: @ctx&.entry
+        )
+        renderer = Textus::Protocol::Produce::Render.new(template, ctx)
+        renderer.bytes_for(data)
+      end
+
+      def merge_hashes(*hashes)
+        hashes.reduce({}) { |acc, h| deep_merge(acc, h) }
+      end
+
+      def pluck(source, *keys)
+        source.slice(*keys)
+      end
+
+      def check_naming(entries, pattern:, code:, fix:)
+        entries.filter_map do |entry|
+          key = entry_value(entry, :key)
+          path = entry_value(entry, :path)
+          name = path && !path.to_s.empty? ? File.basename(path.to_s) : key.to_s.split(".").last
+          next if pattern.match?(name)
+
+          {
+            "code" => code,
+            "level" => "warning",
+            "subject" => key,
+            "message" => "#{key} does not match the required naming pattern #{pattern.inspect}",
+            "fix" => fix,
+          }
+        end
+      end
+
+      private
+
+      def entry_value(entry, key)
+        return entry.public_send(key) if !entry.is_a?(Hash) && entry.respond_to?(key)
+        return entry[key] if entry.is_a?(Hash) && entry.key?(key)
+        return entry[key.to_s] if entry.is_a?(Hash) && entry.key?(key.to_s)
+
+        nil
+      end
+
+      def deep_merge(left_hash, right_hash)
+        left_hash.merge(right_hash) do |_key, old_val, new_val|
+          if old_val.is_a?(Hash) && new_val.is_a?(Hash)
+            deep_merge(old_val, new_val)
+          else
+            new_val
+          end
+        end
+      end
+
+      def build_lanes(ctx)
+        data   = ctx.manifest.data
+        policy = ctx.manifest.policy
+        data.declared_lane_kinds.map do |name, kind|
+          writers = policy.writers_for(name).map(&:to_s)
+          { "name" => name.to_s, "kind" => kind.to_s,
+            "purpose" => data.lane_descs[name].to_s, "writers" => writers }
+        end
+      end
+
+      def build_roles(ctx)
+        ctx.manifest.data.role_caps.map do |role, caps|
+          { "name" => role.to_s, "capabilities" => caps.map(&:to_s) }
+        end
+      end
+    end
+  end
+end
diff --git a/opencode.json b/opencode.json
index 443000f5f..1a85e7275 100644
--- a/opencode.json
+++ b/opencode.json
@@ -11,6 +11,13 @@
         "serve"
       ],
       "enabled": true
+    },
+    "codebase-memory": {
+      "type": "local",
+      "command": [
+        "codebase-memory-mcp"
+      ],
+      "enabled": true
     }
   },
   "lsp": {
@@ -70,7 +77,7 @@
       "AGENTS.md": "deny",
       "CHANGELOG.md": "deny",
       "CODE_OF_CONDUCT.md": "deny",
-      ".mcp.json": "deny"
+       ".mcp.json": "deny"
     }
   },
   "instructions": [
diff --git a/spec/conformance/contract/etag_spec.rb b/spec/conformance/contract/etag_spec.rb
index e296c12a9..79e25c061 100644
--- a/spec/conformance/contract/etag_spec.rb
+++ b/spec/conformance/contract/etag_spec.rb
@@ -6,7 +6,7 @@
 # Etag helper itself are the sanctioned homes; the envelope persist pipeline
 # (envelope/io/writer.rb) is adjacent to the port and out of this guard's scope.
 ETAG_SPEC_APP_GLOBS = [
-  File.expand_path("../../../lib/textus/protocol/handlers.rb", __dir__),
+  File.expand_path("../../../lib/textus/protocol/handlers/read.rb", __dir__),
 ].freeze
 ETAG_SPEC_DIRECT_CALL = /\bEtag\.for_file\b/
 
diff --git a/spec/conformance/docs_links_spec.rb b/spec/conformance/docs_links_spec.rb
index f018f1e51..fbf366a06 100644
--- a/spec/conformance/docs_links_spec.rb
+++ b/spec/conformance/docs_links_spec.rb
@@ -21,12 +21,12 @@
                   .gsub(/^[ \t]*```.*?^[ \t]*```/m, "") # fenced code blocks
                   .gsub(/`[^`\n]*`/, "")                # inline code spans (single line)
     targets = content.scan(/\]\(([^)]+)\)/).flatten
-    rel = Pathname.new(file).relative_path_from(DOCS_REPO_ROOT).to_s # rubocop:disable RSpec/LeakyLocalVariable
+    rel = Pathname.new(file).relative_path_from(DOCS_REPO_ROOT).to_s
 
     targets.each do |target|
       next if target.start_with?("http://", "https://", "mailto:", "#")
 
-      path_part = target.split("#").first # rubocop:disable RSpec/LeakyLocalVariable
+      path_part = target.split("#").first
       next if path_part.nil? || path_part.empty?
 
       it "#{rel}: link resolves -> #{target}" do
diff --git a/spec/conformance/surface/cli/contract_spec.rb b/spec/conformance/surface/cli/contract_spec.rb
index bb2f340f4..d9667afad 100644
--- a/spec/conformance/surface/cli/contract_spec.rb
+++ b/spec/conformance/surface/cli/contract_spec.rb
@@ -34,7 +34,7 @@ def run_cli(argv, cwd:)
     end
   end
 
-  it "the auto-derived verb table matches the prior surface exactly" do # rubocop:disable RSpec/ExampleLength
+  it "the auto-derived verb table matches the prior surface exactly" do
     actual = Textus::Surface::CLI.verbs
     expected = {
       "accept" => Textus::Surface::CLI::Verb::GenAccept,
@@ -88,6 +88,7 @@ def run_cli(argv, cwd:)
       "open" => Textus::Surface::CLI::Verb::GenSessionOpen,
     )
     expect(Textus::Surface::CLI::Group::Schema.subcommands).to eq(
+      "list" => Textus::Surface::CLI::Verb::GenSchemaList,
       "show" => Textus::Surface::CLI::Verb::GenSchemaShow,
     )
   end
diff --git a/spec/integration/surface/mcp_agent_workflow_spec.rb b/spec/integration/surface/mcp_agent_workflow_spec.rb
new file mode 100644
index 000000000..54eb1a9ec
--- /dev/null
+++ b/spec/integration/surface/mcp_agent_workflow_spec.rb
@@ -0,0 +1,104 @@
+RSpec.describe "MCP agent workflow — end-to-end" do
+  include_context "textus/4 conformance fixture"
+
+  let(:agent_store) { Textus::Protocol::Session.open(root, role: "agent") }
+  let(:agent_server) { server_for(agent_store, role: "agent") }
+  let(:human_server) { server_for(human_store, role: "human") }
+  let(:human_store) { Textus::Protocol::Session.open(root, role: "human") }
+
+  def server_for(store, role:)
+    Textus::Surface::MCP::Server.new(store:, role:, stdin: StringIO.new, stdout: StringIO.new)
+  end
+
+  def dispatch(server, verb, args)
+    resp = server.dispatch(verb, args, nil)
+    raise "empty content for #{verb}" if resp.content.empty?
+
+    JSON.parse(resp.content.first[:text] || resp.content.first["text"])
+  rescue StandardError => e
+    raise "dispatch(#{verb}) failed: #{e.class}: #{e.message}"
+  end
+
+  it "session_open works end-to-end" do
+    result = dispatch(agent_server, :session_open, {})
+    expect(result).to have_key("session_id")
+    expect(result["status"]).to eq("active")
+  end
+
+  it "runs a full session_open → get → put → propose → accept → get cycle" do
+    # 1. session_open
+    open_result = dispatch(agent_server, :session_open, {})
+    session_id = open_result["session_id"]
+
+    # 2. get the session entry
+    get_session = dispatch(agent_server, :get, { key: "scratchpad.sessions.#{session_id}.session" })
+    expect(get_session["key"]).to eq("scratchpad.sessions.#{session_id}.session")
+
+    # 3. put a knowledge entry (human)
+    put_result = dispatch(human_server, :put, {
+                            key: "knowledge.intent.0002-test-intent",
+                            _meta: { name: "0002-test-intent" },
+                            body: "# Test intent\n\nBody content.\n",
+                          })
+    expect(put_result["ok"]).to be true
+    expect(put_result["uid"]).to be_a(String)
+    intent_uid = put_result["uid"]
+
+    # 4. verify the entry
+    get_intent = dispatch(agent_server, :get, { key: "knowledge.intent.0002-test-intent" })
+    expect(get_intent.dig("_meta", "uid")).to eq(intent_uid)
+
+    # 5. propose a change
+    propose_result = dispatch(agent_server, :propose, {
+                                key: "intent-update",
+                                _meta: {
+                                  proposal: { target_key: "knowledge.intent.0002-test-intent", action: "put" },
+                                },
+                                body: "# Test intent (updated)\n\nUpdated body.\n",
+                              })
+    pending_key = propose_result["key"]
+
+    # 6. diff
+    diff_result = dispatch(agent_server, :diff, { pending_key: })
+    expect(diff_result["pending_key"]).to eq(pending_key)
+    expect(diff_result["target_key"]).to eq("knowledge.intent.0002-test-intent")
+
+    # 7. accept (human)
+    accept_result = dispatch(human_server, :accept, { pending_key: })
+    expect(accept_result["accepted"]).to eq(pending_key)
+
+    # 8. verify accepted content
+    get_updated = dispatch(agent_server, :get, { key: "knowledge.intent.0002-test-intent" })
+    expect(get_updated["body"]).to include("(updated)")
+
+    # 9. list
+    list_result = dispatch(agent_server, :list, { prefix: "knowledge.intent" })
+    expect(list_result.map { |e| e["key"] }).to include("knowledge.intent.0002-test-intent")
+
+    # 10. pulse
+    pulse_result = dispatch(agent_server, :pulse, {})
+    expect(pulse_result["cursor"]).to be > 0
+  end
+
+  it "rejects a proposal" do
+    propose_result = dispatch(agent_server, :propose, {
+                                key: "to-reject",
+                                _meta: {
+                                  proposal: { target_key: "knowledge.contacts.reject-person", action: "put" },
+                                },
+                                body: "Name: Test\nRelationship: peer\nOrg: Acme\n",
+                              })
+    pending_key = propose_result["key"]
+
+    reject_result = dispatch(human_server, :reject, { pending_key:, reason: "not needed" })
+    expect(reject_result["rejected"]).to eq(pending_key)
+    expect(reject_result["reason"]).to eq("not needed")
+
+    get_proposal = begin
+      dispatch(agent_server, :get, { key: pending_key })
+    rescue StandardError
+      nil
+    end
+    expect(get_proposal).to be_nil.or(be_a(Hash).and(have_key("error")))
+  end
+end
diff --git a/spec/integration/workflows/naming_check_spec.rb b/spec/integration/workflows/naming_check_spec.rb
index 1a431763c..cabf76a37 100644
--- a/spec/integration/workflows/naming_check_spec.rb
+++ b/spec/integration/workflows/naming_check_spec.rb
@@ -5,6 +5,8 @@
 
   def build_store
     FileUtils.mkdir_p(File.join(root, "data/knowledge/loop/judgment"))
+    FileUtils.mkdir_p(File.join(root, "data/artifacts"))
+    File.write(File.join(root, "data/artifacts/doctor.json"), JSON.dump({}))
     store_from_manifest(root, lanes: %w[knowledge artifacts], files: {
                           "workflows/config/doctors.rb" => File.read(".textus/workflows/config/doctors.rb"),
                         }, manifest: <<~YAML)
diff --git a/spec/support/contexts/conformance_fixture.rb b/spec/support/contexts/conformance_fixture.rb
index 2abd77c2b..093b46a07 100644
--- a/spec/support/contexts/conformance_fixture.rb
+++ b/spec/support/contexts/conformance_fixture.rb
@@ -14,7 +14,7 @@
     FileUtils.mkdir_p(File.join(root, "data/knowledge/contacts"))
     FileUtils.mkdir_p(File.join(root, "data/scratchpad/notes"))
     FileUtils.mkdir_p(File.join(root, "data/scratchpad/sessions"))
-    FileUtils.mkdir_p(File.join(root, "data/scratchpad/scripts"))
+    FileUtils.mkdir_p(File.join(root, "data/scratchpad/proposals"))
     FileUtils.mkdir_p(File.join(root, "data/raw"))
     FileUtils.mkdir_p(File.join(root, "data/artifacts"))
 
@@ -38,7 +38,7 @@
             tracked: false
           - key: scratchpad.sessions
             tracked: false
-          - key: scratchpad.scripts
+          - key: scratchpad.proposals
             tracked: false
         raw:
           - key: raw
diff --git a/spec/support/fixtures.rb b/spec/support/fixtures.rb
index d391b02ed..3aa52b4f7 100644
--- a/spec/support/fixtures.rb
+++ b/spec/support/fixtures.rb
@@ -124,12 +124,17 @@ def converge_now(store, prefix: nil, lane: nil, role: Textus::Value::Role::AUTOM
       end
     end
 
-    Textus::Workflow::Queue.new(
-      workflow_queue,
-      registry: registry,
+    consumer = Textus::Workflow::Consumer.new(
+      registry:,
       container: store.container,
       call: Textus::Value::Call.build(role: role, correlation_id: SecureRandom.uuid),
-    ).drain
+    )
+    loop do
+      row = workflow_queue.pop
+      break unless row
+
+      consumer.consume(row, workflow_queue)
+    end
   end
 
   def with_missing_workflows(store)
diff --git a/spec/support/matchers.rb b/spec/support/matchers.rb
index 1764ab766..3a8ba4022 100644
--- a/spec/support/matchers.rb
+++ b/spec/support/matchers.rb
@@ -32,29 +32,4 @@ def last_audit_row(store)
   end
 end
 
-# Result matchers for Textus::Value::Result (was Dry::Monads, replaced by ADR 0119 migration).
-#   expect(handler.call(...)).to be_success
-#   expect(handler.call(...)).to be_failure
-RSpec::Matchers.define :be_success do
-  match { |actual| actual.is_a?(Textus::Value::Result) && actual.success? }
-
-  failure_message do |actual|
-    if actual.is_a?(Textus::Value::Result)
-      "expected Success, got Failure(#{actual.error.inspect})"
-    else
-      "expected Success, got #{actual.class}"
-    end
-  end
-end
-
-RSpec::Matchers.define :be_failure do
-  match { |actual| actual.is_a?(Textus::Value::Result) && actual.failure? }
-
-  failure_message do |actual|
-    if actual.is_a?(Textus::Value::Result)
-      "expected Failure, got Success(#{actual.value.inspect})"
-    else
-      "expected Failure, got #{actual.class}"
-    end
-  end
-end
+# Result matchers removed (Textus::Value::Result was dead code — ADR 0119 migration completed)
diff --git a/spec/unit/events/async_queue_spec.rb b/spec/unit/events/async_queue_spec.rb
index 19d08afa7..b6e9a46ea 100644
--- a/spec/unit/events/async_queue_spec.rb
+++ b/spec/unit/events/async_queue_spec.rb
@@ -1,5 +1,5 @@
-RSpec.describe Textus::Protocol::Async::Queue do
-  subject(:queue) { described_class.new(workflow_queue) }
+RSpec.describe Textus::Workflow::Consumer do
+  subject(:consumer) { described_class.new(registry:, container:, call:) }
 
   let(:workflow_queue) { instance_double(Textus::Infra::Store::WorkflowQueue) }
   let(:registry) { instance_double(Textus::Workflow::Registry) }
@@ -12,21 +12,14 @@
     allow(registry).to receive(:for).with("materialize").and_return(workflow)
   end
 
-  describe "#consume_one" do
-    it "returns nil when there is no pending event" do
-      allow(workflow_queue).to receive(:pop).and_return(nil)
-
-      expect(queue.consume_one(registry:, container:, call:)).to be_nil
-    end
-
+  describe "#consume" do
     it "runs the workflow and marks the event done on success" do
-      allow(workflow_queue).to receive(:pop).and_return(pending_row)
       allow(workflow_queue).to receive(:mark_processing)
       allow(Textus::Workflow::Runner).to receive(:new).with(workflow, container:, call:)
                                                       .and_return(instance_double(Textus::Workflow::Runner, run: nil))
       allow(workflow_queue).to receive(:complete)
 
-      result = queue.consume_one(registry:, container:, call:)
+      result = consumer.consume(pending_row, workflow_queue)
 
       expect(workflow_queue).to have_received(:mark_processing).with(1)
       expect(workflow_queue).to have_received(:complete).with(1)
@@ -34,12 +27,11 @@
     end
 
     it "reschedules with backoff when the workflow raises and retries remain" do
-      allow(workflow_queue).to receive(:pop).and_return(pending_row)
       allow(workflow_queue).to receive(:mark_processing)
       allow(Textus::Workflow::Runner).to receive(:new).with(workflow, container:, call:).and_raise(StandardError.new("boom"))
       allow(workflow_queue).to receive(:reschedule)
 
-      result = queue.consume_one(registry:, container:, call:)
+      result = consumer.consume(pending_row, workflow_queue)
 
       expect(workflow_queue).to have_received(:mark_processing).with(1)
       expect(workflow_queue).to have_received(:reschedule).with(1, retry_count: 1, delay: 10, error: "boom")
@@ -48,12 +40,11 @@
 
     it "marks the event failed (dead-letters it) once max_attempts is reached" do
       exhausted_row = pending_row.merge(retry_count: 2, max_attempts: 3)
-      allow(workflow_queue).to receive(:pop).and_return(exhausted_row)
       allow(workflow_queue).to receive(:mark_processing)
       allow(Textus::Workflow::Runner).to receive(:new).with(workflow, container:, call:).and_raise(StandardError.new("boom"))
       allow(workflow_queue).to receive(:fail)
 
-      result = queue.consume_one(registry:, container:, call:)
+      result = consumer.consume(exhausted_row, workflow_queue)
 
       expect(workflow_queue).to have_received(:fail).with(1, retry_count: 3, error: "boom")
       expect(result[:state]).to eq("failed")
diff --git a/spec/unit/events/consumer_spec.rb b/spec/unit/events/consumer_spec.rb
index ce9c7d666..61324a666 100644
--- a/spec/unit/events/consumer_spec.rb
+++ b/spec/unit/events/consumer_spec.rb
@@ -1,44 +1,53 @@
-RSpec.describe Textus::Workflow::Queue do
-  subject(:queue) { described_class.new(workflow_queue, registry:, container:, call:) }
+RSpec.describe Textus::Workflow::Consumer do
+  subject(:consumer) { described_class.new(registry:, container:, call:) }
 
-  let(:workflow_queue) { instance_double(Textus::Infra::Store::WorkflowQueue) }
   let(:registry) { instance_double(Textus::Workflow::Registry) }
-  let(:workflow) { instance_double(Textus::Workflow::DSL::Definition, type: "materialize") }
   let(:container) { instance_double(Textus::Protocol::Container) }
   let(:call) { instance_double(Textus::Value::Call) }
-  let(:pending_row) { { id: 1, key: "knowledge.a", workflow_type: "materialize", retry_count: 0, max_attempts: 3, state: "pending" } }
-  let(:terminal_row) { { id: 2, key: "knowledge.b", workflow_type: "materialize", retry_count: 3, max_attempts: 3, state: "pending" } }
+  let(:workflow) { instance_double(Textus::Workflow::DSL::Definition, type: "materialize") }
+  let(:workflow_queue) { instance_double(Textus::Infra::Store::WorkflowQueue) }
+  let(:pending_row) { { id: 1, key: "knowledge.a", workflow_type: "materialize", retry_count: 0, max_attempts: 3 } }
+  let(:terminal_row) { { id: 2, key: "knowledge.b", workflow_type: "materialize", retry_count: 3, max_attempts: 3 } }
 
   before do
     allow(registry).to receive(:for).with("materialize").and_return(workflow)
   end
 
-  describe "#drain" do
-    it "loops until pop returns nil, tallying completed and failed" do
-      rows = [
-        pending_row.merge(id: 1),
-        pending_row.merge(id: 2, retry_count: 3, max_attempts: 3),
-        nil,
-      ]
-      allow(workflow_queue).to receive(:pop).and_return(*rows)
-      call_count = 0
-      allow(Textus::Workflow::Runner).to receive(:new) do
-        call_count += 1
-        runner = instance_double(Textus::Workflow::Runner)
-        if call_count == 1
-          allow(runner).to receive(:run)
-        else
-          allow(runner).to receive(:run).and_raise(StandardError.new("boom"))
-        end
-        runner
-      end
+  describe "#consume" do
+    it "runs the workflow and marks complete on success" do
       allow(workflow_queue).to receive(:mark_processing)
       allow(workflow_queue).to receive(:complete)
+      allow(Textus::Workflow::Runner).to receive(:new).and_return(
+        instance_double(Textus::Workflow::Runner, run: nil),
+      )
+
+      result = consumer.consume(pending_row, workflow_queue)
+
+      expect(workflow_queue).to have_received(:mark_processing).with(1)
+      expect(workflow_queue).to have_received(:complete).with(1)
+      expect(result[:state]).to eq("done")
+    end
+
+    it "fails when max_attempts reached" do
+      allow(workflow_queue).to receive(:mark_processing)
       allow(workflow_queue).to receive(:fail)
+      allow(Textus::Workflow::Runner).to receive(:new).and_raise(StandardError.new("boom"))
+
+      result = consumer.consume(terminal_row, workflow_queue)
+
+      expect(workflow_queue).to have_received(:fail).with(2, retry_count: 4, error: "boom")
+      expect(result[:state]).to eq("failed")
+    end
+
+    it "reschedules with backoff when retries remain" do
+      allow(workflow_queue).to receive(:mark_processing)
+      allow(workflow_queue).to receive(:reschedule)
+      allow(Textus::Workflow::Runner).to receive(:new).and_raise(StandardError.new("boom"))
 
-      result = queue.drain
+      result = consumer.consume(pending_row, workflow_queue)
 
-      expect(result).to eq(completed: 1, failed: 1)
+      expect(workflow_queue).to have_received(:reschedule).with(1, retry_count: 1, delay: 10, error: "boom")
+      expect(result[:state]).to eq("retrying")
     end
   end
 end
diff --git a/spec/unit/events/emitter_spec.rb b/spec/unit/events/emitter_spec.rb
index 77515dc00..8131185c3 100644
--- a/spec/unit/events/emitter_spec.rb
+++ b/spec/unit/events/emitter_spec.rb
@@ -1,23 +1,21 @@
-RSpec.describe Textus::Workflow::Queue do
-  subject(:queue) { described_class.new(workflow_queue, registry:, container:, call:) }
+RSpec.describe Textus::Workflow::EventEmitter do
+  subject(:emitter) { described_class.new(workflow_queue, registry:) }
 
   let(:workflow_queue) { instance_double(Textus::Infra::Store::WorkflowQueue) }
   let(:registry) { instance_double(Textus::Workflow::Registry) }
   let(:materialize) { instance_double(Textus::Workflow::DSL::Definition, type: "materialize", max_attempts: 3) }
-  let(:container) { instance_double(Textus::Protocol::Container) }
-  let(:call) { instance_double(Textus::Value::Call) }
 
-  describe "#enqueue" do
+  describe "#emit" do
     before { allow(workflow_queue).to receive(:push) }
 
     it "emits one event per workflow registered for the event type" do
       allow(registry).to receive(:workflows_for).with("entry.written").and_return([materialize])
 
-      count = queue.enqueue(event_type: "entry.written", key: "knowledge.a", lane: "knowledge")
+      count = emitter.emit(event_type: "entry.written", key: "knowledge.a", lane: "knowledge")
 
       expect(workflow_queue).to have_received(:push).with(
         event_type: "entry.written", workflow_type: "materialize",
-        key: "knowledge.a", lane: "knowledge", payload: nil,
+        key: "knowledge.a", lane: "knowledge",
         max_attempts: 3
       )
       expect(count).to eq(1)
@@ -26,7 +24,7 @@
     it "returns 0 and emits nothing when no workflow handles the event type" do
       allow(registry).to receive(:workflows_for).with("entry.written").and_return([])
 
-      expect(queue.enqueue(event_type: "entry.written", key: "knowledge.a", lane: "knowledge")).to eq(0)
+      expect(emitter.emit(event_type: "entry.written", key: "knowledge.a", lane: "knowledge")).to eq(0)
       expect(workflow_queue).not_to have_received(:push)
     end
   end
diff --git a/spec/unit/events/retry_policy_spec.rb b/spec/unit/events/retry_policy_spec.rb
deleted file mode 100644
index 8472f81ee..000000000
--- a/spec/unit/events/retry_policy_spec.rb
+++ /dev/null
@@ -1,40 +0,0 @@
-require "spec_helper"
-
-RSpec.describe Textus::Workflow::RetryPolicy do
-  subject(:policy) { described_class.new }
-
-  describe "#decide" do
-    it "is terminal when retry_count has reached max_attempts" do
-      decision = policy.decide(retry_count: 3, max_attempts: 3)
-      expect(decision).to be_terminal
-    end
-
-    it "is terminal when retry_count exceeds max_attempts" do
-      decision = policy.decide(retry_count: 5, max_attempts: 3)
-      expect(decision).to be_terminal
-    end
-
-    it "is not terminal and returns the first backoff delay on the first retry" do
-      decision = policy.decide(retry_count: 1, max_attempts: 3)
-      expect(decision).not_to be_terminal
-      expect(decision.delay).to eq(10)
-    end
-
-    it "returns increasing delays for later retries" do
-      expect(policy.decide(retry_count: 2, max_attempts: 5).delay).to eq(30)
-      expect(policy.decide(retry_count: 3, max_attempts: 5).delay).to eq(60)
-    end
-
-    it "clamps delay to the longest configured backoff for retries beyond the curve" do
-      decision = policy.decide(retry_count: 10, max_attempts: 20)
-      expect(decision.delay).to eq(60)
-    end
-
-    it "accepts a custom backoff curve" do
-      custom = described_class.new(backoff_delays: [5, 15])
-      expect(custom.decide(retry_count: 1, max_attempts: 3).delay).to eq(5)
-      expect(custom.decide(retry_count: 2, max_attempts: 3).delay).to eq(15)
-      expect(custom.decide(retry_count: 3, max_attempts: 4).delay).to eq(15)
-    end
-  end
-end
diff --git a/spec/unit/ingest/handlers_spec.rb b/spec/unit/ingest/handlers_spec.rb
index 795cf077c..e7aae29ce 100644
--- a/spec/unit/ingest/handlers_spec.rb
+++ b/spec/unit/ingest/handlers_spec.rb
@@ -14,7 +14,7 @@ def mock_container(manifest:, store:, layout: nil)
       layout = instance_double("Layout")
       container = mock_container(manifest:, store:, layout:)
       call = instance_double(Call, role: "agent", correlation_id: "abc")
-      ctx = Textus::Protocol::Handlers::Context.new(container, store_engine: store_engine, call:)
+      ctx = Textus::Protocol::Handlers::CommandContext.new(store_engine, container, call:)
 
       entry = double("entry", entry: instance_double(Mentry, format: "yaml", lane: "raw"))
       allow(manifest.resolver).to receive(:resolve).and_return(entry)
@@ -47,7 +47,7 @@ def mock_container(manifest:, store:, layout: nil)
       layout = instance_double("Layout")
       container = mock_container(manifest:, store:, layout:)
       call = instance_double(Call, role: "agent", correlation_id: "abc")
-      ctx = Textus::Protocol::Handlers::Context.new(container, store_engine: store_engine, call:)
+      ctx = Textus::Protocol::Handlers::CommandContext.new(store_engine, container, call:)
 
       entry = double("entry", entry: instance_double(Mentry, format: "yaml", lane: "raw"))
       allow(manifest.resolver).to receive(:resolve).with("raw.2026.07.03.url-test").and_return(entry)
@@ -57,10 +57,9 @@ def mock_container(manifest:, store:, layout: nil)
       allow(Textus::Lanes::Ingest::EntryTypes).to receive(:for).with("url").and_return(Textus::Lanes::Ingest::EntryTypes::Link)
       allow(Textus::Lanes::Ingest::Dedup).to receive(:find).and_return("raw.2026.06.01.old")
       allow(Textus::Lanes::Ingest::Resolver).to receive(:supersede)
-      allow(store_engine).to receive(:put).and_return(instance_double(Envelope, uid: "uid456", etag: "etag789"))
-      allow(store_engine).to receive(:read).and_return(
-        instance_double(Envelope, content: { "ingest_count" => 1 }),
-      )
+      allow(store_engine).to receive_messages(put: instance_double(Envelope, uid: "uid456", etag: "etag789"),
+                                              read: instance_double(Envelope,
+                                                                    content: { "ingest_count" => 1 }))
       allow(Textus::Lanes::Ingest::IndexRebuilder).to receive(:rebuild!)
 
       allow(Time).to receive(:now).and_return(Time.new(2026, 7, 3, 12, 0, 0, "UTC"))
@@ -89,7 +88,7 @@ def mock_container(manifest:, store:, layout: nil)
     it "returns failure for invalid kind" do
       store_engine = instance_double(Textus::Protocol::StoreEngine)
       container = double("Container", workflow_registry: nil)
-      ctx = Textus::Protocol::Handlers::Context.new(container, store_engine: store_engine, call: instance_double(Call))
+      ctx = Textus::Protocol::Handlers::CommandContext.new(store_engine, container, call: instance_double(Call))
       call = instance_double(Call)
 
       expect { described_class.ingest(kind: "invalid", slug: "test", ctx:, call:) }
diff --git a/spec/unit/ingest/resolver_spec.rb b/spec/unit/ingest/resolver_spec.rb
index c6e03ebc8..d78b0a84e 100644
--- a/spec/unit/ingest/resolver_spec.rb
+++ b/spec/unit/ingest/resolver_spec.rb
@@ -25,7 +25,7 @@ def mock_container(manifest:, store:)
       }
 
       call = instance_double(Call, role: "automation", correlation_id: "abc")
-      ctx = Textus::Protocol::Handlers::Context.new(container, store_engine: store_engine, call:)
+      ctx = Textus::Protocol::Handlers::CommandContext.new(store_engine, container, call:)
 
       described_class.supersede("raw.2026.06.01.old", "raw.2026.07.03.new", ctx:, call:)
 
@@ -47,7 +47,7 @@ def mock_container(manifest:, store:)
       allow(store_engine).to receive(:put)
 
       call = instance_double(Call, role: "automation", correlation_id: "abc")
-      ctx = Textus::Protocol::Handlers::Context.new(container, store_engine: store_engine, call:)
+      ctx = Textus::Protocol::Handlers::CommandContext.new(store_engine, container, call:)
 
       described_class.supersede("raw.2026.06.01.old", "raw.2026.07.03.new", ctx:, call:)
 
diff --git a/spec/unit/lanes/knowledge/handlers_spec.rb b/spec/unit/lanes/knowledge/handlers_spec.rb
index 2b709bf8e..5add21a27 100644
--- a/spec/unit/lanes/knowledge/handlers_spec.rb
+++ b/spec/unit/lanes/knowledge/handlers_spec.rb
@@ -2,7 +2,7 @@
   describe ".loop" do
     let(:manifest) do
       d = double("ManifestData")
-      double("Manifest", data: d).tap { |m| allow(d).to receive(:entries).and_return([]) }
+      double("Manifest", data: d).tap { |_m| allow(d).to receive(:entries).and_return([]) }
     end
 
     it "returns the 8 canonical loop nodes" do
@@ -10,34 +10,34 @@
       result = described_class.loop(ctx:, call: nil)
       expect(result["count"]).to eq(8)
       expect(result["loop"].map { |n| n["name"] }).to eq(%w[
-        intent constraint.repo constraint.protocol
-        judgment.engineering judgment.agent-behavior
-        evidence execution feedback
-      ])
+                                                           intent constraint.repo constraint.protocol
+                                                           judgment.engineering judgment.agent-behavior
+                                                           evidence execution feedback
+                                                         ])
     end
 
     it "maps each node to its manifest entry key" do
       ctx = build_ctx(manifest)
       result = described_class.loop(ctx:, call: nil)
       expect(result["loop"].map { |n| n["key"] }).to eq([
-        "knowledge.loop.intent",
-        "knowledge.loop.constraint.repo",
-        "knowledge.loop.constraint.protocol",
-        "knowledge.loop.judgment.engineering",
-        "knowledge.loop.judgment.agent-behavior",
-        "knowledge.loop.evidence",
-        "knowledge.loop.execution.runbook",
-        "knowledge.loop.feedback",
-      ])
+                                                          "knowledge.loop.intent",
+                                                          "knowledge.loop.constraint.repo",
+                                                          "knowledge.loop.constraint.protocol",
+                                                          "knowledge.loop.judgment.engineering",
+                                                          "knowledge.loop.judgment.agent-behavior",
+                                                          "knowledge.loop.evidence",
+                                                          "knowledge.loop.execution.runbook",
+                                                          "knowledge.loop.feedback",
+                                                        ])
     end
 
     def build_ctx(manifest = nil)
       cursor_store = double("cursor_store", get_loop: { role: "agent", index: 0 })
       entry_index = double("entry_index", search: [])
       if manifest
-        double("Textus::Protocol::Handlers::Context", cursor_store:, entry_index:, manifest:)
+        double("Textus::Protocol::Handlers::QueryContext", cursor_store:, entry_index:, manifest:)
       else
-        double("Textus::Protocol::Handlers::Context", cursor_store:, entry_index:)
+        double("Textus::Protocol::Handlers::QueryContext", cursor_store:, entry_index:)
       end
     end
   end
diff --git a/spec/unit/lanes/scratchpad/handlers_spec.rb b/spec/unit/lanes/scratchpad/handlers_spec.rb
index 3dd1b0458..0e06dee62 100644
--- a/spec/unit/lanes/scratchpad/handlers_spec.rb
+++ b/spec/unit/lanes/scratchpad/handlers_spec.rb
@@ -1,22 +1,14 @@
 RSpec.describe Textus::Lanes::Scratchpad::Handlers do
   describe ".session_open" do
-    it "creates session entry and workspace directories" do
-      ctx = instance_double("Textus::Protocol::Handlers::Context")
-      layout = instance_double("Layout")
-      allow(ctx).to receive(:layout).and_return(layout)
-      allow(layout).to receive(:lane_path).with("scratchpad").and_return("/tmp/textus/data/scratchpad")
-
-      expect(FileUtils).to receive(:mkdir_p).with("/tmp/textus/data/scratchpad/sessions/test-uuid-123/scripts")
-      expect(FileUtils).to receive(:mkdir_p).with("/tmp/textus/data/scratchpad/sessions/test-uuid-123/notes")
-      expect(FileUtils).to receive(:mkdir_p).with("/tmp/textus/data/scratchpad/sessions/test-uuid-123/output")
-
+    it "creates session entry" do
+      ctx = instance_double("Textus::Protocol::Handlers::CommandContext")
       manifest = double("Manifest")
       data = double("ManifestData")
       mentry = double("Mentry")
       allow(manifest).to receive(:data).and_return(data)
       allow(data).to receive(:entries).and_return([mentry])
       allow(mentry).to receive(:key).and_return("scratchpad.sessions")
-      allow(ctx).to receive(:manifest).and_return(manifest)
+      allow(ctx).to receive_messages(manifest: manifest, container: nil)
       allow(ctx).to receive(:put)
       allow(SecureRandom).to receive(:uuid).and_return("test-uuid-123")
 
@@ -28,7 +20,7 @@
 
   describe ".session_close" do
     it "seals an active session" do
-      ctx = instance_double("Textus::Protocol::Handlers::Context")
+      ctx = instance_double("Textus::Protocol::Handlers::CommandContext")
       manifest = double("Manifest")
       data = double("ManifestData")
       mentry = double("Mentry")
@@ -45,7 +37,7 @@
     end
 
     it "returns error for missing session" do
-      ctx = instance_double("Textus::Protocol::Handlers::Context")
+      ctx = instance_double("Textus::Protocol::Handlers::CommandContext")
       allow(ctx).to receive(:read).and_return(nil)
 
       expect { described_class.session_close(session_id: "missing", ctx:, call: nil) }
diff --git a/spec/unit/lanes/scratchpad/proposal_handlers_spec.rb b/spec/unit/lanes/scratchpad/proposal_handlers_spec.rb
index 8c32e80b7..0933d7a2b 100644
--- a/spec/unit/lanes/scratchpad/proposal_handlers_spec.rb
+++ b/spec/unit/lanes/scratchpad/proposal_handlers_spec.rb
@@ -12,7 +12,7 @@ def mock_container(manifest:, store:)
       store = instance_double(Textus::Infra::Store, file_system: nil)
       container = mock_container(manifest:, store:)
       call = instance_double(Call, role: "human", correlation_id: "abc")
-      ctx = Textus::Protocol::Handlers::Context.new(container, store_engine: store_engine, call:)
+      ctx = Textus::Protocol::Handlers::CommandContext.new(store_engine, container, call:)
       entry = double("entry", entry: instance_double(Mentry))
       allow(manifest.resolver).to receive(:resolve).with("scratchpad.proposals.decisions.feature-x").and_return(entry)
       env = instance_double(Envelope)
@@ -40,11 +40,13 @@ def mock_container(manifest:, store:)
       store = instance_double(Textus::Infra::Store, file_system: nil)
       container = mock_container(manifest:, store:)
       call = instance_double(Call, role: "human", correlation_id: "abc")
-      ctx = Textus::Protocol::Handlers::Context.new(container, store_engine: store_engine, call:)
+      ctx = Textus::Protocol::Handlers::CommandContext.new(store_engine, container, call:)
 
       pending_env = instance_double(Envelope,
-                                    meta: { "proposal" => { "target_key" => "knowledge.foo", "action" => "put" } },
-                                    body: "proposed content")
+                                    meta: { "proposal" => { "target_key" => "knowledge.foo", "action" => "put" },
+                                            "name" => "test-entry" },
+                                    body: "proposed content",
+                                    content: nil)
       allow(store_engine).to receive(:read).with(key: "scratchpad.proposals.test").and_return(pending_env)
 
       entry = double("entry", entry: instance_double(Mentry))
@@ -54,18 +56,46 @@ def mock_container(manifest:, store:)
 
       result = described_class.accept(pending_key: "scratchpad.proposals.test", dry_run: false, ctx:, call:)
 
-      expect(store_engine).to have_received(:put).with(hash_including(key: "knowledge.foo"))
+      expect(store_engine).to have_received(:put).with(
+        hash_including(key: "knowledge.foo", meta: { "name" => "test-entry" }, content: nil),
+      )
       expect(store_engine).to have_received(:delete).with(hash_including(key: "scratchpad.proposals.test"))
       expect(result["accepted"]).to eq("scratchpad.proposals.test")
     end
 
+    it "preserves structured content from JSON proposals on accept" do
+      manifest = instance_double(Manifest, resolver: instance_double("Resolver"))
+      store_engine = instance_double(Textus::Protocol::StoreEngine)
+      store = instance_double(Textus::Infra::Store, file_system: nil)
+      container = mock_container(manifest:, store:)
+      call = instance_double(Call, role: "human", correlation_id: "abc")
+      ctx = Textus::Protocol::Handlers::CommandContext.new(store_engine, container, call:)
+
+      pending_env = instance_double(Envelope,
+                                    meta: { "proposal" => { "target_key" => "knowledge.foo", "action" => "put" } },
+                                    body: nil,
+                                    content: { "data" => 1 })
+      allow(store_engine).to receive(:read).with(key: "scratchpad.proposals.test").and_return(pending_env)
+
+      entry = double("entry", entry: instance_double(Mentry))
+      allow(manifest.resolver).to receive(:resolve).with("knowledge.foo").and_return(entry)
+      allow(store_engine).to receive(:put)
+      allow(store_engine).to receive(:delete)
+
+      described_class.accept(pending_key: "scratchpad.proposals.test", dry_run: false, ctx:, call:)
+
+      expect(store_engine).to have_received(:put).with(
+        hash_including(key: "knowledge.foo", content: { "data" => 1 }),
+      )
+    end
+
     it "returns dry_run diff without writing" do
       manifest = instance_double(Manifest)
       store_engine = instance_double(Textus::Protocol::StoreEngine)
       store = instance_double(Textus::Infra::Store, file_system: nil)
       container = mock_container(manifest:, store:)
       call = instance_double(Call, role: "human", correlation_id: "abc")
-      ctx = Textus::Protocol::Handlers::Context.new(container, store_engine: store_engine, call:)
+      ctx = Textus::Protocol::Handlers::CommandContext.new(store_engine, container, call:)
 
       pending_env = instance_double(Envelope,
                                     meta: { "proposal" => { "target_key" => "knowledge.foo", "action" => "put" } },
@@ -88,7 +118,7 @@ def mock_container(manifest:, store:)
       manifest = instance_double(Manifest)
       container = mock_container(manifest:, store:)
       call = instance_double(Call, role: "human", correlation_id: "abc")
-      ctx = Textus::Protocol::Handlers::Context.new(container, store_engine: store_engine, call:)
+      ctx = Textus::Protocol::Handlers::CommandContext.new(store_engine, container, call:)
       env = instance_double(Envelope, meta: {})
       allow(store_engine).to receive(:read).and_return(env)
 
@@ -104,7 +134,7 @@ def mock_container(manifest:, store:)
       manifest = instance_double(Manifest)
       container = mock_container(manifest:, store:)
       call = instance_double(Call, role: "human", correlation_id: "abc")
-      ctx = Textus::Protocol::Handlers::Context.new(container, store_engine: store_engine, call:)
+      ctx = Textus::Protocol::Handlers::CommandContext.new(store_engine, container, call:)
 
       env = instance_double(Envelope, meta: { "proposal" => { "target_key" => "knowledge.foo" } })
       allow(store_engine).to receive(:read).with(key: "scratchpad.proposals.test").and_return(env)
@@ -123,7 +153,7 @@ def mock_container(manifest:, store:)
       manifest = instance_double(Manifest)
       container = mock_container(manifest:, store:)
       call = instance_double(Call, role: "human", correlation_id: "abc")
-      ctx = Textus::Protocol::Handlers::Context.new(container, store_engine: store_engine, call:)
+      ctx = Textus::Protocol::Handlers::CommandContext.new(store_engine, container, call:)
       env = instance_double(Envelope, meta: {})
       allow(store_engine).to receive(:read).and_return(env)
 
@@ -141,7 +171,7 @@ def mock_container(manifest:, store:)
       store = instance_double(Textus::Infra::Store, file_system: nil)
       container = mock_container(manifest:, store:)
       call = instance_double(Call, role: "human", correlation_id: "abc")
-      ctx = Textus::Protocol::Handlers::Context.new(container, store_engine: store_engine, call:)
+      ctx = Textus::Protocol::Handlers::CommandContext.new(store_engine, container, call:)
 
       env = instance_double(Envelope,
                             meta: { "proposal" => { "target_key" => "knowledge.foo" }, "_meta" => { "schema" => "v2" } },
@@ -172,7 +202,7 @@ def mock_container(manifest:, store:)
       manifest = instance_double(Manifest)
       container = mock_container(manifest:, store:)
       call = instance_double(Call, role: "human", correlation_id: "abc")
-      ctx = Textus::Protocol::Handlers::Context.new(container, store_engine: store_engine, call:)
+      ctx = Textus::Protocol::Handlers::CommandContext.new(store_engine, container, call:)
       env = instance_double(Envelope, meta: {})
       allow(store_engine).to receive(:read).and_return(env)
 
diff --git a/spec/unit/manifest/policy_spec.rb b/spec/unit/manifest/policy_spec.rb
new file mode 100644
index 000000000..356f1a5ad
--- /dev/null
+++ b/spec/unit/manifest/policy_spec.rb
@@ -0,0 +1,60 @@
+RSpec.describe Textus::Protocol::Manifest::Policy do
+  subject(:policy) { described_class.new(data) }
+
+  let(:data) { instance_double(Textus::Protocol::Manifest::Data) }
+
+  describe "#allowed?" do
+    it "allows a writer in V4::LANES for the lane" do
+      result = policy.allowed?(role: :human, lane: "knowledge")
+      expect(result).to be true
+    end
+
+    it "denies a non-writer for the lane" do
+      result = policy.allowed?(role: :automation, lane: "knowledge")
+      expect(result).to be false
+    end
+
+    it "allows the automation role in artifacts lane" do
+      result = policy.allowed?(role: :automation, lane: "artifacts")
+      expect(result).to be true
+    end
+
+    it "allows all roles in raw lane" do
+      %i[human agent automation].each do |role|
+        expect(policy.allowed?(role:, lane: "raw")).to be true
+      end
+    end
+
+    it "returns false for an unknown lane" do
+      result = policy.allowed?(role: :human, lane: "nonexistent")
+      expect(result).to be false
+    end
+  end
+
+  describe "#allowed!" do
+    it "does not raise for an allowed role" do
+      expect { policy.allowed!(role: :human, lane: "knowledge") }.not_to raise_error
+    end
+
+    it "raises WriteForbidden for a disallowed role" do
+      expect { policy.allowed!(role: :automation, lane: "knowledge") }
+        .to raise_error(Textus::WriteForbidden)
+    end
+  end
+
+  describe "#writers_for" do
+    it "returns writers for a known lane" do
+      expect(policy.writers_for("knowledge")).to eq(%w[human])
+    end
+
+    it "returns empty array for unknown lane" do
+      expect(policy.writers_for("unknown")).to eq([])
+    end
+  end
+
+  describe "#actor_for" do
+    it "returns the first writer for the lane" do
+      expect(policy.actor_for("knowledge")).to eq("human")
+    end
+  end
+end
diff --git a/spec/unit/protocol/builder/runtime_spec.rb b/spec/unit/protocol/builder/runtime_spec.rb
new file mode 100644
index 000000000..1a07ec157
--- /dev/null
+++ b/spec/unit/protocol/builder/runtime_spec.rb
@@ -0,0 +1,55 @@
+RSpec.describe Textus::Protocol::Builder::Runtime do # rubocop:disable RSpec/MultipleMemoizedHelpers
+  let(:layout) { instance_double(Textus::Protocol::Layout) }
+  let(:database) { instance_double(Textus::Infra::Database) }
+  let(:file_system) { instance_double(Textus::Infra::FileSystem) }
+  let(:store) { instance_double(Textus::Infra::Store) }
+  let(:infra) do
+    instance_double(Textus::Protocol::Builder::Infrastructure::Components,
+                    database: database, file_system: file_system, store: store, layout: layout)
+  end
+  let(:manifest) { instance_double(Textus::Protocol::Manifest) }
+  let(:resolver) { instance_double(Textus::Protocol::Manifest::Resolver) }
+  let(:schemas) { instance_double(Textus::Protocol::Schema::Registry) }
+  let(:workflows) { double("workflows") }
+  let(:workflow_registry) { instance_double(Textus::Workflow::Registry) }
+  let(:domain) do
+    instance_double(Textus::Protocol::Builder::Domain::Components,
+                    manifest: manifest, schemas: schemas,
+                    workflows: workflows, workflow_registry: workflow_registry)
+  end
+
+  before do
+    allow(manifest).to receive_messages(resolver: resolver, policy: double)
+    allow(store).to receive(:workflow_queue).and_return(double)
+    allow(layout).to receive(:root).and_return("/tmp/test")
+    allow(file_system).to receive(:respond_to?).with(:exists?).and_return(true)
+    allow(file_system).to receive(:respond_to?).with(:mtime).and_return(true)
+    allow(file_system).to receive(:respond_to?).with(:read).and_return(true)
+  end
+
+  it "builds a StoreEngine" do
+    result = subject.call(infra: infra, domain: domain, root: "/tmp/test")
+    expect(result.store_engine).to be_a(Textus::Protocol::StoreEngine)
+  end
+
+  it "builds a Gate wired to the StoreEngine" do
+    result = subject.call(infra: infra, domain: domain, root: "/tmp/test")
+    expect(result.gate).to be_a(Textus::Protocol::Gate)
+  end
+
+  it "builds a Container with all components" do
+    result = subject.call(infra: infra, domain: domain, root: "/tmp/test")
+    expect(result.container).to be_a(Textus::Protocol::Container)
+    expect(result.container.store).to eq(store)
+    expect(result.container.layout).to eq(layout)
+    expect(result.container.manifest).to eq(manifest)
+    expect(result.container.schemas).to eq(schemas)
+  end
+
+  it "wires store_engine on the Container" do
+    result = subject.call(infra: infra, domain: domain, root: "/tmp/test")
+    store_engine = result.store_engine
+    expect(store_engine).to respond_to(:read)
+    expect(store_engine).to respond_to(:put)
+  end
+end
diff --git a/spec/unit/protocol/gate_routing_spec.rb b/spec/unit/protocol/gate_routing_spec.rb
index ffd5a2880..993e96c68 100644
--- a/spec/unit/protocol/gate_routing_spec.rb
+++ b/spec/unit/protocol/gate_routing_spec.rb
@@ -1,5 +1,6 @@
 RSpec.describe Textus::Protocol::Gate do
-  let(:manifest) { instance_double("Manifest", resolver:) }
+  let(:policy) { instance_double(Textus::Protocol::Manifest::Policy) }
+  let(:manifest) { instance_double(Manifest, resolver:, policy:) }
   let(:resolver) { instance_double("Resolver") }
   let(:store) { instance_double(Textus::Infra::Store, file_system: nil) }
   let(:store_engine) { double("StoreEngine") }
@@ -21,7 +22,7 @@ def lane_spec(lane:)
       allow(Textus::Protocol::VerbRegistry).to receive(:for).with(:ingest).and_return(lane_spec(lane: :ingest))
 
       expect(handler).to receive(:ingest) do |**kwargs|
-        expect(kwargs[:ctx]).to be_a(Textus::Protocol::Handlers::Context)
+        expect(kwargs[:ctx]).to be_a(Textus::Protocol::Handlers::CommandContext)
         expect(kwargs[:ctx].store_engine).to eq(store_engine)
         expect(kwargs[:call]).to be_a(Textus::Value::Call)
       end
diff --git a/spec/unit/protocol/handlers/command_context_spec.rb b/spec/unit/protocol/handlers/command_context_spec.rb
new file mode 100644
index 000000000..762d724dd
--- /dev/null
+++ b/spec/unit/protocol/handlers/command_context_spec.rb
@@ -0,0 +1,51 @@
+RSpec.describe Textus::Protocol::Handlers::CommandContext do
+  subject(:ctx) { described_class.new(store_engine, container, call) }
+
+  let(:store_engine) { instance_double("Textus::Protocol::StoreEngine") }
+  let(:container) { instance_double("Textus::Protocol::Container") }
+  let(:call) { instance_double("Textus::Value::Call") }
+  let(:store) { instance_double("Textus::Infra::Store") }
+
+  before do
+    allow(container).to receive_messages(manifest: double, schemas: double, layout: double, store: store, workflows: double,
+                                         workflow_registry: double)
+    allow(store).to receive_messages(link_store: double, entry_index: double, cursor_store: double, audit_log: double,
+                                     workflow_queue: double, file_system: double)
+  end
+
+  it "inherits from QueryContext" do
+    expect(described_class.superclass).to eq(Textus::Protocol::Handlers::QueryContext)
+  end
+
+  it "has read methods (inherited)" do
+    expect(store_engine).to receive(:read).with(key: "test.key")
+    ctx.read(key: "test.key")
+  end
+
+  it "delegates put to store_engine" do
+    expect(store_engine).to receive(:put).with(key: "test", meta: {}, body: nil, content: nil, call:)
+    ctx.put(key: "test", meta: {}, body: nil, content: nil, call:)
+  end
+
+  it "delegates delete to store_engine" do
+    expect(store_engine).to receive(:delete).with(key: "test", call:)
+    ctx.delete(key: "test", call:)
+  end
+
+  it "delegates move to store_engine" do
+    expect(store_engine).to receive(:move).with(from_key: "a", to_key: "b", call:)
+    ctx.move(from_key: "a", to_key: "b", call:)
+  end
+
+  it "exposes audit_log" do
+    expect(ctx.audit_log).to eq(store.audit_log)
+  end
+
+  it "exposes workflow_queue" do
+    expect(ctx.workflow_queue).to eq(store.workflow_queue)
+  end
+
+  it "exposes file_system" do
+    expect(ctx.file_system).to eq(store.file_system)
+  end
+end
diff --git a/spec/unit/protocol/handlers/query_context_spec.rb b/spec/unit/protocol/handlers/query_context_spec.rb
new file mode 100644
index 000000000..20f85ba85
--- /dev/null
+++ b/spec/unit/protocol/handlers/query_context_spec.rb
@@ -0,0 +1,62 @@
+RSpec.describe Textus::Protocol::Handlers::QueryContext do
+  subject(:ctx) { described_class.new(store_engine, container, call) }
+
+  let(:store_engine) { instance_double("Textus::Protocol::StoreEngine") }
+  let(:container) { instance_double("Textus::Protocol::Container") }
+  let(:call) { instance_double("Textus::Value::Call") }
+  let(:store) { instance_double("Textus::Infra::Store") }
+
+  before do
+    allow(container).to receive_messages(manifest: double, schemas: double, layout: double, store: store)
+    allow(store).to receive_messages(link_store: double, entry_index: double, cursor_store: double)
+  end
+
+  it "exposes call" do
+    expect(ctx.call).to eq(call)
+  end
+
+  it "delegates read to store_engine" do
+    expect(store_engine).to receive(:read).with(key: "test.key")
+    ctx.read(key: "test.key")
+  end
+
+  it "delegates resolve to store_engine" do
+    expect(store_engine).to receive(:resolve).with(key: "test.key")
+    ctx.resolve(key: "test.key")
+  end
+
+  it "delegates list to store_engine" do
+    expect(store_engine).to receive(:list).with(prefix: "test")
+    ctx.list(prefix: "test")
+  end
+
+  it "delegates exists? to store_engine" do
+    expect(store_engine).to receive(:exists?).with(key: "test.key")
+    ctx.exists?(key: "test.key")
+  end
+
+  it "delegates mentry_for to store_engine" do
+    expect(store_engine).to receive(:mentry_for).with(key: "test.key")
+    ctx.mentry_for(key: "test.key")
+  end
+
+  it "does not respond to put" do
+    expect { ctx.put(key: "test", call: double) }.to raise_error(NoMethodError)
+  end
+
+  it "does not respond to delete" do
+    expect { ctx.delete(key: "test", call: double) }.to raise_error(NoMethodError)
+  end
+
+  it "does not respond to move" do
+    expect { ctx.move(from_key: "a", to_key: "b", call: double) }.to raise_error(NoMethodError)
+  end
+
+  it "exposes manifest via container" do
+    expect(ctx.manifest).to eq(container.manifest)
+  end
+
+  it "exposes schemas via container" do
+    expect(ctx.schemas).to eq(container.schemas)
+  end
+end
diff --git a/spec/unit/store/entry/write_step_spec.rb b/spec/unit/store/entry/write_step_spec.rb
index 0a7cfb21b..58af2720d 100644
--- a/spec/unit/store/entry/write_step_spec.rb
+++ b/spec/unit/store/entry/write_step_spec.rb
@@ -11,7 +11,7 @@
         key: key, mentry: mentry, payload: payload, if_etag: nil,
         path: nil, existing_env: nil, meta: nil, content: nil,
         bytes: nil, eff_meta: nil, eff_body: nil, eff_content: nil,
-        etag_before: nil, envelope: nil
+        etag_before: nil, envelope: nil, fmt: nil
       )
       updated = ctx.with(path: "/tmp/demo.md")
       expect(updated.path).to eq("/tmp/demo.md")
diff --git a/spec/unit/store/pipeline_guards_spec.rb b/spec/unit/store/pipeline_guards_spec.rb
new file mode 100644
index 000000000..3967c47a8
--- /dev/null
+++ b/spec/unit/store/pipeline_guards_spec.rb
@@ -0,0 +1,45 @@
+require "spec_helper"
+
+RSpec.describe Textus::Protocol::StoreEngine::Pipeline do
+  describe ".check_etag" do
+    it "returns ctx with etag_before when file exists and if_etag matches" do
+      deps = double("deps", file_system: double(exists?: true, etag: "abc"))
+      ctx  = described_class::DeleteContext.new(key: "k", if_etag: "abc", path: "/p", etag_before: nil)
+      result = described_class.check_etag(ctx, deps)
+      expect(result.etag_before).to eq("abc")
+    end
+
+    it "returns ctx when file does not exist and if_etag is nil" do
+      deps = double("deps", file_system: double(exists?: false))
+      ctx  = described_class::DeleteContext.new(key: "k", if_etag: nil, path: "/p", etag_before: nil)
+      result = described_class.check_etag(ctx, deps)
+      expect(result.etag_before).to be_nil
+    end
+
+    it "raises EtagMismatch when if_etag does not match" do
+      deps = double("deps", file_system: double(exists?: true, etag: "def"))
+      ctx  = described_class::DeleteContext.new(key: "k", if_etag: "abc", path: "/p", etag_before: nil)
+      expect { described_class.check_etag(ctx, deps) }
+        .to raise_error(Textus::EtagMismatch)
+    end
+
+    it "raises EtagMismatch with key, wanted, got in details" do
+      deps = double("deps", file_system: double(exists?: true, etag: "def"))
+      ctx  = described_class::DeleteContext.new(key: "my.key", if_etag: "abc", path: "/p", etag_before: nil)
+      expect { described_class.check_etag(ctx, deps) }
+        .to(raise_error do |e|
+          expect(e.details["key"]).to eq("my.key")
+          expect(e.details["wanted"]).to eq("abc")
+          expect(e.details["got"]).to eq("def")
+        end)
+    end
+  end
+
+  describe ".resolve_path" do
+    it "delegates to manifest resolver and returns path" do
+      resolver = double("resolver", resolve: double(path: "/data/k.md"))
+      deps = double("deps", manifest: double(resolver: resolver))
+      expect(described_class.resolve_path("knowledge.k", deps)).to eq("/data/k.md")
+    end
+  end
+end
diff --git a/spec/unit/store/write_pipeline/index_entry_spec.rb b/spec/unit/store/write_pipeline/index_entry_spec.rb
index 478e8200f..93216686a 100644
--- a/spec/unit/store/write_pipeline/index_entry_spec.rb
+++ b/spec/unit/store/write_pipeline/index_entry_spec.rb
@@ -1,15 +1,20 @@
 require "spec_helper"
 
-# rubocop:disable RSpec/VerifiedDoubles
 RSpec.describe "WritePipeline indexing" do
   let(:entry_index) { instance_double(Textus::Infra::Store::EntryIndex) }
+  let(:audit_log) { instance_double(Textus::Infra::Store::AuditLog) }
+  let(:call) { instance_double(Textus::Value::Call, role: "automation", correlation_id: "abc") }
 
-  describe Textus::Protocol::StoreEngine::PutPipeline::IndexEntry do
+  describe Textus::Protocol::StoreEngine::PutPipeline::Emit do
     it "records the written entry in the index" do
-      ctx = double("ctx", key: "knowledge.a", mentry: double(schema: "runbook", lane: "knowledge", format: "markdown"), eff_content: nil,
-                          eff_body: "hello")
-      deps = double("deps", entry_index:)
+      mentry = double(schema: "runbook", lane: "knowledge", format: "markdown")
+      ctx = double("ctx", key: "knowledge.a", format: "markdown", mentry:,
+                          eff_content: nil, eff_body: "hello",
+                          envelope: double(etag: "abc"), etag_before: nil)
+      deps = double("deps", entry_index:, audit_log:, call:)
       allow(entry_index).to receive(:record)
+      allow(audit_log).to receive(:append)
+      allow(Textus::Protocol::StoreEngine::Pipeline).to receive(:emit_event)
 
       described_class.call(ctx, deps)
 
@@ -20,10 +25,14 @@
     end
 
     it "indexes serialized content (not body) when the entry is content-based (json/yaml)" do
-      ctx = double("ctx", key: "artifacts.b", mentry: double(schema: nil, lane: "artifacts", format: "json"), eff_content: { "x" => 1 },
-                          eff_body: nil)
-      deps = double("deps", entry_index:)
+      mentry = double(schema: nil, lane: "artifacts", format: "json")
+      ctx = double("ctx", key: "artifacts.b", format: "json", mentry:,
+                          eff_content: { "x" => 1 }, eff_body: nil,
+                          envelope: double(etag: "def"), etag_before: nil)
+      deps = double("deps", entry_index:, audit_log:, call:)
       allow(entry_index).to receive(:record)
+      allow(audit_log).to receive(:append)
+      allow(Textus::Protocol::StoreEngine::Pipeline).to receive(:emit_event)
 
       described_class.call(ctx, deps)
 
@@ -64,4 +73,3 @@
     end
   end
 end
-# rubocop:enable RSpec/VerifiedDoubles
diff --git a/spec/unit/workflow/event_emitter_spec.rb b/spec/unit/workflow/event_emitter_spec.rb
new file mode 100644
index 000000000..b429acc38
--- /dev/null
+++ b/spec/unit/workflow/event_emitter_spec.rb
@@ -0,0 +1,41 @@
+RSpec.describe Textus::Workflow::EventEmitter do
+  subject(:emitter) { described_class.new(workflow_queue, registry:) }
+
+  let(:workflow_queue) { instance_double(Textus::Infra::Store::WorkflowQueue) }
+  let(:registry) { instance_double(Textus::Workflow::Registry) }
+  let(:materialize) { instance_double(Textus::Workflow::DSL::Definition, type: "materialize", max_attempts: 3) }
+
+  describe "#emit" do
+    before { allow(workflow_queue).to receive(:push) }
+
+    it "pushes one event per workflow registered for the event type" do
+      allow(registry).to receive(:workflows_for).with("entry.written").and_return([materialize])
+
+      count = emitter.emit(event_type: "entry.written", key: "knowledge.a", lane: "knowledge")
+
+      expect(workflow_queue).to have_received(:push).with(
+        event_type: "entry.written", workflow_type: "materialize",
+        key: "knowledge.a", lane: "knowledge",
+        max_attempts: 3
+      )
+      expect(count).to eq(1)
+    end
+
+    it "emits nothing when no workflow handles the event type" do
+      allow(registry).to receive(:workflows_for).with("entry.written").and_return([])
+
+      expect(emitter.emit(event_type: "entry.written", key: "knowledge.a", lane: "knowledge")).to eq(0)
+      expect(workflow_queue).not_to have_received(:push)
+    end
+
+    it "defaults to the artifacts lane" do
+      allow(registry).to receive(:workflows_for).with("entry.written").and_return([materialize])
+
+      emitter.emit(event_type: "entry.written", key: "knowledge.a")
+
+      expect(workflow_queue).to have_received(:push).with(
+        hash_including(lane: "artifacts"),
+      )
+    end
+  end
+end