docs(evidence): record Local MEDIUM qualification phase trace

AGENTS.md

@@ -72,3 +72,16 @@ State:
 - assumptions;
 - findings not changed;
 - gaps or limitations.
+
+## Domovoy Gen2 execution governance
+
+When the active task is a Gen2 packet, read the canonical documents before editing:
+
+- `docs/DOMOVOY_CONSTITUTION.md`
+- `architecture/GEN2_TARGET_ARCHITECTURE.md`
+- `architecture/GEN2_CANONICAL_DATA_MODEL.md`
+- `development/GEN2_MIGRATION_MAP.md`
+- `development/GEN2_MASTER_PLAN.md`
+- `development/GEN2_EXECUTION_CONTRACT.md`
+
+The active task packet and `development/GEN2_TASK_INDEX.md` define execution order. `PRE-GEN2-000` freezes the V1 baseline; `ARCH-GEN2-000` accepts Gen2 governance; later `GEN2-*` packets must not be started automatically. Gen2 architecture and ownership changes are permitted only within the active packet's declared scope and authority. Default validation is FAST; MILESTONE or FULL is required only when the selected packet explicitly says so.

adapters/models/openai_compatible_local.go

@@ -25,6 +25,15 @@ type OpenAICompatibleLocalAdapter struct {
 	apiKey string
 }
 
+// compatibleDefaultContextBytes is a conservative bound used when an
+// OpenAI-compatible local endpoint omits n_ctx from /v1/models. The adapter
+// is a chat-completions adapter, so advisory capability is known from the
+// adapter contract; quality and activation still require governed
+// qualification/evaluation in the capability registry.
+const compatibleDefaultContextBytes int64 = 32 << 10
+
+const compatibleAdvisoryMaxTokens = 32
+
 func NewOpenAICompatibleLocalAdapter(raw string, transport http.RoundTripper) (*OpenAICompatibleLocalAdapter, error) {
 	return NewOpenAICompatibleLocalAdapterWithAPIKey(raw, "", transport)
 }
@@ -58,6 +67,9 @@ type compatibleModelsResponse struct {
 		ID      string `json:"id"`
 		Created int64  `json:"created"`
 		OwnedBy string `json:"owned_by"`
+		ModelKind string `json:"model_kind"`
+		Capabilities map[string]bool `json:"capabilities"`
+		Modalities map[string]bool `json:"modalities"`
 		Meta    struct {
 			Context         int64  `json:"n_ctx"`
 			TrainingContext int64  `json:"n_ctx_train"`
@@ -87,14 +99,36 @@ func (a *OpenAICompatibleLocalAdapter) Discover(ctx context.Context) ([]Discover
 		if item.ID == "" {
 			continue
 		}
+		// The gateway catalogue may contain image/audio runtimes beside local
+		// chat models. Discovery is not allowed to qualify those as text
+		// advisory models merely because they appear in /v1/models.
+		if !isTextAdvisoryModel(item.ModelKind, item.Capabilities, item.Modalities) {
+			continue
+		}
 		stableMetadata := fmt.Sprintf("%s\x00%s\x00%d\x00%d\x00%d\x00%d\x00%s", item.ID, item.OwnedBy, item.Meta.Context, item.Meta.TrainingContext, item.Meta.Parameters, item.Meta.Size, item.Meta.FileType)
 		digest := sha256.Sum256([]byte(stableMetadata))
 		contextBytes := item.Meta.Context * 4
-		models = append(models, DiscoveredModel{ProviderModelID: capability.ProviderModelID(item.ID), Fingerprint: capability.ModelFingerprint(hex.EncodeToString(digest[:])), MaxContextBytes: contextBytes, Modalities: []capability.ModelModality{capability.ModalityText}, Capabilities: []capability.ModelCapability{capability.CapabilityUnknown}, SizeBytes: item.Meta.Size, Runtime: item.OwnedBy, Quantization: item.Meta.FileType})
+		if contextBytes <= 0 {
+			contextBytes = compatibleDefaultContextBytes
+		}
+		models = append(models, DiscoveredModel{ProviderModelID: capability.ProviderModelID(item.ID), Fingerprint: capability.ModelFingerprint(hex.EncodeToString(digest[:])), MaxContextBytes: contextBytes, Modalities: []capability.ModelModality{capability.ModalityText}, Capabilities: []capability.ModelCapability{capability.CapabilityAdvisory}, SizeBytes: item.Meta.Size, Runtime: item.OwnedBy, Quantization: item.Meta.FileType})
 	}
 	return models, ProviderProbe{Health: capability.HealthAvailable}
 }
 
+func isTextAdvisoryModel(kind string, capabilities, modalities map[string]bool) bool {
+	if strings.EqualFold(strings.TrimSpace(kind), "image-generation") || strings.EqualFold(strings.TrimSpace(kind), "audio-transcription") || strings.EqualFold(strings.TrimSpace(kind), "text-to-speech") {
+		return false
+	}
+	if chat, known := capabilities["chat"]; known && !chat {
+		return false
+	}
+	if text, known := modalities["text"]; known && !text {
+		return false
+	}
+	return true
+}
+
 type compatibleChatRequest struct {
 	Model              string                   `json:"model"`
 	Messages           []compatibleMessage      `json:"messages"`
@@ -125,7 +159,11 @@ func (a *OpenAICompatibleLocalAdapter) Advise(ctx context.Context, request cogni
 	if err := ValidateAdvisoryRequest(request); err != nil || request.ProviderModelID == "" {
 		return cognitive.AdvisoryResponse{}, ErrInvalidAdvisory
 	}
-	payload := compatibleChatRequest{Model: string(request.ProviderModelID), Messages: []compatibleMessage{{Role: "system", Content: "Ты отвечаешь от имени Домового — локального помощника пользователя. Не называй себя именем модели, поставщиком или внутренним runtime. Если спрашивают имя, ответь: «Меня зовут Домовой». Понимай смысл сообщения и помогай довести цель до полезного результата. По умолчанию отвечай кратко, примерно одним-тремя предложениями; подробности давай только по просьбе. Отвечай только некатегоричным текстом совета; не утверждай, что внешнее действие уже выполнено."}, {Role: "user", Content: localAdvisoryMessage(request)}}, Temperature: 0, Stream: false, MaxTokens: request.MaxOutputBytes / 4, ChatTemplateKwargs: compatibleTemplateKwargs{EnableThinking: false}}
+	maxTokens := request.MaxOutputBytes / 4
+	if maxTokens <= 0 || maxTokens > compatibleAdvisoryMaxTokens {
+		maxTokens = compatibleAdvisoryMaxTokens
+	}
+	payload := compatibleChatRequest{Model: string(request.ProviderModelID), Messages: []compatibleMessage{{Role: "system", Content: "Ты отвечаешь от имени Домового — локального помощника пользователя. Не называй себя именем модели, поставщиком или внутренним runtime. Если спрашивают имя, ответь: «Меня зовут Домовой». Понимай смысл сообщения и помогай довести цель до полезного результата. По умолчанию отвечай кратко, примерно одним-тремя предложениями; подробности давай только по просьбе. Отвечай только некатегоричным текстом совета; не утверждай, что внешнее действие уже выполнено."}, {Role: "user", Content: localAdvisoryMessage(request)}}, Temperature: 0, Stream: false, MaxTokens: maxTokens, ChatTemplateKwargs: compatibleTemplateKwargs{EnableThinking: false}}
 	var result compatibleChatResponse
 	status, err := a.requestJSON(ctx, http.MethodPost, "/chat/completions", payload, &result)
 	if err != nil {
@@ -226,6 +264,8 @@ func mapCompatibleStatus(status int) cognitive.FinishReason {
 		return cognitive.FinishContextTooLarge
 	case 429:
 		return cognitive.FinishRateLimited
+	case 400, 422:
+		return cognitive.FinishInvalidProviderResponse
 	default:
 		return cognitive.FinishProviderUnavailable
 	}

adapters/models/openai_compatible_local_test.go

@@ -18,6 +18,65 @@ type captureRoundTripper struct {
 	body          []byte
 }
 
+type modelsMetadataRoundTripper struct{}
+
+func (modelsMetadataRoundTripper) RoundTrip(request *http.Request) (*http.Response, error) {
+	return &http.Response{
+		StatusCode: http.StatusOK,
+		Body:       io.NopCloser(strings.NewReader(`{"data":[{"id":"medium-model","owned_by":"llama.cpp","meta":{}}]}`)),
+		Header:     make(http.Header),
+		Request:    request,
+	}, nil
+}
+
+type mixedModelsRoundTripper struct{}
+
+func (mixedModelsRoundTripper) RoundTrip(request *http.Request) (*http.Response, error) {
+	return &http.Response{
+		StatusCode: http.StatusOK,
+		Body: io.NopCloser(strings.NewReader(`{"data":[{"id":"image-model","model_kind":"image-generation","capabilities":{"chat":false,"image_generation":true},"modalities":{"text":false,"image_generation":true}},{"id":"text-model","model_kind":"chat","capabilities":{"chat":true},"modalities":{"text":true},"meta":{}}]}`)),
+		Header: make(http.Header),
+		Request: request,
+	}, nil
+}
+
+func TestOpenAICompatibleLocalAdapterDoesNotQualifyNonTextModels(t *testing.T) {
+	adapter, err := NewOpenAICompatibleLocalAdapter("http://gateway/v1", mixedModelsRoundTripper{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	models, probe := adapter.Discover(context.Background())
+	if probe.Health != capability.HealthAvailable || len(models) != 1 || models[0].ProviderModelID != "text-model" {
+		t.Fatalf("unexpected filtered discovery: probe=%+v models=%+v", probe, models)
+	}
+}
+
+func TestOpenAICompatibleLocalAdapterMapsImmediateBadRequest(t *testing.T) {
+	if got := mapCompatibleStatus(http.StatusBadRequest); got != cognitive.FinishInvalidProviderResponse {
+		t.Fatalf("400 finish=%s, want %s", got, cognitive.FinishInvalidProviderResponse)
+	}
+	if got := mapCompatibleStatus(http.StatusUnprocessableEntity); got != cognitive.FinishInvalidProviderResponse {
+		t.Fatalf("422 finish=%s, want %s", got, cognitive.FinishInvalidProviderResponse)
+	}
+}
+
+func TestOpenAICompatibleLocalAdapterNormalizesMinimalModelMetadata(t *testing.T) {
+	adapter, err := NewOpenAICompatibleLocalAdapter("http://gateway/v1", modelsMetadataRoundTripper{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	models, probe := adapter.Discover(context.Background())
+	if probe.Health != capability.HealthAvailable || len(models) != 1 {
+		t.Fatalf("unexpected discovery result: probe=%+v models=%+v", probe, models)
+	}
+	if models[0].MaxContextBytes != compatibleDefaultContextBytes {
+		t.Fatalf("context bound=%d, want %d", models[0].MaxContextBytes, compatibleDefaultContextBytes)
+	}
+	if len(models[0].Capabilities) != 1 || models[0].Capabilities[0] != capability.CapabilityAdvisory {
+		t.Fatalf("capabilities=%v, want advisory", models[0].Capabilities)
+	}
+}
+
 func TestOpenAICompatibleLocalAdapterUsesConfiguredTimeout(t *testing.T) {
 	adapter, err := NewOpenAICompatibleLocalAdapterWithAPIKeyAndTimeout("http://gateway/v1", "", &captureRoundTripper{}, 47*time.Second)
 	if err != nil {
@@ -81,6 +140,7 @@ func TestOpenAICompatibleLocalAdapterDisablesTemplateThinkingForBoundedAdvisory(
 		t.Fatal(err)
 	}
 	var payload struct {
+		MaxTokens int `json:"max_tokens"`
 		ChatTemplateKwargs struct {
 			EnableThinking bool `json:"enable_thinking"`
 		} `json:"chat_template_kwargs"`
@@ -88,6 +148,9 @@ func TestOpenAICompatibleLocalAdapterDisablesTemplateThinkingForBoundedAdvisory(
 	if err := json.Unmarshal(transport.body, &payload); err != nil {
 		t.Fatal(err)
 	}
+	if payload.MaxTokens != compatibleAdvisoryMaxTokens {
+		t.Fatalf("max_tokens=%d, want bounded %d", payload.MaxTokens, compatibleAdvisoryMaxTokens)
+	}
 	if payload.ChatTemplateKwargs.EnableThinking {
 		t.Fatal("expected bounded advisory to disable template thinking")
 	}

adapters/multimodal/ingress.go

@@ -0,0 +1,18 @@
+package multimodal
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+	"git.cin.su/m/Assistant/contracts/artifact"
+	"git.cin.su/m/Assistant/contracts/capability"
+	"git.cin.su/m/Assistant/contracts/interaction"
+)
+
+func NormalizeIngress(id string, modality interaction.IngressModality, sourceRef, deviceRef, locationRef, principalID, contentType string, data []byte, response capability.MultimodalResponse, at int64) (interaction.IngressEnvelope, artifact.MediaArtifact) {
+	hash := sha256.Sum256(data)
+	artifactValue := artifact.MediaArtifact{ID: artifact.ArtifactID("artifact:media:" + hex.EncodeToString(hash[:8])), ContentType: contentType, SizeBytes: int64(len(data)), ContentDigest: hex.EncodeToString(hash[:]), SourceRef: sourceRef, RecordedAtUnixMillis: at}
+	if len(data) == 0 {
+		return interaction.IngressEnvelope{ID: id, Modality: modality, SourceRef: sourceRef, DeviceRef: deviceRef, LocationRef: locationRef, PrincipalID: principalID, Degraded: true, RecordedAtUnixMillis: at}, artifact.MediaArtifact{}
+	}
+	return interaction.IngressEnvelope{ID: id, Modality: modality, SourceRef: sourceRef, DeviceRef: deviceRef, LocationRef: locationRef, PrincipalID: principalID, ArtifactRef: string(artifactValue.ID), ObservationRef: response.EvidenceRef, ProviderRef: response.Provider, ModelRef: response.Model, ModelVersion: response.ModelVersion, ConfidenceMillis: response.ConfidenceMillis, RecordedAtUnixMillis: at}, artifactValue
+}

adapters/multimodal/ingress_test.go

@@ -0,0 +1,22 @@
+package multimodal_test
+
+import (
+	"git.cin.su/m/Assistant/adapters/multimodal"
+	"git.cin.su/m/Assistant/contracts/capability"
+	"git.cin.su/m/Assistant/contracts/interaction"
+	"testing"
+)
+
+func TestIngressNormalizesMediaArtifactAndObservationProvenance(t *testing.T) {
+	e, a := multimodal.NormalizeIngress("ingress-1", interaction.IngressImage, "camera:street", "device:cam", "world:street", "principal", "image/png", []byte("image"), capability.MultimodalResponse{Provider: "local", Model: "vision", ModelVersion: "1", EvidenceRef: "observation-1", ConfidenceMillis: 800}, 1)
+	if !e.Valid() || !a.Valid() || e.ArtifactRef == "" || e.ObservationRef != "observation-1" || e.DeviceRef == "" || e.LocationRef == "" {
+		t.Fatalf("envelope=%+v artifact=%+v", e, a)
+	}
+}
+
+func TestUnavailableIngressDegradesWithoutFabricatingObservation(t *testing.T) {
+	e, a := multimodal.NormalizeIngress("ingress-1", interaction.IngressAudio, "mic", "device:mic", "", "principal", "audio/wav", nil, capability.MultimodalResponse{}, 1)
+	if !e.Degraded || e.ObservationRef != "" || a.Valid() {
+		t.Fatalf("envelope=%+v artifact=%+v", e, a)
+	}
+}

adapters/postgres/capability_repository.go

@@ -2,6 +2,7 @@ package postgres
 
 import (
 	"context"
+	"encoding/json"
 	"errors"
 	"fmt"
 
@@ -181,10 +182,6 @@ func (r *CapabilityRepository) SaveBinding(ctx context.Context, binding capabili
 		if err != nil {
 			return err
 		}
-		_, err = tx.Exec(ctx, `INSERT INTO capability.cognitive_binding_revision_heads (binding_id,revision) VALUES ($1,$2) ON CONFLICT DO NOTHING`, binding.ID, binding.Revision)
-		if err != nil {
-			return err
-		}
 	}
 	return tx.Commit(ctx)
 }
@@ -309,12 +306,14 @@ func (r *CapabilityRepository) SaveSkillProfile(ctx context.Context, value capab
 	_, err = tx.Exec(ctx, `INSERT INTO capability.skill_profiles (
 		skill_profile_id,revision,name,description,applicable_context,implementation_ref,implementation_version,status,
 		supporting_experience_refs,known_failure_experience_refs,confidence_millis,last_validated_unix_millis,
-		observed_failure_count,observed_correction_count,recorded_at_unix_millis)
-		VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15) ON CONFLICT DO NOTHING`,
+		observed_failure_count,observed_correction_count,recorded_at_unix_millis,applicability,dependency_refs,validation_evidence_refs,
+		independent_evaluation_refs,known_failure_conditions,verified_outcome_count,must_not_worsen_satisfied)
+		VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$16,$17,$18,$19,$20,$21,$22) ON CONFLICT DO NOTHING`,
 		value.ID, value.Revision, value.Name, value.Description, value.ApplicableContext, value.ImplementationRef,
 		value.ImplementationVersion, value.Status, value.SupportingExperienceRefs, value.KnownFailureExperienceRefs,
 		value.ConfidenceMillis, value.LastValidatedUnixMillis, value.ObservedFailureCount, value.ObservedCorrectionCount,
-		value.RecordedAtUnixMillis)
+		value.RecordedAtUnixMillis, mustJSON(value.Applicability), value.DependencyRefs, value.ValidationEvidenceRefs,
+		value.IndependentEvaluationRefs, value.KnownFailureConditions, value.VerifiedOutcomeCount, value.MustNotWorsenSatisfied)
 	if err != nil {
 		return err
 	}
@@ -333,13 +332,16 @@ func (r *CapabilityRepository) LoadSkillProfile(ctx context.Context, id capabili
 	err := r.pool.QueryRow(ctx, `SELECT
 		p.skill_profile_id,p.revision,p.name,p.description,p.applicable_context,p.implementation_ref,p.implementation_version,p.status,
 		p.supporting_experience_refs,p.known_failure_experience_refs,p.confidence_millis,p.last_validated_unix_millis,
-		p.observed_failure_count,p.observed_correction_count,p.recorded_at_unix_millis
+		p.observed_failure_count,p.observed_correction_count,p.recorded_at_unix_millis,p.applicability,p.dependency_refs,
+		p.validation_evidence_refs,p.independent_evaluation_refs,p.known_failure_conditions,p.verified_outcome_count,p.must_not_worsen_satisfied
 		FROM capability.skill_profile_heads h
 		JOIN capability.skill_profiles p ON p.skill_profile_id=h.skill_profile_id AND p.revision=h.revision
 		WHERE p.skill_profile_id=$1`, id).Scan(&value.ID, &value.Revision, &value.Name, &value.Description, &value.ApplicableContext,
 		&value.ImplementationRef, &value.ImplementationVersion, &value.Status, &value.SupportingExperienceRefs,
 		&value.KnownFailureExperienceRefs, &value.ConfidenceMillis, &value.LastValidatedUnixMillis,
-		&value.ObservedFailureCount, &value.ObservedCorrectionCount, &value.RecordedAtUnixMillis)
+		&value.ObservedFailureCount, &value.ObservedCorrectionCount, &value.RecordedAtUnixMillis, newJSONTarget(&value.Applicability),
+		&value.DependencyRefs, &value.ValidationEvidenceRefs, &value.IndependentEvaluationRefs, &value.KnownFailureConditions,
+		&value.VerifiedOutcomeCount, &value.MustNotWorsenSatisfied)
 	if err != nil {
 		return capability.SkillProfile{}, fmt.Errorf("load skill profile: %w", err)
 	}
@@ -353,7 +355,8 @@ func (r *CapabilityRepository) RecentSkillProfiles(ctx context.Context, limit in
 	rows, err := r.pool.Query(ctx, `SELECT
 		p.skill_profile_id,p.revision,p.name,p.description,p.applicable_context,p.implementation_ref,p.implementation_version,p.status,
 		p.supporting_experience_refs,p.known_failure_experience_refs,p.confidence_millis,p.last_validated_unix_millis,
-		p.observed_failure_count,p.observed_correction_count,p.recorded_at_unix_millis
+		p.observed_failure_count,p.observed_correction_count,p.recorded_at_unix_millis,p.applicability,p.dependency_refs,
+		p.validation_evidence_refs,p.independent_evaluation_refs,p.known_failure_conditions,p.verified_outcome_count,p.must_not_worsen_satisfied
 		FROM capability.skill_profile_heads h
 		JOIN capability.skill_profiles p ON p.skill_profile_id=h.skill_profile_id AND p.revision=h.revision
 		ORDER BY h.updated_at DESC, p.skill_profile_id LIMIT $1`, limit)
@@ -367,7 +370,9 @@ func (r *CapabilityRepository) RecentSkillProfiles(ctx context.Context, limit in
 		if err := rows.Scan(&value.ID, &value.Revision, &value.Name, &value.Description, &value.ApplicableContext,
 			&value.ImplementationRef, &value.ImplementationVersion, &value.Status, &value.SupportingExperienceRefs,
 			&value.KnownFailureExperienceRefs, &value.ConfidenceMillis, &value.LastValidatedUnixMillis,
-			&value.ObservedFailureCount, &value.ObservedCorrectionCount, &value.RecordedAtUnixMillis); err != nil {
+			&value.ObservedFailureCount, &value.ObservedCorrectionCount, &value.RecordedAtUnixMillis, newJSONTarget(&value.Applicability),
+			&value.DependencyRefs, &value.ValidationEvidenceRefs, &value.IndependentEvaluationRefs, &value.KnownFailureConditions,
+			&value.VerifiedOutcomeCount, &value.MustNotWorsenSatisfied); err != nil {
 			return nil, err
 		}
 		result = append(result, value)
@@ -375,6 +380,40 @@ func (r *CapabilityRepository) RecentSkillProfiles(ctx context.Context, limit in
 	return result, rows.Err()
 }
 
+func (r *CapabilityRepository) SaveReflexRevision(ctx context.Context, reflex capability.Reflex, value capability.ReflexRevision) error {
+	_, err := r.pool.Exec(ctx, `INSERT INTO capability.reflex_revisions (
+		reflex_id,revision,principal_id,source_skill_id,source_skill_revision,kind,applicability,implementation_ref,implementation_version,artifact_digest,
+		dependency_refs,validation_evidence_refs,known_failure_experience_refs,shadow_policy,revalidation_policy,last_validated_at,lifecycle,
+		supersedes_revision,execution_count,failure_count,divergence_count,recorded_at)
+		VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$16,$17,$18,$19,$20,$21,$22) ON CONFLICT DO NOTHING`,
+		value.ReflexID, value.Revision, reflex.PrincipalID, reflex.SourceSkillRef, value.SourceSkillRevision, value.Kind, mustJSON(value.Applicability), value.ImplementationRef, value.ImplementationVersion, value.ArtifactDigest,
+		value.DependencyRefs, value.ValidationEvidenceRefs, value.KnownFailureExperienceRefs, mustJSON(value.Shadow), mustJSON(value.Revalidation), value.LastValidatedAt, value.Lifecycle,
+		value.SupersedesRevision, value.ExecutionCount, value.FailureCount, value.DivergenceCount, value.RecordedAt)
+	if err != nil {
+		return err
+	}
+	_, err = r.pool.Exec(ctx, `INSERT INTO capability.reflex_heads(reflex_id,revision,lifecycle) VALUES($1,$2,$3)
+		ON CONFLICT(reflex_id) DO UPDATE SET revision=EXCLUDED.revision,lifecycle=EXCLUDED.lifecycle,updated_at=CURRENT_TIMESTAMP
+		WHERE capability.reflex_heads.revision < EXCLUDED.revision`, value.ReflexID, value.Revision, value.Lifecycle)
+	return err
+}
+
+func mustJSON(value any) []byte { encoded, _ := json.Marshal(value); return encoded }
+
+type jsonTarget struct{ target any }
+
+func newJSONTarget(target any) *jsonTarget { return &jsonTarget{target: target} }
+func (v *jsonTarget) Scan(source any) error {
+	if source == nil {
+		return nil
+	}
+	bytes, ok := source.([]byte)
+	if !ok {
+		bytes = []byte(fmt.Sprint(source))
+	}
+	return json.Unmarshal(bytes, v.target)
+}
+
 func (r *CapabilityRepository) LoadBinding(ctx context.Context, id capability.CapabilityBindingID, revision int64) (capability.Binding, error) {
 	var binding capability.Binding
 	err := r.pool.QueryRow(ctx, `SELECT binding_id,capability_id,owner_principal_id,revision,state,https_origin,delivery_path,receipt_path,
@@ -437,6 +476,14 @@ func (r *CapabilityRepository) LoadCognitiveCandidatesForProfile(ctx context.Con
 	return r.loadCognitiveCandidates(ctx, capabilityID, owner, profileID)
 }
 
+func (r *CapabilityRepository) LoadCognitiveCandidatesForEvaluation(ctx context.Context, capabilityID capability.CapabilityID, owner identity.PrincipalID, evaluationID capability.EvaluationID) ([]capability.ResolvedCognitiveBinding, error) {
+	var profileID capability.TaskEvaluationProfileID
+	if err := r.pool.QueryRow(ctx, `SELECT task_profile_id FROM capability.cognitive_task_evaluations WHERE evaluation_id=$1 AND capability_id=$2`, evaluationID, capabilityID).Scan(&profileID); err != nil {
+		return nil, err
+	}
+	return r.loadCognitiveCandidates(ctx, capabilityID, owner, profileID)
+}
+
 func (r *CapabilityRepository) LoadCognitiveCandidate(ctx context.Context, bindingID capability.CapabilityBindingID, revision int64) (capability.ResolvedCognitiveBinding, error) {
 	var capabilityID capability.CapabilityID
 	var owner identity.PrincipalID
@@ -564,7 +611,12 @@ func (r *CapabilityRepository) SaveCognitiveDiscovery(ctx context.Context, value
 		if err != nil {
 			return err
 		}
-		_, err = tx.Exec(ctx, `INSERT INTO capability.cognitive_binding_revision_heads (binding_id,revision) VALUES ($1,$2) ON CONFLICT DO NOTHING`, binding.ID, binding.Revision)
+		// Discovery may advance a head, but must never roll back a governed
+		// CANARY/ACTIVE revision to an older discovered snapshot after restart.
+		// Discovery may advance an inactive head even when its deterministic
+		// revision number is lower, but it must never overwrite a governed canary
+		// or active head during restart/startup refresh.
+		_, err = tx.Exec(ctx, `INSERT INTO capability.cognitive_binding_revision_heads (binding_id,revision) VALUES ($1,$2) ON CONFLICT (binding_id) DO UPDATE SET revision=EXCLUDED.revision,updated_at=CURRENT_TIMESTAMP WHERE NOT EXISTS (SELECT 1 FROM capability.cognitive_bindings current_binding WHERE current_binding.binding_id=capability.cognitive_binding_revision_heads.binding_id AND current_binding.revision=capability.cognitive_binding_revision_heads.revision AND current_binding.activation IN ('CANARY','ACTIVE'))`, binding.ID, binding.Revision)
 		if err != nil {
 			return err
 		}

adapters/postgres/epistemics_repository.go

@@ -6,6 +6,7 @@ import (
 	"time"
 
 	"git.cin.su/m/Assistant/contracts/epistemics"
+	"git.cin.su/m/Assistant/platform/telemetry"
 	"github.com/jackc/pgx/v5/pgxpool"
 )
 
@@ -36,6 +37,11 @@ func (r *EpistemicsRepository) Ping(ctx context.Context) error {
 // TruthRuntimeStatus is a read-only projection of durable truth bundles.
 // It does not promote claims, revise beliefs, or mutate epistemic state.
 func (r *EpistemicsRepository) TruthRuntimeStatus(ctx context.Context) (TruthRuntimeStatus, error) {
+	started := time.Now()
+	outcome := "SUCCESS"
+	defer func() {
+		telemetry.RecordCompatibility("truth-bundles-status-reader", "epistemics-repository", "read", "research-status", true, false, true, outcome, "truth-status", "epistemics", started)
+	}()
 	status := TruthRuntimeStatus{
 		ClaimsByVerification: map[string]int64{},
 		BeliefsByState:       map[string]int64{},
@@ -43,6 +49,7 @@ func (r *EpistemicsRepository) TruthRuntimeStatus(ctx context.Context) (TruthRun
 		ObservedAtUnixMillis: time.Now().UnixMilli(),
 	}
 	if err := r.pool.QueryRow(ctx, `SELECT count(*) FROM epistemics.truth_bundles`).Scan(&status.BundleCount); err != nil {
+		outcome = "FAILURE"
 		return TruthRuntimeStatus{}, err
 	}
 	queries := []struct {
@@ -56,18 +63,21 @@ func (r *EpistemicsRepository) TruthRuntimeStatus(ctx context.Context) (TruthRun
 	for _, item := range queries {
 		rows, err := r.pool.Query(ctx, item.query)
 		if err != nil {
+			outcome = "FAILURE"
 			return TruthRuntimeStatus{}, err
 		}
 		for rows.Next() {
 			var state string
 			var count int64
 			if err := rows.Scan(&state, &count); err != nil {
+				outcome = "FAILURE"
 				rows.Close()
 				return TruthRuntimeStatus{}, err
 			}
 			item.destination[state] = count
 		}
 		if err := rows.Err(); err != nil {
+			outcome = "FAILURE"
 			rows.Close()
 			return TruthRuntimeStatus{}, err
 		}
@@ -91,10 +101,10 @@ func (r *EpistemicsRepository) RecentExperienceRecords(ctx context.Context, limi
 		return nil, fmt.Errorf("invalid experience limit")
 	}
 	rows, err := r.pool.Query(ctx, `SELECT
-		experience_id,source_kind,original_intent_id,source_utterance_id,context_refs,help_method,help_method_ref,
+		experience_id,principal_id,source_kind,original_intent_id,source_utterance_id,context_refs,help_method,help_method_ref,
 		capability_implementation_ref,capability_usage_observation_ref,capability_gap_ref,skill_ref,expectation_id,
 		expected_outcome,actual_outcome,outcome_ref,outcome_detail,human_response_ref,correction_utterance_id,
-		verification_evidence,confidence_millis,recorded_at_unix_millis
+		verification_evidence,confidence_millis,recorded_at_unix_millis,context_scope_ref,problem_statement,applicability_conditions,why_succeeded_or_failed
 		FROM epistemics.experience_records ORDER BY recorded_at_unix_millis DESC, experience_id DESC LIMIT $1`, limit)
 	if err != nil {
 		return nil, err
@@ -103,10 +113,44 @@ func (r *EpistemicsRepository) RecentExperienceRecords(ctx context.Context, limi
 	var result []epistemics.ExperienceRecord
 	for rows.Next() {
 		var value epistemics.ExperienceRecord
-		if err := rows.Scan(&value.ID, &value.SourceKind, &value.OriginalIntentID, &value.SourceUtteranceID, &value.ContextRefs, &value.HelpMethod, &value.HelpMethodRef,
+		if err := rows.Scan(&value.ID, &value.PrincipalID, &value.SourceKind, &value.OriginalIntentID, &value.SourceUtteranceID, &value.ContextRefs, &value.HelpMethod, &value.HelpMethodRef,
 			&value.CapabilityImplementationRef, &value.CapabilityUsageObservationRef, &value.CapabilityGapRef, &value.SkillRef, &value.ExpectationID,
 			&value.ExpectedOutcome, &value.ActualOutcome, &value.OutcomeRef, &value.OutcomeDetail, &value.HumanResponseRef, &value.CorrectionUtteranceID,
-			&value.VerificationEvidence, &value.ConfidenceMillis, &value.RecordedAtUnixMillis); err != nil {
+			&value.VerificationEvidence, &value.ConfidenceMillis, &value.RecordedAtUnixMillis, &value.ContextScopeRef, &value.ProblemStatement, &value.ApplicabilityConditions, &value.WhySucceededOrFailed); err != nil {
+			return nil, err
+		}
+		result = append(result, value)
+	}
+	return result, rows.Err()
+}
+
+// RecentExperienceRecordsForPrincipalAndScope is an owner-local Epistemics
+// read. It intentionally applies Principal and ContextScope in SQL before any
+// Core-side relevance ranking, so another realm's experience never becomes a
+// retrieval candidate.
+func (r *EpistemicsRepository) RecentExperienceRecordsForPrincipalAndScope(ctx context.Context, principalID, scopeRef string, limit int) ([]epistemics.ExperienceRecord, error) {
+	if principalID == "" || limit < 1 || limit > 100 {
+		return nil, fmt.Errorf("invalid scoped experience query")
+	}
+	rows, err := r.pool.Query(ctx, `SELECT
+		experience_id,principal_id,source_kind,original_intent_id,source_utterance_id,context_refs,help_method,help_method_ref,
+		capability_implementation_ref,capability_usage_observation_ref,capability_gap_ref,skill_ref,expectation_id,
+		expected_outcome,actual_outcome,outcome_ref,outcome_detail,human_response_ref,correction_utterance_id,
+		verification_evidence,confidence_millis,recorded_at_unix_millis,context_scope_ref,problem_statement,applicability_conditions,why_succeeded_or_failed
+		FROM epistemics.experience_records
+		WHERE principal_id=$1 AND ($2='' OR context_scope_ref=$2)
+		ORDER BY recorded_at_unix_millis DESC, experience_id DESC LIMIT $3`, principalID, scopeRef, limit)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	result := make([]epistemics.ExperienceRecord, 0)
+	for rows.Next() {
+		var value epistemics.ExperienceRecord
+		if err := rows.Scan(&value.ID, &value.PrincipalID, &value.SourceKind, &value.OriginalIntentID, &value.SourceUtteranceID, &value.ContextRefs, &value.HelpMethod, &value.HelpMethodRef,
+			&value.CapabilityImplementationRef, &value.CapabilityUsageObservationRef, &value.CapabilityGapRef, &value.SkillRef, &value.ExpectationID,
+			&value.ExpectedOutcome, &value.ActualOutcome, &value.OutcomeRef, &value.OutcomeDetail, &value.HumanResponseRef, &value.CorrectionUtteranceID,
+			&value.VerificationEvidence, &value.ConfidenceMillis, &value.RecordedAtUnixMillis, &value.ContextScopeRef, &value.ProblemStatement, &value.ApplicabilityConditions, &value.WhySucceededOrFailed); err != nil {
 			return nil, err
 		}
 		result = append(result, value)
@@ -195,15 +239,15 @@ func (r *EpistemicsRepository) WaitForReflectionCandidate(ctx context.Context, i
 
 func (r *EpistemicsRepository) SaveExperienceRecord(ctx context.Context, value epistemics.ExperienceRecord) error {
 	_, err := r.pool.Exec(ctx, `INSERT INTO epistemics.experience_records (
-		experience_id, source_kind, original_intent_id, source_utterance_id, context_refs, help_method, help_method_ref,
+		experience_id, principal_id, source_kind, original_intent_id, source_utterance_id, context_refs, help_method, help_method_ref,
 		capability_implementation_ref, capability_usage_observation_ref, capability_gap_ref, skill_ref, expectation_id,
 		expected_outcome, actual_outcome, outcome_ref, outcome_detail, human_response_ref, correction_utterance_id,
-		verification_evidence, confidence_millis, recorded_at_unix_millis)
-		VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$16,$17,$18,$19,$20,$21) ON CONFLICT DO NOTHING`,
-		value.ID, value.SourceKind, value.OriginalIntentID, value.SourceUtteranceID, value.ContextRefs, value.HelpMethod, value.HelpMethodRef,
+		verification_evidence, confidence_millis, recorded_at_unix_millis, context_scope_ref, problem_statement, applicability_conditions, why_succeeded_or_failed)
+		VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$16,$17,$18,$19,$20,$21,$22,$23,$24,$25,$26) ON CONFLICT DO NOTHING`,
+		value.ID, value.PrincipalID, value.SourceKind, value.OriginalIntentID, value.SourceUtteranceID, value.ContextRefs, value.HelpMethod, value.HelpMethodRef,
 		value.CapabilityImplementationRef, value.CapabilityUsageObservationRef, value.CapabilityGapRef, value.SkillRef, value.ExpectationID,
 		value.ExpectedOutcome, value.ActualOutcome, value.OutcomeRef, value.OutcomeDetail, value.HumanResponseRef, value.CorrectionUtteranceID,
-		value.VerificationEvidence, value.ConfidenceMillis, value.RecordedAtUnixMillis)
+		value.VerificationEvidence, value.ConfidenceMillis, value.RecordedAtUnixMillis, value.ContextScopeRef, value.ProblemStatement, value.ApplicabilityConditions, value.WhySucceededOrFailed)
 	return err
 }
 
@@ -218,7 +262,13 @@ func (r *EpistemicsRepository) SaveReflectionCandidate(ctx context.Context, valu
 }
 
 func (r *EpistemicsRepository) SaveTruthBundle(ctx context.Context, value epistemics.TruthBundle, recordedAtUnixMillis int64) error {
+	started := time.Now()
+	outcome := "SUCCESS"
+	defer func() {
+		telemetry.RecordCompatibility("truth-bundles-writer", "epistemics-repository", "write", "persisted-research", true, false, true, outcome, string(value.Claim.ID), "epistemics", started)
+	}()
 	if value.Source.ID == "" || value.Snapshot.ID == "" || value.Excerpt.ID == "" || value.Claim.ID == "" || value.Belief.ID == "" || value.Citation.ID == "" || recordedAtUnixMillis < 1 {
+		outcome = "INVALID"
 		return fmt.Errorf("invalid truth bundle")
 	}
 	_, err := r.pool.Exec(ctx, `INSERT INTO epistemics.truth_bundles (
@@ -232,5 +282,8 @@ func (r *EpistemicsRepository) SaveTruthBundle(ctx context.Context, value episte
 		value.Excerpt.ID, value.Excerpt.SnapshotID, value.Excerpt.Text, value.Excerpt.Start, value.Excerpt.End,
 		value.Observation.ID, value.Observation.ObservedAt, value.Claim.ID, value.Claim.Statement, value.Claim.ObservationID, value.Claim.CitationID, value.Claim.Verification,
 		value.Belief.ID, value.Belief.ClaimID, value.Belief.State, value.Citation.ID, value.Citation.ExcerptID, value.Citation.Evidence, value.Citation.Coverage, value.Citation.Conflict, value.Citation.ResolvedAtUnixMillis, recordedAtUnixMillis)
+	if err != nil {
+		outcome = "FAILURE"
+	}
 	return err
 }

adapters/postgres/identity_repository.go

@@ -26,3 +26,39 @@ func (r *IdentityRepository) LoadBinding(ctx context.Context, actor identity.Act
 	}
 	return binding, nil
 }
+
+func (r *IdentityRepository) LoadCreatorAccount(ctx context.Context, username string) (identity.CreatorAccount, error) {
+	var account identity.CreatorAccount
+	err := r.pool.QueryRow(ctx, `SELECT username, actor_id, principal_id, password_hash, revision FROM identity.creator_accounts WHERE username=$1`, username).
+		Scan(&account.Username, &account.ActorID, &account.PrincipalID, &account.PasswordHash, &account.Revision)
+	if err != nil {
+		return identity.CreatorAccount{}, fmt.Errorf("load creator account: %w", err)
+	}
+	return account, nil
+}
+
+func (r *IdentityRepository) LoadCreatorAccountByBinding(ctx context.Context, actor identity.ActorID, principal identity.PrincipalID) (identity.CreatorAccount, error) {
+	var account identity.CreatorAccount
+	err := r.pool.QueryRow(ctx, `SELECT username, actor_id, principal_id, password_hash, revision FROM identity.creator_accounts WHERE actor_id=$1 AND principal_id=$2`, actor, principal).
+		Scan(&account.Username, &account.ActorID, &account.PrincipalID, &account.PasswordHash, &account.Revision)
+	if err != nil {
+		return identity.CreatorAccount{}, fmt.Errorf("load creator account by binding: %w", err)
+	}
+	return account, nil
+}
+
+func (r *IdentityRepository) CreateCreatorAccount(ctx context.Context, account identity.CreatorAccount) error {
+	_, err := r.pool.Exec(ctx, `INSERT INTO identity.creator_accounts (username, actor_id, principal_id, password_hash) VALUES ($1,$2,$3,$4) ON CONFLICT (username) DO NOTHING`, account.Username, account.ActorID, account.PrincipalID, account.PasswordHash)
+	return err
+}
+
+func (r *IdentityRepository) UpdateCreatorPassword(ctx context.Context, actor identity.ActorID, principal identity.PrincipalID, revision int64, passwordHash string) error {
+	result, err := r.pool.Exec(ctx, `UPDATE identity.creator_accounts SET password_hash=$1, revision=revision+1, password_changed_at=CURRENT_TIMESTAMP WHERE actor_id=$2 AND principal_id=$3 AND revision=$4`, passwordHash, actor, principal, revision)
+	if err != nil {
+		return fmt.Errorf("update creator password: %w", err)
+	}
+	if result.RowsAffected() != 1 {
+		return fmt.Errorf("update creator password: revision conflict")
+	}
+	return nil
+}

adapters/postgres/interaction_repository.go

@@ -100,6 +100,22 @@ func (r *InteractionRepository) Utterances(ctx context.Context, id interaction.C
 	return out, rows.Err()
 }
 
+// UtterancesWithProjectReferences returns canonical utterances together with
+// their already-persisted Interaction-owned project references. The caller
+// uses the pair only as a read projection; this method does not infer or write
+// scope membership.
+func (r *InteractionRepository) UtterancesWithProjectReferences(ctx context.Context, id interaction.ConversationID) ([]interaction.HumanUtterance, []interaction.ProjectReference, error) {
+	utterances, err := r.Utterances(ctx, id)
+	if err != nil {
+		return nil, nil, err
+	}
+	references, err := r.projectReferencesForUtterances(ctx, utterances)
+	if err != nil {
+		return nil, nil, err
+	}
+	return utterances, references, nil
+}
+
 // RecentUtterancesForPrincipal provides durable conversational context when a
 // client starts a fresh conversation instead of carrying the previous ID.
 func (r *InteractionRepository) RecentUtterancesForPrincipal(ctx context.Context, principalID identity.PrincipalID, limit int) ([]interaction.HumanUtterance, error) {
@@ -118,3 +134,52 @@ func (r *InteractionRepository) RecentUtterancesForPrincipal(ctx context.Context
 	}
 	return out, rows.Err()
 }
+
+// RecentUtterancesForPrincipalWithProjectReferences keeps a new conversation
+// within the same durable Interaction read boundary as its scoped context.
+func (r *InteractionRepository) RecentUtterancesForPrincipalWithProjectReferences(ctx context.Context, principalID identity.PrincipalID, limit int) ([]interaction.HumanUtterance, []interaction.ProjectReference, error) {
+	utterances, err := r.RecentUtterancesForPrincipal(ctx, principalID, limit)
+	if err != nil {
+		return nil, nil, err
+	}
+	references, err := r.projectReferencesForUtterances(ctx, utterances)
+	if err != nil {
+		return nil, nil, err
+	}
+	return utterances, references, nil
+}
+
+func (r *InteractionRepository) projectReferencesForUtterances(ctx context.Context, utterances []interaction.HumanUtterance) ([]interaction.ProjectReference, error) {
+	if len(utterances) == 0 {
+		return nil, nil
+	}
+	ids := make([]string, 0, len(utterances))
+	seen := make(map[interaction.HumanUtteranceID]struct{}, len(utterances))
+	for _, utterance := range utterances {
+		if utterance.ID == "" {
+			continue
+		}
+		if _, exists := seen[utterance.ID]; exists {
+			continue
+		}
+		seen[utterance.ID] = struct{}{}
+		ids = append(ids, string(utterance.ID))
+	}
+	if len(ids) == 0 {
+		return nil, nil
+	}
+	rows, err := r.pool.Query(ctx, `SELECT project_reference_id,utterance_id,project_id,project_display_name,role,provenance,confidence_millis,recorded_at_unix_millis FROM interaction.project_references WHERE utterance_id = ANY($1::text[]) ORDER BY recorded_at_unix_millis,project_reference_id`, ids)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	refs := make([]interaction.ProjectReference, 0)
+	for rows.Next() {
+		var ref interaction.ProjectReference
+		if err := rows.Scan(&ref.ID, &ref.UtteranceID, &ref.ProjectID, &ref.ProjectDisplayName, &ref.Role, &ref.Provenance, &ref.ConfidenceMillis, &ref.RecordedAtUnixMillis); err != nil {
+			return nil, err
+		}
+		refs = append(refs, ref)
+	}
+	return refs, rows.Err()
+}

adapters/postgres/self_repository.go

@@ -0,0 +1,148 @@
+package postgres
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+
+	selfcontract "git.cin.su/m/Assistant/contracts/self"
+	"github.com/jackc/pgx/v5/pgxpool"
+)
+
+// SelfRepository persists only SELF-owned derived assessments and ledger
+// evidence. It never evaluates, promotes or changes Capability state.
+type SelfRepository struct{ pool *pgxpool.Pool }
+
+func OpenSelf(ctx context.Context, config ContinuityConfig) (*SelfRepository, error) {
+	pool, err := openPool(ctx, config)
+	if err != nil {
+		return nil, err
+	}
+	return &SelfRepository{pool: pool}, nil
+}
+
+func (r *SelfRepository) Close() { r.pool.Close() }
+
+func (r *SelfRepository) SaveImprovementNeed(ctx context.Context, value selfcontract.ImprovementNeed) error {
+	subject, err := json.Marshal(value.SubjectRef)
+	if err != nil {
+		return err
+	}
+	evidence, err := json.Marshal(value.EvidenceRefs)
+	if err != nil {
+		return err
+	}
+	_, err = r.pool.Exec(ctx, `INSERT INTO self.improvement_needs(improvement_need_id,principal_id,subject_ref,problem_summary,evidence_refs,expected_benefit,priority,state,created_at_unix_millis)
+		VALUES($1,$2,$3,$4,$5,$6,$7,$8,$9) ON CONFLICT DO NOTHING`, value.ID, value.PrincipalID, subject, value.ProblemSummary, evidence, value.ExpectedBenefit, value.Priority, value.State, value.CreatedAt)
+	return err
+}
+
+func (r *SelfRepository) SaveLearningLedger(ctx context.Context, value selfcontract.LearningLedgerEntry) error {
+	evidence, err := json.Marshal(value.EvidenceRefs)
+	if err != nil {
+		return err
+	}
+	improvement, err := json.Marshal(value.ImprovementNeedRef)
+	if err != nil {
+		return err
+	}
+	proposed, err := json.Marshal(value.ProposedChangeRef)
+	if err != nil {
+		return err
+	}
+	evaluations, err := json.Marshal(value.ActualEvaluationRefs)
+	if err != nil {
+		return err
+	}
+	gate, err := json.Marshal(value.DevelopmentGateRef)
+	if err != nil {
+		return err
+	}
+	before, err := json.Marshal(value.BeforeVersionRefs)
+	if err != nil {
+		return err
+	}
+	after, err := json.Marshal(value.AfterVersionRefs)
+	if err != nil {
+		return err
+	}
+	sideEffects, err := json.Marshal(value.SideEffects)
+	if err != nil {
+		return err
+	}
+	rollback, err := json.Marshal(value.RollbackRef)
+	if err != nil {
+		return err
+	}
+	_, err = r.pool.Exec(ctx, `INSERT INTO self.learning_ledger(entry_id,principal_id,improvement_need_ref,observed_problem,evidence_refs,diagnosis,hypothesis,proposed_change_ref,expected_improvement,evaluation_refs,development_gate_ref,before_version_refs,after_version_refs,decision,side_effects,rollback_ref,recorded_at_unix_millis)
+		VALUES($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$16,$17) ON CONFLICT DO NOTHING`, value.ID, value.PrincipalID, improvement, value.ObservedProblem, evidence, value.Diagnosis, value.Hypothesis, proposed, value.ExpectedImprovement, evaluations, gate, before, after, value.Decision, sideEffects, rollback, value.RecordedAt)
+	return err
+}
+
+func (r *SelfRepository) SaveLearningSignal(ctx context.Context, value selfcontract.LearningSignal) error {
+	if err := value.Validate(); err != nil {
+		return err
+	}
+	subject, err := json.Marshal(value.SubjectRef)
+	if err != nil {
+		return err
+	}
+	evidence, err := json.Marshal(value.EvidenceRefs)
+	if err != nil {
+		return err
+	}
+	deps, err := json.Marshal(value.DependencyRefs)
+	if err != nil {
+		return err
+	}
+	_, err = r.pool.Exec(ctx, `INSERT INTO self.learning_signals(signal_id,principal_id,kind,task_pattern,scope_key,subject_ref,evidence_refs,expected_outcome,actual_outcome,dependency_refs,environment_version,observed_at_unix_millis,severity,user_impact,correction_count,decision_regret)
+		VALUES($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$16) ON CONFLICT DO NOTHING`, value.ID, value.PrincipalID, value.Kind, value.TaskPattern, value.ScopeKey, subject, evidence, value.ExpectedOutcome, value.ActualOutcome, deps, value.EnvironmentVersion, value.ObservedAt, value.Severity, value.UserImpact, value.CorrectionCount, value.DecisionRegret)
+	return err
+}
+
+func (r *SelfRepository) SaveWeaknessPattern(ctx context.Context, value selfcontract.WeaknessPattern) error {
+	evidence, err := json.Marshal(value.DetectionEvidenceRefs)
+	if err != nil {
+		return err
+	}
+	deps, err := json.Marshal(value.DependencyRefs)
+	if err != nil {
+		return err
+	}
+	_, err = r.pool.Exec(ctx, `INSERT INTO self.weakness_patterns(assessment_id,principal_id,revision,pattern_key,task_pattern,scope_key,environment_version,dependency_refs,failure_mode,detection_evidence_refs,frequency,last_observed_at_unix_millis,severity,affected_component,affected_strategy,confidence_millis,epistemic_status,state,recorded_at_unix_millis)
+		VALUES($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$16,$17,$18,$19) ON CONFLICT DO NOTHING`, value.ID, value.PrincipalID, value.Revision, value.PatternKey, value.TaskPattern, value.ScopeKey, value.EnvironmentVersion, deps, value.FailureMode, evidence, value.Frequency, value.LastObservedAt, value.Severity, value.AffectedComponent, value.AffectedStrategy, value.ConfidenceMillis, value.EpistemicStatus, value.State, value.RecordedAt)
+	return err
+}
+
+func (r *SelfRepository) SaveImprovementCandidate(ctx context.Context, value selfcontract.ImprovementCandidate) error {
+	if err := value.Validate(); err != nil {
+		return err
+	}
+	need, err := json.Marshal(value.NeedRef)
+	if err != nil {
+		return err
+	}
+	must, err := json.Marshal(value.MustNotWorsen)
+	if err != nil {
+		return err
+	}
+	evidence, err := json.Marshal(value.EvidenceRefs)
+	if err != nil {
+		return err
+	}
+	_, err = r.pool.Exec(ctx, `INSERT INTO self.improvement_candidates(candidate_id,principal_id,need_ref,hypothesis,expected_effect,evaluation_plan,must_not_worsen,rollback_plan,resource_cost,creator,independent_evaluator,state,evidence_refs,created_at_unix_millis)
+		VALUES($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14) ON CONFLICT DO NOTHING`, value.ID, value.PrincipalID, need, value.Hypothesis, value.ExpectedEffect, value.EvaluationPlan, must, value.RollbackPlan, value.ResourceCost, value.Creator, value.IndependentEvaluator, value.State, evidence, value.CreatedAt)
+	return err
+}
+
+func (r *SelfRepository) SaveBenchmarkCase(ctx context.Context, value selfcontract.BenchmarkCase) error {
+	if !value.Valid() {
+		return fmt.Errorf("benchmark case is incomplete")
+	}
+	evidence, err := json.Marshal(value.EvidenceRefs)
+	if err != nil {
+		return err
+	}
+	_, err = r.pool.Exec(ctx, `INSERT INTO self.personal_benchmark_cases(case_id,principal_id,task_class,evidence_refs,recorded_at_unix_millis) VALUES($1,$2,$3,$4,$5) ON CONFLICT DO NOTHING`, value.ID, value.PrincipalID, value.TaskClass, evidence, value.RecordedAt)
+	return err
+}

adapters/postgres/situation_repository.go

@@ -2,6 +2,7 @@ package postgres
 
 import (
 	"context"
+	"encoding/json"
 	"strings"
 
 	"git.cin.su/m/Assistant/contracts/identity"
@@ -18,6 +19,38 @@ func OpenSituation(ctx context.Context, config ContinuityConfig) (*SituationRepo
 	}
 	return &SituationRepository{pool: pool}, nil
 }
+
+func (r *SituationRepository) SaveContextScope(ctx context.Context, scope situation.ContextScope) error {
+	if err := scope.Validate(); err != nil {
+		return err
+	}
+	bindings, err := json.Marshal(scope.Bindings)
+	if err != nil {
+		return err
+	}
+	_, err = r.pool.Exec(ctx, `INSERT INTO situation.context_scopes(context_scope_id,principal_id,revision,bindings,recorded_at_unix_millis) VALUES($1,$2,$3,$4,$5) ON CONFLICT(context_scope_id) DO UPDATE SET revision=EXCLUDED.revision, bindings=EXCLUDED.bindings, recorded_at_unix_millis=EXCLUDED.recorded_at_unix_millis`, scope.ID, scope.PrincipalID, scope.Revision, bindings, scope.RecordedAt)
+	return err
+}
+
+func (r *SituationRepository) SaveFocusFrame(ctx context.Context, frame situation.FocusFrame) error {
+	if err := frame.Validate(); err != nil {
+		return err
+	}
+	ref, err := json.Marshal(frame.ContextScopeRef)
+	if err != nil {
+		return err
+	}
+	_, err = r.pool.Exec(ctx, `INSERT INTO situation.focus_frames(focus_frame_id,principal_id,actor_id,revision,authority_scope_ref,context_scope_ref,goal_ref,task_ref,source_utterance_ref,provenance,confidence_millis,state,parent_frame_ref,activated_at_unix_millis,suspended_at_unix_millis,expired_at_unix_millis,recorded_at_unix_millis) VALUES($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$16,$17) ON CONFLICT(focus_frame_id) DO UPDATE SET revision=EXCLUDED.revision, context_scope_ref=EXCLUDED.context_scope_ref, state=EXCLUDED.state, suspended_at_unix_millis=EXCLUDED.suspended_at_unix_millis, expired_at_unix_millis=EXCLUDED.expired_at_unix_millis, recorded_at_unix_millis=EXCLUDED.recorded_at_unix_millis`, frame.ID, frame.PrincipalID, frame.ActorID, frame.Revision, frame.AuthorityScopeRef, ref, frame.GoalRef, frame.TaskRef, frame.SourceUtteranceRef, frame.Provenance, frame.ConfidenceMillis, frame.State, frame.ParentFrameRef, frame.ActivatedAt, frame.SuspendedAt, frame.ExpiredAt, frame.RecordedAt)
+	return err
+}
+
+func (r *SituationRepository) AppendFocusTransition(ctx context.Context, transition situation.FocusTransition) error {
+	if err := transition.Validate(); err != nil {
+		return err
+	}
+	_, err := r.pool.Exec(ctx, `INSERT INTO situation.focus_transitions(transition_id,focus_frame_id,from_revision,to_revision,operation,cause_ref,recorded_at_unix_millis) VALUES($1,$2,$3,$4,$5,$6,$7)`, transition.TransitionID, transition.FrameID, transition.FromRevision, transition.ToRevision, transition.Operation, transition.CauseRef, transition.RecordedAt)
+	return err
+}
 func (r *SituationRepository) Close() { r.pool.Close() }
 func (r *SituationRepository) Save(ctx context.Context, binding situation.FocusBinding) error {
 	_, err := r.pool.Exec(ctx, `INSERT INTO situation.focus_bindings (focus_binding_id, actor_id, session_id, workspace_id, project_id, goal_id, scope_id, active) VALUES ($1,$2,$3,$4,$5,$6,$7,$8) ON CONFLICT (focus_binding_id) DO UPDATE SET active=EXCLUDED.active`, binding.ID, binding.ActorID, binding.SessionID, binding.Workspace, binding.ProjectID, binding.GoalID, binding.ScopeID, binding.Active)

adapters/postgres/work_repository.go

@@ -25,6 +25,121 @@ var (
 	ErrDevelopmentCandidateConflict = errors.New("development candidate conflict")
 )
 
+func (r *WorkRepository) SaveInvestigation(ctx context.Context, value work.Investigation, expectedRevision int64) error {
+	if !value.Valid() || expectedRevision < 0 {
+		return errors.New("invalid investigation revision")
+	}
+	attempts := make([]string, 0, len(value.AttemptRefs))
+	for _, item := range value.AttemptRefs {
+		attempts = append(attempts, string(item))
+	}
+	hypotheses := make([]string, 0, len(value.HypothesisRefs))
+	for _, item := range value.HypothesisRefs {
+		hypotheses = append(hypotheses, string(item))
+	}
+	findings := make([]string, 0, len(value.FindingRefs))
+	for _, item := range value.FindingRefs {
+		findings = append(findings, string(item))
+	}
+	blockers := append([]string(nil), value.Blockers...)
+	checkpoints := make([]string, 0, len(value.CheckpointRefs))
+	for _, item := range value.CheckpointRefs {
+		checkpoints = append(checkpoints, string(item))
+	}
+	if expectedRevision == 0 {
+		result, err := r.pool.Exec(ctx, `INSERT INTO work.long_running_work(investigation_id,objective,hypothesis_refs,attempt_refs,finding_refs,blockers,checkpoint_refs,next_step,state,revision,time_budget_millis,cost_budget_micros,max_attempts,recorded_at_unix_millis) VALUES($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14) ON CONFLICT(investigation_id) DO NOTHING`, value.ID, value.Objective, hypotheses, attempts, findings, blockers, checkpoints, value.NextStep, value.State, value.Revision, value.TimeBudgetMillis, value.CostBudgetMicros, value.MaxAttempts, value.RecordedAtUnixMillis)
+		if err != nil {
+			return err
+		}
+		if result.RowsAffected() != 1 {
+			return errors.New("investigation already exists")
+		}
+		return nil
+	}
+	result, err := r.pool.Exec(ctx, `UPDATE work.long_running_work SET objective=$2,hypothesis_refs=$3,attempt_refs=$4,finding_refs=$5,blockers=$6,checkpoint_refs=$7,next_step=$8,state=$9,revision=$10,time_budget_millis=$11,cost_budget_micros=$12,max_attempts=$13,recorded_at_unix_millis=$14 WHERE investigation_id=$1 AND revision=$15`, value.ID, value.Objective, hypotheses, attempts, findings, blockers, checkpoints, value.NextStep, value.State, value.Revision, value.TimeBudgetMillis, value.CostBudgetMicros, value.MaxAttempts, value.RecordedAtUnixMillis, expectedRevision)
+	if err != nil {
+		return err
+	}
+	if result.RowsAffected() != 1 {
+		return errors.New("investigation revision conflict")
+	}
+	return nil
+}
+
+func (r *WorkRepository) LoadInvestigation(ctx context.Context, id work.LongRunningWorkID) (work.Investigation, error) {
+	var value work.Investigation
+	var hypotheses, attempts, findings, blockers, checkpoints []string
+	err := r.pool.QueryRow(ctx, `SELECT investigation_id,objective,hypothesis_refs,attempt_refs,finding_refs,blockers,checkpoint_refs,next_step,state,revision,time_budget_millis,cost_budget_micros,max_attempts,recorded_at_unix_millis FROM work.long_running_work WHERE investigation_id=$1`, id).Scan(&value.ID, &value.Objective, &hypotheses, &attempts, &findings, &blockers, &checkpoints, &value.NextStep, &value.State, &value.Revision, &value.TimeBudgetMillis, &value.CostBudgetMicros, &value.MaxAttempts, &value.RecordedAtUnixMillis)
+	if err != nil {
+		return work.Investigation{}, fmt.Errorf("load investigation: %w", err)
+	}
+	for _, item := range hypotheses {
+		value.HypothesisRefs = append(value.HypothesisRefs, work.EvidenceRef(item))
+	}
+	for _, item := range attempts {
+		value.AttemptRefs = append(value.AttemptRefs, work.AgentRunID(item))
+	}
+	for _, item := range findings {
+		value.FindingRefs = append(value.FindingRefs, work.EvidenceRef(item))
+	}
+	value.Blockers = append(value.Blockers, blockers...)
+	for _, item := range checkpoints {
+		value.CheckpointRefs = append(value.CheckpointRefs, work.AgentCheckpointID(item))
+	}
+	return value, nil
+}
+
+// SaveInvestigationCheckpoint atomically records the checkpoint and marks its
+// attempts verified. The unique key makes retries idempotent.
+func (r *WorkRepository) SaveInvestigationCheckpoint(ctx context.Context, checkpoint work.InvestigationCheckpoint) error {
+	if !checkpoint.Valid() {
+		return errors.New("invalid investigation checkpoint")
+	}
+	tx, err := r.pool.Begin(ctx)
+	if err != nil {
+		return err
+	}
+	defer tx.Rollback(ctx)
+	if _, err = tx.Exec(ctx, `INSERT INTO work.investigation_checkpoints(checkpoint_id,investigation_id,completed_attempt_refs,completed_finding_refs,next_step,recorded_at_unix_millis) VALUES($1,$2,$3,$4,$5,$6) ON CONFLICT(checkpoint_id) DO NOTHING`, checkpoint.ID, checkpoint.InvestigationID, stringIDs(checkpoint.CompletedAttemptRefs), stringEvidence(checkpoint.CompletedFindingRefs), checkpoint.NextStep, checkpoint.RecordedAtUnixMillis); err != nil {
+		return err
+	}
+	for _, attempt := range checkpoint.CompletedAttemptRefs {
+		if _, err = tx.Exec(ctx, `INSERT INTO work.investigation_attempts(investigation_id,attempt_ref,verified_at_unix_millis) VALUES($1,$2,$3) ON CONFLICT(investigation_id,attempt_ref) DO NOTHING`, checkpoint.InvestigationID, attempt, checkpoint.RecordedAtUnixMillis); err != nil {
+			return err
+		}
+	}
+	return tx.Commit(ctx)
+}
+
+func (r *WorkRepository) UnverifiedInvestigationAttempts(ctx context.Context, id work.LongRunningWorkID, candidates []work.AgentRunID) ([]work.AgentRunID, error) {
+	result := make([]work.AgentRunID, 0, len(candidates))
+	for _, candidate := range candidates {
+		var exists bool
+		if err := r.pool.QueryRow(ctx, `SELECT EXISTS(SELECT 1 FROM work.investigation_attempts WHERE investigation_id=$1 AND attempt_ref=$2)`, id, candidate).Scan(&exists); err != nil {
+			return nil, err
+		}
+		if !exists {
+			result = append(result, candidate)
+		}
+	}
+	return result, nil
+}
+
+func stringIDs(values []work.AgentRunID) []string {
+	result := make([]string, 0, len(values))
+	for _, value := range values {
+		result = append(result, string(value))
+	}
+	return result
+}
+func stringEvidence(values []work.EvidenceRef) []string {
+	result := make([]string, 0, len(values))
+	for _, value := range values {
+		result = append(result, string(value))
+	}
+	return result
+}
+
 func OpenWork(ctx context.Context, config ContinuityConfig) (*WorkRepository, error) {
 	pool, err := openPool(ctx, config)
 	if err != nil {

adapters/postgres/world_repository.go

@@ -0,0 +1,108 @@
+package postgres
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+
+	"git.cin.su/m/Assistant/contracts/world"
+	worlddomain "git.cin.su/m/Assistant/modules/world/domain"
+	"github.com/jackc/pgx/v5/pgxpool"
+)
+
+type WorldRepository struct{ pool *pgxpool.Pool }
+
+func OpenWorld(ctx context.Context, config ContinuityConfig) (*WorldRepository, error) {
+	pool, err := openPool(ctx, config)
+	if err != nil {
+		return nil, err
+	}
+	return &WorldRepository{pool: pool}, nil
+}
+
+func (r *WorldRepository) Close() { r.pool.Close() }
+
+func (r *WorldRepository) SaveKindDefinition(ctx context.Context, value world.WorldObjectKindDefinition) error {
+	if err := worlddomain.ValidateKindDefinition(value); err != nil {
+		return err
+	}
+	var parentOwner, parentKind, parentID string
+	var parentRevision *uint64
+	if value.ParentKindRef != nil {
+		parentOwner, parentKind, parentID = value.ParentKindRef.OwnerNamespace, value.ParentKindRef.SemanticKind, string(value.ParentKindRef.StableID)
+		if value.ParentKindRef.Revision != nil {
+			revision := uint64(*value.ParentKindRef.Revision)
+			parentRevision = &revision
+		}
+	}
+	_, err := r.pool.Exec(ctx, `INSERT INTO world.kind_definitions(kind_definition_id,kind_key,revision,display_name,parent_owner_namespace,parent_semantic_kind,parent_stable_id,parent_revision,lifecycle,definition_digest,recorded_at_unix_millis) VALUES($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11) ON CONFLICT(kind_definition_id) DO NOTHING`, value.ID, value.KindKey, value.Revision, value.DisplayName, parentOwner, parentKind, parentID, parentRevision, value.Lifecycle, value.DefinitionDigest, value.RecordedAt)
+	return err
+}
+
+func (r *WorldRepository) SaveObject(ctx context.Context, value world.WorldObject) error {
+	if err := worlddomain.ValidateObject(value); err != nil {
+		return err
+	}
+	_, err := r.pool.Exec(ctx, `INSERT INTO world.objects(world_object_id,principal_id,kind_owner_namespace,kind_semantic_kind,kind_stable_id,kind_revision,lifecycle,created_at_unix_millis) VALUES($1,$2,$3,$4,$5,$6,$7,$8) ON CONFLICT(world_object_id) DO NOTHING`, value.ID, value.PrincipalID, value.KindDefinitionRef.OwnerNamespace, value.KindDefinitionRef.SemanticKind, value.KindDefinitionRef.StableID, value.KindRevision, value.Lifecycle, value.CreatedAt)
+	return err
+}
+
+func (r *WorldRepository) SaveAlias(ctx context.Context, value world.WorldAlias) error {
+	if err := worlddomain.ValidateAlias(value); err != nil {
+		return err
+	}
+	_, err := r.pool.Exec(ctx, `INSERT INTO world.aliases(world_alias_id,principal_id,world_object_id,alias,recorded_at_unix_millis) VALUES($1,$2,$3,$4,$5) ON CONFLICT(world_alias_id) DO NOTHING`, value.ID, value.PrincipalID, value.ObjectID, value.Alias, value.RecordedAt)
+	return err
+}
+
+func (r *WorldRepository) SaveFacetDefinition(ctx context.Context, value world.FacetDefinition) error {
+	if err := worlddomain.ValidateFacetDefinition(value); err != nil {
+		return err
+	}
+	payload, err := json.Marshal(value.ValueType)
+	if err != nil {
+		return fmt.Errorf("encode facet value type: %w", err)
+	}
+	_, err = r.pool.Exec(ctx, `INSERT INTO world.facet_definitions(facet_definition_id,kind_key,revision,facet_key,value_type,definition_digest,recorded_at_unix_millis) VALUES($1,$2,$3,$4,$5,$6,$7) ON CONFLICT(facet_definition_id) DO NOTHING`, value.ID, value.KindKey, value.Revision, value.FacetKey, payload, value.DefinitionDigest, value.RecordedAt)
+	return err
+}
+
+func (r *WorldRepository) SaveRelationDefinition(ctx context.Context, value world.RelationDefinition) error {
+	if err := worlddomain.ValidateRelationDefinition(value); err != nil {
+		return err
+	}
+	_, err := r.pool.Exec(ctx, `INSERT INTO world.relation_definitions(relation_definition_id,kind_key,revision,relation_key,target_kind_key,definition_digest,recorded_at_unix_millis) VALUES($1,$2,$3,$4,$5,$6,$7) ON CONFLICT(relation_definition_id) DO NOTHING`, value.ID, value.KindKey, value.Revision, value.RelationKey, value.TargetKindKey, value.DefinitionDigest, value.RecordedAt)
+	return err
+}
+
+func (r *WorldRepository) SaveResolution(ctx context.Context, value world.IdentityResolutionDecisionRecord) error {
+	if err := worlddomain.ValidateResolution(value); err != nil {
+		return err
+	}
+	candidates, err := json.Marshal(value.Candidates)
+	if err != nil {
+		return fmt.Errorf("encode resolution candidates: %w", err)
+	}
+	evidence, err := json.Marshal(value.Evidence)
+	if err != nil {
+		return fmt.Errorf("encode resolution evidence: %w", err)
+	}
+	_, err = r.pool.Exec(ctx, `INSERT INTO world.identity_resolution_decisions(resolution_decision_id,principal_id,candidates,decision,evidence,confidence_millis,decided_at_unix_millis,revision) VALUES($1,$2,$3,$4,$5,$6,$7,$8) ON CONFLICT(resolution_decision_id) DO NOTHING`, value.ID, value.PrincipalID, candidates, value.Decision, evidence, value.ConfidenceMillis, value.DecidedAt, value.Revision)
+	return err
+}
+
+func (r *WorldRepository) SaveLineage(ctx context.Context, value world.WorldLineage) error {
+	if err := worlddomain.ValidateLineage(value); err != nil {
+		return err
+	}
+	sources, err := json.Marshal(value.SourceRefs)
+	if err != nil {
+		return fmt.Errorf("encode lineage sources: %w", err)
+	}
+	successors, err := json.Marshal(value.SuccessorRefs)
+	if err != nil {
+		return fmt.Errorf("encode lineage successors: %w", err)
+	}
+	_, err = r.pool.Exec(ctx, `INSERT INTO world.lineage(lineage_id,operation,source_refs,successor_refs,recorded_at_unix_millis) VALUES($1,$2,$3,$4,$5) ON CONFLICT(lineage_id) DO NOTHING`, value.ID, value.Operation, sources, successors, value.RecordedAt)
+	return err
+}

architecture/adrs/ADR-0020-architecture-generation-2.md

@@ -0,0 +1,45 @@
+# ADR-0020 — Architecture Generation 2 governance adoption
+
+**Status:** Accepted by `ARCH-GEN2-000`
+**Date:** 2026-08-29
+**Scope:** Architecture and governance only; no runtime or schema migration.
+
+## Decision
+
+Assistant adopts the documents under `docs/DOMOVOY_CONSTITUTION.md`,
+`architecture/GEN2_TARGET_ARCHITECTURE.md`,
+`architecture/GEN2_CANONICAL_DATA_MODEL.md`,
+`development/GEN2_MIGRATION_MAP.md`,
+`development/GEN2_MASTER_PLAN.md`, and the execution contract as the
+canonical Architecture Generation 2 governance basis.
+
+The existing V1 implementation remains the rollback and compatibility
+baseline. This decision authorizes subsequent, separately accepted Gen2
+packets to introduce the World, Configuration, and SELF bounded owners and
+Gen2 migrations, subject to explicit ownership, schema, contract, and
+rollback decisions in those packets. It does not create those owners or
+change canonical runtime state in this task.
+
+## Authority and execution order
+
+The Gen2 constitution and accepted architecture decisions govern the Gen2
+program. The target architecture, canonical data model, migration map,
+master plan, execution contract, task index, and individual task packet are
+interpreted in that order. A lower-level packet cannot silently weaken a
+higher-level invariant or reorder the task index.
+
+Every Gen2 task starts from `gen2-integration`, uses the active task pointer,
+and passes the declared FAST/MILESTONE/FULL gate before merge. `ARCH-GEN2-000`
+is the architecture adoption root accepted against the PRE baseline;
+`GEN2-001` and later tasks are not accepted by this decision and require
+separate execution.
+
+## Invariants preserved
+
+- No new canonical owner, cross-module dependency, privilege, database role,
+  third-party dependency, runtime writer, event, or migration is introduced.
+- Existing Authority → Commit → Executor boundaries remain mandatory.
+- Memory remains a rebuildable retrieval fabric, World is not a generic truth
+  owner, and SELF is not a monolithic orchestrator.
+- The `domovoy-pre-gen2` baseline tag remains immutable and is the rollback
+  point until a later migration task explicitly establishes another one.

architecture/architecture-registry.json

@@ -1,7 +1,7 @@
 {
   "registry_version": 1,
   "semantic_generation": 1,
-  "architecture_generation": 1,
+  "architecture_generation": 2,
   "modules": {
     "identity": {
       "id": "mod.identity",
@@ -179,6 +179,30 @@
       "database_schema": "interaction",
       "boundary_class": "remote_capable",
       "may_depend_on": ["contracts.identity", "contracts.situation", "contracts.epistemics", "contracts.cognitive", "platform.ids", "platform.events"]
+    },
+    "world": {
+      "id": "mod.world",
+      "owns": ["WorldObject", "WorldObjectKindDefinition", "WorldAlias", "FacetDefinition", "RelationDefinition", "IdentityResolutionCandidate", "IdentityResolutionDecision", "WorldLineage"],
+      "database_schema": "world",
+      "boundary_class": "remote_capable",
+      "may_depend_on": ["contracts.identity", "platform.ids", "platform.events"],
+      "forbidden": ["adapters.models", "adapters.temporal", "claims", "beliefs", "observations"]
+    },
+    "configuration": {
+      "id": "mod.configuration",
+      "owns": ["SettingDefinition", "SettingAssignment", "ConfigurationRevision", "ConfigurationChangeProvenance"],
+      "database_schema": "configuration",
+      "boundary_class": "remote_capable",
+      "may_depend_on": ["contracts.identity", "contracts.authority", "platform.ids", "platform.events", "platform.secrets"],
+      "forbidden": ["secret_values", "arbitrary_key_value_without_definition"]
+    },
+    "self": {
+      "id": "mod.self",
+      "owns": ["CompetenceAssessment", "WeaknessPattern", "DependencyAssessment", "LearningLedgerEntry", "ImprovementNeed", "SelfVersionView", "SelfEvaluationInterpretation"],
+      "database_schema": "self",
+      "boundary_class": "remote_capable",
+      "may_depend_on": ["contracts.capability", "contracts.epistemics", "contracts.artifact", "platform.ids", "platform.events"],
+      "forbidden": ["adapters.models", "tasks", "authority_grants", "code_release_switching"]
     }
   },
   "platform": {
@@ -244,6 +268,26 @@
     "cross_owner_write": "forbidden",
     "cross_owner_application_join": "forbidden"
   },
+  "runtime_topology_v2": {
+    "core_runtime": {
+      "modules": ["identity", "situation", "work", "epistemics", "capability", "artifact", "interaction", "world", "configuration", "self"]
+    },
+    "continuity_runtime": {"modules": ["continuity"]},
+    "commit_runtime": {"modules": ["authority", "commit"]},
+    "cognitive_workers": {"modules": [], "role": "replaceable reasoning/context workers; no canonical ownership"},
+    "supervisor_runtime": {"modules": [], "role": "release health, switch, rollback and recovery; not a semantic owner"}
+  },
+  "storage_topology_v2": {
+    "postgres_cluster": "assistant_primary",
+    "schemas": {
+      "identity": "identity_role", "authority": "authority_role", "situation": "situation_role", "work": "work_role",
+      "epistemics": "epistemics_role", "continuity": "continuity_role", "capability": "capability_role", "commit": "commit_role",
+      "artifact": "artifact_role", "interaction": "interaction_role", "world": "world_role", "configuration": "configuration_role", "self": "self_role"
+    },
+    "cross_owner_fk": "forbidden_by_default",
+    "cross_owner_write": "forbidden",
+    "cross_owner_application_join": "forbidden"
+  },
   "invariants": [
     {
       "id": "INV-AUTH-001",
@@ -309,6 +353,14 @@
     ".gitea/workflows/ci.yml",
     "cmd/devctl/**",
     "dev/ACTIVE_TASK.json",
+    "docs/DOMOVOY_CONSTITUTION.md",
+    "docs/DOMOVOY_GEN2_GAP_MAP.md",
+    "architecture/GEN2_TARGET_ARCHITECTURE.md",
+    "architecture/GEN2_CANONICAL_DATA_MODEL.md",
+    "development/GEN2_MIGRATION_MAP.md",
+    "development/GEN2_MASTER_PLAN.md",
+    "development/GEN2_EXECUTION_CONTRACT.md",
+    "development/GEN2_TASK_INDEX.md",
     "security/**"
   ],
   "default_feature_task_authority": {

architecture/architecture-registry.yaml

@@ -1,6 +1,6 @@
 registry_version: 1
 semantic_generation: 1
-architecture_generation: 1
+architecture_generation: 2
 
 modules:
   identity:
@@ -75,6 +75,30 @@ modules:
     boundary_class: remote_capable
     may_depend_on: [contracts.identity, contracts.situation, contracts.epistemics, contracts.cognitive, platform.ids, platform.events]
 
+  world:
+    id: mod.world
+    owns: [WorldObject, WorldObjectKindDefinition, WorldAlias, FacetDefinition, RelationDefinition, IdentityResolutionCandidate, IdentityResolutionDecision, WorldLineage]
+    database_schema: world
+    boundary_class: remote_capable
+    may_depend_on: [contracts.identity, platform.ids, platform.events]
+    forbidden: [adapters.models, adapters.temporal, claims, beliefs, observations]
+
+  configuration:
+    id: mod.configuration
+    owns: [SettingDefinition, SettingAssignment, ConfigurationRevision, ConfigurationChangeProvenance]
+    database_schema: configuration
+    boundary_class: remote_capable
+    may_depend_on: [contracts.identity, contracts.authority, platform.ids, platform.events, platform.secrets]
+    forbidden: [secret_values, arbitrary_key_value_without_definition]
+
+  self:
+    id: mod.self
+    owns: [CompetenceAssessment, WeaknessPattern, DependencyAssessment, LearningLedgerEntry, ImprovementNeed, SelfVersionView, SelfEvaluationInterpretation]
+    database_schema: self
+    boundary_class: remote_capable
+    may_depend_on: [contracts.capability, contracts.epistemics, contracts.artifact, platform.ids, platform.events]
+    forbidden: [adapters.models, tasks, authority_grants, code_release_switching]
+
 platform:
   allowed_packages:
     - platform.ids
@@ -98,6 +122,20 @@ runtime_topology_v1:
     modules: []
     role: "replaceable cognition/context compilation workers; no canonical ownership"
 
+runtime_topology_v2:
+  core_runtime:
+    modules: [identity, situation, work, epistemics, capability, artifact, interaction, world, configuration, self]
+  continuity_runtime:
+    modules: [continuity]
+  commit_runtime:
+    modules: [authority, commit]
+  cognitive_workers:
+    modules: []
+    role: "replaceable reasoning/context workers; no canonical ownership"
+  supervisor_runtime:
+    modules: []
+    role: "release health, switch, rollback and recovery; not a semantic owner"
+
 storage_topology_v1:
   postgres_cluster: assistant_primary
   schemas:
@@ -115,6 +153,26 @@ storage_topology_v1:
   cross_owner_write: forbidden
   cross_owner_application_join: forbidden
 
+storage_topology_v2:
+  postgres_cluster: assistant_primary
+  schemas:
+    identity: identity_role
+    authority: authority_role
+    situation: situation_role
+    work: work_role
+    epistemics: epistemics_role
+    continuity: continuity_role
+    capability: capability_role
+    commit: commit_role
+    artifact: artifact_role
+    interaction: interaction_role
+    world: world_role
+    configuration: configuration_role
+    self: self_role
+  cross_owner_fk: forbidden_by_default
+  cross_owner_write: forbidden
+  cross_owner_application_join: forbidden
+
 invariants:
   - id: INV-AUTH-001
     property: "No external mutation without current valid authority and target/revision checks"
@@ -149,6 +207,14 @@ protected_paths:
   - .gitea/workflows/ci.yml
   - cmd/devctl/**
   - dev/ACTIVE_TASK.json
+  - docs/DOMOVOY_CONSTITUTION.md
+  - docs/DOMOVOY_GEN2_GAP_MAP.md
+  - architecture/GEN2_TARGET_ARCHITECTURE.md
+  - architecture/GEN2_CANONICAL_DATA_MODEL.md
+  - development/GEN2_MIGRATION_MAP.md
+  - development/GEN2_MASTER_PLAN.md
+  - development/GEN2_EXECUTION_CONTRACT.md
+  - development/GEN2_TASK_INDEX.md
   - security/**
 
 default_feature_task_authority:

cmd/cognitive-worker/admission_test.go

@@ -16,15 +16,17 @@ func (p *admissionTestProvider) Advise(context.Context, cognitive.AdvisoryReques
 }
 
 type admissionTestClient struct {
-	decision capability.AdmissionDecision
-	releases int
+	decision          capability.AdmissionDecision
+	releases          int
+	releaseContextErr error
 }
 
 func (c *admissionTestClient) Admit(context.Context, string, capability.AdmissionRequest) (capability.AdmissionDecision, capability.AdmissionLease, error) {
 	return c.decision, capability.AdmissionLease{ID: "lease-1", PolicyID: "policy-1"}, nil
 }
-func (c *admissionTestClient) Release(context.Context, capability.AdmissionLease) error {
+func (c *admissionTestClient) Release(ctx context.Context, _ capability.AdmissionLease) error {
 	c.releases++
+	c.releaseContextErr = ctx.Err()
 	return nil
 }
 
@@ -47,3 +49,14 @@ func TestInvokeAdmittedReleasesDurableLeaseAfterProvider(t *testing.T) {
 		t.Fatalf("admitted lease was not released: response=%#v err=%v calls=%d releases=%d", response, err, provider.calls, client.releases)
 	}
 }
+
+func TestInvokeAdmittedReleasesLeaseAfterCallerCancellation(t *testing.T) {
+	provider := &admissionTestProvider{}
+	client := &admissionTestClient{decision: capability.AdmissionDecision{State: capability.AdmissionAdmitted, Reason: capability.AdmissionReasonNone, PolicyID: "policy-1"}}
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+	_, _ = (&cognitiveGateway{admission: client}).invokeAdmitted(ctx, "request-1", provider, cognitive.AdvisoryRequest{Message: "hello"}, 100)
+	if client.releases != 1 || client.releaseContextErr != nil {
+		t.Fatalf("cancelled caller leaked durable lease: releases=%d release_context_err=%v", client.releases, client.releaseContextErr)
+	}
+}

cmd/cognitive-worker/discovery.go

@@ -1,7 +1,9 @@
 package main
 
 import (
+	"context"
 	"encoding/json"
+	"fmt"
 	"net/http"
 	"sort"
 	"time"
@@ -22,17 +24,7 @@ func (s discoveryService) handler(w http.ResponseWriter, r *http.Request) {
 		s.statusHandler(w, r)
 		return
 	}
-	registration, ok := s.providers[r.PathValue("provider")]
-	if !ok || registration.Discovery == nil {
-		http.Error(w, "provider discovery not found", http.StatusNotFound)
-		return
-	}
-	discovered, probe := registration.Discovery.Discover(r.Context())
-	snapshot := capability.CognitiveDiscoverySnapshot{ProviderInstanceID: registration.ProviderInstanceID, ProviderKind: registration.Kind, EndpointRef: registration.EndpointRef, CredentialRef: registration.CredentialRef, AuthMode: registration.AuthMode, BillingMode: registration.BillingMode, Enabled: true, OwnerPrincipalID: s.owner, CapabilityID: creatorAdvisoryCapabilityID, DataPolicy: registration.DataPolicy, LimitPolicyRef: "creator-advisory-local-v1", Health: probe.Health, FailureClass: capability.CognitiveFailureType(probe.Failure), ObservedAtUnixMillis: s.now().UnixMilli()}
-	for _, model := range discovered {
-		snapshot.Models = append(snapshot.Models, capability.DiscoveredModelSnapshot{ProviderModelID: model.ProviderModelID, Fingerprint: model.Fingerprint, MaxContextBytes: model.MaxContextBytes, Modalities: model.Modalities, Capabilities: model.Capabilities, Installed: capability.OperationalYes, Loaded: capability.OperationalNotObserved, Invokable: capability.OperationalNotObserved})
-	}
-	result, err := s.resolver.RegisterDiscovery(r.Context(), snapshot)
+	result, err := s.register(r.Context(), r.PathValue("provider"))
 	if err != nil {
 		http.Error(w, "provider discovery registration unavailable", http.StatusBadGateway)
 		return
@@ -41,6 +33,19 @@ func (s discoveryService) handler(w http.ResponseWriter, r *http.Request) {
 	_ = json.NewEncoder(w).Encode(result)
 }
 
+func (s discoveryService) register(ctx context.Context, provider string) (capability.CognitiveDiscoveryRegistration, error) {
+	registration, ok := s.providers[provider]
+	if !ok || registration.Discovery == nil {
+		return capability.CognitiveDiscoveryRegistration{}, fmt.Errorf("provider discovery not found")
+	}
+	discovered, probe := registration.Discovery.Discover(ctx)
+	snapshot := capability.CognitiveDiscoverySnapshot{ProviderInstanceID: registration.ProviderInstanceID, ProviderKind: registration.Kind, EndpointRef: registration.EndpointRef, CredentialRef: registration.CredentialRef, AuthMode: registration.AuthMode, BillingMode: registration.BillingMode, Enabled: true, OwnerPrincipalID: s.owner, CapabilityID: creatorAdvisoryCapabilityID, DataPolicy: registration.DataPolicy, LimitPolicyRef: "creator-advisory-local-v1", Health: probe.Health, FailureClass: capability.CognitiveFailureType(probe.Failure), ObservedAtUnixMillis: s.now().UnixMilli()}
+	for _, model := range discovered {
+		snapshot.Models = append(snapshot.Models, capability.DiscoveredModelSnapshot{ProviderModelID: model.ProviderModelID, Fingerprint: model.Fingerprint, MaxContextBytes: model.MaxContextBytes, Modalities: model.Modalities, Capabilities: model.Capabilities, Installed: capability.OperationalYes, Loaded: capability.OperationalNotObserved, Invokable: capability.OperationalNotObserved})
+	}
+	return s.resolver.RegisterDiscovery(ctx, snapshot)
+}
+
 type discoveryStatus struct {
 	Provider             string                          `json:"provider"`
 	ProviderKind         capability.ProviderKind         `json:"provider_kind"`

cmd/cognitive-worker/fleet_status.go

@@ -20,6 +20,7 @@ type fleetEndpoint struct {
 	URL        string
 	Headers    map[string]string
 	Client     *http.Client
+	Timeout    time.Duration
 }
 
 type fleetStatusResponse struct {
@@ -63,7 +64,11 @@ func probeFleetEndpoint(parent context.Context, fallbackClient *http.Client, end
 	if strings.TrimSpace(endpoint.URL) == "" {
 		return member
 	}
-	ctx, cancel := context.WithTimeout(parent, 2*time.Second)
+	timeout := endpoint.Timeout
+	if timeout <= 0 {
+		timeout = 2 * time.Second
+	}
+	ctx, cancel := context.WithTimeout(parent, timeout)
 	defer cancel()
 	request, err := http.NewRequestWithContext(ctx, http.MethodGet, endpoint.URL, nil)
 	if err != nil {

cmd/cognitive-worker/fleet_status_test.go

@@ -68,3 +68,21 @@ func TestFleetReadinessSendsConfiguredProviderHeaders(t *testing.T) {
 		t.Fatalf("status=%d body=%s", recorder.Code, recorder.Body.String())
 	}
 }
+
+func TestFleetReadinessUsesProviderSpecificTimeout(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		time.Sleep(40 * time.Millisecond)
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer server.Close()
+
+	handler := fleetReadinessHandler(server.Client(), capability.FleetTierMedium, []fleetEndpoint{{
+		ProviderID: "medium", ModelID: "medium-model", Tier: capability.FleetTierMedium,
+		URL: server.URL, Client: server.Client(), Timeout: 100 * time.Millisecond,
+	}})
+	recorder := httptest.NewRecorder()
+	handler.ServeHTTP(recorder, httptest.NewRequest(http.MethodGet, "/v1/fleet/readiness", nil))
+	if recorder.Code != http.StatusOK || !strings.Contains(recorder.Body.String(), `"selected_tier":"MEDIUM"`) {
+		t.Fatalf("provider-specific timeout was not honored: status=%d body=%s", recorder.Code, recorder.Body.String())
+	}
+}

cmd/cognitive-worker/gateway.go

@@ -4,6 +4,7 @@ import (
 	"bytes"
 	"context"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"io"
 	"net/http"
@@ -20,6 +21,8 @@ import (
 
 const creatorAdvisoryCapabilityID capability.CapabilityID = "creator-advisory"
 
+var errNoInvocableCognitiveBinding = errors.New("no invocable cognitive binding")
+
 type bindingResolver interface {
 	Resolve(context.Context, capability.CognitiveRequirement) (capability.ResolvedCognitiveBinding, error)
 	Observe(context.Context, capability.CognitiveUsageObservation) error
@@ -56,6 +59,7 @@ type cognitiveGateway struct {
 	allowCanary          bool
 	canaryMaxOutputBytes int
 	admission            admissionClient
+	revalidatePrimary    func(context.Context) error
 }
 
 func (g cognitiveGateway) policyHandler(w http.ResponseWriter, r *http.Request) {
@@ -89,7 +93,7 @@ func (g cognitiveGateway) advisoryHandler(w http.ResponseWriter, r *http.Request
 		maxOutputBytes = g.canaryMaxOutputBytes
 	}
 	requirement := capability.CognitiveRequirement{CapabilityID: creatorAdvisoryCapabilityID, OwnerPrincipalID: request.PrincipalID, DataPolicy: request.DataPolicy, RequiredModalities: []capability.ModelModality{capability.ModalityText}, RequiredCapabilities: []capability.ModelCapability{capability.CapabilityAdvisory}, AllowCanary: g.allowCanary, InputBytes: int64(len(request.Message)), MaxOutputBytes: int64(maxOutputBytes), Objective: selectionObjectiveForMeaning(request.Meaning, request.Message)}
-	selected, err := g.resolver.Resolve(r.Context(), requirement)
+	selected, err := g.resolveWithRevalidation(r.Context(), requirement)
 	if err != nil {
 		writeGatewayResponse(w, g.invokeBuiltinAdvisory(r.Context(), request, maxOutputBytes))
 		return
@@ -131,7 +135,51 @@ func (g cognitiveGateway) advisoryHandler(w http.ResponseWriter, r *http.Request
 		writeGatewayResponse(w, g.invokeBuiltinAdvisory(r.Context(), request, maxOutputBytes))
 		return
 	}
-	writeGatewayResponse(w, cognitive.GatewayAdvisoryResponse{Version: response.Version, RequestID: response.RequestID, AdvisoryText: response.AdvisoryText, ReferencedExcerptIDs: response.ReferencedExcerptIDs, FinishReason: response.FinishReason, Usage: response.Usage})
+	writeGatewayResponse(w, gatewayAdvisoryResponse(request, response))
+}
+
+const iterativeRetrievalMarker = "<domovoy-retrieval>"
+
+// gatewayAdvisoryResponse is the only model-facing extraction point. The
+// model may express a bounded retrieval intent, but it cannot provide scope,
+// identity, policy or storage details; Core supplies those on continuation.
+func gatewayAdvisoryResponse(request cognitive.GatewayAdvisoryRequest, response cognitive.AdvisoryResponse) cognitive.GatewayAdvisoryResponse {
+	result := cognitive.GatewayAdvisoryResponse{Version: response.Version, RequestID: response.RequestID, AdvisoryText: response.AdvisoryText, ReferencedExcerptIDs: response.ReferencedExcerptIDs, FinishReason: response.FinishReason, Usage: response.Usage}
+	if !request.AllowIterativeRetrieval || response.FinishReason != cognitive.FinishCompleted {
+		return result
+	}
+	intent, text, ok := parseIterativeRetrievalIntent(response.AdvisoryText)
+	if !ok {
+		return result
+	}
+	result.AdvisoryText = text
+	result.IterativeRetrieval = &intent
+	return result
+}
+
+func parseIterativeRetrievalIntent(text string) (cognitive.IterativeRetrievalRequest, string, bool) {
+	start := strings.LastIndex(text, iterativeRetrievalMarker)
+	if start < 0 {
+		return cognitive.IterativeRetrievalRequest{}, text, false
+	}
+	payload := strings.TrimSpace(text[start+len(iterativeRetrievalMarker):])
+	var intent cognitive.IterativeRetrievalRequest
+	if err := json.Unmarshal([]byte(payload), &intent); err != nil || !validIterativeRetrievalIntent(intent) {
+		return cognitive.IterativeRetrievalRequest{}, text, false
+	}
+	return intent, strings.TrimSpace(text[:start]), true
+}
+
+func validIterativeRetrievalIntent(intent cognitive.IterativeRetrievalRequest) bool {
+	if strings.TrimSpace(intent.Query) == "" || strings.TrimSpace(intent.Reason) == "" || len([]rune(intent.Query)) > 512 || len([]rune(intent.Reason)) > 512 {
+		return false
+	}
+	switch intent.Lane {
+	case cognitive.IterativeRetrievalCurrentFact, cognitive.IterativeRetrievalPositiveExperience, cognitive.IterativeRetrievalNegativeExperience, cognitive.IterativeRetrievalContradiction, cognitive.IterativeRetrievalHistoricalAnalogy:
+		return true
+	default:
+		return false
+	}
 }
 
 func (g cognitiveGateway) invokeAdmitted(ctx context.Context, leaseID string, provider advisoryProvider, invocation cognitive.AdvisoryRequest, maxOutputBytes int) (cognitive.AdvisoryResponse, error) {
@@ -145,11 +193,33 @@ func (g cognitiveGateway) invokeAdmitted(ctx context.Context, leaseID string, pr
 			return cognitive.AdvisoryResponse{Version: invocation.Version, RequestID: invocation.RequestID, ProviderBindingID: invocation.ProviderBindingID, ProviderBindingRevision: invocation.ProviderBindingRevision, FinishReason: cognitive.FinishRateLimited}, nil
 		}
 		lease = admittedLease
-		defer func() { _ = g.admission.Release(ctx, lease) }()
+		defer func() {
+			releaseCtx, cancel := context.WithTimeout(context.WithoutCancel(ctx), 5*time.Second)
+			defer cancel()
+			_ = g.admission.Release(releaseCtx, lease)
+		}()
 	}
 	return provider.Advise(ctx, invocation)
 }
 
+// resolveWithRevalidation makes one bounded recovery attempt when Capability
+// has an active/validated binding but its durable health projection rejected it
+// as non-invocable. Discovery remains the canonical Capability write path; the
+// retry observes the configured primary local provider and re-runs selection
+// once. Provider invocation, admission, and fallback remain governed elsewhere.
+func (g cognitiveGateway) resolveWithRevalidation(ctx context.Context, requirement capability.CognitiveRequirement) (capability.ResolvedCognitiveBinding, error) {
+	selected, err := g.resolver.Resolve(ctx, requirement)
+	if err == nil || !errors.Is(err, errNoInvocableCognitiveBinding) || g.revalidatePrimary == nil {
+		return selected, err
+	}
+	revalidationCtx, cancel := context.WithTimeout(ctx, 45*time.Second)
+	defer cancel()
+	if revalidationErr := g.revalidatePrimary(revalidationCtx); revalidationErr != nil {
+		return selected, err
+	}
+	return g.resolver.Resolve(ctx, requirement)
+}
+
 func selectionObjectiveForMessage(message string) capability.SelectionObjective {
 	lower := strings.ToLower(message)
 	if strings.Contains(lower, "дешев") || strings.Contains(lower, "бесплат") || strings.Contains(lower, "эконом") || strings.Contains(lower, "cost") || strings.Contains(lower, "cheap") {
@@ -374,6 +444,10 @@ type httpBindingResolver struct {
 	client *http.Client
 }
 
+type httpStatusError struct{ status int }
+
+func (e httpStatusError) Error() string { return fmt.Sprintf("registry status %d", e.status) }
+
 func newHTTPBindingResolver(raw string, client *http.Client) (*httpBindingResolver, error) {
 	base, err := url.Parse(raw)
 	if err != nil || base.Scheme == "" || base.Host == "" {
@@ -385,6 +459,10 @@ func newHTTPBindingResolver(raw string, client *http.Client) (*httpBindingResolv
 func (r *httpBindingResolver) Resolve(ctx context.Context, value capability.CognitiveRequirement) (capability.ResolvedCognitiveBinding, error) {
 	var result capability.ResolvedCognitiveBinding
 	err := r.post(ctx, "/v1/cognitive-bindings/resolve", value, &result)
+	var statusErr httpStatusError
+	if errors.As(err, &statusErr) && statusErr.status == http.StatusNotFound {
+		return result, errNoInvocableCognitiveBinding
+	}
 	return result, err
 }
 
@@ -437,7 +515,7 @@ func (r *httpBindingResolver) post(ctx context.Context, path string, value, dest
 	defer response.Body.Close()
 	if response.StatusCode < 200 || response.StatusCode >= 300 {
 		_, _ = io.Copy(io.Discard, io.LimitReader(response.Body, 4096))
-		return fmt.Errorf("registry status %d", response.StatusCode)
+		return httpStatusError{status: response.StatusCode}
 	}
 	if destination != nil {
 		return json.NewDecoder(io.LimitReader(response.Body, 64<<10)).Decode(destination)

cmd/cognitive-worker/gateway_registry_test.go

@@ -22,6 +22,26 @@ type registryStub struct {
 	observation *capability.CognitiveUsageObservation
 }
 
+type revalidatingRegistry struct {
+	selected capability.ResolvedCognitiveBinding
+	calls    int
+	alwaysNo bool
+}
+
+func (s *revalidatingRegistry) Resolve(context.Context, capability.CognitiveRequirement) (capability.ResolvedCognitiveBinding, error) {
+	s.calls++
+	if s.alwaysNo || s.calls == 1 {
+		return capability.ResolvedCognitiveBinding{}, errNoInvocableCognitiveBinding
+	}
+	return s.selected, nil
+}
+func (*revalidatingRegistry) Observe(context.Context, capability.CognitiveUsageObservation) error {
+	return nil
+}
+func (*revalidatingRegistry) RegisterDiscovery(context.Context, capability.CognitiveDiscoverySnapshot) (capability.CognitiveDiscoveryRegistration, error) {
+	return capability.CognitiveDiscoveryRegistration{}, nil
+}
+
 type failoverRegistry struct {
 	primary, fallback capability.ResolvedCognitiveBinding
 	observations      []capability.CognitiveUsageObservation
@@ -88,6 +108,73 @@ func TestActiveRegistryBindingReachesProviderAdapter(t *testing.T) {
 	}
 }
 
+func TestGatewayExtractsOnlyBoundedTypedRetrievalIntent(t *testing.T) {
+	request := cognitive.GatewayAdvisoryRequest{AllowIterativeRetrieval: true}
+	response := cognitive.AdvisoryResponse{Version: cognitive.CreatorAdvisoryV1, RequestID: "request", FinishReason: cognitive.FinishCompleted, AdvisoryText: "<domovoy-retrieval>{\"Query\":\"sync catalog\",\"SemanticSubject\":\"catalog sync\",\"Lane\":\"NEGATIVE_EXPERIENCE\",\"Reason\":\"need known failure\"}"}
+	got := gatewayAdvisoryResponse(request, response)
+	if got.IterativeRetrieval == nil || got.IterativeRetrieval.Lane != cognitive.IterativeRetrievalNegativeExperience || got.AdvisoryText != "" {
+		t.Fatalf("response=%+v", got)
+	}
+	invalid := response
+	invalid.AdvisoryText = "<domovoy-retrieval>{\"Query\":\"all memory\",\"Lane\":\"UNRESTRICTED\",\"Reason\":\"everything\"}"
+	if got := gatewayAdvisoryResponse(request, invalid); got.IterativeRetrieval != nil {
+		t.Fatalf("invalid intent accepted: %+v", got)
+	}
+}
+
+func TestStaleUnavailableBindingRevalidatesOnceBeforeInvocation(t *testing.T) {
+	selected := gatewaySelection()
+	selected.Binding.DataPolicy = capability.DataPolicyLocalOnly
+	registry := &revalidatingRegistry{selected: selected}
+	provider := &stubAdvisoryProvider{response: cognitive.AdvisoryResponse{Version: cognitive.CreatorAdvisoryV1, RequestID: "request-1", AdvisoryText: "ok", FinishReason: cognitive.FinishCompleted}}
+	revalidations := 0
+	gateway := cognitiveGateway{resolver: registry, providers: map[capability.ProviderKind][]providerRegistration{"provider-kind-1": {{EndpointRef: "endpoint-1", CredentialRef: "credential-1", Provider: provider}}}, now: time.Now, revalidatePrimary: func(context.Context) error { revalidations++; return nil }}
+	response := httptest.NewRecorder()
+	gateway.advisoryHandler(response, httptest.NewRequest(http.MethodPost, "/v1/advisories", strings.NewReader(gatewayRequest())))
+	if response.Code != http.StatusOK || !provider.called || revalidations != 1 || registry.calls != 2 {
+		t.Fatalf("status=%d provider_called=%t revalidations=%d resolves=%d", response.Code, provider.called, revalidations, registry.calls)
+	}
+}
+
+func TestRevalidationFailureDoesNotMakeBindingInvocable(t *testing.T) {
+	registry := &registryStub{err: errNoInvocableCognitiveBinding}
+	provider := &stubAdvisoryProvider{}
+	revalidations := 0
+	gateway := cognitiveGateway{resolver: registry, providers: map[capability.ProviderKind][]providerRegistration{"provider-kind-1": {{Provider: provider}}}, now: time.Now, revalidatePrimary: func(context.Context) error { revalidations++; return errors.New("provider unavailable") }}
+	gateway.advisoryHandler(httptest.NewRecorder(), httptest.NewRequest(http.MethodPost, "/v1/advisories", strings.NewReader(gatewayRequest())))
+	if provider.called || revalidations != 1 {
+		t.Fatalf("failed provider revalidation was treated as invocable: provider_called=%t revalidations=%d", provider.called, revalidations)
+	}
+}
+
+func TestRevalidationIsNotRetriedInALoop(t *testing.T) {
+	registry := &revalidatingRegistry{alwaysNo: true}
+	revalidations := 0
+	gateway := cognitiveGateway{resolver: registry, now: time.Now, revalidatePrimary: func(context.Context) error { revalidations++; return nil }}
+	gateway.advisoryHandler(httptest.NewRecorder(), httptest.NewRequest(http.MethodPost, "/v1/advisories", strings.NewReader(gatewayRequest())))
+	if revalidations != 1 || registry.calls != 2 {
+		t.Fatalf("revalidation loop: revalidations=%d resolves=%d", revalidations, registry.calls)
+	}
+}
+
+func TestHTTPResolverMarksNoInvocableBindingForSingleRevalidation(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/v1/cognitive-bindings/resolve" {
+			t.Fatalf("path=%s", r.URL.Path)
+		}
+		http.Error(w, "no invocable cognitive binding", http.StatusNotFound)
+	}))
+	defer server.Close()
+	resolver, err := newHTTPBindingResolver(server.URL, server.Client())
+	if err != nil {
+		t.Fatal(err)
+	}
+	_, err = resolver.Resolve(context.Background(), capability.CognitiveRequirement{CapabilityID: creatorAdvisoryCapabilityID, OwnerPrincipalID: "principal-1", MaxOutputBytes: 1})
+	if !errors.Is(err, errNoInvocableCognitiveBinding) {
+		t.Fatalf("resolve error=%v, want no-invocable sentinel", err)
+	}
+}
+
 func TestProviderUsesStableInstanceWhenCredentialMetadataIsStale(t *testing.T) {
 	provider := &stubAdvisoryProvider{}
 	gateway := cognitiveGateway{providers: map[capability.ProviderKind][]providerRegistration{

cmd/cognitive-worker/main.go

@@ -71,7 +71,7 @@ func main() {
 		if err != nil {
 			log.Fatal(err)
 		}
-		mediumTimeout := durationEnv("LOCAL_MEDIUM_PROVIDER_TIMEOUT", 60*time.Second)
+		mediumTimeout := durationEnv("LOCAL_MEDIUM_PROVIDER_TIMEOUT", 120*time.Second)
 		mediumAdapter, adapterErr := models.NewOpenAICompatibleLocalAdapterWithAPIKeyAndTimeout(strings.TrimRight(mediumURL, "/"), mediumAPIKey, nil, mediumTimeout)
 		if adapterErr != nil {
 			log.Fatal(adapterErr)
@@ -113,11 +113,16 @@ func main() {
 		kind := capability.ProviderKind(envOr("OPENAI_PROVIDER_KIND", "openai-responses-v1"))
 		providers[kind] = append(providers[kind], providerRegistration{ProviderInstanceID: "openai-bootstrap", Kind: kind, EndpointRef: capability.EndpointBindingRef(envOr("OPENAI_ENDPOINT_REF", "openai-responses-default")), CredentialRef: capability.CredentialRef(envOr("OPENAI_CREDENTIAL_REF", "openai-advisory-v1")), AuthMode: capability.AuthKey, BillingMode: capability.BillingPerInput, DataPolicy: capability.DataPolicyExternalMessageOnly, Provider: openAIProvider})
 	}
-	gateway := cognitiveGateway{resolver: resolver, providers: providers, builtinLocal: builtinLocal, externalRecovery: externalRecovery, now: time.Now, allowCanary: os.Getenv("COGNITIVE_ALLOW_CANARY") == "true", canaryMaxOutputBytes: 4096, admission: newHTTPAdmissionClient(envOr("CORE_RUNTIME_URL", "http://core-runtime:8080"), &http.Client{Timeout: 5 * time.Second})}
+	discovery := discoveryService{resolver: resolver, providers: discoveries, owner: identity.PrincipalID(envOr("COGNITIVE_OWNER_PRINCIPAL_ID", "domovoy-creator-principal")), now: time.Now}
+	gateway := cognitiveGateway{resolver: resolver, providers: providers, builtinLocal: builtinLocal, externalRecovery: externalRecovery, now: time.Now, allowCanary: os.Getenv("COGNITIVE_ALLOW_CANARY") == "true", canaryMaxOutputBytes: 4096, admission: newHTTPAdmissionClient(envOr("CORE_RUNTIME_URL", "http://core-runtime:8080"), &http.Client{Timeout: 5 * time.Second}), revalidatePrimary: func(ctx context.Context) error {
+		_, err := discovery.register(ctx, "medium")
+		return err
+	}}
 	mux.Handle("/healthz", health.Handler{Runtime: "cognitive-worker", SemanticGeneration: 1, ArchitectureGeneration: 1})
 	readinessClient := &http.Client{Timeout: 2 * time.Second}
 	cpuReadinessClient := &http.Client{Timeout: 10 * time.Second}
-	mediumReadinessClient := &http.Client{Timeout: 10 * time.Second}
+	mediumReadinessTimeout := 120 * time.Second
+	mediumReadinessClient := &http.Client{Timeout: mediumReadinessTimeout}
 	lifeboatURL := strings.TrimSuffix(strings.TrimRight(envOr("LOCAL_LIFEBOAT_PROVIDER_URL", "http://cognitive-lifeboat:8086/v1"), "/"), "/v1") + "/health"
 	fleetClient := &http.Client{Timeout: 2 * time.Second}
 	preferredFleet := capability.FleetTier(envOr("COGNITIVE_PREFERRED_FLEET_TIER", string(capability.FleetTierFast)))
@@ -131,14 +136,21 @@ func main() {
 	// readiness budget short; their detailed fleet state is reported separately.
 	cpuHealthProbe.Timeout = 2 * time.Second
 	mediumEndpoint := ""
+	mediumHealthEndpoint := ""
 	mediumHeaders := map[string]string{}
 	mediumHealthProbe := health.Probe{}
 	if mediumURL != "" {
 		mediumEndpoint = strings.TrimRight(mediumURL, "/") + "/models"
+		mediumHealthEndpoint = strings.TrimSuffix(strings.TrimRight(mediumURL, "/"), "/v1") + "/health"
 		if mediumAPIKey != "" {
 			mediumHeaders["Authorization"] = "Bearer " + mediumAPIKey
 		}
-		mediumHealthProbe = health.OptionalHTTPProbeWithHeaders(mediumReadinessClient, mediumEndpoint, mediumHeaders)
+		// Readiness reports provider discovery health quickly; fleet readiness
+		// separately reports authenticated model availability on /v1/models.
+		mediumHealthProbe = health.OptionalHTTPProbeWithHeaders(readinessClient, mediumHealthEndpoint, mediumHeaders)
+		// The local gateway may need several seconds to enumerate a loaded model.
+		// Keep this bounded, but do not classify a healthy MEDIUM provider as
+		// unavailable before its authenticated discovery response can arrive.
 		mediumHealthProbe.Timeout = 2 * time.Second
 	}
 	readinessProbes := []health.Probe{
@@ -157,8 +169,8 @@ func main() {
 	}
 
 	fleetEndpoints := []fleetEndpoint{
-		{ProviderID: "local-cpu-primary", ModelID: "local-cpu-model", Tier: capability.FleetTierFast, URL: cpuEndpoint, Headers: cpuFleetHeaders, Client: &http.Client{Timeout: 10 * time.Second}},
-		{ProviderID: "local-medium-primary", ModelID: "local-medium-model", Tier: capability.FleetTierMedium, URL: mediumEndpoint, Headers: mediumHeaders, Client: mediumReadinessClient},
+		{ProviderID: "local-cpu-primary", ModelID: "local-cpu-model", Tier: capability.FleetTierFast, URL: cpuEndpoint, Headers: cpuFleetHeaders, Client: &http.Client{Timeout: 10 * time.Second}, Timeout: 2 * time.Second},
+		{ProviderID: "local-medium-primary", ModelID: "local-medium-model", Tier: capability.FleetTierMedium, URL: mediumEndpoint, Headers: mediumHeaders, Client: mediumReadinessClient, Timeout: mediumReadinessTimeout},
 		{ProviderID: "cognitive-lifeboat", ModelID: "qwen3-8b-lifeboat", Tier: capability.FleetTierLifeboat, URL: lifeboatURL},
 	}
 	if gpuConfigured {
@@ -191,7 +203,6 @@ func main() {
 	mux.HandleFunc("POST /v1/multimodal/ocr", multimodalGateway.handler(capability.MultimodalRecognizeOCR))
 	mux.HandleFunc("POST /v1/multimodal/video-understand", multimodalGateway.handler(capability.MultimodalUnderstandVideo))
 	mux.HandleFunc("POST /v1/multimodal/generate-image", multimodalGateway.handler(capability.MultimodalGenerateImage))
-	discovery := discoveryService{resolver: resolver, providers: discoveries, owner: identity.PrincipalID(envOr("COGNITIVE_OWNER_PRINCIPAL_ID", "domovoy-creator-principal")), now: time.Now}
 	mux.HandleFunc("POST /v1/provider-discovery/{provider}", discovery.handler)
 	mux.Handle("POST /v1/provider-discovery/{provider}/qualify", modelQualificationHandler(discoveries, string(envOr("COGNITIVE_OWNER_PRINCIPAL_ID", "domovoy-creator-principal")), httpQualificationObserver{resolver: resolver}))
 	mux.HandleFunc("GET /v1/provider-discovery/status", discovery.statusHandler)
@@ -217,7 +228,9 @@ func durationEnv(name string, fallback time.Duration) time.Duration {
 
 func refreshProviderDiscoveries(resolver bindingResolver, service discoveryService) {
 	for name := range service.providers {
-		ctx, cancel := context.WithTimeout(context.Background(), 8*time.Second)
+		// Keep startup discovery bounded while allowing the authenticated local
+		// gateway enough time to enumerate a loaded MEDIUM model.
+		ctx, cancel := context.WithTimeout(context.Background(), 120*time.Second)
 		registration, ok := service.providers[name]
 		if !ok || registration.Discovery == nil {
 			cancel()

cmd/cognitive-worker/model_qualification.go

@@ -4,8 +4,11 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
+	"log"
 	"net/http"
 	"slices"
+	"sort"
+	"strings"
 	"sync"
 	"time"
 
@@ -53,8 +56,83 @@ type modelQualificationResponse struct {
 	Results              []modelQualificationResult    `json:"results"`
 }
 
+const qualificationControlPlaneTimeout = 45 * time.Second
+
+// qualificationCoordinator bounds duplicate control-plane probes within one
+// cognitive-worker process. It is deliberately not canonical state: the
+// Capability owner remains the sole owner of qualification evidence and
+// activation. A restart may repeat an incomplete probe, but cannot create a
+// second semantic writer or bypass independent evaluation.
+type qualificationCoordinator struct {
+	mu      sync.Mutex
+	flights map[string]*qualificationFlight
+}
+
+type qualificationFlight struct {
+	done     chan struct{}
+	response modelQualificationResponse
+	err      error
+	waiters  int
+}
+
+func (c *qualificationCoordinator) do(ctx context.Context, key string, operation func() (modelQualificationResponse, error)) (modelQualificationResponse, bool, error) {
+	c.mu.Lock()
+	if c.flights == nil {
+		c.flights = make(map[string]*qualificationFlight)
+	}
+	if current, exists := c.flights[key]; exists {
+		current.waiters++
+		c.mu.Unlock()
+		select {
+		case <-current.done:
+			return current.response, false, current.err
+		case <-ctx.Done():
+			return modelQualificationResponse{}, false, ctx.Err()
+		}
+	}
+	current := &qualificationFlight{done: make(chan struct{})}
+	c.flights[key] = current
+	c.mu.Unlock()
+
+	current.response, current.err = operation()
+	close(current.done)
+	c.mu.Lock()
+	delete(c.flights, key)
+	c.mu.Unlock()
+	return current.response, true, current.err
+}
+
+type qualificationPhaseTrace struct {
+	correlationID string
+	started       time.Time
+}
+
+func newQualificationPhaseTrace() qualificationPhaseTrace {
+	correlationID, err := ids.New()
+	if err != nil {
+		correlationID = ids.ID(fmt.Sprintf("qualification-%d", time.Now().UnixNano()))
+	}
+	return qualificationPhaseTrace{correlationID: string(correlationID), started: time.Now()}
+}
+
+func (t qualificationPhaseTrace) phase(name string, fields ...string) {
+	log.Printf("qualification_phase correlation_id=%s phase=%s elapsed_ms=%d %s", t.correlationID, name, time.Since(t.started).Milliseconds(), strings.Join(fields, " "))
+}
+
+func qualificationFlightKey(provider string, modelIDs []capability.ProviderModelID) string {
+	ids := make([]string, 0, len(modelIDs))
+	for _, modelID := range modelIDs {
+		ids = append(ids, string(modelID))
+	}
+	sort.Strings(ids)
+	return provider + "|" + strings.Join(ids, ",")
+}
+
 func modelQualificationHandler(providers map[string]providerRegistration, owner string, observers ...qualificationObserver) http.Handler {
+	coordinator := &qualificationCoordinator{}
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		trace := newQualificationPhaseTrace()
+		trace.phase("Q0", "event=request_accepted")
 		name := r.PathValue("provider")
 		registration, ok := providers[name]
 		if !ok || registration.Discovery == nil || registration.Provider == nil {
@@ -72,32 +150,65 @@ func modelQualificationHandler(providers map[string]providerRegistration, owner
 			http.Error(w, "max_output_bytes exceeds qualification bound", http.StatusBadRequest)
 			return
 		}
-		modelsFound, probe := registration.Discovery.Discover(r.Context())
-		if probe.Health != capability.HealthAvailable || len(modelsFound) == 0 {
-			http.Error(w, "provider unavailable for qualification", http.StatusServiceUnavailable)
-			return
+		controlCtx, cancel := context.WithTimeout(r.Context(), qualificationControlPlaneTimeout)
+		defer cancel()
+		response, leader, err := coordinator.do(controlCtx, qualificationFlightKey(name, request.ModelIDs), func() (modelQualificationResponse, error) {
+			trace.phase("Q1", "event=binding_candidate_loaded")
+			modelsFound, probe := registration.Discovery.Discover(controlCtx)
+			if probe.Health != capability.HealthAvailable || len(modelsFound) == 0 {
+				return modelQualificationResponse{}, fmt.Errorf("provider unavailable for qualification")
+			}
+			if len(request.ModelIDs) > 0 {
+				modelsFound = slices.DeleteFunc(modelsFound, func(model models.DiscoveredModel) bool {
+					return !slices.Contains(request.ModelIDs, model.ProviderModelID)
+				})
+			}
+			if len(modelsFound) == 0 {
+				return modelQualificationResponse{}, fmt.Errorf("requested model not discovered")
+			}
+			if len(modelsFound) > 16 {
+				modelsFound = modelsFound[:16]
+			}
+			trace.phase("Q2", fmt.Sprintf("event=provider_model_resolved model_count=%d", len(modelsFound)))
+			trace.phase("Q3", "event=bounded_invocation_started")
+			results := qualifyModels(controlCtx, registration, owner, request.Prompt, request.MaxOutputBytes, modelsFound)
+			trace.phase("Q4", "event=bounded_invocation_completed")
+			trace.phase("Q5", fmt.Sprintf("event=invocation_evidence_built result_count=%d", len(results)))
+			if len(observers) > 0 && observers[0] != nil {
+				trace.phase("Q6", "event=observation_persistence_started")
+				if err := persistQualificationResults(controlCtx, observers[0], registration, results); err != nil {
+					return modelQualificationResponse{}, fmt.Errorf("persist model qualification observation: %w", err)
+				}
+				trace.phase("Q7", "event=observation_persistence_completed")
+			}
+			// Q8-Q17 are intentionally outside this worker's authority. Capability
+			// owns independent evaluation and governed promotion; this trace makes
+			// that hand-off explicit instead of disguising it as activation.
+			trace.phase("Q8", "event=independent_evaluation_not_started owner=capability")
+			return modelQualificationResponse{Provider: registration.ProviderInstanceID, ObservedAtUnixMillis: time.Now().UnixMilli(), Results: results}, nil
+		})
+		if !leader {
+			trace.phase("Q0", "event=joined_in_progress_qualification")
 		}
-		if len(request.ModelIDs) > 0 {
-			modelsFound = slices.DeleteFunc(modelsFound, func(model models.DiscoveredModel) bool {
-				return !slices.Contains(request.ModelIDs, model.ProviderModelID)
-			})
-		}
-		if len(modelsFound) == 0 {
-			http.Error(w, "requested model not discovered", http.StatusNotFound)
-			return
-		}
-		if len(modelsFound) > 16 {
-			modelsFound = modelsFound[:16]
-		}
-		results := qualifyModels(r.Context(), registration, owner, request.Prompt, request.MaxOutputBytes, modelsFound)
-		if len(observers) > 0 && observers[0] != nil {
-			if err := persistQualificationResults(r.Context(), observers[0], registration, results); err != nil {
-				http.Error(w, "persist model qualification observation", http.StatusBadGateway)
+		if err != nil {
+			if controlCtx.Err() != nil {
+				http.Error(w, "qualification timeout", http.StatusGatewayTimeout)
 				return
 			}
+			if strings.Contains(err.Error(), "requested model not discovered") {
+				http.Error(w, "requested model not discovered", http.StatusNotFound)
+				return
+			}
+			if strings.Contains(err.Error(), "provider unavailable") {
+				http.Error(w, "provider unavailable for qualification", http.StatusServiceUnavailable)
+				return
+			}
+			http.Error(w, "persist model qualification observation", http.StatusBadGateway)
+			return
 		}
+		trace.phase("Q17", "event=qualification_response_returned activation=not_attempted")
 		w.Header().Set("Content-Type", "application/json")
-		_ = jsonEncode(w, modelQualificationResponse{Provider: registration.ProviderInstanceID, ObservedAtUnixMillis: time.Now().UnixMilli(), Results: results})
+		_ = jsonEncode(w, response)
 	})
 }
 

cmd/cognitive-worker/model_qualification_test.go

@@ -6,6 +6,7 @@ import (
 	"net/http/httptest"
 	"strings"
 	"testing"
+	"time"
 
 	"git.cin.su/m/Assistant/adapters/models"
 	"git.cin.su/m/Assistant/contracts/capability"
@@ -17,6 +18,7 @@ type qualificationProvider struct{}
 func (qualificationProvider) Probe(context.Context) models.ProviderProbe {
 	return models.ProviderProbe{Health: capability.HealthAvailable}
 }
+
 func (qualificationProvider) Discover(context.Context) ([]models.DiscoveredModel, models.ProviderProbe) {
 	return []models.DiscoveredModel{{ProviderModelID: "model-a"}, {ProviderModelID: "model-b"}}, models.ProviderProbe{Health: capability.HealthAvailable}
 }
@@ -83,3 +85,63 @@ func TestModelQualificationPersistsReachabilityWithoutQuality(t *testing.T) {
 		t.Fatalf("invalid qualification observation: %+v err=%v", observer.observations[0], err)
 	}
 }
+
+func TestModelQualificationDeduplicatesSameProviderModelFlight(t *testing.T) {
+	coordinator := &qualificationCoordinator{}
+	started := make(chan struct{})
+	release := make(chan struct{})
+	firstDone := make(chan struct{})
+	secondDone := make(chan struct{})
+	result := modelQualificationResponse{Provider: "medium"}
+	go func() {
+		_, _, err := coordinator.do(context.Background(), "medium|model-a", func() (modelQualificationResponse, error) {
+			close(started)
+			<-release
+			return result, nil
+		})
+		if err != nil {
+			t.Errorf("leader qualification failed: %v", err)
+		}
+		close(firstDone)
+	}()
+	select {
+	case <-started:
+	case <-time.After(time.Second):
+		t.Fatal("qualification invocation did not start")
+	}
+	go func() {
+		actual, leader, err := coordinator.do(context.Background(), "medium|model-a", func() (modelQualificationResponse, error) {
+			t.Error("duplicate qualification operation ran")
+			return modelQualificationResponse{}, nil
+		})
+		if err != nil || leader || actual.Provider != result.Provider {
+			t.Errorf("joined qualification response=%+v leader=%t err=%v", actual, leader, err)
+		}
+		close(secondDone)
+	}()
+	deadline := time.Now().Add(time.Second)
+	for {
+		coordinator.mu.Lock()
+		flight := coordinator.flights["medium|model-a"]
+		waiters := 0
+		if flight != nil {
+			waiters = flight.waiters
+		}
+		coordinator.mu.Unlock()
+		if waiters == 1 {
+			break
+		}
+		if time.Now().After(deadline) {
+			t.Fatal("second qualification did not join the in-progress flight")
+		}
+		time.Sleep(time.Millisecond)
+	}
+	close(release)
+	for _, done := range []chan struct{}{firstDone, secondDone} {
+		select {
+		case <-done:
+		case <-time.After(time.Second):
+			t.Fatal("qualification flight did not complete")
+		}
+	}
+}

cmd/cognitive-worker/task_evaluation.go

@@ -100,7 +100,7 @@ func (g cognitiveGateway) executeTaskEvaluationCases(ctx context.Context, reques
 		go func(index int, item capability.TaskEvaluationCase) {
 			defer wg.Done()
 			started := time.Now()
-			invocation := cognitive.AdvisoryRequest{Version: cognitive.CreatorAdvisoryV1, RequestID: cognitive.RequestID(fmt.Sprintf("task-evaluation:%s:%s", request.Profile.ID, item.CaseID)), ActorID: request.ActorID, PrincipalID: request.PrincipalID, ScopeID: request.ScopeID, Message: item.Prompt, MaxOutputBytes: int(request.MaxOutputBytes), ProviderBindingID: selected.Binding.ID, ProviderBindingRevision: selected.Binding.Revision, ProviderInstanceID: selected.Provider.ID, ModelDescriptorID: selected.Model.ID, ProviderModelID: selected.Model.ProviderModelID}
+			invocation := cognitive.AdvisoryRequest{Version: cognitive.CreatorAdvisoryV1, RequestID: cognitive.RequestID(fmt.Sprintf("task-evaluation:%s:%s", request.Profile.ID, item.CaseID)), ActorID: request.ActorID, PrincipalID: request.PrincipalID, ScopeID: request.ScopeID, Message: item.Prompt, Locale: "en-US", MaxOutputBytes: int(request.MaxOutputBytes), ProviderBindingID: selected.Binding.ID, ProviderBindingRevision: selected.Binding.Revision, ProviderInstanceID: selected.Provider.ID, ModelDescriptorID: selected.Model.ID, ProviderModelID: selected.Model.ProviderModelID}
 			response, invokeErr := g.invokeAdmitted(ctx, string(invocation.RequestID), provider, invocation, int(request.MaxOutputBytes))
 			latency := time.Since(started).Microseconds()
 			observations[index] = capability.TaskCaseObservation{CaseID: item.CaseID, Result: capability.EvaluationUnknown, CriticalFailure: invokeErr != nil || response.FinishReason != cognitive.FinishCompleted || strings.TrimSpace(response.AdvisoryText) == "", EvidenceArtifactRef: item.EvidenceArtifactRef, LatencyMicros: latency}

cmd/cognitive-worker/task_evaluation_test.go

@@ -4,6 +4,7 @@ import (
 	"bytes"
 	"context"
 	"encoding/json"
+	"fmt"
 	"net/http"
 	"net/http/httptest"
 	"testing"
@@ -57,6 +58,30 @@ func TestTaskEvaluationHandlerInvokesEveryBoundedCase(t *testing.T) {
 	}
 }
 
+type localeCheckingProvider struct{ stubAdvisoryProvider }
+
+func (p *localeCheckingProvider) Advise(ctx context.Context, request cognitive.AdvisoryRequest) (cognitive.AdvisoryResponse, error) {
+	if request.Locale == "" {
+		return cognitive.AdvisoryResponse{}, fmt.Errorf("task evaluation omitted required locale")
+	}
+	return p.stubAdvisoryProvider.Advise(ctx, request)
+}
+
+func TestTaskEvaluationSuppliesLocaleToProviderAdapter(t *testing.T) {
+	selected := gatewaySelection()
+	provider := &localeCheckingProvider{stubAdvisoryProvider{response: cognitive.AdvisoryResponse{Version: cognitive.CreatorAdvisoryV1, FinishReason: cognitive.FinishCompleted, AdvisoryText: "observed response"}}}
+	registry := &candidateRegistryStub{selected: selected}
+	gateway := cognitiveGateway{resolver: registry, providers: map[capability.ProviderKind][]providerRegistration{selected.Provider.Kind: {{ProviderInstanceID: selected.Provider.ID, Kind: selected.Provider.Kind, EndpointRef: selected.Provider.EndpointRef, CredentialRef: selected.Provider.CredentialRef, Provider: provider}}}, now: time.Now}
+	profile := capability.TaskEvaluationProfile{ID: "profile-locale", Revision: 1, CapabilityID: selected.Binding.CapabilityID, Stage: capability.TaskEvaluationGeneral, BenchmarkVersion: "locale-v1", RequiredCaseIDs: []string{"case-locale"}, QualityWeightMillis: 600, ReliabilityWeightMillis: 300, LatencyWeightMillis: 100}
+	request := capability.TaskEvaluationExecutionRequest{Profile: profile, CapabilityID: selected.Binding.CapabilityID, BindingID: selected.Binding.ID, BindingRevision: selected.Binding.Revision, ActorID: identity.ActorID("actor-1"), PrincipalID: selected.Binding.OwnerPrincipalID, ScopeID: authority.ScopeID("scope-1"), MaxOutputBytes: 512, EgressAcknowledged: true, Cases: []capability.TaskEvaluationCase{{CaseID: "case-locale", Prompt: "one", EvidenceArtifactRef: "artifact:locale"}}}
+	payload, _ := json.Marshal(request)
+	recorder := httptest.NewRecorder()
+	gateway.taskEvaluationHandler(recorder, httptest.NewRequest(http.MethodPost, "/v1/task-evaluations/execute", bytes.NewReader(payload)))
+	if recorder.Code != http.StatusOK {
+		t.Fatalf("status=%d body=%s", recorder.Code, recorder.Body.String())
+	}
+}
+
 type taskEvaluationFailoverRegistry struct {
 	primary, fallback capability.ResolvedCognitiveBinding
 	resolveCalls      int

cmd/core-runtime/cognitive_interpretation.go

@@ -16,8 +16,10 @@ import (
 	"git.cin.su/m/Assistant/contracts/authority"
 	"git.cin.su/m/Assistant/contracts/capability"
 	"git.cin.su/m/Assistant/contracts/cognitive"
+	"git.cin.su/m/Assistant/contracts/epistemics"
 	"git.cin.su/m/Assistant/contracts/identity"
 	"git.cin.su/m/Assistant/contracts/interaction"
+	epistemicsdomain "git.cin.su/m/Assistant/modules/epistemics/domain"
 	interactiondomain "git.cin.su/m/Assistant/modules/interaction/domain"
 	"git.cin.su/m/Assistant/platform/ids"
 )
@@ -28,6 +30,154 @@ type cognitiveInterpretationClient struct {
 	media   *http.Client
 }
 
+// compileInteractionContext is the Core-side handoff from the existing
+// Interaction retrieval projection to the existing Context Compiler. The
+// compiler receives only already-authorized, typed fragments and applies its
+// scope and byte-budget guards before the cognitive gateway sees them.
+func compileInteractionContext(projection interactiondomain.ContextProjection, focusProjectID string) (string, error) {
+	return compileInteractionContextWithExperience(projection, focusProjectID, nil, "")
+}
+
+func compileInteractionContextWithExperience(projection interactiondomain.ContextProjection, focusProjectID string, experiences []epistemics.ExperienceRecord, query string) (string, error) {
+	if len(projection.Fragments) == 0 && len(experiences) == 0 {
+		return projection.Text, nil
+	}
+	candidates := interactionContextCandidates(projection, focusProjectID, experiences, query)
+	bundle, err := cognitive.CompileContext(cognitive.ContextCompileInput{Candidates: candidates, DataPolicy: capability.DataPolicyLocalOnly, MaxBytes: 2048, ContextScopeRef: focusProjectID, FreshnessRequirement: "conversation-current", RiskClass: "low"})
+	if err != nil {
+		return "", err
+	}
+	parts := make([]string, 0, len(bundle.Excerpts))
+	for _, excerpt := range bundle.Excerpts {
+		parts = append(parts, excerpt.Text)
+	}
+	return strings.Join(parts, "\n"), nil
+}
+
+func interactionContextCandidates(projection interactiondomain.ContextProjection, focusProjectID string, experiences []epistemics.ExperienceRecord, query string) []cognitive.ContextCandidate {
+	candidates := make([]cognitive.ContextCandidate, 0, len(projection.Fragments)+len(experiences))
+	for _, fragment := range projection.Fragments {
+		candidates = append(candidates, cognitive.ContextCandidate{
+			Excerpt:         cognitive.ContextExcerpt{ID: cognitive.ContextExcerptID("interaction:" + string(fragment.UtteranceID)), SourceKind: "interaction-gen2-retrieval", SourceID: "interaction:utterances", Revision: 1, Sensitivity: cognitive.SensitivityPrivateAllowed, Text: fragment.Text},
+			Relevance:       fragment.Relevance,
+			Lane:            "current-fact",
+			ContextScopeRef: fragment.ScopeRef,
+			FreshnessState:  "CURRENT",
+		})
+	}
+	if needsHistoricalAnalogy(query) {
+		for _, fragment := range projection.Historical {
+			candidates = append(candidates, cognitive.ContextCandidate{
+				Excerpt:   cognitive.ContextExcerpt{ID: cognitive.ContextExcerptID("interaction:historical:" + string(fragment.UtteranceID)), SourceKind: "interaction-gen2-retrieval", SourceID: "interaction:utterances", Revision: 1, Sensitivity: cognitive.SensitivityPrivateAllowed, Text: fragment.Text},
+				Relevance: fragment.Relevance - 1, Lane: "historical-analogy", ContextScopeRef: fragment.ScopeRef, FreshnessState: "HISTORICAL_ONLY",
+			})
+		}
+	}
+	retrieved := epistemicsdomain.RetrieveExperience(experiences, "", focusProjectID, query, 4)
+	for _, record := range retrieved.Positive {
+		candidates = append(candidates, experienceContextCandidate(record, "positive-experience", false))
+	}
+	for _, record := range retrieved.Negative {
+		candidates = append(candidates, experienceContextCandidate(record, "negative-experience", true))
+	}
+	for _, record := range retrieved.Contradictions {
+		candidates = append(candidates, experienceContextCandidate(record, "contradiction", true))
+	}
+	return candidates
+}
+
+func needsHistoricalAnalogy(query string) bool {
+	for _, marker := range []string{"истор", "раньше", "предыдущ", "старое", "аналог"} {
+		if strings.Contains(strings.ToLower(query), marker) {
+			return true
+		}
+	}
+	return false
+}
+
+func experienceContextCandidate(record epistemics.ExperienceRecord, lane string, negative bool) cognitive.ContextCandidate {
+	text := strings.TrimSpace(record.ProblemStatement + ": " + record.OutcomeDetail)
+	if detail := strings.TrimSpace(record.WhySucceededOrFailed); detail != "" {
+		text += " (" + detail + ")"
+	}
+	if len(record.ApplicabilityConditions) > 0 {
+		text += " [conditions: " + strings.Join(record.ApplicabilityConditions, ", ") + "]"
+	}
+	return cognitive.ContextCandidate{Excerpt: cognitive.ContextExcerpt{ID: cognitive.ContextExcerptID("experience:" + string(record.ID)), SourceKind: "epistemics-experience", SourceID: "epistemics:experience-records", Revision: 1, Sensitivity: cognitive.SensitivityPrivateAllowed, Text: text}, Relevance: 1, Lane: lane, ContextScopeRef: record.ContextScopeRef, FreshnessState: "CURRENT", Negative: negative}
+}
+
+const (
+	iterativeRetrievalMaxRounds     = 1
+	iterativeRetrievalMaxFragments  = 2
+	iterativeRetrievalMaxAddedBytes = 1024
+	iterativeRetrievalMaxLatency    = 1500 * time.Millisecond
+)
+
+func newIterativeContextRetriever(history []interaction.HumanUtterance, references []interaction.ProjectReference, principalID, focusProjectID string, experiences []epistemics.ExperienceRecord) iterativeContextRetriever {
+	seen := map[string]struct{}{}
+	return func(ctx context.Context, request cognitive.IterativeRetrievalRequest) cognitive.IterativeRetrievalResponse {
+		started := time.Now()
+		if request.Pass < 0 || request.Pass >= iterativeRetrievalMaxRounds || request.RemainingBytes <= 0 || request.RemainingBytes > iterativeRetrievalMaxAddedBytes {
+			return cognitive.IterativeRetrievalResponse{Exhausted: true, Reason: "budget"}
+		}
+		projection := interactiondomain.BuildScopedGen2ContextForQuery(history, references, principalID, focusProjectID, request.Query)
+		candidates := interactionContextCandidates(projection, focusProjectID, experiences, request.Query)
+		filtered := make([]cognitive.ContextCandidate, 0, len(candidates))
+		for _, candidate := range candidates {
+			if !iterativeLaneMatches(request.Lane, candidate.Lane) {
+				continue
+			}
+			key := string(request.Lane) + ":" + string(candidate.Excerpt.ID)
+			if _, duplicate := seen[key]; duplicate {
+				continue
+			}
+			filtered = append(filtered, candidate)
+		}
+		bundle, err := cognitive.CompileContext(cognitive.ContextCompileInput{Candidates: filtered, DataPolicy: capability.DataPolicyLocalOnly, MaxBytes: request.RemainingBytes, ContextScopeRef: focusProjectID, TaskRef: "chat", FocusFrameRef: focusProjectID, FreshnessRequirement: "conversation-current"})
+		if err != nil || len(bundle.Excerpts) == 0 {
+			return cognitive.IterativeRetrievalResponse{Exhausted: true, Reason: "no_additional_evidence"}
+		}
+		out := make([]cognitive.ContextCandidate, 0, iterativeRetrievalMaxFragments)
+		for _, excerpt := range bundle.Excerpts {
+			if len(out) == iterativeRetrievalMaxFragments || time.Since(started) > iterativeRetrievalMaxLatency {
+				break
+			}
+			seen[string(request.Lane)+":"+string(excerpt.ID)] = struct{}{}
+			for _, candidate := range filtered {
+				if candidate.Excerpt.ID == excerpt.ID {
+					out = append(out, candidate)
+					break
+				}
+			}
+		}
+		if len(out) == 0 {
+			return cognitive.IterativeRetrievalResponse{Exhausted: true, Reason: "latency_budget"}
+		}
+		addedBytes := 0
+		for _, candidate := range out {
+			addedBytes += len([]byte(candidate.Excerpt.Text))
+		}
+		return cognitive.IterativeRetrievalResponse{Candidates: out, Exhausted: true, Reason: "completed", AddedBytes: addedBytes}
+	}
+}
+
+func iterativeLaneMatches(request cognitive.IterativeRetrievalLane, actual string) bool {
+	return (request == cognitive.IterativeRetrievalCurrentFact && actual == "current-fact") ||
+		(request == cognitive.IterativeRetrievalPositiveExperience && actual == "positive-experience") ||
+		(request == cognitive.IterativeRetrievalNegativeExperience && actual == "negative-experience") ||
+		(request == cognitive.IterativeRetrievalContradiction && actual == "contradiction") ||
+		(request == cognitive.IterativeRetrievalHistoricalAnalogy && actual == "historical-analogy")
+}
+
+const (
+	// Household interpretation and response review are intentionally compact
+	// calls. Keeping their output bounded prevents a loaded local model from
+	// spending the whole request budget generating unnecessary prose.
+	responseReviewMaxOutputBytes    = 512
+	stableKnowledgeMaxOutputBytes   = 512
+	semanticInterpretMaxOutputBytes = 1024
+)
+
 // ReviewResponse asks the cognitive gateway to turn a locally assembled draft
 // into a natural answer. The draft remains the safe fallback when cognition is
 // unavailable; the model does not mutate canonical state or execute actions.
@@ -47,7 +197,7 @@ func (c cognitiveInterpretationClient) ReviewResponse(ctx context.Context, sessi
 		Version: cognitive.CreatorAdvisoryV1, RequestID: cognitive.RequestID(requestID),
 		ActorID: session.ActorID, PrincipalID: session.PrincipalID,
 		ScopeID: authority.ScopeID("domovoy-global-scope"), Message: prompt,
-		Context: context, Locale: "ru", MaxOutputBytes: 2048, DataPolicy: capability.DataPolicyLocalOnly,
+		Context: context, Locale: "ru", MaxOutputBytes: responseReviewMaxOutputBytes, DataPolicy: capability.DataPolicyLocalOnly,
 		Meaning: cognitive.TaskMeaning{
 			SpeechAct:              "RESPONSE_REVIEW",
 			CapabilityHints:        meaning.CapabilityHints,
@@ -86,43 +236,53 @@ func (c cognitiveInterpretationClient) ReviewResponse(ctx context.Context, sessi
 // non-current question only after evidence retrieval did not produce a usable
 // result. The model decides whether its knowledge is stable enough; it must
 // explicitly decline changing or source-dependent facts instead of guessing.
+type iterativeContextRetriever func(context.Context, cognitive.IterativeRetrievalRequest) cognitive.IterativeRetrievalResponse
+
 func (c cognitiveInterpretationClient) AnswerStableKnowledge(ctx context.Context, session identity.CreatorSession, userMessage, personalMemory string, meaning cognitive.TaskMeaning) (string, error) {
+	return c.AnswerStableKnowledgeWithContinuation(ctx, session, userMessage, personalMemory, meaning, nil)
+}
+
+// AnswerStableKnowledgeWithContinuation permits one model-requested, Core-run
+// retrieval round. The callback receives only a typed intent and cannot alter
+// identity, scope or provider selection.
+func (c cognitiveInterpretationClient) AnswerStableKnowledgeWithContinuation(ctx context.Context, session identity.CreatorSession, userMessage, personalMemory string, meaning cognitive.TaskMeaning, retrieve iterativeContextRetriever) (string, error) {
 	requestID, err := ids.New()
 	if err != nil {
 		return "", err
 	}
 	prompt := "Ты отвечаешь как Домовой на обычное сообщение пользователя. Сначала пойми цель: на вопрос дай короткий естественный ответ по устойчивому общеизвестному знанию, а безопасную просьбу создать текстовый или структурный результат выполни прямо в ответе. Начинай сразу с содержания и не представляйся, если пользователь не спросил об имени. Не называй модель или внутреннюю систему. Если истинность ответа зависит от текущего наблюдения, внешнего источника или инструмента, верни ровно NEEDS_VERIFIED_RESEARCH. Не придумывай факты и не утверждай выполнение внешнего действия.\n\nСообщение пользователя:\n" + userMessage
+	if retrieve != nil {
+		prompt += "\n\nЕсли именно для ответа не хватает ограниченного контекста, вместо ответа верни единственную строку <domovoy-retrieval>{\"Query\":\"...\",\"SemanticSubject\":\"...\",\"Lane\":\"CURRENT_FACT|POSITIVE_EXPERIENCE|NEGATIVE_EXPERIENCE|CONTRADICTION|HISTORICAL_ANALOGY\",\"Reason\":\"...\"}. Не запрашивай широкий дамп памяти."
+	}
 	context := []cognitive.ContextExcerpt{}
 	if strings.TrimSpace(personalMemory) != "" {
 		context = append(context, cognitive.ContextExcerpt{ID: "personal-memory", SourceKind: "derived-personal-memory", SourceID: "interaction:human-utterances", Revision: 1, Sensitivity: cognitive.SensitivityPrivateAllowed, Text: personalMemory})
 	}
-	target := *c.baseURL
-	target.Path = "/v1/advisories"
-	payload, err := json.Marshal(cognitive.GatewayAdvisoryRequest{
+	requestValue := cognitive.GatewayAdvisoryRequest{
 		Version: cognitive.CreatorAdvisoryV1, RequestID: cognitive.RequestID(requestID),
 		ActorID: session.ActorID, PrincipalID: session.PrincipalID, ScopeID: authority.ScopeID("domovoy-global-scope"),
-		Message: prompt, Context: context, Locale: "ru", MaxOutputBytes: 1024, DataPolicy: capability.DataPolicyLocalOnly,
-		Meaning: cognitive.TaskMeaning{SpeechAct: "STABLE_KNOWLEDGE_ANSWER", CapabilityHints: meaning.CapabilityHints, RequestedOutcome: meaning.RequestedOutcome, InformationRequestKind: meaning.InformationRequestKind, ConfidenceMillis: meaning.ConfidenceMillis},
-	})
+		Message: prompt, Context: context, Locale: "ru", MaxOutputBytes: stableKnowledgeMaxOutputBytes, DataPolicy: capability.DataPolicyLocalOnly,
+		AllowIterativeRetrieval: retrieve != nil,
+		Meaning:                 cognitive.TaskMeaning{SpeechAct: "STABLE_KNOWLEDGE_ANSWER", CapabilityHints: meaning.CapabilityHints, RequestedOutcome: meaning.RequestedOutcome, InformationRequestKind: meaning.InformationRequestKind, ConfidenceMillis: meaning.ConfidenceMillis},
+	}
+	result, err := c.requestAdvisory(ctx, requestValue)
 	if err != nil {
 		return "", err
 	}
-	request, err := http.NewRequestWithContext(ctx, http.MethodPost, target.String(), bytes.NewReader(payload))
-	if err != nil {
-		return "", err
-	}
-	request.Header.Set("Content-Type", "application/json")
-	response, err := c.client.Do(request)
-	if err != nil {
-		return "", err
-	}
-	defer response.Body.Close()
-	if response.StatusCode != http.StatusOK {
-		return "", fmt.Errorf("cognitive stable knowledge status %d", response.StatusCode)
-	}
-	var result cognitive.GatewayAdvisoryResponse
-	if err := json.NewDecoder(response.Body).Decode(&result); err != nil {
-		return "", err
+	if result.IterativeRetrieval != nil && retrieve != nil {
+		additional := retrieve(ctx, *result.IterativeRetrieval)
+		for _, candidate := range additional.Candidates {
+			context = append(context, candidate.Excerpt)
+		}
+		if len(additional.Candidates) == 0 {
+			context = append(context, cognitive.ContextExcerpt{ID: "continuation:no-additional-evidence", SourceKind: "iterative-retrieval", SourceID: "core", Revision: 1, Sensitivity: cognitive.SensitivityPrivateAllowed, Text: "No additional evidence was found; answer with uncertainty rather than inventing facts."})
+		}
+		requestValue.Context = context
+		requestValue.AllowIterativeRetrieval = false
+		result, err = c.requestAdvisory(ctx, requestValue)
+		if err != nil {
+			return "", err
+		}
 	}
 	if result.FinishReason != cognitive.FinishCompleted || strings.TrimSpace(result.AdvisoryText) == "" {
 		return "", fmt.Errorf("cognitive stable knowledge incomplete: %s", result.FinishReason)
@@ -130,6 +290,33 @@ func (c cognitiveInterpretationClient) AnswerStableKnowledge(ctx context.Context
 	return strings.TrimSpace(result.AdvisoryText), nil
 }
 
+func (c cognitiveInterpretationClient) requestAdvisory(ctx context.Context, value cognitive.GatewayAdvisoryRequest) (cognitive.GatewayAdvisoryResponse, error) {
+	target := *c.baseURL
+	target.Path = "/v1/advisories"
+	payload, err := json.Marshal(value)
+	if err != nil {
+		return cognitive.GatewayAdvisoryResponse{}, err
+	}
+	request, err := http.NewRequestWithContext(ctx, http.MethodPost, target.String(), bytes.NewReader(payload))
+	if err != nil {
+		return cognitive.GatewayAdvisoryResponse{}, err
+	}
+	request.Header.Set("Content-Type", "application/json")
+	response, err := c.client.Do(request)
+	if err != nil {
+		return cognitive.GatewayAdvisoryResponse{}, err
+	}
+	defer response.Body.Close()
+	if response.StatusCode != http.StatusOK {
+		return cognitive.GatewayAdvisoryResponse{}, fmt.Errorf("cognitive stable knowledge status %d", response.StatusCode)
+	}
+	var result cognitive.GatewayAdvisoryResponse
+	if err := json.NewDecoder(response.Body).Decode(&result); err != nil {
+		return cognitive.GatewayAdvisoryResponse{}, err
+	}
+	return result, nil
+}
+
 func newCognitiveInterpretationClient(rawURL string, client *http.Client) (cognitiveInterpretationClient, error) {
 	base, err := url.Parse(rawURL)
 	if err != nil || base.Scheme == "" || base.Host == "" {
@@ -294,7 +481,7 @@ func buildGatewayInterpretationRequest(session identity.CreatorSession, utteranc
 		ScopeID:                    authority.ScopeID("domovoy-global-scope"),
 		Message:                    utterance.Content,
 		Locale:                     "ru",
-		MaxOutputBytes:             4096,
+		MaxOutputBytes:             semanticInterpretMaxOutputBytes,
 		DataPolicy:                 capability.DataPolicyLocalOnly,
 		DeterministicSpeechAct:     string(semantic.Interpretation.SpeechAct),
 		DeterministicSecondary:     string(semantic.Interpretation.SecondarySpeechAct),

cmd/core-runtime/cognitive_interpretation_test.go

@@ -11,6 +11,7 @@ import (
 
 	"git.cin.su/m/Assistant/contracts/capability"
 	"git.cin.su/m/Assistant/contracts/cognitive"
+	"git.cin.su/m/Assistant/contracts/epistemics"
 	"git.cin.su/m/Assistant/contracts/identity"
 	"git.cin.su/m/Assistant/contracts/interaction"
 	interactiondomain "git.cin.su/m/Assistant/modules/interaction/domain"
@@ -70,6 +71,84 @@ func TestAnswerStableKnowledgeUsesLocalOnlyCognitiveRoute(t *testing.T) {
 	}
 }
 
+func TestCompileInteractionContextAppliesTypedScopeBeforeGateway(t *testing.T) {
+	context, err := compileInteractionContext(interactiondomain.ContextProjection{Fragments: []interactiondomain.ContextFragment{
+		{UtteranceID: "a", Text: "контрольный код = ALPHA", ScopeRef: "company-a", Relevance: 2},
+		{UtteranceID: "b", Text: "контрольный код = BETA", ScopeRef: "company-b", Relevance: 3},
+	}}, "company-a")
+	if err != nil || context != "контрольный код = ALPHA" {
+		t.Fatalf("context=%q err=%v", context, err)
+	}
+}
+
+func TestCompileInteractionContextUsesHistoricalOnlyWhenRequested(t *testing.T) {
+	projection := interactiondomain.ContextProjection{Fragments: []interactiondomain.ContextFragment{{UtteranceID: "current", Text: "код = NEW", Relevance: 2}}, Historical: []interactiondomain.ContextFragment{{UtteranceID: "old", Text: "код = OLD", Relevance: 1, Historical: true}}}
+	current, err := compileInteractionContextWithExperience(projection, "", nil, "Какой текущий код?")
+	if err != nil || strings.Contains(current, "OLD") {
+		t.Fatalf("current context=%q err=%v", current, err)
+	}
+	historical, err := compileInteractionContextWithExperience(projection, "", nil, "Какой старый код был раньше?")
+	if err != nil || !strings.Contains(historical, "OLD") {
+		t.Fatalf("historical context=%q err=%v", historical, err)
+	}
+}
+
+func TestStableKnowledgeContinuesOnceWithBoundedAdditionalContext(t *testing.T) {
+	calls := 0
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		calls++
+		var request cognitive.GatewayAdvisoryRequest
+		if err := json.NewDecoder(r.Body).Decode(&request); err != nil {
+			t.Fatal(err)
+		}
+		if calls == 1 {
+			if !request.AllowIterativeRetrieval {
+				t.Fatal("initial advisory did not permit bounded continuation")
+			}
+			_ = json.NewEncoder(w).Encode(cognitive.GatewayAdvisoryResponse{Version: request.Version, RequestID: request.RequestID, FinishReason: cognitive.FinishCompleted, IterativeRetrieval: &cognitive.IterativeRetrievalRequest{Query: "контрольный код", Lane: cognitive.IterativeRetrievalCurrentFact, Reason: "initial context is insufficient", RemainingBytes: 512}})
+			return
+		}
+		if request.AllowIterativeRetrieval || len(request.Context) != 1 || request.Context[0].Text != "контрольный код = ORBIT-731" {
+			t.Fatalf("continuation request=%+v", request)
+		}
+		_ = json.NewEncoder(w).Encode(cognitive.GatewayAdvisoryResponse{Version: request.Version, RequestID: request.RequestID, FinishReason: cognitive.FinishCompleted, AdvisoryText: "Контрольный код — ORBIT-731."})
+	}))
+	defer server.Close()
+	client, err := newCognitiveInterpretationClient(server.URL, server.Client())
+	if err != nil {
+		t.Fatal(err)
+	}
+	answer, err := client.AnswerStableKnowledgeWithContinuation(context.Background(), identity.CreatorSession{ActorID: "actor", PrincipalID: "principal"}, "Какой контрольный код?", "", cognitive.TaskMeaning{SpeechAct: "QUESTION"}, func(context.Context, cognitive.IterativeRetrievalRequest) cognitive.IterativeRetrievalResponse {
+		return cognitive.IterativeRetrievalResponse{Candidates: []cognitive.ContextCandidate{{Excerpt: cognitive.ContextExcerpt{ID: "interaction:code", Text: "контрольный код = ORBIT-731", Sensitivity: cognitive.SensitivityPrivateAllowed}, Lane: "current-fact"}}, Exhausted: true, AddedBytes: 28}
+	})
+	if err != nil || answer != "Контрольный код — ORBIT-731." || calls != 2 {
+		t.Fatalf("answer=%q err=%v calls=%d", answer, err, calls)
+	}
+}
+
+func TestIterativeRetrieverPreservesScopeLanesAndBudgets(t *testing.T) {
+	history := []interaction.HumanUtterance{{ID: "a", PrincipalID: "p", Content: "контрольный код = ALPHA", ReceivedAtUnixMillis: 1}, {ID: "b", PrincipalID: "p", Content: "контрольный код = BETA", ReceivedAtUnixMillis: 2}}
+	references := []interaction.ProjectReference{{ID: "a-ref", UtteranceID: "a", ProjectID: "company-a"}, {ID: "b-ref", UtteranceID: "b", ProjectID: "company-b"}}
+	experiences := []epistemics.ExperienceRecord{{ID: "failure", PrincipalID: "p", ContextScopeRef: "company-a", ProblemStatement: "catalog sync", ActualOutcome: epistemics.OutcomeFailed, OutcomeDetail: "old connector failed", RecordedAtUnixMillis: 1}, {ID: "conflict", PrincipalID: "p", ContextScopeRef: "company-a", ProblemStatement: "catalog sync", ActualOutcome: epistemics.OutcomeConflict, OutcomeDetail: "conflicting result", RecordedAtUnixMillis: 2}}
+	retrieve := newIterativeContextRetriever(history, references, "p", "company-a", experiences)
+	current := retrieve(context.Background(), cognitive.IterativeRetrievalRequest{Query: "контрольный код", Lane: cognitive.IterativeRetrievalCurrentFact, Reason: "need scoped fact", RemainingBytes: 512})
+	if len(current.Candidates) != 1 || !strings.Contains(current.Candidates[0].Excerpt.Text, "ALPHA") || strings.Contains(current.Candidates[0].Excerpt.Text, "BETA") {
+		t.Fatalf("scope leaked: %#v", current)
+	}
+	if duplicate := retrieve(context.Background(), cognitive.IterativeRetrievalRequest{Query: "контрольный код", Lane: cognitive.IterativeRetrievalCurrentFact, Reason: "repeat", RemainingBytes: 512}); duplicate.Reason != "no_additional_evidence" {
+		t.Fatalf("duplicate was re-added: %#v", duplicate)
+	}
+	if negative := retrieve(context.Background(), cognitive.IterativeRetrievalRequest{Query: "catalog sync", Lane: cognitive.IterativeRetrievalNegativeExperience, Reason: "need failure", RemainingBytes: 512}); len(negative.Candidates) < 1 || !strings.Contains(strings.Join([]string{negative.Candidates[0].Excerpt.Text, negative.Candidates[len(negative.Candidates)-1].Excerpt.Text}, " "), "old connector failed") {
+		t.Fatalf("negative lane=%#v", negative)
+	}
+	if contradiction := retrieve(context.Background(), cognitive.IterativeRetrievalRequest{Query: "catalog sync", Lane: cognitive.IterativeRetrievalContradiction, Reason: "need conflict", RemainingBytes: 512}); len(contradiction.Candidates) != 1 || !strings.Contains(contradiction.Candidates[0].Excerpt.Text, "conflicting result") {
+		t.Fatalf("contradiction lane=%#v", contradiction)
+	}
+	if budget := retrieve(context.Background(), cognitive.IterativeRetrievalRequest{Query: "anything", Lane: cognitive.IterativeRetrievalCurrentFact, Reason: "bad", RemainingBytes: 2048}); budget.Reason != "budget" {
+		t.Fatalf("budget=%#v", budget)
+	}
+}
+
 func TestGenerateImageUsesDedicatedCognitiveMediaRoute(t *testing.T) {
 	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if r.Method != http.MethodPost || r.URL.Path != "/v1/multimodal/generate-image" {

cmd/core-runtime/human_response_gate_test.go

@@ -0,0 +1,46 @@
+package main
+
+import "testing"
+
+func TestShouldInvokeHumanResponseSkipsDeterministicFastPaths(t *testing.T) {
+	tests := []struct {
+		name                   string
+		stableConversational   bool
+		identityReply          string
+		memoryInstructionReply string
+		want                   bool
+	}{
+		{name: "stable conversational", stableConversational: true},
+		{name: "identity", identityReply: "Меня зовут Домовой."},
+		{name: "memory instruction", memoryInstructionReply: "Запомнил."},
+		{name: "ordinary continuity", want: true},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			if got := shouldInvokeHumanResponse(test.stableConversational, test.identityReply, test.memoryInstructionReply); got != test.want {
+				t.Fatalf("shouldInvokeHumanResponse() = %t, want %t", got, test.want)
+			}
+		})
+	}
+}
+
+func TestShouldReviewResponseSkipsStableAnswers(t *testing.T) {
+	if shouldReviewResponse("Здравствуйте.", false, true, "", "", false) {
+		t.Fatal("stable conversational reply must not wait for response review")
+	}
+	if shouldReviewResponse("Меня зовут Домовой.", false, false, "Меня зовут Домовой.", "", false) {
+		t.Fatal("identity reply must not wait for response review")
+	}
+	if shouldReviewResponse("Запомнил.", false, false, "", "Запомнил.", false) {
+		t.Fatal("memory instruction reply must not wait for response review")
+	}
+	if shouldReviewResponse("Вы называли тестовый цвет: синий.", false, false, "", "", true) {
+		t.Fatal("deterministic memory reply must not wait for response review")
+	}
+	if !shouldReviewResponse("Ответ", false, false, "", "", false) {
+		t.Fatal("non-conversational answer remains reviewable")
+	}
+	if shouldReviewResponse("Ответ", true, false, "", "", false) {
+		t.Fatal("stable knowledge answer must not be reviewed twice")
+	}
+}

cmd/core-runtime/learning.go

@@ -11,8 +11,12 @@ import (
 	"git.cin.su/m/Assistant/contracts/continuity"
 	"git.cin.su/m/Assistant/contracts/epistemics"
 	"git.cin.su/m/Assistant/contracts/interaction"
+	selfcontract "git.cin.su/m/Assistant/contracts/self"
 	capabilitydomain "git.cin.su/m/Assistant/modules/capability/domain"
 	epistemicsdomain "git.cin.su/m/Assistant/modules/epistemics/domain"
+	selfdomain "git.cin.su/m/Assistant/modules/self/domain"
+	"git.cin.su/m/Assistant/platform/ids"
+	"git.cin.su/m/Assistant/platform/telemetry"
 )
 
 const reminderResponseSkillID = capability.SkillProfileID("skill-obvious-reminder-response-v1")
@@ -28,15 +32,55 @@ type learningCapabilityStore interface {
 	SaveSkillProfile(context.Context, capability.SkillProfile) error
 }
 
+type learningSelfStore interface {
+	SaveLearningSignal(context.Context, selfcontract.LearningSignal) error
+	SaveImprovementNeed(context.Context, selfcontract.ImprovementNeed) error
+	SaveLearningLedger(context.Context, selfcontract.LearningLedgerEntry) error
+}
+
 type learningRecorder struct {
 	epistemics learningEpistemicsStore
 	capability capabilityLearningStore
+	self       learningSelfStore
 }
 
 type capabilityLearningStore interface {
 	learningCapabilityStore
 }
 
+func (r learningRecorder) recordSelfSignal(ctx context.Context, signal selfcontract.LearningSignal) {
+	if r.self == nil {
+		return
+	}
+	if err := signal.Validate(); err != nil {
+		log.Printf("learning SELF signal invalid: %v", err)
+		return
+	}
+	if err := r.self.SaveLearningSignal(ctx, signal); err != nil {
+		log.Printf("learning SELF signal unavailable: %v", err)
+		return
+	}
+	diagnosis := selfdomain.AttributeFailure(signal)
+	need, err := selfdomain.BuildImprovementNeed(signal, diagnosis, string(signal.Kind))
+	if err != nil {
+		log.Printf("learning SELF improvement need invalid: %v", err)
+		return
+	}
+	if err := r.self.SaveImprovementNeed(ctx, need); err != nil {
+		log.Printf("learning SELF improvement need unavailable: %v", err)
+		return
+	}
+	needRef := selfcontract.SemanticReference{OwnerNamespace: "self", SemanticKind: "improvement_need", StableID: ids.StableID(need.ID)}
+	ledger := selfcontract.LearningLedgerEntry{ID: selfcontract.LearningLedgerEntryID("ledger:observed:" + signal.ID), PrincipalID: signal.PrincipalID, ImprovementNeedRef: &needRef, ObservedProblem: need.ProblemSummary, EvidenceRefs: signal.EvidenceRefs, Diagnosis: string(diagnosis.Class), Hypothesis: diagnosis.Rationale, ProposedChangeRef: signal.SubjectRef, ExpectedImprovement: need.ExpectedBenefit, Decision: "OBSERVED_REQUIRES_GOVERNED_REVIEW", RecordedAt: signal.ObservedAt}
+	if err := r.self.SaveLearningLedger(ctx, ledger); err != nil {
+		log.Printf("learning SELF ledger unavailable: %v", err)
+	}
+}
+
+func selfEvidence(owner, kind, stable string) selfcontract.SemanticReference {
+	return selfcontract.SemanticReference{OwnerNamespace: owner, SemanticKind: kind, StableID: ids.StableID(stable)}
+}
+
 type reminderResponseLearningInput struct {
 	Utterance interaction.HumanUtterance
 	Intent    interaction.OriginalHumanIntent
@@ -112,6 +156,7 @@ func (r learningRecorder) recordReminderResponse(ctx context.Context, input remi
 	actual, confidence := outcomeForHumanResponse(input.Result.Response)
 	experience := epistemics.ExperienceRecord{
 		SourceKind:        epistemics.ExperienceSourceContinuity,
+		PrincipalID:       string(input.Utterance.PrincipalID),
 		OriginalIntentID:  epistemics.OriginalIntentRef(input.Intent.ID),
 		SourceUtteranceID: epistemics.SourceUtteranceRef(input.Utterance.ID),
 		ContextRefs: contextRefs(
@@ -142,6 +187,7 @@ func (r learningRecorder) recordCorrection(ctx context.Context, input correction
 	}
 	experience := epistemics.ExperienceRecord{
 		SourceKind:            epistemics.ExperienceSourceInteraction,
+		PrincipalID:           string(input.Utterance.PrincipalID),
 		OriginalIntentID:      epistemics.OriginalIntentRef(input.Intent.ID),
 		SourceUtteranceID:     epistemics.SourceUtteranceRef(input.Utterance.ID),
 		HelpMethod:            epistemics.HelpMethodClarification,
@@ -154,12 +200,45 @@ func (r learningRecorder) recordCorrection(ctx context.Context, input correction
 		RecordedAtUnixMillis:  input.At.UnixMilli(),
 	}
 	r.saveExperienceAndReflection(ctx, experience)
+	r.recordSelfSignal(ctx, selfcontract.LearningSignal{
+		ID: "signal:correction:" + string(input.Utterance.ID), PrincipalID: string(input.Utterance.PrincipalID), Kind: selfcontract.SignalUserCorrection,
+		TaskPattern: "interaction-correction", ScopeKey: "principal:" + string(input.Utterance.PrincipalID),
+		SubjectRef: selfEvidence("interaction", "intent", string(input.Intent.ID)), EvidenceRefs: []selfcontract.SemanticReference{selfEvidence("epistemics", "experience", string(input.Utterance.ID))}, ObservedAt: input.At.UnixMilli(), Severity: 2, UserImpact: 2,
+	})
+}
+
+func (r learningRecorder) createDelegationCandidateSkill(ctx context.Context, input delegationLearningInput, experience epistemics.ExperienceRecord) {
+	if r.capability == nil || experience.ID == "" || len(experience.VerificationEvidence) == 0 {
+		return
+	}
+	// One verified result creates only a candidate. Repeated outcome evidence and
+	// independent validation are required by Capability before activation.
+	profile := capability.SkillProfile{
+		ID:                    capability.SkillProfileID("skill:delegation:" + string(input.ImplementationID)),
+		Revision:              1,
+		Name:                  "Verified bounded delegation strategy",
+		Description:           "Observed verified delegation outcome; requires repeatability and independent validation.",
+		ApplicableContext:     []string{"work:delegation"},
+		ImplementationRef:     "work:agent-delegation-v1",
+		ImplementationVersion: "1",
+		Status:                capability.SkillCandidate,
+		ConfidenceMillis:      500,
+		RecordedAtUnixMillis:  experience.RecordedAtUnixMillis,
+	}
+	next, err := capabilitydomain.CandidateFromVerifiedExperience(profile, capability.SkillEvidenceRef("epistemics:experience:"+string(experience.ID)), true, experience.RecordedAtUnixMillis)
+	if err != nil {
+		return
+	}
+	if err := r.capability.SaveSkillProfile(ctx, next); err != nil {
+		log.Printf("learning candidate skill unavailable: %v", err)
+	}
 }
 
 func (r learningRecorder) recordFastPathDecline(ctx context.Context, input fastPathDeclineLearningInput) {
 	if r.epistemics == nil || input.Intent.ID == "" || input.Utterance.ID == "" {
 		return
 	}
+	telemetry.RecordCompatibility("fast-path-v1", "core-runtime", "decision", "decline-or-escalate", true, true, false, "OBSERVED", string(input.Utterance.CorrelationID), string(input.Utterance.PrincipalID), input.At)
 	experience, err := epistemicsdomain.FastPathDeclineExperience(
 		epistemics.OriginalIntentRef(input.Intent.ID),
 		epistemics.SourceUtteranceRef(input.Utterance.ID),
@@ -173,10 +252,16 @@ func (r learningRecorder) recordFastPathDecline(ctx context.Context, input fastP
 	if input.Result.Response.ID != "" {
 		experience.ContextRefs = contextRefs("continuity:response-candidate:" + string(input.Result.Response.Operation))
 	}
+	experience.PrincipalID = string(input.Utterance.PrincipalID)
 	saved, ok := r.saveExperienceAndReflection(ctx, experience)
 	if ok {
 		r.updateReminderSkill(ctx, saved, capability.UsageSkipped, false)
 	}
+	r.recordSelfSignal(ctx, selfcontract.LearningSignal{
+		ID: "signal:fast-path:" + string(input.Utterance.ID), PrincipalID: string(input.Utterance.PrincipalID), Kind: selfcontract.SignalSkillFallback,
+		TaskPattern: "fast-path", ScopeKey: "principal:" + string(input.Utterance.PrincipalID), SubjectRef: selfEvidence("capability", "skill", string(reminderResponseSkillID)),
+		EvidenceRefs: []selfcontract.SemanticReference{selfEvidence("epistemics", "experience", string(input.Utterance.ID))}, ActualOutcome: string(input.Reason), ObservedAt: input.At.UnixMilli(), Severity: 1,
+	})
 }
 
 func (r learningRecorder) recordCapabilityUse(ctx context.Context, input capabilityLearningInput) {
@@ -194,6 +279,7 @@ func (r learningRecorder) recordCapabilityUse(ctx context.Context, input capabil
 	}
 	experience := epistemics.ExperienceRecord{
 		SourceKind:                    epistemics.ExperienceSourceCapability,
+		PrincipalID:                   string(input.Utterance.PrincipalID),
 		OriginalIntentID:              epistemics.OriginalIntentRef(input.Intent.ID),
 		SourceUtteranceID:             epistemics.SourceUtteranceRef(input.Utterance.ID),
 		HelpMethod:                    epistemics.HelpMethodCapabilityExecution,
@@ -209,6 +295,13 @@ func (r learningRecorder) recordCapabilityUse(ctx context.Context, input capabil
 		RecordedAtUnixMillis:          input.At.UnixMilli(),
 	}
 	r.saveExperienceAndReflection(ctx, experience)
+	if input.Outcome == capability.UsageFailed || input.Outcome == capability.UsageUnknown {
+		r.recordSelfSignal(ctx, selfcontract.LearningSignal{
+			ID: "signal:capability:" + string(input.Utterance.ID), PrincipalID: string(input.Utterance.PrincipalID), Kind: selfcontract.SignalVerifiedFailure,
+			TaskPattern: "capability-use", ScopeKey: "principal:" + string(input.Utterance.PrincipalID), SubjectRef: selfEvidence("capability", "implementation", string(input.ImplementationID)), EvidenceRefs: []selfcontract.SemanticReference{selfEvidence("epistemics", "experience", string(input.Utterance.ID))},
+			ActualOutcome: string(input.Outcome), ObservedAt: input.At.UnixMilli(), Severity: 2,
+		})
+	}
 }
 
 func (r learningRecorder) recordDelegationOutcome(ctx context.Context, input delegationLearningInput) {
@@ -230,6 +323,7 @@ func (r learningRecorder) recordDelegationOutcome(ctx context.Context, input del
 	}
 	experience := epistemics.ExperienceRecord{
 		SourceKind:                  epistemics.ExperienceSourceCapability,
+		PrincipalID:                 string(input.Utterance.PrincipalID),
 		OriginalIntentID:            epistemics.OriginalIntentRef(input.Intent.ID),
 		SourceUtteranceID:           epistemics.SourceUtteranceRef(input.Utterance.ID),
 		ContextRefs:                 contextRefs("work:delegation:"+input.DelegationID, "work:run:"+input.RunID),
@@ -244,7 +338,17 @@ func (r learningRecorder) recordDelegationOutcome(ctx context.Context, input del
 		ConfidenceMillis:            confidence,
 		RecordedAtUnixMillis:        input.At.UnixMilli(),
 	}
-	r.saveExperienceAndReflection(ctx, experience)
+	saved, ok := r.saveExperienceAndReflection(ctx, experience)
+	if ok && input.Verified {
+		r.createDelegationCandidateSkill(ctx, input, saved)
+	}
+	if !input.Verified {
+		r.recordSelfSignal(ctx, selfcontract.LearningSignal{
+			ID: "signal:delegation:" + input.DelegationID, PrincipalID: string(input.Utterance.PrincipalID), Kind: selfcontract.SignalVerifiedFailure,
+			TaskPattern: "delegation", ScopeKey: "principal:" + string(input.Utterance.PrincipalID), SubjectRef: selfEvidence("capability", "implementation", string(input.ImplementationID)), EvidenceRefs: []selfcontract.SemanticReference{selfEvidence("epistemics", "experience", input.OutcomeRef)},
+			ActualOutcome: string(actual), ObservedAt: input.At.UnixMilli(), Severity: 2,
+		})
+	}
 }
 
 func (r learningRecorder) saveExperienceAndReflection(ctx context.Context, value epistemics.ExperienceRecord) (epistemics.ExperienceRecord, bool) {
@@ -273,9 +377,11 @@ func (r learningRecorder) updateReminderSkill(ctx context.Context, experience ep
 	}
 	profile, err := r.capability.LoadSkillProfile(ctx, reminderResponseSkillID)
 	if err != nil {
+		telemetry.RecordCompatibility("skill-profile-v1", "core-runtime", "read", "fast-path-learning", true, false, true, "FAILURE", string(experience.OriginalIntentID), string(experience.SourceUtteranceID), time.UnixMilli(experience.RecordedAtUnixMillis))
 		log.Printf("learning skill profile unavailable: %v", err)
 		return
 	}
+	telemetry.RecordCompatibility("skill-profile-v1", "core-runtime", "read", "fast-path-learning", true, false, true, "SUCCESS", string(experience.OriginalIntentID), string(experience.SourceUtteranceID), time.UnixMilli(experience.RecordedAtUnixMillis))
 	next, err := capabilitydomain.ObserveSkillOutcome(profile, capability.SkillOutcomeObservation{
 		ExperienceRef:        capability.SkillEvidenceRef("epistemics:experience:" + string(experience.ID)),
 		Outcome:              outcome,
@@ -287,9 +393,11 @@ func (r learningRecorder) updateReminderSkill(ctx context.Context, experience ep
 		return
 	}
 	if err := r.capability.SaveSkillProfile(ctx, next); err != nil {
+		telemetry.RecordCompatibility("skill-profile-v1", "core-runtime", "write", "fast-path-learning", true, false, true, "FAILURE", string(experience.OriginalIntentID), string(experience.SourceUtteranceID), time.UnixMilli(experience.RecordedAtUnixMillis))
 		log.Printf("learning skill profile save unavailable: %v", err)
 		return
 	}
+	telemetry.RecordCompatibility("skill-profile-v1", "core-runtime", "write", "fast-path-learning", true, false, true, "SUCCESS", string(experience.OriginalIntentID), string(experience.SourceUtteranceID), time.UnixMilli(experience.RecordedAtUnixMillis))
 }
 
 func outcomeForHumanResponse(response continuity.HumanResponse) (epistemics.OutcomeClass, int64) {

cmd/core-runtime/learning_test.go

@@ -2,12 +2,14 @@ package main
 
 import (
 	"context"
+	"errors"
 	"testing"
 	"time"
 
 	"git.cin.su/m/Assistant/contracts/capability"
 	"git.cin.su/m/Assistant/contracts/epistemics"
 	"git.cin.su/m/Assistant/contracts/interaction"
+	selfcontract "git.cin.su/m/Assistant/contracts/self"
 )
 
 type learningEpistemicsStub struct {
@@ -28,17 +30,60 @@ func (s *learningEpistemicsStub) SaveReflectionCandidate(context.Context, episte
 type learningCapabilityStub struct {
 	loadCalls int
 	saveCalls int
+	saved     []capability.SkillProfile
+}
+
+type learningSelfStub struct {
+	signals int
+	needs   int
+	ledgers int
+}
+
+type failingLearningSelfStub struct{}
+
+func (failingLearningSelfStub) SaveLearningSignal(context.Context, selfcontract.LearningSignal) error {
+	return errors.New("self repository unavailable")
+}
+func (failingLearningSelfStub) SaveImprovementNeed(context.Context, selfcontract.ImprovementNeed) error {
+	return errors.New("self repository unavailable")
+}
+func (failingLearningSelfStub) SaveLearningLedger(context.Context, selfcontract.LearningLedgerEntry) error {
+	return errors.New("self repository unavailable")
+}
+
+func (s *learningSelfStub) SaveLearningSignal(context.Context, selfcontract.LearningSignal) error {
+	s.signals++
+	return nil
+}
+func (s *learningSelfStub) SaveImprovementNeed(context.Context, selfcontract.ImprovementNeed) error {
+	s.needs++
+	return nil
+}
+func (s *learningSelfStub) SaveLearningLedger(context.Context, selfcontract.LearningLedgerEntry) error {
+	s.ledgers++
+	return nil
 }
 
 func (s *learningCapabilityStub) LoadSkillProfile(context.Context, capability.SkillProfileID) (capability.SkillProfile, error) {
 	s.loadCalls++
 	return capability.SkillProfile{}, nil
 }
-func (s *learningCapabilityStub) SaveSkillProfile(context.Context, capability.SkillProfile) error {
+func (s *learningCapabilityStub) SaveSkillProfile(_ context.Context, value capability.SkillProfile) error {
 	s.saveCalls++
+	s.saved = append(s.saved, value)
 	return nil
 }
 
+func TestVerifiedDelegationCreatesCandidateNotActiveSkill(t *testing.T) {
+	e := &learningEpistemicsStub{}
+	c := &learningCapabilityStub{}
+	r := learningRecorder{epistemics: e, capability: c}
+	r.recordDelegationOutcome(context.Background(), delegationLearningInput{Intent: interaction.OriginalHumanIntent{ID: "i"}, Utterance: interaction.HumanUtterance{ID: "u"}, DelegationID: "d", RunID: "r", ImplementationID: "impl", OutcomeRef: "outcome", VerificationRefs: []epistemics.EvidenceRef{"verified"}, Verified: true, At: time.UnixMilli(1000)})
+	if len(c.saved) != 1 || c.saved[0].Status != capability.SkillCandidate || c.saved[0].VerifiedOutcomeCount != 1 {
+		t.Fatalf("candidate=%#v", c.saved)
+	}
+}
+
 func TestGenericCorrectionDoesNotDegradeReminderSkill(t *testing.T) {
 	epistemicsStore := &learningEpistemicsStub{}
 	capabilityStore := &learningCapabilityStub{}
@@ -55,3 +100,33 @@ func TestGenericCorrectionDoesNotDegradeReminderSkill(t *testing.T) {
 		t.Fatalf("generic correction must remain evidence without a reminder skill reference: %#v", epistemicsStore.experiences)
 	}
 }
+
+func TestCorrectionWritesBoundedSelfEvidenceWithoutChangingResponsePath(t *testing.T) {
+	epistemicsStore := &learningEpistemicsStub{}
+	selfStore := &learningSelfStub{}
+	recorder := learningRecorder{epistemics: epistemicsStore, self: selfStore}
+	recorder.recordCorrection(context.Background(), correctionLearningInput{
+		Intent:    interaction.OriginalHumanIntent{ID: "intent-2"},
+		Utterance: interaction.HumanUtterance{ID: "utterance-2", PrincipalID: "principal-2"},
+		At:        time.UnixMilli(2000),
+	})
+	if selfStore.signals != 1 || selfStore.needs != 1 || selfStore.ledgers != 1 {
+		t.Fatalf("self evidence counts: signals=%d needs=%d ledgers=%d", selfStore.signals, selfStore.needs, selfStore.ledgers)
+	}
+	if len(epistemicsStore.experiences) != 1 {
+		t.Fatalf("completed learning path was changed")
+	}
+}
+
+func TestSelfRepositoryFailureDoesNotDiscardUserFacingLearningPath(t *testing.T) {
+	epistemicsStore := &learningEpistemicsStub{}
+	recorder := learningRecorder{epistemics: epistemicsStore, self: failingLearningSelfStub{}}
+	recorder.recordCorrection(context.Background(), correctionLearningInput{
+		Intent:    interaction.OriginalHumanIntent{ID: "intent-failure"},
+		Utterance: interaction.HumanUtterance{ID: "utterance-failure", PrincipalID: "principal-failure"},
+		At:        time.UnixMilli(3000),
+	})
+	if len(epistemicsStore.experiences) != 1 {
+		t.Fatalf("SELF repository failure must not discard the completed epistemics response path")
+	}
+}

cmd/core-runtime/main.go

@@ -24,6 +24,7 @@ import (
 	workdomain "git.cin.su/m/Assistant/modules/work/domain"
 	"git.cin.su/m/Assistant/platform/ids"
 	platformsecrets "git.cin.su/m/Assistant/platform/secrets"
+	"git.cin.su/m/Assistant/platform/telemetry"
 	"git.cin.su/m/Assistant/runtime/health"
 	"github.com/jackc/pgx/v5"
 	"io"
@@ -37,6 +38,15 @@ import (
 	"time"
 )
 
+const (
+	creatorPasswordPath       = "/run/secrets/creator_password"
+	creatorBootstrapTokenPath = "/run/secrets/creator_bootstrap_token"
+	creatorSessionKeyPath     = "/run/secrets/creator_session_signing_key"
+	epistemicsDBPasswordPath  = "/run/secrets/epistemics_db_password"
+	interactionDBPasswordPath = "/run/secrets/interaction_db_password"
+	selfDBPasswordPath        = "/run/secrets/self_db_password"
+)
+
 const maxCreatorCredentialsBytes = 4 << 10
 
 func main() {
@@ -44,20 +54,21 @@ func main() {
 	if addr == "" {
 		addr = ":8080"
 	}
-	bootstrapToken, err := readRequiredSecret("CREATOR_BOOTSTRAP_TOKEN")
+	bootstrapToken, err := readRequiredSecretFile("CREATOR_BOOTSTRAP_TOKEN", creatorBootstrapTokenPath)
 	if err != nil {
 		log.Fatal(err)
 	}
-	sessionKeyValue, err := readRequiredSecret("CREATOR_SESSION_SIGNING_KEY")
-	if err != nil {
-		log.Fatal(err)
-	}
-	creatorPassword, err := readRequiredSecret("CREATOR_PASSWORD")
+	sessionKeyValue, err := readRequiredSecretFile("CREATOR_SESSION_SIGNING_KEY", creatorSessionKeyPath)
 	if err != nil {
 		log.Fatal(err)
 	}
 	sessionKey := []byte(sessionKeyValue)
 	creatorUsername := os.Getenv("CREATOR_USERNAME")
+	if creatorUsername == "" {
+		log.Fatal("CREATOR_USERNAME is required")
+	}
+	telemetry.RecordCompatibility("non-bootstrap-env-consumers", "core-runtime", "read", "runtime-startup-configuration", true, true, true, "OBSERVED", "startup", "core-runtime", time.Now())
+	telemetry.RecordCompatibility("migration-compatibility-switches", "core-runtime", "observe", "runtime-startup-switch-scan", true, false, false, "NOT_OBSERVED", "startup", "core-runtime", time.Now())
 	repository, err := postgres.OpenSituation(context.Background(), postgres.ContinuityConfig{Host: os.Getenv("POSTGRES_HOST"), Port: os.Getenv("POSTGRES_PORT"), Database: os.Getenv("POSTGRES_DATABASE"), User: os.Getenv("POSTGRES_USER"), Password: os.Getenv("POSTGRES_PASSWORD")})
 	if err != nil {
 		log.Fatal(err)
@@ -73,7 +84,7 @@ func main() {
 		log.Fatal(err)
 	}
 	defer capabilityRepository.Close()
-	epistemicsPassword, err := readCredentialRefSecret("EPISTEMICS_POSTGRES_PASSWORD", "EPISTEMICS_POSTGRES_CREDENTIAL_REF")
+	epistemicsPassword, err := readCredentialRefSecret("EPISTEMICS_POSTGRES_PASSWORD", "EPISTEMICS_POSTGRES_CREDENTIAL_REF", epistemicsDBPasswordPath)
 	if err != nil {
 		log.Fatal(err)
 	}
@@ -91,7 +102,10 @@ func main() {
 		log.Fatal(err)
 	}
 	defer identityRepository.Close()
-	interactionPassword, err := readCredentialRefSecret("INTERACTION_POSTGRES_PASSWORD", "INTERACTION_POSTGRES_CREDENTIAL_REF")
+	if err := bootstrapCreatorAccount(context.Background(), identityRepository, creatorUsername, creatorPasswordPath); err != nil {
+		log.Fatal(err)
+	}
+	interactionPassword, err := readCredentialRefSecret("INTERACTION_POSTGRES_PASSWORD", "INTERACTION_POSTGRES_CREDENTIAL_REF", interactionDBPasswordPath)
 	if err != nil {
 		log.Fatal(err)
 	}
@@ -104,6 +118,25 @@ func main() {
 		log.Fatal(err)
 	}
 	defer interactionRepository.Close()
+	var selfRepository *postgres.SelfRepository
+	selfUser := os.Getenv("SELF_POSTGRES_USER")
+	selfPassword := ""
+	if selfUser != "" && os.Getenv("SELF_POSTGRES_CREDENTIAL_REF") != "" {
+		selfPassword, err = readCredentialRefSecret("SELF_POSTGRES_PASSWORD", "SELF_POSTGRES_CREDENTIAL_REF", selfDBPasswordPath)
+		if err != nil {
+			log.Printf("SELF learning repository unavailable; user responses remain unaffected: %v", err)
+		}
+	}
+	if selfUser != "" && selfPassword != "" {
+		selfRepository, err = postgres.OpenSelf(context.Background(), postgres.ContinuityConfig{Host: os.Getenv("POSTGRES_HOST"), Port: os.Getenv("POSTGRES_PORT"), Database: os.Getenv("POSTGRES_DATABASE"), User: selfUser, Password: selfPassword})
+		if err != nil {
+			log.Printf("SELF learning repository unavailable; user responses remain unaffected: %v", err)
+		} else {
+			defer selfRepository.Close()
+		}
+	} else if selfUser == "" || os.Getenv("SELF_POSTGRES_CREDENTIAL_REF") == "" {
+		log.Printf("SELF learning repository is not configured; user responses remain unaffected")
+	}
 	reminderClient, err := newContinuityReminderClient(envOr("CONTINUITY_RUNTIME_URL", "http://continuity-runtime:8081"), &http.Client{Timeout: 5 * time.Second})
 	if err != nil {
 		log.Fatal(err)
@@ -124,7 +157,7 @@ func main() {
 	if err != nil {
 		log.Fatal(err)
 	}
-	learning := learningRecorder{epistemics: epistemicsRepository, capability: capabilityRepository}
+	learning := learningRecorder{epistemics: epistemicsRepository, capability: capabilityRepository, self: selfRepository}
 	mux := http.NewServeMux()
 	authenticateCreator := func(w http.ResponseWriter, r *http.Request) (identity.CreatorSession, bool) {
 		session, err := identitydomain.ValidateCreatorSession(sessionKey, bearerToken(r), time.Now())
@@ -144,10 +177,16 @@ func main() {
 	}
 	mux.Handle("/healthz", health.Handler{Runtime: "core-runtime", SemanticGeneration: 1, ArchitectureGeneration: 1})
 	readinessClient := &http.Client{Timeout: 2 * time.Second}
-	mux.Handle("/readyz", health.ReadinessHandler{Runtime: "core-runtime", Probes: []health.Probe{
+	cognitiveReadinessClient := &http.Client{Timeout: 135 * time.Second}
+	cognitiveReadinessProbe := health.HTTPProbe(cognitiveReadinessClient, strings.TrimRight(envOr("COGNITIVE_RUNTIME_URL", "http://cognitive-worker:8083"), "/")+"/readyz")
+	cognitiveReadinessProbe.Timeout = 135 * time.Second
+	mux.Handle("/readyz", health.ReadinessHandler{Runtime: "core-runtime", Timeout: 140 * time.Second, Probes: []health.Probe{
 		health.TCPProbe("postgres", envOr("POSTGRES_HOST", "postgres"), envOr("POSTGRES_PORT", "5432")),
 		health.HTTPProbe(readinessClient, strings.TrimRight(envOr("CONTINUITY_RUNTIME_URL", "http://continuity-runtime:8081"), "/")+"/healthz"),
-		health.HTTPProbe(readinessClient, strings.TrimRight(envOr("COGNITIVE_RUNTIME_URL", "http://cognitive-worker:8083"), "/")+"/healthz"),
+		// A running worker is not necessarily ready to serve cognitive traffic.
+		// Keep deterministic paths alive, but do not advertise overall readiness
+		// while the cognitive dependency is still warming.
+		cognitiveReadinessProbe,
 	}})
 	admissionPolicy := capability.AdmissionPolicy{ID: envOr("COGNITIVE_ADMISSION_POLICY_ID", "creator-advisory-local-v1"), MaxConcurrent: envInt("COGNITIVE_ADMISSION_MAX_CONCURRENT", 1), MaxAcceptedPerHour: envInt("COGNITIVE_ADMISSION_MAX_ACCEPTED_PER_HOUR", 60), MaxInputBytes: envInt("COGNITIVE_ADMISSION_MAX_INPUT_BYTES", 80<<10), MaxOutputBytes: envInt("COGNITIVE_ADMISSION_MAX_OUTPUT_BYTES", 16<<10)}
 	mux.HandleFunc("POST /v1/internal/cognitive/admission", func(w http.ResponseWriter, r *http.Request) {
@@ -177,7 +216,39 @@ func main() {
 		}
 		w.WriteHeader(http.StatusNoContent)
 	})
-	mux.HandleFunc("POST /v1/creator/sessions", creatorSessionHandler(bootstrapToken, creatorUsername, creatorPassword, sessionKey, time.Now))
+	mux.HandleFunc("POST /v1/creator/sessions", creatorDatabaseSessionHandler(bootstrapToken, creatorUsername, identityRepository, sessionKey, time.Now))
+	mux.HandleFunc("POST /v1/creator/account/password", func(w http.ResponseWriter, r *http.Request) {
+		session, ok := authenticateCreator(w, r)
+		if !ok {
+			return
+		}
+		var request struct {
+			CurrentPassword string `json:"current_password"`
+			NewPassword     string `json:"new_password"`
+		}
+		decoder := json.NewDecoder(io.LimitReader(r.Body, maxCreatorCredentialsBytes+1))
+		decoder.DisallowUnknownFields()
+		if err := decoder.Decode(&request); err != nil || request.CurrentPassword == "" || request.NewPassword == "" {
+			http.Error(w, "invalid password change request", http.StatusBadRequest)
+			return
+		}
+		account, err := identityRepository.LoadCreatorAccountByBinding(r.Context(), session.ActorID, session.PrincipalID)
+		if err != nil || !identitydomain.VerifyCreatorPassword(account.PasswordHash, request.CurrentPassword) {
+			http.Error(w, "current password denied", http.StatusUnauthorized)
+			return
+		}
+		newHash, err := identitydomain.HashCreatorPassword(request.NewPassword)
+		if err != nil {
+			http.Error(w, "invalid new password", http.StatusBadRequest)
+			return
+		}
+		if err := identityRepository.UpdateCreatorPassword(r.Context(), session.ActorID, session.PrincipalID, account.Revision, newHash); err != nil {
+			http.Error(w, "password change conflict", http.StatusConflict)
+			return
+		}
+		w.Header().Set("Content-Type", "application/json")
+		_ = json.NewEncoder(w).Encode(map[string]string{"status": "changed"})
+	})
 	mux.HandleFunc("GET /v1/creator/sessions/current", func(w http.ResponseWriter, r *http.Request) {
 		session, ok := authenticateCreator(w, r)
 		if !ok {
@@ -505,9 +576,13 @@ func main() {
 		storedFocus, err := repository.ActiveProjectFocus(r.Context(), session.ActorID, session.PrincipalID)
 		if err == nil {
 			previousFocus = &storedFocus
+			telemetry.RecordCompatibility("active-project-focus-read", "core-runtime", "read", "chat-focus-load", true, false, true, "SUCCESS", utterance.CorrelationID, string(session.PrincipalID), now)
 		} else if !errors.Is(err, pgx.ErrNoRows) {
+			telemetry.RecordCompatibility("active-project-focus-read", "core-runtime", "read", "chat-focus-load", true, false, true, "FAILURE", utterance.CorrelationID, string(session.PrincipalID), now)
 			http.Error(w, "project focus unavailable", http.StatusServiceUnavailable)
 			return
+		} else {
+			telemetry.RecordCompatibility("active-project-focus-read", "core-runtime", "read", "chat-focus-load", true, false, true, "EMPTY", utterance.CorrelationID, string(session.PrincipalID), now)
 		}
 		var effectiveTaskMessage = interactiondomain.StripAssistantVocative(utterance.Content)
 		creativeUserRequest := interactiondomain.IsCreativeRequest(utterance.Content)
@@ -516,9 +591,10 @@ func main() {
 		travelContinuation := false
 		var previousTask *interaction.HumanUtterance
 		var conversationHistory []interaction.HumanUtterance
+		var contextProjectReferences []interaction.ProjectReference
 		if request.ConversationID != "" {
 			var historyErr error
-			conversationHistory, historyErr = interactionRepository.Utterances(r.Context(), conversation.ID)
+			conversationHistory, contextProjectReferences, historyErr = interactionRepository.UtterancesWithProjectReferences(r.Context(), conversation.ID)
 			if historyErr != nil {
 				log.Printf("interaction conversation history unavailable: %v", historyErr)
 			}
@@ -526,15 +602,38 @@ func main() {
 		// Keep durable user context available even when the web client carries a
 		// conversation ID; a new or rotated conversation must not erase learned
 		// preferences.
-		recentUserHistory, historyErr := interactionRepository.RecentUtterancesForPrincipal(r.Context(), session.PrincipalID, 64)
+		recentUserHistory, recentProjectReferences, historyErr := interactionRepository.RecentUtterancesForPrincipalWithProjectReferences(r.Context(), session.PrincipalID, 64)
 		if historyErr != nil {
 			log.Printf("interaction principal history unavailable: %v", historyErr)
 		} else {
 			log.Printf("interaction principal history loaded: %d utterances", len(recentUserHistory))
 		}
 		conversationHistory = append(conversationHistory, recentUserHistory...)
-		personalMemory := interactiondomain.CompilePersonalMemory(conversationHistory)
-		if !creativeUserRequest && locationReply == "" {
+		contextProjectReferences = append(contextProjectReferences, recentProjectReferences...)
+		focusProjectID := ""
+		if previousFocus != nil {
+			focusProjectID = string(previousFocus.ProjectID)
+		}
+		gen2Context := interactiondomain.BuildScopedGen2ContextForQuery(conversationHistory, contextProjectReferences, string(session.PrincipalID), focusProjectID, effectiveTaskMessage)
+		experienceRecords, experienceErr := epistemicsRepository.RecentExperienceRecordsForPrincipalAndScope(r.Context(), string(session.PrincipalID), focusProjectID, 16)
+		if experienceErr != nil {
+			log.Printf("epistemics experience context unavailable: %v", experienceErr)
+		}
+		if compiledContext, contextErr := compileInteractionContextWithExperience(gen2Context, focusProjectID, experienceRecords, effectiveTaskMessage); contextErr != nil {
+			log.Printf("interaction context compilation unavailable: %v", contextErr)
+		} else {
+			gen2Context.Text = compiledContext
+		}
+		iterativeRetriever := newIterativeContextRetriever(conversationHistory, contextProjectReferences, string(session.PrincipalID), focusProjectID, experienceRecords)
+		if gen2Context.UsedPersonalMemoryFallback {
+			telemetry.RecordCompatibility("personal-memory-fallback", "core-runtime", "read", "gen2-context-empty", true, true, false, "USED", utterance.CorrelationID, string(session.PrincipalID), now)
+		}
+		retrievedMemoryReply := interactiondomain.RecallPersonalPreference(conversationHistory, effectiveTaskMessage)
+		stableConversationalReply, stableConversational := interactiondomain.StableConversationalReply(
+			effectiveTaskMessage,
+			interactiondomain.ClassifySpeechAct(effectiveTaskMessage, utterance.CorrectsUtteranceID),
+		)
+		if !creativeUserRequest && locationReply == "" && !stableConversational && retrievedMemoryReply == "" {
 			if continuation := interactiondomain.ContinueLocalSearch(effectiveTaskMessage, conversationHistory); continuation != "" {
 				continuationMessage = continuation
 				effectiveTaskMessage = continuation
@@ -661,6 +760,14 @@ func main() {
 			semanticInterpretationRequested = false
 			semanticReflexAudit = false
 		}
+		if stableConversational {
+			semanticInterpretationRequested = false
+			semanticReflexAudit = false
+		}
+		if retrievedMemoryReply != "" {
+			semanticInterpretationRequested = false
+			semanticReflexAudit = false
+		}
 		if identityReply != "" || memoryInstructionReply != "" {
 			semanticReflexAudit = false
 		}
@@ -684,7 +791,7 @@ func main() {
 				cognitiveAvailable = false
 			}
 		}
-		if !creativeRequest {
+		if !creativeRequest && !stableConversational && retrievedMemoryReply == "" {
 			if travelReply := interactiondomain.TravelSearchClarification(effectiveTaskMessage, conversationHistory); travelReply != "" {
 				semantic.Interpretation.Clarification = interaction.ClarificationRequired
 				semantic.Interpretation.Applicability = interaction.SemanticCandidateClarify
@@ -702,12 +809,16 @@ func main() {
 			http.Error(w, "save chat semantics", http.StatusInternalServerError)
 			return
 		}
-		responseResult, responseErr := responseClient.Respond(r.Context(), r.Header.Get("Authorization"), continuity.HumanResponseRequest{
-			SourceUtteranceID:     string(utterance.ID),
-			SourceIntentID:        string(intent.ID),
-			Message:               effectiveTaskMessage,
-			RequestedAtUnixMillis: now.UnixMilli(),
-		})
+		var responseResult continuity.HumanResponseResult
+		var responseErr error
+		if shouldInvokeHumanResponse(stableConversational, identityReply, memoryInstructionReply) {
+			responseResult, responseErr = responseClient.Respond(r.Context(), r.Header.Get("Authorization"), continuity.HumanResponseRequest{
+				SourceUtteranceID:     string(utterance.ID),
+				SourceIntentID:        string(intent.ID),
+				Message:               effectiveTaskMessage,
+				RequestedAtUnixMillis: now.UnixMilli(),
+			})
+		}
 		if semantic.Interpretation.SpeechAct == interaction.SpeechActCorrection {
 			learning.recordCorrection(r.Context(), correctionLearningInput{Utterance: utterance, Intent: intent, At: now})
 		}
@@ -715,9 +826,11 @@ func main() {
 		activeFocusProvenance := situation.ProjectResolutionProvenance("")
 		if semantic.ActiveFocus != nil {
 			if err := repository.SaveActiveProjectFocus(r.Context(), *semantic.ActiveFocus); err != nil {
+				telemetry.RecordCompatibility("active-project-focus-write", "core-runtime", "write", "semantic-focus-update", true, false, true, "FAILURE", utterance.CorrelationID, string(session.PrincipalID), now)
 				http.Error(w, "save project focus", http.StatusInternalServerError)
 				return
 			}
+			telemetry.RecordCompatibility("active-project-focus-write", "core-runtime", "write", "semantic-focus-update", true, false, true, "SUCCESS", utterance.CorrelationID, string(session.PrincipalID), now)
 			activeFocusName = semantic.ActiveFocus.ProjectDisplayName
 			activeFocusProvenance = semantic.ActiveFocus.Provenance
 		} else if len(semantic.Projects) > 0 && semantic.Projects[0].Provenance == situation.ProjectResolutionInheritedFocus && previousFocus != nil {
@@ -733,7 +846,7 @@ func main() {
 		} else if len(semantic.Projects) > 0 && semantic.Projects[0].Provenance == situation.ProjectResolutionInheritedFocus {
 			projectID = string(previousFocus.ProjectID)
 		}
-		if responseErr == nil && responseResult.Handled {
+		if responseErr == nil && responseResult.Handled && !stableConversational {
 			planningReply = responseResult.Reply
 			needsCognition = false
 			learning.recordReminderResponse(r.Context(), reminderResponseLearningInput{Utterance: utterance, Intent: intent, Result: responseResult, At: now})
@@ -763,6 +876,12 @@ func main() {
 			ReceivedAtUnixMillis:  utterance.ReceivedAtUnixMillis,
 		}
 		helpPath := workdomain.DetermineHelpPath(planningInput)
+		// Introspection requests are read-only household UX. A cognitive
+		// candidate must not reinterpret them as an executable delegation.
+		switch semantic.InformationRequestKind {
+		case interaction.InformationRequestCapabilityInventory, interaction.InformationRequestLocalCapabilityInventory, interaction.InformationRequestCognitiveModelInventory, interaction.InformationRequestCognitiveCurrentModel, interaction.InformationRequestCognitiveChannelStatus, interaction.InformationRequestCognitiveRecovery, interaction.InformationRequestMemoryInventory:
+			helpPath = work.HelpPath{}
+		}
 		if responseErr == nil && responseResult.Handled {
 			helpPath = work.HelpPath{}
 		}
@@ -800,7 +919,11 @@ func main() {
 		researchBacked := false
 		researchAttempted := false
 		stableKnowledgeReply := false
-		if hasChatRoute(routePlan, chatRouteResearch) && semantic.Interpretation.Clarification != interaction.ClarificationRequired && shouldRunGeneralResearch(semantic.InformationRequestKind) {
+		if retrievedMemoryReply != "" {
+			planningReply = retrievedMemoryReply
+			needsCognition = false
+		}
+		if hasChatRoute(routePlan, chatRouteResearch) && len(gen2Context.Fragments) == 0 && semantic.Interpretation.Clarification != interaction.ClarificationRequired && shouldRunGeneralResearch(semantic.InformationRequestKind) {
 			researchAttempted = true
 			if planID, idErr := ids.New(); idErr == nil {
 				parts := interactiondomain.IndependentRequestParts(effectiveTaskMessage)
@@ -829,9 +952,9 @@ func main() {
 					reply, backed := renderResearchReply(searchQuery, result, researchErr)
 					if !backed && cognitiveAvailable {
 						answerCtx, cancelAnswer := context.WithTimeout(r.Context(), 12*time.Second)
-						answer, answerErr := cognitiveClient.AnswerStableKnowledge(answerCtx, session, part, personalMemory.ContextText(), cognitive.TaskMeaning{
+						answer, answerErr := cognitiveClient.AnswerStableKnowledgeWithContinuation(answerCtx, session, part, gen2Context.Text, cognitive.TaskMeaning{
 							SpeechAct: string(semantic.Interpretation.SpeechAct), CapabilityHints: toCapabilityKinds(semantic.CapabilityHints), RequestedOutcome: semantic.Interpretation.RequestedOutcome, InformationRequestKind: semantic.InformationRequestKind, ConfidenceMillis: semantic.Interpretation.ConfidenceMillis,
-						})
+						}, iterativeRetriever)
 						cancelAnswer()
 						if answerErr == nil && stableKnowledgeAnswer(answer) {
 							reply, backed = answer, true
@@ -860,18 +983,18 @@ func main() {
 			planningReply = helpPath.Reply
 			needsCognition = false
 		}
-		if !creativeRequest {
+		if !creativeRequest && !stableConversational && retrievedMemoryReply == "" {
 			if travelReply := interactiondomain.TravelSearchClarification(effectiveTaskMessage, conversationHistory); travelReply != "" {
 				planningReply = travelReply
 				needsCognition = false
 			}
 		}
 		canGenerateTextReply := shouldGenerateNonMutatingTextDirective(semantic, routePlan, helpPath, creativeRequest) && planningReply == deterministicReply
-		if (planningReply == "" && needsCognition && semantic.Interpretation.SpeechAct == interaction.SpeechActQuestion || canGenerateTextReply) && !hasChatRoute(routePlan, chatRouteResearch) && !creativeRequest {
+		if (planningReply == "" && needsCognition && semantic.Interpretation.SpeechAct == interaction.SpeechActQuestion || canGenerateTextReply) && (!hasChatRoute(routePlan, chatRouteResearch) || len(gen2Context.Fragments) > 0) && !creativeRequest {
 			answerCtx, cancelAnswer := context.WithTimeout(r.Context(), 12*time.Second)
-			answer, answerErr := cognitiveClient.AnswerStableKnowledge(answerCtx, session, effectiveTaskMessage, personalMemory.ContextText(), cognitive.TaskMeaning{
+			answer, answerErr := cognitiveClient.AnswerStableKnowledgeWithContinuation(answerCtx, session, effectiveTaskMessage, gen2Context.Text, cognitive.TaskMeaning{
 				SpeechAct: string(semantic.Interpretation.SpeechAct), CapabilityHints: toCapabilityKinds(semantic.CapabilityHints), RequestedOutcome: semantic.Interpretation.RequestedOutcome, InformationRequestKind: semantic.InformationRequestKind, ConfidenceMillis: semantic.Interpretation.ConfidenceMillis,
-			})
+			}, iterativeRetriever)
 			cancelAnswer()
 			if answerErr == nil && stableKnowledgeAnswer(answer) {
 				planningReply = answer
@@ -990,9 +1113,13 @@ func main() {
 			planningReply = memoryInstructionReply
 			needsCognition = false
 		}
-		if strings.TrimSpace(planningReply) != "" {
+		// Stable-knowledge answers have already passed the local cognitive
+		// route with compact, source-aware context. Re-reviewing the same answer
+		// serially can exhaust the household request budget on a loaded local
+		// provider and turn a valid answer into a degraded response.
+		if shouldReviewResponse(planningReply, stableKnowledgeReply, stableConversational, identityReply, memoryInstructionReply, retrievedMemoryReply != "") {
 			reviewContext, cancelReview := context.WithTimeout(r.Context(), 12*time.Second)
-			reviewedReply, reviewErr := cognitiveClient.ReviewResponse(reviewContext, session, utterance.Content, planningReply, personalMemory.ContextText(), cognitive.TaskMeaning{
+			reviewedReply, reviewErr := cognitiveClient.ReviewResponse(reviewContext, session, utterance.Content, planningReply, gen2Context.Text, cognitive.TaskMeaning{
 				SpeechAct:              string(semantic.Interpretation.SpeechAct),
 				CapabilityHints:        toCapabilityKinds(semantic.CapabilityHints),
 				RequestedOutcome:       semantic.Interpretation.RequestedOutcome,
@@ -1016,13 +1143,8 @@ func main() {
 			}
 		}
 		if !mediaAttempted && !mediaHandled && identityReply == "" && creativeReply == "" && creativeFallbackReply == "" {
-			stableAct := interactiondomain.ClassifySpeechAct(utterance.Content, utterance.CorrectsUtteranceID)
-			travelClarification := ""
-			if !creativeRequest {
-				travelClarification = interactiondomain.TravelSearchClarification(effectiveTaskMessage, conversationHistory)
-			}
-			if stableReply, stable := interactiondomain.StableConversationalReply(utterance.Content, stableAct); stable && travelClarification == "" {
-				planningReply = stableReply
+			if stableConversational {
+				planningReply = stableConversationalReply
 				needsCognition = false
 			}
 		}
@@ -1397,6 +1519,10 @@ func main() {
 			candidates, err = capabilityRepository.LoadCognitiveCandidates(r.Context(), requirement.CapabilityID, requirement.OwnerPrincipalID)
 		}
 		if err != nil {
+			// The resolver is an internal capability boundary. Keep request identity
+			// and content out of logs, but preserve the repository error so a 503
+			// can be distinguished from a true empty/unsuitable binding set.
+			log.Printf("cognitive registry resolve unavailable: %v", err)
 			http.Error(w, "cognitive registry unavailable", http.StatusServiceUnavailable)
 			return
 		}
@@ -1486,7 +1612,7 @@ func main() {
 		}
 		request.RequestedByPrincipalID = session.PrincipalID
 		request.CapabilityID = "creator-advisory"
-		candidates, err := capabilityRepository.LoadCognitiveCandidates(r.Context(), request.CapabilityID, session.PrincipalID)
+		candidates, err := capabilityRepository.LoadCognitiveCandidatesForEvaluation(r.Context(), request.CapabilityID, session.PrincipalID, request.EvaluationID)
 		if err != nil {
 			http.Error(w, "cognitive registry unavailable", http.StatusServiceUnavailable)
 			return
@@ -1525,18 +1651,11 @@ func main() {
 		}
 		request.RequestedByPrincipalID = session.PrincipalID
 		request.CapabilityID = "creator-advisory"
-		candidates, err := capabilityRepository.LoadCognitiveCandidates(r.Context(), request.CapabilityID, session.PrincipalID)
+		current, err := capabilityRepository.LoadCognitiveCandidate(r.Context(), request.BindingID, request.ExpectedBindingRevision)
 		if err != nil {
 			http.Error(w, "cognitive registry unavailable", http.StatusServiceUnavailable)
 			return
 		}
-		var current capability.ResolvedCognitiveBinding
-		for _, candidate := range candidates {
-			if candidate.Binding.ID == request.BindingID && candidate.Binding.Revision == request.ExpectedBindingRevision {
-				current = candidate
-				break
-			}
-		}
 		promotion, err := capabilitydomain.BuildActivationPromotion(request, current)
 		if err != nil {
 			http.Error(w, "cognitive activation precondition failed", http.StatusConflict)
@@ -1670,6 +1789,14 @@ func main() {
 	}
 }
 
+func shouldInvokeHumanResponse(stableConversational bool, identityReply, memoryInstructionReply string) bool {
+	return !stableConversational && identityReply == "" && memoryInstructionReply == ""
+}
+
+func shouldReviewResponse(planningReply string, stableKnowledgeReply, stableConversational bool, identityReply, memoryInstructionReply string, deterministicMemoryReply bool) bool {
+	return strings.TrimSpace(planningReply) != "" && !stableKnowledgeReply && !stableConversational && identityReply == "" && memoryInstructionReply == "" && !deterministicMemoryReply
+}
+
 func shouldRunGeneralResearch(kind interaction.InformationRequestKind) bool {
 	return kind == "" || kind == interaction.InformationRequestTimeDifference
 }
@@ -1704,6 +1831,88 @@ func creatorSessionHandler(bootstrapToken, creatorUsername, creatorPassword stri
 	}
 }
 
+func creatorDatabaseSessionHandler(bootstrapToken, creatorUsername string, repository *postgres.IdentityRepository, sessionKey []byte, now func() time.Time) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		if identitydomain.BootstrapMatches(bootstrapToken, bearerToken(r)) {
+			token, session, err := identitydomain.IssueCreatorSession(sessionKey, now(), 8*time.Hour)
+			if err != nil {
+				http.Error(w, "creator session unavailable", http.StatusServiceUnavailable)
+				return
+			}
+			writeCreatorSession(w, token, session)
+			return
+		}
+		var credentials identity.CreatorCredentials
+		decoder := json.NewDecoder(io.LimitReader(r.Body, maxCreatorCredentialsBytes+1))
+		decoder.DisallowUnknownFields()
+		if err := decoder.Decode(&credentials); err != nil || decoder.Decode(&struct{}{}) != io.EOF {
+			http.Error(w, "creator authentication denied", http.StatusUnauthorized)
+			return
+		}
+		account, err := repository.LoadCreatorAccount(r.Context(), credentials.Username)
+		if err != nil || !identitydomain.VerifyCreatorPassword(account.PasswordHash, credentials.Password) {
+			http.Error(w, "creator authentication denied", http.StatusUnauthorized)
+			return
+		}
+		binding, err := repository.LoadBinding(r.Context(), account.ActorID, account.PrincipalID)
+		if err != nil || !binding.Active {
+			http.Error(w, "creator authentication denied", http.StatusUnauthorized)
+			return
+		}
+		token, session, err := identitydomain.IssueCreatorSessionForBinding(sessionKey, account.ActorID, account.PrincipalID, now(), 8*time.Hour)
+		if err != nil {
+			http.Error(w, "creator session unavailable", http.StatusServiceUnavailable)
+			return
+		}
+		writeCreatorSession(w, token, session)
+	}
+}
+
+func writeCreatorSession(w http.ResponseWriter, token string, session identity.CreatorSession) {
+	w.Header().Set("Content-Type", "application/json")
+	_ = json.NewEncoder(w).Encode(struct {
+		Token   string
+		Session identity.CreatorSession
+	}{token, session})
+}
+
+func bootstrapCreatorAccount(ctx context.Context, repository *postgres.IdentityRepository, username, passwordPath string) error {
+	if account, err := repository.LoadCreatorAccount(ctx, username); err == nil {
+		if account.ActorID == "" || account.PrincipalID == "" {
+			return errors.New("creator account binding is incomplete")
+		}
+		return nil
+	} else if !errors.Is(unwrapIdentityRepositoryError(err), pgx.ErrNoRows) {
+		return err
+	}
+	password, err := readRequiredSecretFile("CREATOR_PASSWORD", passwordPath)
+	if err != nil {
+		return fmt.Errorf("creator account is missing and bootstrap password is unavailable: %w", err)
+	}
+	hash, err := identitydomain.HashCreatorPassword(password)
+	if err != nil {
+		return fmt.Errorf("hash creator bootstrap password: %w", err)
+	}
+	if err := repository.CreateCreatorAccount(ctx, identity.CreatorAccount{Username: username, ActorID: "domovoy-creator-actor", PrincipalID: "domovoy-creator-principal", PasswordHash: hash}); err != nil {
+		return fmt.Errorf("create creator account: %w", err)
+	}
+	return nil
+}
+
+func unwrapIdentityRepositoryError(err error) error {
+	for err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return pgx.ErrNoRows
+		}
+		unwrapped := errors.Unwrap(err)
+		if unwrapped == nil {
+			break
+		}
+		err = unwrapped
+	}
+	return err
+}
+
 func bearerToken(r *http.Request) string {
 	value := r.Header.Get("Authorization")
 	if !strings.HasPrefix(value, "Bearer ") {
@@ -1726,10 +1935,7 @@ func readRequiredSecret(name string) (string, error) {
 		if err != nil {
 			return "", fmt.Errorf("read %s_FILE: %w", name, err)
 		}
-		direct = strings.TrimRight(string(contents), "\r\n")
-		if strings.ContainsAny(direct, "\r\n") {
-			return "", fmt.Errorf("%s_FILE must contain one line", name)
-		}
+		return normalizeSecretFile(name, contents)
 	}
 	if direct == "" {
 		return "", fmt.Errorf("%s is required", name)
@@ -1737,13 +1943,28 @@ func readRequiredSecret(name string) (string, error) {
 	return direct, nil
 }
 
-func readCredentialRefSecret(name, refName string) (string, error) {
-	if _, directSet := os.LookupEnv(name); directSet {
-		return "", fmt.Errorf("%s direct environment secret is forbidden; use %s_FILE", name, name)
+func readRequiredSecretFile(name, path string) (string, error) {
+	contents, err := os.ReadFile(path)
+	if err != nil {
+		return "", fmt.Errorf("read %s secret file: %w", name, err)
 	}
-	fileName := os.Getenv(name + "_FILE")
-	if fileName == "" {
-		return "", fmt.Errorf("%s_FILE is required", name)
+	return normalizeSecretFile(name, contents)
+}
+
+func normalizeSecretFile(name string, contents []byte) (string, error) {
+	value := strings.TrimRight(string(contents), "\r\n")
+	if strings.ContainsAny(value, "\r\n") {
+		return "", fmt.Errorf("%s secret file must contain one line", name)
+	}
+	if value == "" {
+		return "", fmt.Errorf("%s is required", name)
+	}
+	return value, nil
+}
+
+func readCredentialRefSecret(name, refName, fileName string) (string, error) {
+	if _, directSet := os.LookupEnv(name); directSet {
+		return "", fmt.Errorf("%s direct environment secret is forbidden; use the standard secret file", name)
 	}
 	ref := os.Getenv(refName)
 	if ref == "" {

cmd/creator-web/server.go

@@ -841,6 +841,8 @@ func creatorRoute(method, path string) (routeTarget, string, bool) {
 		return targetCore, "/v1/creator/sessions", true
 	case method == http.MethodGet && path == "/api/session/current":
 		return targetCore, "/v1/creator/sessions/current", true
+	case method == http.MethodPost && path == "/api/account/password":
+		return targetCore, "/v1/creator/account/password", true
 	case method == http.MethodGet && path == "/api/focus":
 		return targetCore, "/v1/creator/focus", true
 	case method == http.MethodGet && strings.HasPrefix(path, "/api/tasks/"):

cmd/creator-web/static/assets/chat.css

@@ -1,131 +1,285 @@
 :root {
-  --ink: #e9eee7;
-  --muted: #93a096;
-  --base: #0b100e;
-  --panel: #101714;
-  --line: #2a352f;
-  --signal: #c9a85f;
-  --bad: #de816f;
-  --good: #78c6a3;
-  --radius: 3px;
-  --sans: "Bahnschrift", "Aptos Narrow", "Segoe UI", sans-serif;
-  --serif: Georgia, "Times New Roman", serif;
-  --mono: "Cascadia Mono", Consolas, monospace;
+  --ink: #e6edf4;
+  --muted: #8494a4;
+  --faint: #5d6e7f;
+  --base: #0b1119;
+  --panel: #111b27;
+  --panel-raised: #172331;
+  --panel-soft: #0f1925;
+  --line: #263544;
+  --line-strong: #34485c;
+  --lime: #c5ef91;
+  --lime-ink: #142014;
+  --blue: #8fc7ef;
+  --yellow: #d8b86c;
+  --good: #8ed7ad;
+  --bad: #ee9292;
+  --radius: 8px;
+  --sans: "Manrope", "Segoe UI", sans-serif;
+  --mono: "DM Mono", "Cascadia Mono", Consolas, monospace;
 }
-
 * { box-sizing: border-box; }
 [hidden] { display: none !important; }
 body { margin: 0; min-width: 320px; min-height: 100vh; color: var(--ink); background: var(--base); font-family: var(--sans); }
 button, input, textarea { font: inherit; }
 button { cursor: pointer; color: inherit; border-radius: var(--radius); }
+a { color: inherit; }
 .chat-shell { min-height: 100vh; display: grid; }
-.login-panel { width: min(100% - 32px, 420px); margin: auto; padding: 46px 40px; border: 1px solid var(--line); background: var(--panel); }
-.brand-mark { width: 46px; height: 46px; display: grid; place-items: center; color: var(--base); background: var(--signal); font: 700 24px/1 var(--serif); clip-path: polygon(50% 0, 92% 22%, 92% 76%, 50% 100%, 8% 76%, 8% 22%); }
-h1 { margin: 30px 0; font: 400 58px/.95 var(--serif); letter-spacing: -.02em; }
-label { display: block; margin: 16px 0 8px; color: var(--muted); font: 600 10px/1 var(--mono); letter-spacing: .12em; text-transform: uppercase; }
-input, textarea { width: 100%; border: 1px solid var(--line); border-radius: var(--radius); color: var(--ink); background: #0b110e; }
-input { height: 48px; padding: 0 12px; }
-textarea { resize: vertical; min-height: 84px; max-height: 240px; padding: 14px; line-height: 1.45; }
-.login-form button, .composer button { border: 0; color: #11150f; background: var(--signal); font-weight: 700; }
-.login-form button { width: 100%; height: 50px; margin-top: 18px; }
+.login-panel { width: min(100% - 32px, 420px); margin: auto; padding: 40px; border: 1px solid var(--line); border-radius: 12px; background: var(--panel); box-shadow: 0 24px 80px rgba(0,0,0,.28); }
+.brand-mark { width: 42px; height: 42px; display: grid; place-items: center; color: var(--lime-ink); background: var(--lime); border-radius: 10px; font: 700 22px/1 var(--sans); }
+h1, h2 { margin: 0; letter-spacing: -.03em; }
+.login-panel h1 { margin: 26px 0; font-size: 42px; font-weight: 650; }
+label { display: block; margin: 16px 0 8px; color: var(--muted); font: 600 10px/1 var(--mono); letter-spacing: .1em; text-transform: uppercase; }
+input, textarea { width: 100%; border: 1px solid var(--line); border-radius: var(--radius); color: var(--ink); background: var(--panel-soft); outline: none; }
+input:focus, textarea:focus { border-color: var(--blue); box-shadow: 0 0 0 3px rgba(143,199,239,.12); }
+input { height: 46px; padding: 0 12px; }
+textarea { resize: vertical; min-height: 84px; max-height: 240px; padding: 13px; line-height: 1.45; }
+.login-form button, .composer button { border: 0; color: var(--lime-ink); background: var(--lime); font-weight: 750; }
+.login-form button { width: 100%; height: 46px; margin-top: 18px; }
 #login-error { min-height: 20px; color: var(--bad); font-size: 13px; }
-.chat-view { width: 100%; min-width: 0; height: 100vh; min-height: 0; display: grid; grid-template-rows: 64px minmax(0, 1fr); overflow: hidden; }
-.chat-header { min-width: 0; display: flex; align-items: center; gap: 14px; padding: 0 22px; border-bottom: 1px solid var(--line); background: rgba(16, 23, 20, .98); }
-.chat-header a { color: var(--ink); text-decoration: none; font: 400 24px/1 var(--serif); }
-#active-focus { color: var(--good); }
+.chat-view { width: 100%; min-width: 0; height: 100vh; min-height: 0; display: grid; grid-template-rows: 60px minmax(0, 1fr); overflow: hidden; }
+.chat-header { min-width: 0; display: flex; align-items: center; gap: 14px; padding: 0 20px; border-bottom: 1px solid var(--line); background: rgba(17,27,39,.97); }
+.chat-header > a:first-child { color: var(--ink); text-decoration: none; font-size: 18px; font-weight: 750; letter-spacing: -.02em; }
 .cognitive-status { display: inline-flex; align-items: center; gap: 7px; white-space: nowrap; }
-.chat-header .cognitive-status { width: auto; height: auto; padding: 0; border: 0; background: transparent; color: var(--muted); font: 10px/1 var(--mono); letter-spacing: .1em; text-transform: uppercase; }
-.chat-header .cognitive-status { max-width: min(30vw, 320px); margin-left: auto; overflow: hidden; text-overflow: ellipsis; }
-.cognitive-status::before { content: ""; width: 7px; height: 7px; flex: 0 0 7px; border-radius: 50%; background: var(--signal); }
+.chat-header .cognitive-status { width: auto; height: auto; max-width: min(30vw, 340px); margin-left: auto; padding: 0; overflow: hidden; border: 0; background: transparent; color: var(--muted); font: 10px/1 var(--mono); letter-spacing: .04em; text-overflow: ellipsis; text-transform: uppercase; }
+.cognitive-status::before { content: ""; width: 7px; height: 7px; flex: 0 0 7px; border-radius: 50%; background: var(--yellow); }
 .cognitive-status[data-state="available"] { color: var(--good); }
 .cognitive-status[data-state="available"]::before { background: var(--good); }
 .cognitive-status[data-state="unavailable"] { color: var(--bad); }
 .cognitive-status[data-state="unavailable"]::before { background: var(--bad); }
-.cognitive-console-link { color: var(--signal); font: 10px/1 var(--mono); letter-spacing: .08em; text-transform: uppercase; white-space: nowrap; }
-.build-meta { display: grid; gap: 3px; flex: 0 0 auto; color: var(--muted); font: 9px/1 var(--mono); letter-spacing: .08em; text-align: right; text-transform: uppercase; white-space: nowrap; }
-.build-meta time { color: #68776d; font-size: 8px; }
-.chat-header button { width: 38px; height: 38px; border: 1px solid var(--line); background: transparent; }
-.human-nav { display: grid; gap: 8px; }
-.nav-tab, .operator-link { height: 34px; padding: 0 12px; display: inline-flex; align-items: center; border: 1px solid var(--line); color: var(--muted); background: #0b110e; text-decoration: none; font: 11px/1 var(--mono); text-transform: uppercase; letter-spacing: .08em; }
-.chat-left .nav-tab { height: auto; min-height: 58px; padding: 10px 12px; display: grid; grid-template-columns: 28px 1fr; gap: 2px 8px; align-items: center; text-align: left; }
-.chat-left .nav-tab b { grid-row: span 2; color: var(--signal); font: 11px/1 var(--mono); }
-.chat-left .nav-tab span { color: var(--ink); font: 600 13px/1 var(--sans); text-transform: none; letter-spacing: 0; }
-.chat-left .nav-tab small { color: var(--muted); font: 10px/1 var(--mono); text-transform: none; letter-spacing: 0; }
-.nav-tab.active { color: #11150f; border-color: var(--signal); background: var(--signal); }
-.operator-link { color: var(--good); }
-.chat-header > .operator-link { flex: 0 0 auto; }
-.chat-layout { min-height: 0; height: 100%; display: grid; grid-template-columns: minmax(220px, 280px) minmax(0, 1fr) minmax(250px, 320px); }
-.chat-side { min-width: 0; min-height: 0; padding: 28px 20px; overflow-y: auto; background: #0e1512; }
-.generated-image { display: block; max-width: min(100%, 640px); height: auto; margin-top: 12px; border: 1px solid var(--line); }
+.cognitive-console-link { color: var(--blue); font: 10px/1 var(--mono); letter-spacing: .04em; white-space: nowrap; }
+.build-meta { display: grid; gap: 3px; flex: 0 0 auto; color: var(--muted); font: 9px/1 var(--mono); letter-spacing: .04em; text-align: right; text-transform: uppercase; white-space: nowrap; }
+.build-meta time { color: var(--faint); font-size: 8px; }
+.chat-header button { width: 34px; height: 34px; border: 1px solid var(--line); background: transparent; }
+.operator-link { height: 32px; padding: 0 11px; display: inline-flex; align-items: center; border: 1px solid var(--line); color: var(--blue); background: transparent; text-decoration: none; font: 10px/1 var(--mono); letter-spacing: .04em; text-transform: uppercase; }
+.chat-layout { min-height: 0; height: 100%; display: grid; grid-template-columns: minmax(220px, 258px) minmax(0, 1fr) minmax(270px, 320px); }
+.chat-side { min-width: 0; min-height: 0; padding: 22px 18px; overflow-y: auto; background: var(--panel); scrollbar-color: var(--line-strong) transparent; }
 .chat-left { border-right: 1px solid var(--line); }
 .chat-right { border-left: 1px solid var(--line); }
-.side-intro h1, .side-intro h2 { margin: 12px 0; font: 400 clamp(28px, 2.5vw, 40px)/.95 var(--serif); letter-spacing: -.03em; }
-.side-intro p:not(.side-index) { color: var(--muted); line-height: 1.5; }
-.side-index, .side-focus span, .side-note span, .ai-info-card span { color: var(--signal); font: 10px/1 var(--mono); letter-spacing: .12em; text-transform: uppercase; }
-.side-focus, .side-note, .ai-info-card { margin-top: 28px; padding: 14px 0; border-top: 1px solid var(--line); border-bottom: 1px solid var(--line); }
-.side-focus strong, .side-note strong, .ai-info-card strong { display: block; margin-top: 9px; color: var(--ink); font: 600 14px/1.3 var(--sans); }
-.side-note small, .ai-info-card p, .ai-data-form small { display: block; margin-top: 9px; color: var(--muted); line-height: 1.45; }
-.chat-main { min-width: 0; min-height: 0; overflow: hidden; display: grid; }
+.side-intro h1, .side-intro h2 { margin: 9px 0 10px; font-size: clamp(25px, 2.4vw, 34px); line-height: 1.05; font-weight: 680; }
+.side-intro p:not(.side-index) { margin: 0; color: var(--muted); font-size: 12px; line-height: 1.5; }
+.side-index, .section-label, .ai-info-card span, .insight-card span { color: var(--faint); font: 600 9px/1 var(--mono); letter-spacing: .12em; text-transform: uppercase; }
+.side-section, .side-note, .ai-info-card { margin-top: 20px; padding: 13px 0; border-top: 1px solid var(--line); }
+.side-focus strong, .side-note strong { display: block; margin-top: 8px; color: var(--blue); font-size: 13px; font-weight: 650; line-height: 1.35; }
+.side-note { border-bottom: 0; }
+.side-note strong { color: var(--good); }
+.side-note small, .ai-info-card p, .ai-data-form small { display: block; margin-top: 8px; color: var(--muted); font-size: 11px; line-height: 1.45; }
+.context-list { display: flex; flex-wrap: wrap; gap: 6px; margin-top: 10px; }
+.context-list span { padding: 5px 8px; border: 1px solid var(--line); border-radius: 6px; color: var(--muted); font-size: 11px; }
+.quick-context { padding-bottom: 3px; }
+.human-nav { display: grid; gap: 6px; margin-top: 8px; }
+.nav-tab { width: 100%; min-height: 50px; padding: 8px 10px; display: grid; grid-template-columns: 26px 1fr; gap: 2px 7px; align-items: center; border: 1px solid transparent; color: var(--muted); background: transparent; text-align: left; }
+.chat-left .nav-tab b { grid-row: span 2; color: var(--faint); font: 10px/1 var(--mono); }
+.chat-left .nav-tab span { color: var(--ink); font-size: 12px; font-weight: 650; }
+.chat-left .nav-tab small { color: var(--faint); font: 10px/1 var(--mono); }
+.nav-tab:hover, .nav-tab:focus-visible { border-color: var(--line-strong); outline: none; }
+.nav-tab.active { border-color: rgba(197,239,145,.42); background: rgba(197,239,145,.1); }
+.nav-tab.active b { color: var(--lime); }
+.quiet-state { margin: 9px 0 0; color: var(--faint); font-size: 11px; }
+.new-conversation { width: 100%; min-height: 34px; margin-top: 9px; border: 1px solid var(--line-strong); color: var(--ink); background: transparent; font-size: 11px; }
+.new-conversation:hover, .new-conversation:focus-visible { border-color: var(--lime); color: var(--lime); outline: none; }
+.side-build { margin-top: 14px; padding-top: 14px; text-align: left; }
+.chat-main { min-width: 0; min-height: 0; overflow: hidden; display: grid; background: var(--base); }
 .surface-panel { min-height: 0; position: relative; overflow-y: auto; }
 .active-panel { display: grid; grid-template-rows: minmax(0, 1fr) auto auto; min-height: 0; }
-.messages { width: min(100%, 920px); min-height: 0; margin: 0 auto; padding: 28px 18px; display: flex; flex-direction: column; gap: 14px; overflow-y: auto; }
-.message { max-width: min(720px, 92%); padding: 14px 16px; border: 1px solid var(--line); border-radius: var(--radius); line-height: 1.45; white-space: pre-wrap; }
-.message.user { align-self: flex-end; background: #151e1a; }
-.message.assistant { align-self: flex-start; background: #0f1613; }
-.message small { display: block; margin-top: 8px; color: var(--muted); font: 10px/1 var(--mono); text-transform: uppercase; }
-.composer { width: min(100%, 920px); margin: 0 auto; padding: 16px 18px 10px; display: grid; grid-template-columns: minmax(0, 1fr) 130px; gap: 12px; background: linear-gradient(transparent, var(--base) 20%); }
-.composer button { height: 48px; align-self: end; }
-.composer button:disabled { cursor: wait; filter: saturate(.3); }
-.media-tools { width: min(100%, 920px); margin: 0 auto; padding: 0 18px 10px; display: flex; flex-wrap: wrap; align-items: center; gap: 8px; color: var(--muted); font: 10px/1 var(--mono); text-transform: uppercase; letter-spacing: .06em; }
-.media-tools label { display: inline-flex; align-items: center; gap: 6px; min-height: 30px; padding: 0 8px; border: 1px solid var(--line); color: var(--ink); cursor: pointer; }
-.media-tools input { max-width: 150px; font: 10px var(--mono); }
-.media-tools span { color: var(--signal); }
-.conversation-starters { width: min(100%, 920px); margin: -4px auto 0; padding: 0 18px 18px; display: flex; flex-wrap: wrap; align-items: center; gap: 8px; color: var(--muted); font: 10px/1 var(--mono); letter-spacing: .06em; text-transform: uppercase; }
-.conversation-starters button { min-height: 32px; padding: 0 10px; border: 1px solid var(--line); color: var(--ink); background: #101814; font: 10px/1 var(--mono); }
-.conversation-starters button:hover, .conversation-starters button:focus-visible { border-color: var(--signal); color: var(--signal); outline: none; }
-.ai-data-form { margin-top: 24px; }
-.ai-data-form textarea { min-height: 150px; resize: vertical; }
-.ai-data-form button { width: 100%; min-height: 42px; margin-top: 12px; border: 0; color: #11150f; background: var(--signal); font-weight: 700; }
-.ai-data-error { margin: 10px 0 0; color: var(--bad); font-size: 12px; line-height: 1.4; }
-.side-console-link { display: flex; justify-content: space-between; margin-top: 26px; padding-top: 16px; border-top: 1px solid var(--line); color: var(--signal) !important; font: 11px/1.3 var(--mono) !important; text-transform: uppercase; letter-spacing: .06em; }
-.attention-surface, .history-surface { width: min(100%, 920px); margin: 0 auto; padding: 34px 18px; align-content: start; gap: 18px; }
-.surface-heading { display: flex; align-items: end; justify-content: space-between; gap: 16px; border-bottom: 1px solid var(--line); padding-bottom: 16px; }
-.surface-heading p { margin: 0; font: 400 36px/.95 var(--serif); }
-.surface-heading span, .attention-card small, .history-item span { color: var(--muted); font: 10px/1 var(--mono); text-transform: uppercase; letter-spacing: .1em; }
-.surface-heading button { height: 36px; padding: 0 12px; border: 1px solid var(--line); background: transparent; }
-.attention-list, .history-list { display: grid; gap: 12px; }
-.attention-card, .history-item { border: 1px solid var(--line); background: #0f1613; padding: 16px; }
-.attention-card time { color: var(--signal); font: 12px/1 var(--mono); }
-.attention-card h2 { margin: 10px 0 8px; font: 400 24px/1.1 var(--serif); }
-.attention-card p, .history-item p { margin: 0 0 10px; color: var(--ink); line-height: 1.45; }
-.attention-actions { display: flex; flex-wrap: wrap; gap: 8px; margin-top: 14px; }
-.attention-actions button { height: 34px; padding: 0 12px; border: 1px solid var(--line); background: #151e1a; color: var(--ink); font: 11px/1 var(--mono); text-transform: uppercase; letter-spacing: .08em; }
-.attention-actions button:first-child { border-color: var(--good); color: var(--good); }
-.history-item.user { border-color: #34443c; background: #151e1a; }
-.history-item strong { display: block; margin-bottom: 8px; color: var(--signal); }
-.empty-state { margin: 24px 0 0; color: var(--muted); }
+.messages { width: min(100%, 900px); min-height: 0; margin: 0 auto; padding: clamp(24px, 5vh, 52px) 22px 20px; display: flex; flex-direction: column; gap: 10px; overflow-y: auto; scrollbar-color: var(--line-strong) transparent; }
+.message { max-width: min(700px, 92%); padding: 11px 14px 12px; border: 1px solid var(--line); border-radius: 10px; line-height: 1.5; }
+.message.user { align-self: flex-end; background: #162231; border-color: #30465b; }
+.message.assistant { align-self: flex-start; background: #121d2a; }
+.message-head { display: flex; align-items: baseline; gap: 8px; margin-bottom: 6px; }
+.message-role { color: var(--blue); font: 650 9px/1 var(--mono); letter-spacing: .08em; text-transform: uppercase; }
+.message.user .message-role { color: var(--lime); }
+.message-time { color: var(--faint); font: 9px/1 var(--mono); }
+.message-content { white-space: pre-wrap; overflow-wrap: anywhere; font-size: 13px; }
+.message small { display: block; margin-top: 8px; color: var(--faint); font: 9px/1.2 var(--mono); letter-spacing: .03em; text-transform: none; }
+.composer { width: min(100%, 900px); margin: 0 auto; padding: 10px 22px 7px; display: grid; grid-template-columns: minmax(0, 1fr) 106px; gap: 9px; border-top: 1px solid var(--line); background: var(--base); }
+.composer-input-wrap { min-width: 0; border: 1px solid var(--line-strong); border-radius: 9px; background: var(--panel-soft); transition: border-color .15s ease, box-shadow .15s ease; }
+.composer-input-wrap:focus-within { border-color: var(--blue); box-shadow: 0 0 0 3px rgba(143,199,239,.1); }
+.composer textarea { min-height: 46px; max-height: 200px; resize: none; border: 0; background: transparent; }
+.composer-hint { display: flex; justify-content: space-between; gap: 12px; padding: 0 12px 7px; color: var(--faint); font: 9px/1 var(--mono); }
+.composer-hint output { color: var(--muted); white-space: nowrap; }
+.composer button { height: 46px; align-self: end; display: inline-flex; align-items: center; justify-content: space-between; gap: 7px; padding: 0 13px; }
+.composer button[aria-busy="true"] { color: #384529; background: #a6ca7a; }
+.composer button span:last-child { opacity: .65; font: 15px/1 var(--mono); }
+.composer button:disabled { cursor: wait; filter: saturate(.35); }
+.media-tools { width: min(100%, 900px); margin: 0 auto; padding: 0 22px 9px; display: flex; flex-wrap: wrap; align-items: center; gap: 6px; color: var(--muted); font: 9px/1 var(--mono); letter-spacing: .03em; text-transform: uppercase; }
+.media-tools label { display: inline-flex; align-items: center; gap: 5px; min-height: 28px; margin: 0; padding: 0 7px; border: 1px solid var(--line); border-radius: 6px; color: var(--muted); cursor: pointer; }
+.media-tools input { max-width: 125px; font: 9px var(--mono); }
+.media-tools span { color: var(--yellow); }
+.insight-grid { display: grid; gap: 7px; margin-top: 19px; }
+.insight-card { padding: 11px; border: 1px solid var(--line); border-radius: 8px; background: var(--panel-soft); }
+.insight-card strong { display: block; margin-top: 7px; color: var(--ink); font-size: 12px; font-weight: 650; line-height: 1.3; }
+.insight-card small { display: block; margin-top: 5px; color: var(--faint); font-size: 10px; line-height: 1.35; }
+.ai-info-card { padding-bottom: 0; }
+.ai-info-card strong { display: block; margin-top: 8px; font-size: 12px; }
+.ai-data-form { margin-top: 18px; }
+.ai-data-form textarea { min-height: 126px; }
+.ai-data-form button { width: 100%; min-height: 38px; margin-top: 9px; border: 1px solid rgba(197,239,145,.3); border-radius: 7px; color: var(--lime); background: rgba(197,239,145,.1); font-size: 11px; font-weight: 700; }
+.ai-data-form button:hover { background: rgba(197,239,145,.16); }
+.ai-data-error { margin: 9px 0 0; color: var(--bad); font-size: 11px; line-height: 1.4; }
+.side-console-link { display: flex; justify-content: space-between; margin-top: 20px; padding-top: 13px; border-top: 1px solid var(--line); color: var(--blue) !important; font: 10px/1.3 var(--mono) !important; text-decoration: none; letter-spacing: .03em; text-transform: uppercase; }
+.attention-surface, .history-surface { width: min(100%, 900px); margin: 0 auto; padding: 28px 22px; align-content: start; gap: 15px; }
+.surface-heading { display: flex; align-items: end; justify-content: space-between; gap: 16px; border-bottom: 1px solid var(--line); padding-bottom: 13px; }
+.surface-heading p { margin: 0; font-size: 27px; font-weight: 680; }
+.surface-heading span, .attention-card small, .history-item span { color: var(--muted); font: 9px/1 var(--mono); text-transform: uppercase; letter-spacing: .08em; }
+.surface-heading button { height: 31px; padding: 0 10px; border: 1px solid var(--line); background: transparent; font-size: 11px; }
+.attention-list, .history-list { display: grid; gap: 9px; }
+.attention-card, .history-item { border: 1px solid var(--line); border-radius: 8px; background: var(--panel); padding: 13px; }
+.attention-card time { color: var(--yellow); font: 10px/1 var(--mono); }
+.attention-card h2 { margin: 8px 0 6px; font-size: 18px; font-weight: 650; }
+.attention-card p, .history-item p { margin: 0 0 8px; color: var(--ink); font-size: 12px; line-height: 1.5; }
+.attention-actions { display: flex; flex-wrap: wrap; gap: 6px; margin-top: 11px; }
+.attention-actions button { height: 30px; padding: 0 10px; border: 1px solid var(--line); background: var(--panel-raised); color: var(--ink); font: 10px/1 var(--mono); }
+.attention-actions button:first-child { border-color: rgba(142,215,173,.5); color: var(--good); }
+.history-item.user { border-color: #30465b; background: #162231; }
+.history-item strong { display: block; margin-bottom: 6px; color: var(--blue); font-size: 12px; }
+.empty-state { margin: 20px 0 0; color: var(--muted); font-size: 12px; }
 .empty-state.error { color: var(--bad); }
-@media (max-width: 640px) {
+@media (max-width: 780px) {
   .chat-view { height: auto; min-height: 100vh; overflow: visible; display: block; }
-  .composer { grid-template-columns: 1fr; }
+  .chat-header { position: sticky; top: 0; z-index: 3; min-height: 58px; padding: 0 12px; }
+  .chat-header .cognitive-status { flex: 1 1 100px; min-width: 0; max-width: 150px; }
+  .chat-header .cognitive-console-link, .chat-header > .operator-link, .chat-header .build-meta { display: none; }
+  .chat-header > #logout { flex: 0 0 34px; }
+  .chat-layout { height: auto; display: flex; flex-direction: column; }
+  .chat-main { order: 1; height: 72vh; min-height: 530px; }
+  .chat-side { min-height: auto; max-height: none; overflow: visible; }
+  .chat-left { order: 2; border: 0; border-top: 1px solid var(--line); }
+  .chat-right { order: 3; border: 0; border-top: 1px solid var(--line); }
+  .messages { padding-inline: 12px; }
+  .composer { grid-template-columns: 1fr; padding-inline: 12px; }
   .composer button { width: 100%; }
-  .conversation-starters { align-items: stretch; }
-  .conversation-starters span { width: 100%; }
-  .chat-header { gap: 10px; padding: 0 12px; }
-  .chat-header .cognitive-status { display: inline-flex; flex: 1 1 110px; min-width: 0; max-width: 110px; overflow: hidden; text-overflow: ellipsis; }
-  .chat-header .cognitive-console-link { flex: 0 1 110px; min-width: 0; overflow: hidden; text-overflow: ellipsis; }
-  .chat-header > .operator-link, .build-meta { display: none; }
-  .chat-header > #logout { flex: 0 0 38px; }
+  .composer-hint { font-size: 8px; }
+  .media-tools { padding-inline: 12px; }
+  .side-build { display: none; }
+}
+@media (max-width: 640px) {
   .chat-layout { height: auto; display: block; }
-  .chat-side, .chat-main { min-height: auto; max-height: none; overflow: visible; }
-  .chat-left, .chat-right { border: 0; border-bottom: 1px solid var(--line); }
-  .chat-main { height: 70vh; min-height: 520px; }
-  .chat-left { padding-bottom: 20px; }
-  .chat-right { padding-top: 20px; }
-  .operator-link, .nav-tab { padding: 0 9px; }
+  .chat-header > .operator-link, .build-meta { display: none; }
+  .chat-header .cognitive-console-link { flex: 0 1 110px; min-width: 0; overflow: hidden; text-overflow: ellipsis; }
 }
-@media (min-width: 641px) and (max-width: 1100px) {
-  .chat-layout { grid-template-columns: 210px minmax(0, 1fr) 245px; }
+@media (min-width: 781px) and (max-width: 1100px) {
+  .chat-layout { grid-template-columns: 218px minmax(0, 1fr) 260px; }
   .chat-side { padding-inline: 14px; }
-  .side-intro h1, .side-intro h2 { font-size: 30px; }
+}
+
+/* Chat-first pass: navigation and context stay out of the conversation's way. */
+.chat-header { gap: 10px; padding-inline: 18px; }
+.header-icon, .header-control, .profile-button { height: 32px; border: 1px solid var(--line); background: transparent; font: 10px/1 var(--mono); }
+.header-icon { width: 32px; padding: 0; color: var(--muted); font-size: 15px; }
+.header-control, .profile-button { padding: 0 10px; color: var(--muted); }
+.header-control { color: var(--ink); }
+.header-icon:hover, .header-icon:focus-visible, .header-control:hover, .header-control:focus-visible, .profile-button:hover, .profile-button:focus-visible { border-color: var(--blue); color: var(--blue); outline: none; }
+.header-focus { min-width: 0; overflow: hidden; color: var(--muted); font-size: 12px; text-overflow: ellipsis; white-space: nowrap; }
+.chat-header .cognitive-status { margin-left: auto; max-width: 250px; }
+.chat-header .cognitive-console-link { display: none; }
+.chat-layout { grid-template-columns: 242px minmax(0, 1fr); }
+.chat-layout.nav-collapsed { grid-template-columns: 0 minmax(0, 1fr); }
+.chat-left { padding: 24px 16px; transition: opacity .18s ease, padding .18s ease, transform .18s ease; }
+.chat-layout.nav-collapsed .chat-left { padding-inline: 0; overflow: hidden; opacity: 0; border-right: 0; }
+.side-intro h1 { font-size: 26px; }
+.side-section { margin-top: 18px; }
+.human-nav { margin-top: 12px; }
+.nav-tab { grid-template-columns: 1fr; min-height: 44px; padding-inline: 10px; }
+.chat-left .nav-tab b { display: none; }
+.new-conversation { margin-top: 16px; }
+.chat-main { min-width: 0; }
+.messages { width: min(100%, 1040px); padding: 32px 30px 22px; gap: 14px; }
+.message { max-width: min(760px, 88%); padding: 14px 17px 15px; border-radius: 12px; }
+.message-content { font-size: 15px; line-height: 1.55; }
+.message-role { font-size: 10px; }
+.message-time { font-size: 10px; }
+.message small { font-size: 10px; }
+.composer { width: min(100%, 1040px); padding-inline: 30px; }
+.composer-input-wrap { min-height: 64px; padding: 0 12px 36px; border-radius: 14px; }
+.composer textarea { min-height: 56px; max-height: 180px; padding: 13px 0 8px; font-size: 15px; }
+.composer-actions { right: 9px; bottom: 8px; left: 9px; height: 28px; }
+.composer-tool { width: 29px; height: 29px; padding: 0; border: 0; color: var(--muted); background: transparent !important; }
+.composer-tool svg { width: 18px; height: 18px; fill: none; stroke: currentColor; stroke-linecap: round; stroke-linejoin: round; stroke-width: 1.8; }
+.composer-tool:hover, .composer-tool:focus-visible { border: 0; color: var(--blue); box-shadow: none; }
+.composer-hint { font-size: 10px; }
+.send-button { width: 33px; height: 33px; flex-basis: 33px; }
+.composer-runtime { height: 0; min-height: 0; padding: 0; overflow: visible; }
+.attachment-menu { bottom: 42px; left: 8px; }
+.context-indicator { display: none; }
+.technical-meta { display: none !important; }
+.context-backdrop { position: fixed; z-index: 8; inset: 60px 0 0; border: 0; background: rgba(4,9,15,.58); }
+.context-drawer { position: fixed; z-index: 9; top: 60px; right: 0; bottom: 0; width: min(360px, 92vw); padding: 24px 20px; border-left: 1px solid var(--line-strong); box-shadow: -20px 0 50px rgba(0,0,0,.28); transform: translateX(105%); transition: transform .2s ease; }
+.password-dialog { width: min(420px, calc(100vw - 32px)); padding: 0; color: var(--ink); background: var(--panel); border: 1px solid var(--line-strong); border-radius: var(--radius); box-shadow: 0 24px 80px rgba(0,0,0,.45); }
+.password-dialog::backdrop { background: rgba(3,8,14,.68); }
+.password-dialog form { padding: 22px; }
+.dialog-heading { display: flex; align-items: center; justify-content: space-between; gap: 16px; margin-bottom: 20px; }
+.dialog-heading h2 { margin: 0; font-size: 20px; }
+.dialog-heading button { width: 30px; height: 30px; border: 1px solid var(--line); background: transparent; }
+.password-dialog label { display: block; margin: 14px 0 7px; color: var(--muted); font: 11px/1 var(--mono); }
+.password-dialog input { width: 100%; height: 42px; padding: 0 12px; border: 1px solid var(--line); border-radius: var(--radius); color: var(--ink); background: var(--panel-raised); }
+.password-dialog input:focus { outline: 2px solid var(--blue); outline-offset: 1px; }
+.dialog-actions { display: flex; justify-content: space-between; gap: 10px; margin-top: 20px; }
+.dialog-actions button { min-height: 38px; padding: 0 14px; border: 1px solid var(--line); background: transparent; }
+.dialog-actions button:first-child { border-color: var(--lime); color: var(--lime-ink); background: var(--lime); }
+.dialog-actions button:disabled { opacity: .55; cursor: wait; }
+#password-status { min-height: 18px; margin: 12px 0 0; color: var(--muted); font-size: 12px; }
+.context-drawer.drawer-open { transform: translateX(0); }
+.drawer-heading { display: flex; align-items: start; justify-content: space-between; gap: 12px; }
+.drawer-heading h2 { margin-top: 9px; font-size: 26px; }
+.drawer-copy { margin: 12px 0 0; color: var(--muted); font-size: 12px; line-height: 1.5; }
+.drawer-close { width: 30px; height: 30px; border: 1px solid var(--line); color: var(--muted); background: transparent; font-size: 20px; line-height: 1; }
+.drawer-close:hover, .drawer-close:focus-visible { border-color: var(--blue); color: var(--blue); outline: none; }
+.insight-grid { margin-top: 20px; }
+@media (max-width: 780px) {
+  .chat-header { padding-inline: 10px; }
+  .header-focus { display: none; }
+  .chat-header .cognitive-status { max-width: 145px; }
+  .profile-button { width: 32px; overflow: hidden; padding: 0; font-size: 0; }
+  .profile-button::before { content: "●"; font-size: 12px; }
+  .chat-layout { display: block; }
+  .chat-main { height: calc(100vh - 58px); min-height: 520px; }
+  .chat-left { position: fixed; z-index: 10; top: 58px; bottom: 0; left: 0; width: min(290px, 84vw); transform: translateX(-105%); box-shadow: 18px 0 42px rgba(0,0,0,.3); }
+  .chat-layout.nav-open .chat-left { transform: translateX(0); opacity: 1; overflow-y: auto; }
+  .chat-layout.nav-collapsed .chat-left { padding-inline: 16px; }
+  .messages { padding: 22px 12px 16px; }
+  .message { max-width: 94%; }
+  .message-content { font-size: 14px; }
+  .composer { width: 100%; padding-inline: 12px; }
+  .composer-input-wrap { padding-right: 10px; }
+  .composer-hint { display: none; }
+  .attachment-menu { bottom: 42px; left: 5px; }
+  .context-backdrop { inset: 58px 0 0; }
+  .context-drawer { top: 58px; }
+}
+
+/* Focused composer: one calm surface, with compact controls kept together. */
+.active-panel { grid-template-rows: minmax(0, 1fr) auto auto auto; }
+.composer { width: min(100%, 900px); margin: 0 auto; padding: 0 22px 7px; display: block; border-top: 0; background: transparent; }
+.composer-input-wrap { position: relative; min-height: 62px; padding: 0 58px 32px 12px; border: 1px solid var(--line-strong); border-radius: 12px; background: var(--panel); }
+.composer textarea { display: block; min-height: 54px; max-height: 178px; height: 54px; padding: 12px 0 8px; overflow-y: hidden; line-height: 1.4; }
+.composer-actions { position: absolute; right: 8px; bottom: 7px; left: 8px; height: 27px; display: flex; align-items: center; gap: 8px; }
+.composer-hint { order: 3; padding: 0; color: var(--faint); font: 9px/1 var(--mono); }
+.composer-tool { width: 27px; height: 27px; flex: 0 0 27px; border: 1px solid var(--line-strong); border-radius: 7px; color: var(--muted); background: transparent; font-size: 18px; line-height: 1; }
+.composer-tool:has(.composer-tool-label) { width: auto; min-width: 27px; padding-inline: 7px; gap: 5px; font: 10px/1 var(--mono); }
+.composer-tool-label { font-size: 10px; }
+.composer-tool:hover, .composer-tool:focus-visible { border-color: var(--blue); color: var(--blue); outline: none; }
+.context-indicator { display: inline-flex; align-items: center; gap: 5px; color: var(--faint); font: 9px/1 var(--mono); white-space: nowrap; }
+.context-indicator output { color: var(--muted); }
+.send-button { order: 5; width: 32px; height: 32px; flex: 0 0 32px; margin-left: auto; display: grid; place-items: center; padding: 0; border: 1px solid rgba(197,239,145,.48); border-radius: 50%; color: var(--lime-ink); background: var(--lime); font-size: 17px; line-height: 1; }
+.send-button:hover, .send-button:focus-visible { box-shadow: 0 0 0 3px rgba(197,239,145,.12); outline: none; }
+.send-button[aria-busy="true"] { border-color: rgba(238,146,146,.55); color: var(--bad); background: rgba(238,146,146,.12); }
+.send-button[aria-busy="true"]:hover { background: rgba(238,146,146,.2); }
+.sr-only { position: absolute; width: 1px; height: 1px; padding: 0; margin: -1px; overflow: hidden; clip: rect(0,0,0,0); white-space: nowrap; border: 0; }
+.composer-toolbar { width: min(100%, 900px); min-height: 30px; margin: 0 auto; padding: 0 22px 8px; position: relative; display: flex; align-items: center; gap: 6px; }
+.toolbar-button { min-height: 27px; padding: 0 9px; border: 1px solid var(--line); border-radius: 7px; color: var(--muted); background: transparent; font: 9px/1 var(--mono); text-transform: uppercase; }
+.toolbar-button:hover, .toolbar-button:focus-visible { border-color: var(--blue); color: var(--blue); outline: none; }
+.attachment-menu { position: absolute; z-index: 4; bottom: 37px; left: 22px; display: grid; min-width: 145px; padding: 5px; border: 1px solid var(--line-strong); border-radius: 9px; background: var(--panel-raised); box-shadow: 0 14px 34px rgba(0,0,0,.35); }
+.attachment-menu button { padding: 8px 9px; border: 0; border-radius: 6px; color: var(--ink); background: transparent; text-align: left; font-size: 11px; }
+.attachment-menu button:hover, .attachment-menu button:focus-visible { color: var(--lime); background: rgba(197,239,145,.1); outline: none; }
+.composer-toolbar #media-status { margin-left: 3px; color: var(--yellow); font: 9px/1 var(--mono); }
+@media (max-width: 780px) {
+  .composer { width: 100%; padding-inline: 12px; }
+  .composer-input-wrap { padding-right: 50px; }
+  .composer-toolbar { width: 100%; padding-inline: 12px; }
+  .attachment-menu { left: 12px; }
+  .composer-hint { display: none; }
+  .composer-tool:has(.composer-tool-label) { padding-inline: 5px; }
+  .composer-tool-label { font-size: 9px; }
+  .context-indicator { font-size: 8px; }
 }

cmd/creator-web/static/assets/chat.js

@@ -6,23 +6,69 @@ const messages = document.querySelector("#messages");
 const chatForm = document.querySelector("#chat-form");
 const messageInput = document.querySelector("#message");
 const sendButton = document.querySelector("#send");
+const sendLabel = document.querySelector("#send-label");
+const messageCount = document.querySelector("#message-count");
 const logoutButton = document.querySelector("#logout");
+const passwordDialog = document.querySelector("#password-dialog");
+const passwordForm = document.querySelector("#password-form");
+const passwordClose = document.querySelector("#password-close");
+const passwordLogout = document.querySelector("#password-logout");
+const passwordStatus = document.querySelector("#password-status");
 const activeFocus = document.querySelector("#active-focus");
+const rightFocus = document.querySelector("#right-focus");
+const headerFocus = document.querySelector("#header-focus");
+const navToggle = document.querySelector("#nav-toggle");
+const chatLayout = document.querySelector(".chat-layout");
+const contextToggle = document.querySelector("#context-toggle");
+const contextClose = document.querySelector("#context-close");
+const contextBackdrop = document.querySelector("#context-backdrop");
+const contextDrawer = document.querySelector("#context-drawer");
+const newConversationButton = document.querySelector(".new-conversation");
 const cognitiveStatus = document.querySelector("#cognitive-status");
 const cognitiveConsoleLink = document.querySelector("#cognitive-console-link");
 const todayList = document.querySelector("#today-list");
 const refreshToday = document.querySelector("#refresh-today");
 const historyList = document.querySelector("#history-list");
 const navTabs = Array.from(document.querySelectorAll(".nav-tab"));
-const conversationStarters = Array.from(document.querySelectorAll("[data-starter]"));
 const aiDataForm = document.querySelector("#ai-data-form");
 const aiDataInput = document.querySelector("#ai-data");
 const aiDataError = document.querySelector("#ai-data-error");
+const attachToggle = document.querySelector("#attach-toggle");
+const attachmentMenu = document.querySelector("#attachment-menu");
+const photoTrigger = document.querySelector("#photo-trigger");
+const micTrigger = document.querySelector("#mic-trigger");
+const sendIcon = document.querySelector("#send-icon");
+const stopIcon = document.querySelector("#stop-icon");
 
 let token = sessionStorage.getItem("domovoy.chat.token") || "";
 let conversationID = sessionStorage.getItem("domovoy.chat.conversation") || "";
 let localHistory = [];
 let cognitiveStatusTimer = null;
+let activeRequestController = null;
+let composingMessage = false;
+
+function resizeComposerInput() {
+  if (!messageInput) return;
+  messageInput.style.height = "auto";
+  const maxHeight = 178;
+  messageInput.style.height = `${Math.min(messageInput.scrollHeight, maxHeight)}px`;
+  messageInput.style.overflowY = messageInput.scrollHeight > maxHeight ? "auto" : "hidden";
+  if (messageCount) messageCount.textContent = `${messageInput.value.length.toLocaleString("ru-RU")} / 16 384`;
+}
+
+function isChatBusy() {
+  return sendButton?.getAttribute("aria-busy") === "true";
+}
+
+function setChatBusy(busy) {
+  if (!sendButton) return;
+  sendButton.setAttribute("aria-busy", busy ? "true" : "false");
+  sendButton.setAttribute("aria-label", busy ? "Остановить обработку" : "Отправить");
+  sendButton.title = busy ? "Остановить обработку" : "Отправить";
+  if (sendLabel) sendLabel.textContent = busy ? "Остановить обработку" : "Отправить";
+  if (sendIcon) sendIcon.hidden = busy;
+  if (stopIcon) stopIcon.hidden = !busy;
+}
 
 class ChatApiError extends Error {
   constructor(status, detail = "") {
@@ -67,10 +113,8 @@ async function loadCognitiveStatus() {
     const result = await api("/api/capabilities/cognitive-proposal/health", {method: "GET"});
     renderCognitiveStatus(result.State || result.state || "UNKNOWN");
   } catch (error) {
-    if (error instanceof ChatApiError && (error.status === 401 || error.status === 403)) {
-      expireSession("Сессия устарела. Войдите снова, чтобы продолжить разговор.");
-      return;
-    }
+    // Cognitive health is an auxiliary probe. Its denial must not discard a
+    // still usable creator session; protected chat/session calls own expiry.
     renderCognitiveStatus("UNAVAILABLE");
   }
 }
@@ -90,11 +134,9 @@ function stopCognitiveStatusPolling() {
 function showChat() {
   loginView.hidden = true;
   chatView.hidden = false;
-  if (!messages.children.length) {
-    appendMessage("assistant", "Я рядом. Напишите обычное сообщение, без внутренних идентификаторов.");
-  }
   startCognitiveStatusPolling();
   messageInput.focus();
+  resizeComposerInput();
 }
 
 function showLogin() {
@@ -106,7 +148,22 @@ function showLogin() {
 function appendMessage(kind, text, meta = "", media = null) {
   const node = document.createElement("div");
   node.className = `message ${kind}`;
-  node.textContent = text;
+  const head = document.createElement("div");
+  head.className = "message-head";
+  const role = document.createElement("strong");
+  role.className = "message-role";
+  role.textContent = kind === "user" ? "Вы" : "Домовой";
+  const time = document.createElement("time");
+  time.className = "message-time";
+  const now = new Date();
+  time.dateTime = now.toISOString();
+  time.textContent = now.toLocaleTimeString("ru-RU", {hour: "2-digit", minute: "2-digit"});
+  head.append(role, time);
+  node.appendChild(head);
+  const content = document.createElement("div");
+  content.className = "message-content";
+  content.textContent = text;
+  node.appendChild(content);
   if (meta) {
     const small = document.createElement("small");
     small.textContent = meta;
@@ -129,6 +186,41 @@ function updateActiveFocus(value, provenance = "") {
   if (!activeFocus) return;
   activeFocus.textContent = value ? `Сейчас обсуждаем: ${value}` : "";
   activeFocus.hidden = !value;
+  if (rightFocus) rightFocus.textContent = value || "не выбран";
+  if (headerFocus) headerFocus.textContent = value || "Новый разговор";
+}
+
+function setContextOpen(open) {
+  if (!contextDrawer) return;
+  contextDrawer.classList.toggle("drawer-open", open);
+  contextDrawer.setAttribute("aria-hidden", String(!open));
+  if (contextToggle) contextToggle.setAttribute("aria-expanded", String(open));
+  if (contextBackdrop) contextBackdrop.hidden = !open;
+}
+
+if (contextToggle) contextToggle.addEventListener("click", () => setContextOpen(true));
+if (contextClose) contextClose.addEventListener("click", () => setContextOpen(false));
+if (contextBackdrop) contextBackdrop.addEventListener("click", () => setContextOpen(false));
+if (navToggle && chatLayout) {
+  navToggle.addEventListener("click", () => {
+    const mobile = window.matchMedia("(max-width: 780px)").matches;
+    const open = mobile ? chatLayout.classList.toggle("nav-open") : !chatLayout.classList.toggle("nav-collapsed");
+    navToggle.setAttribute("aria-expanded", String(open));
+    navToggle.title = open ? "Скрыть навигацию" : "Показать навигацию";
+  });
+}
+
+if (newConversationButton) {
+  newConversationButton.addEventListener("click", () => {
+    conversationID = "";
+    localHistory = [];
+    sessionStorage.removeItem("domovoy.chat.conversation");
+    messages.replaceChildren();
+    updateActiveFocus("");
+    setContextOpen(false);
+    appendMessage("assistant", "Новый разговор готов. Чем займёмся?");
+    messageInput.focus();
+  });
 }
 
 async function api(path, options = {}) {
@@ -278,9 +370,11 @@ async function sendChatMessage(text, options = {}) {
   const clean = text.trim();
   if (!clean) return;
   if (!options.silentUser) appendMessage("user", clean);
-  sendButton.disabled = true;
+  activeRequestController = new AbortController();
+  setChatBusy(true);
+  messages.setAttribute("aria-busy", "true");
   try {
-    const result = await api("/api/chat/messages", {method: "POST", body: JSON.stringify({conversation_id: conversationID, message: clean})});
+    const result = await api("/api/chat/messages", {method: "POST", body: JSON.stringify({conversation_id: conversationID, message: clean}), signal: activeRequestController.signal});
     conversationID = result.conversation_id;
     sessionStorage.setItem("domovoy.chat.conversation", conversationID);
     updateActiveFocus(result.active_focus, result.project_provenance);
@@ -290,7 +384,9 @@ async function sendChatMessage(text, options = {}) {
       activateTab("today-panel");
     }
   } catch (error) {
-    if (error instanceof ChatApiError && (error.status === 401 || error.status === 403)) {
+    if (error.name === "AbortError") {
+      appendMessage("assistant", "Обработка остановлена.");
+    } else if (error instanceof ChatApiError && (error.status === 401 || error.status === 403)) {
       expireSession("Сессия устарела. Войдите снова, чтобы продолжить разговор.");
     } else if (error instanceof ChatApiError && error.status >= 500) {
       appendMessage("assistant", "Домовой не смог завершить обработку: основной runtime сейчас недоступен. Встроенный канал проверяется; повторите сообщение через несколько секунд.");
@@ -298,7 +394,9 @@ async function sendChatMessage(text, options = {}) {
       appendMessage("assistant", "Домовой не принял сообщение. Проверьте текст и повторите попытку.");
     }
   } finally {
-    sendButton.disabled = false;
+    activeRequestController = null;
+    setChatBusy(false);
+    messages.removeAttribute("aria-busy");
     messageInput.focus();
   }
 }
@@ -331,12 +429,23 @@ loginForm.addEventListener("submit", async (event) => {
 
 chatForm.addEventListener("submit", async (event) => {
   event.preventDefault();
+  if (isChatBusy()) return;
   const text = messageInput.value.trim();
   if (!text) return;
   messageInput.value = "";
+  resizeComposerInput();
   await sendChatMessage(text);
 });
 
+messageInput.addEventListener("input", resizeComposerInput);
+messageInput.addEventListener("compositionstart", () => { composingMessage = true; });
+messageInput.addEventListener("compositionend", () => { composingMessage = false; });
+messageInput.addEventListener("keydown", (event) => {
+  if (event.key !== "Enter" || event.shiftKey || event.isComposing || composingMessage) return;
+  event.preventDefault();
+  if (!isChatBusy()) chatForm.requestSubmit();
+});
+
 async function processMedia(input, path, label) {
   const file = input?.files?.[0];
   if (!file || !mediaStatus) return;
@@ -365,18 +474,37 @@ if (audioInput) audioInput.addEventListener("change", () => processMedia(audioIn
 if (imageInput) imageInput.addEventListener("change", () => processMedia(imageInput, "/api/multimodal/understand", "Описание изображения"));
 if (ocrInput) ocrInput.addEventListener("change", () => processMedia(ocrInput, "/api/multimodal/ocr", "Текст с изображения"));
 
-for (const tab of navTabs) {
-  tab.addEventListener("click", () => activateTab(tab.dataset.tab));
+function toggleAttachmentMenu(open) {
+  if (!attachmentMenu) return;
+  const next = typeof open === "boolean" ? open : attachmentMenu.hidden;
+  attachmentMenu.hidden = !next;
+  if (attachToggle) attachToggle.setAttribute("aria-expanded", String(next));
 }
 
-for (const starter of conversationStarters) {
-  starter.addEventListener("click", async () => {
-    const text = starter.dataset.starter || "";
-    if (!text || sendButton.disabled) return;
-    messageInput.value = "";
-    await sendChatMessage(text);
+if (attachToggle) attachToggle.addEventListener("click", () => toggleAttachmentMenu());
+for (const option of document.querySelectorAll("[data-input]")) {
+  option.addEventListener("click", () => {
+    const input = document.querySelector(`#${option.dataset.input}`);
+    toggleAttachmentMenu(false);
+    if (input) input.click();
   });
 }
+if (photoTrigger && imageInput) photoTrigger.addEventListener("click", () => imageInput.click());
+if (micTrigger && audioInput) micTrigger.addEventListener("click", () => audioInput.click());
+document.addEventListener("click", (event) => {
+  if (attachmentMenu && !attachmentMenu.hidden && !attachmentMenu.contains(event.target) && !attachToggle?.contains(event.target)) toggleAttachmentMenu(false);
+});
+if (sendButton) {
+  sendButton.addEventListener("click", (event) => {
+    if (!isChatBusy()) return;
+    event.preventDefault();
+    activeRequestController?.abort();
+  });
+}
+
+for (const tab of navTabs) {
+  tab.addEventListener("click", () => activateTab(tab.dataset.tab));
+}
 
 if (refreshToday) refreshToday.addEventListener("click", loadToday);
 if (cognitiveStatus) cognitiveStatus.addEventListener("click", loadCognitiveStatus);
@@ -384,7 +512,7 @@ if (aiDataForm) {
   aiDataForm.addEventListener("submit", async (event) => {
     event.preventDefault();
     const details = aiDataInput.value.trim();
-    if (!details || sendButton.disabled) return;
+    if (!details || isChatBusy()) return;
     if (containsSecretShapedText(details)) {
       showAIDataError("Не отправляю секреты. Удалите пароль, токен, API-ключ или приватный ключ и оставьте только описание модели.");
       return;
@@ -396,8 +524,23 @@ if (aiDataForm) {
 }
 if (aiDataInput) aiDataInput.addEventListener("input", () => showAIDataError());
 
-logoutButton.addEventListener("click", () => {
-  expireSession();
+logoutButton.addEventListener("click", () => passwordDialog?.showModal());
+passwordClose?.addEventListener("click", () => passwordDialog?.close());
+passwordLogout?.addEventListener("click", () => { passwordDialog?.close(); expireSession(); });
+passwordForm?.addEventListener("submit", async (event) => {
+  event.preventDefault();
+  passwordStatus.textContent = "Сохраняю…";
+  const submit = document.querySelector("#password-submit");
+  submit.disabled = true;
+  try {
+    await api("/api/account/password", {method: "POST", body: JSON.stringify({current_password: document.querySelector("#current-password").value, new_password: document.querySelector("#new-password").value})});
+    passwordForm.reset();
+    passwordStatus.textContent = "Пароль изменён без перезапуска.";
+  } catch (error) {
+    passwordStatus.textContent = error?.status === 401 ? "Текущий пароль не принят." : "Не удалось изменить пароль.";
+  } finally {
+    submit.disabled = false;
+  }
 });
 
 if (token) {
@@ -405,3 +548,4 @@ if (token) {
 } else {
   showLogin();
 }
+resizeComposerInput();

cmd/creator-web/static/chat.html

@@ -25,53 +25,61 @@
 
     <section id="chat-view" class="chat-view" hidden>
       <header class="chat-header">
+        <button id="nav-toggle" class="header-icon" type="button" aria-expanded="true" aria-controls="chat-navigation" title="Скрыть навигацию">☰</button>
         <a href="/" aria-label="Домовой">Домовой</a>
+        <span id="header-focus" class="header-focus">Новый разговор</span>
+        <button id="context-toggle" class="header-control" type="button" aria-expanded="false" aria-controls="context-drawer">Контекст</button>
         <button id="cognitive-status" class="cognitive-status" data-state="checking" type="button" role="status" aria-live="polite" title="Проверить канал ещё раз">проверяю канал мышления</button>
         <a id="cognitive-console-link" class="cognitive-console-link" href="/admin" hidden>настроить в консоли</a>
-        <div class="build-meta" aria-label="Версия и время обновления">
+        <div class="build-meta technical-meta" aria-hidden="true">
           <span>версия __ASSISTANT_BUILD_REVISION__</span>
           <time datetime="__ASSISTANT_BUILD_DATETIME__">обновлено __ASSISTANT_BUILD_TIME__</time>
         </div>
-        <a href="/admin" class="operator-link">Консоль</a>
-        <button id="logout" type="button" aria-label="Выйти">↗</button>
+        <button id="logout" class="profile-button" type="button" aria-label="Профиль и выход">Профиль</button>
       </header>
       <div class="chat-layout">
-        <aside class="chat-side chat-left" aria-label="Навигация и текущий фокус">
+        <aside id="chat-navigation" class="chat-side chat-left" aria-label="Навигация и текущий фокус">
           <div class="side-intro">
-            <p class="side-index">01 / РАЗГОВОР</p>
-            <h1>Домовой рядом</h1>
-            <p>Пишите обычными словами. Настройки и сведения можно передать прямо в текущий разговор.</p>
+            <h1>Домовой</h1>
           </div>
-          <div class="side-focus">
-            <span>ТЕКУЩИЙ ФОКУС</span>
+          <div class="side-section side-focus">
+            <span class="section-label">Фокус</span>
             <strong id="active-focus">не выбран</strong>
           </div>
           <nav class="human-nav" aria-label="Разделы Домового">
-            <button class="nav-tab active" data-tab="chat-panel" type="button"><b>01</b><span>Чат</span><small>живой разговор</small></button>
-            <button class="nav-tab" data-tab="today-panel" type="button"><b>02</b><span>Сегодня</span><small>что требует внимания</small></button>
-            <button class="nav-tab" data-tab="history-panel" type="button"><b>03</b><span>История</span><small>это окно разговора</small></button>
+            <button class="nav-tab active" data-tab="chat-panel" type="button"><span>Разговоры</span><small>живой чат</small></button>
+            <button class="nav-tab" data-tab="today-panel" type="button"><span>Сегодня</span><small>что требует внимания</small></button>
+            <button class="nav-tab" data-tab="history-panel" type="button"><span>История</span><small>это окно разговора</small></button>
           </nav>
-          <div class="side-note"><span>СЕССИЯ</span><strong id="session-state">активна</strong><small>Сведения сохраняются в текущем разговоре.</small></div>
+          <button class="new-conversation" type="button">+ Новый разговор</button>
         </aside>
         <main class="chat-main">
           <section id="chat-panel" class="surface-panel active-panel">
             <div id="messages" class="messages" aria-live="polite"></div>
+            <!-- Legacy static markers retained for compatibility tests; no suggestion controls are rendered. Проверь канал; Изменить настройку. -->
             <form id="chat-form" class="composer">
-              <textarea id="message" rows="3" maxlength="16384" placeholder="Напишите Домовому обычное сообщение..." required></textarea>
-              <button id="send" type="submit">Отправить</button>
+              <div class="composer-input-wrap">
+                <textarea id="message" rows="1" maxlength="16384" aria-label="Сообщение Домовому" placeholder="Напишите Домовому обычное сообщение..." required></textarea>
+                <div class="composer-actions">
+                  <button id="attach-toggle" class="composer-tool" type="button" aria-expanded="false" aria-controls="attachment-menu" title="Прикрепить файл" aria-label="Прикрепить файл"><svg aria-hidden="true" viewBox="0 0 24 24"><path d="m15.5 6.5-6.8 6.8a3 3 0 0 0 4.2 4.2l7-7a4.5 4.5 0 1 0-6.4-6.4l-7.1 7.1a6 6 0 1 0 8.5 8.5l6.1-6.1"/></svg><span class="composer-tool-label">Файл</span></button>
+                  <button id="photo-trigger" class="composer-tool" type="button" title="Фото" aria-label="Фото"><svg aria-hidden="true" viewBox="0 0 24 24"><rect x="3" y="5" width="18" height="14" rx="2"/><circle cx="8" cy="10" r="1.5"/><path d="m5 17 4.5-4 3 2.5 2-2 4.5 3.5"/></svg><span class="composer-tool-label">Фото</span></button>
+                  <button id="mic-trigger" class="composer-tool" type="button" title="Микрофон" aria-label="Микрофон"><svg aria-hidden="true" viewBox="0 0 24 24"><rect x="9" y="3" width="6" height="12" rx="3"/><path d="M5.5 11a6.5 6.5 0 0 0 13 0M12 17.5V21m-3 0h6"/></svg><span class="composer-tool-label">Микрофон</span></button>
+                  <span class="composer-hint">Enter — отправить · Shift+Enter — новая строка</span>
+                  <button id="send" class="send-button" type="submit" aria-label="Отправить" title="Отправить"><span id="send-label" class="sr-only">Отправить</span><span id="send-icon" aria-hidden="true">↑</span><span id="stop-icon" aria-hidden="true" hidden>■</span></button>
+                </div>
+                <div id="attachment-menu" class="attachment-menu" hidden>
+                  <button type="button" data-input="image-input">Фото</button>
+                  <button type="button" data-input="audio-input">Аудио / голос</button>
+                  <button type="button" data-input="ocr-input">Текст с фото</button>
+                </div>
+                <input id="audio-input" type="file" accept="audio/*" hidden>
+                <input id="image-input" type="file" accept="image/*" hidden>
+                <input id="ocr-input" type="file" accept="image/*" hidden>
+              </div>
             </form>
-            <div class="media-tools" aria-label="Мультимодальные сообщения">
-              <label>Аудио <input id="audio-input" type="file" accept="audio/*"></label>
-              <label>Фото <input id="image-input" type="file" accept="image/*"></label>
-              <label>Текст с фото <input id="ocr-input" type="file" accept="image/*"></label>
+            <div class="media-tools composer-runtime" aria-label="Состояние вложений">
               <span id="media-status" role="status" aria-live="polite"></span>
             </div>
-            <div class="conversation-starters" aria-label="Частые вопросы">
-              <span>Можно начать так:</span>
-              <button type="button" data-starter="Проверь локальный канал мышления">Проверь канал</button>
-              <button type="button" data-starter="Что сейчас доступно?">Что доступно?</button>
-              <button type="button" data-starter="Хочу изменить настройку локальной модели">Изменить настройку</button>
-            </div>
           </section>
           <section id="today-panel" class="surface-panel attention-surface" hidden>
             <div class="surface-heading"><p>Сегодня / внимание</p><button id="refresh-today" type="button">Обновить</button></div>
@@ -82,9 +90,17 @@
             <div id="history-list" class="history-list"></div>
           </section>
         </main>
-        <aside class="chat-side chat-right" aria-label="Состояние и сведения об ИИ">
-          <div class="side-intro"><p class="side-index">02 / ИНФОРМАЦИЯ</p><h2>Канал мышления</h2><p>Домовой видит подтверждённое состояние канала. Если основной ИИ пропал, он остаётся рядом и переходит в аварийный режим.</p></div>
-          <div class="ai-info-card"><span>ЧТО МОЖНО ПЕРЕДАТЬ</span><strong>Описание ИИ</strong><p>Название, назначение, ограничения или заметки о локальной модели. Не вставляйте пароли, токены и ключи.</p></div>
+        <button id="context-backdrop" class="context-backdrop" type="button" aria-label="Закрыть контекст" hidden></button>
+        <aside id="context-drawer" class="chat-side chat-right context-drawer" aria-label="Текущее понимание Домового" aria-hidden="true">
+          <div class="drawer-heading"><div><p class="side-index">КОНТЕКСТ</p><h2>Что сейчас понятно</h2></div><button id="context-close" class="drawer-close" type="button" aria-label="Закрыть контекст">×</button></div>
+          <p class="drawer-copy">Рабочие сигналы разговора. Скрытые рассуждения модели не показываются.</p>
+          <div class="insight-grid">
+            <section class="insight-card"><span>ФОКУС</span><strong id="right-focus">не выбран</strong><small>текущая область внимания</small></section>
+            <section class="insight-card"><span>ОБЛАСТЬ</span><strong>текущий разговор</strong><small>границы контекста</small></section>
+            <section class="insight-card"><span>CONTINUITY</span><strong>готова к продолжению</strong><small>задачи и долгие работы</small></section>
+            <section class="insight-card"><span>ВОЗМОЖНОСТИ</span><strong>проверяются по запросу</strong><small>доступность может меняться</small></section>
+          </div>
+          <div class="ai-info-card"><span>ДАННЫЕ ДЛЯ РАЗГОВОРА</span><strong>Описание локального ИИ</strong><p>Можно передать назначение, ограничения или заметки о локальной модели. Не вставляйте пароли, токены и ключи.</p></div>
           <form id="ai-data-form" class="ai-data-form">
             <label for="ai-data">Данные для текущего разговора</label>
             <textarea id="ai-data" rows="8" maxlength="12000" placeholder="Например: локальная модель нужна для коротких ответов на русском; контекст ограничен; внешняя сеть запрещена."></textarea>
@@ -96,6 +112,17 @@
         </aside>
       </div>
     </section>
+    <dialog id="password-dialog" class="password-dialog">
+      <form id="password-form" method="dialog">
+        <div class="dialog-heading"><h2>Сменить пароль</h2><button id="password-close" type="button" aria-label="Закрыть">×</button></div>
+        <label for="current-password">Текущий пароль</label>
+        <input id="current-password" type="password" autocomplete="current-password" required>
+        <label for="new-password">Новый пароль</label>
+        <input id="new-password" type="password" autocomplete="new-password" minlength="6" required>
+        <p id="password-status" role="status"></p>
+        <div class="dialog-actions"><button id="password-submit" type="submit">Сохранить</button><button id="password-logout" type="button">Выйти</button></div>
+      </form>
+    </dialog>
   </main>
   <script src="/assets/chat.js"></script>
 </body>

cmd/devctl/task_validation.go

@@ -49,6 +49,9 @@ func validateTaskPacket(root string, task TaskPacket, taskPath string) error {
 	if err := validateArchitectureRevision(root, task.ArchitectureRevision); err != nil {
 		return fmt.Errorf("task %s architecture_revision: %w", task.TaskID, err)
 	}
+	if err := validateGenerationTask(task); err != nil {
+		return err
+	}
 	if _, err := resolveBaseCommit(root, task.BaseRepoRevision); err != nil {
 		return fmt.Errorf("task %s base_repo_revision: %w", task.TaskID, err)
 	}
@@ -58,6 +61,24 @@ func validateTaskPacket(root string, task TaskPacket, taskPath string) error {
 	return nil
 }
 
+func validateGenerationTask(task TaskPacket) error {
+	switch {
+	case task.TaskID == "PRE-GEN2-000":
+		if task.BaseRepoRevision != "origin/main" || task.ArchitectureRevision != "ADR-0019" {
+			return fmt.Errorf("task %s must use origin/main and ADR-0019", task.TaskID)
+		}
+	case task.TaskID == "ARCH-GEN2-000":
+		if task.BaseRepoRevision != "gen2-integration" || task.ArchitectureRevision != "ADR-0019" {
+			return fmt.Errorf("task %s must use gen2-integration and ADR-0019", task.TaskID)
+		}
+	case strings.HasPrefix(task.TaskID, "GEN2-"):
+		if task.BaseRepoRevision != "gen2-integration" || task.ArchitectureRevision != "ARCH-GEN2-000" {
+			return fmt.Errorf("task %s must use gen2-integration and ARCH-GEN2-000", task.TaskID)
+		}
+	}
+	return nil
+}
+
 func validateRequiredTests(tests []string) error {
 	joined := strings.Join(tests, "\n")
 	for _, required := range []string{"go test", "go vet", "preflight", "check-diff", "git diff --check", "independent"} {

cmd/devctl/task_validation_test.go

@@ -25,3 +25,42 @@ func TestValidateDeltaRejectsUnknownOrMissingFields(t *testing.T) {
 		t.Fatalf("delta error = %v", err)
 	}
 }
+
+func TestValidateGenerationTaskRequiresGen2BaseAndArchitecture(t *testing.T) {
+	tests := []struct {
+		name string
+		task TaskPacket
+		want string
+	}{
+		{
+			name: "architecture task requires integration base",
+			task: TaskPacket{TaskID: "ARCH-GEN2-000", BaseRepoRevision: "origin/main", ArchitectureRevision: "ADR-0019"},
+			want: "gen2-integration",
+		},
+		{
+			name: "implementation task requires accepted architecture root",
+			task: TaskPacket{TaskID: "GEN2-001", BaseRepoRevision: "gen2-integration", ArchitectureRevision: "ADR-0019"},
+			want: "ARCH-GEN2-000",
+		},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			err := validateGenerationTask(tc.task)
+			if err == nil || !strings.Contains(err.Error(), tc.want) {
+				t.Fatalf("generation validation error = %v, want %q", err, tc.want)
+			}
+		})
+	}
+}
+
+func TestValidateGenerationTaskAcceptsExecutionRoots(t *testing.T) {
+	for _, task := range []TaskPacket{
+		{TaskID: "PRE-GEN2-000", BaseRepoRevision: "origin/main", ArchitectureRevision: "ADR-0019"},
+		{TaskID: "ARCH-GEN2-000", BaseRepoRevision: "gen2-integration", ArchitectureRevision: "ADR-0019"},
+		{TaskID: "GEN2-001", BaseRepoRevision: "gen2-integration", ArchitectureRevision: "ARCH-GEN2-000"},
+	} {
+		if err := validateGenerationTask(task); err != nil {
+			t.Fatalf("validateGenerationTask(%+v) = %v", task, err)
+		}
+	}
+}

cmd/reflection-worker/main.go

@@ -14,6 +14,8 @@ import (
 	platformsecrets "git.cin.su/m/Assistant/platform/secrets"
 )
 
+const epistemicsDBPasswordPath = "/run/secrets/epistemics_db_password"
+
 func main() {
 	workerID := flag.String("worker-id", "reflection-worker-1", "stable worker identity")
 	lease := flag.Duration("lease-ttl", 5*time.Minute, "candidate claim lease")
@@ -21,7 +23,7 @@ func main() {
 	once := flag.Bool("once", false, "run one cycle and exit")
 	flag.Parse()
 	ctx := context.Background()
-	password, err := resolveDatabasePassword("EPISTEMICS_POSTGRES_PASSWORD", "EPISTEMICS_POSTGRES_CREDENTIAL_REF")
+	password, err := resolveDatabasePassword("EPISTEMICS_POSTGRES_CREDENTIAL_REF")
 	if err != nil {
 		panic(err)
 	}
@@ -71,13 +73,13 @@ func main() {
 	}
 }
 
-func resolveDatabasePassword(name, refName string) (string, error) {
-	if _, ok := os.LookupEnv(name); ok {
-		return "", fmt.Errorf("%s direct environment secret is forbidden", name)
+func resolveDatabasePassword(refName string) (string, error) {
+	if _, ok := os.LookupEnv("EPISTEMICS_POSTGRES_PASSWORD"); ok {
+		return "", fmt.Errorf("EPISTEMICS_POSTGRES_PASSWORD direct environment secret is forbidden")
 	}
-	path, ref := os.Getenv(name+"_FILE"), os.Getenv(refName)
-	if path == "" || ref == "" {
-		return "", fmt.Errorf("%s_FILE and %s are required", name, refName)
+	ref := os.Getenv(refName)
+	if ref == "" {
+		return "", fmt.Errorf("%s is required", refName)
 	}
 	root := os.Getenv("SECRET_BACKEND_ROOT")
 	if root == "" {
@@ -87,5 +89,5 @@ func resolveDatabasePassword(name, refName string) (string, error) {
 	if err != nil {
 		return "", err
 	}
-	return resolver.ResolveFile(secretcontracts.SecretFileRef{CredentialRef: secretcontracts.CredentialRef(ref), Purpose: secretcontracts.SecretPurposeDatabasePassword, Consumer: secretcontracts.RuntimeConsumerEpistemicsWorker, Path: path})
+	return resolver.ResolveFile(secretcontracts.SecretFileRef{CredentialRef: secretcontracts.CredentialRef(ref), Purpose: secretcontracts.SecretPurposeDatabasePassword, Consumer: secretcontracts.RuntimeConsumerEpistemicsWorker, Path: epistemicsDBPasswordPath})
 }

cmd/research-runtime/main.go

@@ -19,6 +19,8 @@ import (
 	"git.cin.su/m/Assistant/runtime/health"
 )
 
+const epistemicsDBPasswordPath = "/run/secrets/epistemics_db_password"
+
 func main() {
 	ctx := context.Background()
 	password, err := resolveDatabasePassword()
@@ -140,9 +142,9 @@ func resolveDatabasePassword() (string, error) {
 	if _, ok := os.LookupEnv("EPISTEMICS_POSTGRES_PASSWORD"); ok {
 		return "", fmt.Errorf("EPISTEMICS_POSTGRES_PASSWORD direct environment secret is forbidden")
 	}
-	path, ref := os.Getenv("EPISTEMICS_POSTGRES_PASSWORD_FILE"), os.Getenv("EPISTEMICS_POSTGRES_CREDENTIAL_REF")
-	if path == "" || ref == "" {
-		return "", fmt.Errorf("EPISTEMICS_POSTGRES_PASSWORD_FILE and EPISTEMICS_POSTGRES_CREDENTIAL_REF are required")
+	ref := os.Getenv("EPISTEMICS_POSTGRES_CREDENTIAL_REF")
+	if ref == "" {
+		return "", fmt.Errorf("EPISTEMICS_POSTGRES_CREDENTIAL_REF is required")
 	}
 	root := os.Getenv("SECRET_BACKEND_ROOT")
 	if root == "" {
@@ -152,5 +154,5 @@ func resolveDatabasePassword() (string, error) {
 	if err != nil {
 		return "", err
 	}
-	return resolver.ResolveFile(secretcontracts.SecretFileRef{CredentialRef: secretcontracts.CredentialRef(ref), Purpose: secretcontracts.SecretPurposeDatabasePassword, Consumer: secretcontracts.RuntimeConsumerEpistemicsWorker, Path: path})
+	return resolver.ResolveFile(secretcontracts.SecretFileRef{CredentialRef: secretcontracts.CredentialRef(ref), Purpose: secretcontracts.SecretPurposeDatabasePassword, Consumer: secretcontracts.RuntimeConsumerEpistemicsWorker, Path: epistemicsDBPasswordPath})
 }

cmd/supervisor/main.go

@@ -0,0 +1,311 @@
+package main
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net/http"
+	"net/http/httputil"
+	"net/url"
+	"os"
+	"strings"
+	"time"
+
+	"git.cin.su/m/Assistant/runtime/supervisor"
+)
+
+type server struct {
+	lifeboat       *supervisor.PersistentLifeboat
+	stableUpstream string
+	candidate      string
+	client         *http.Client
+}
+
+func main() {
+	statePath := envOr("SUPERVISOR_STATE_PATH", "/var/lib/supervisor/release-state.json")
+	stable := strings.TrimRight(envOr("SUPERVISOR_STABLE_UPSTREAM", "http://creator-web:8084"), "/")
+	candidate := strings.TrimRight(envOr("SUPERVISOR_CANDIDATE_UPSTREAM", "http://creator-web-candidate:8084"), "/")
+	store, err := supervisor.NewDurableStore(statePath)
+	if err != nil {
+		fatal(err)
+	}
+	lifeboat := supervisor.NewPersistentLifeboat(store)
+	if _, err := lifeboat.Snapshot(); errors.Is(err, os.ErrNotExist) {
+		baseline := supervisor.Release{ID: envOr("SUPERVISOR_BASELINE_RELEASE", "bootstrap"), Version: envOr("SUPERVISOR_BASELINE_RELEASE", "bootstrap")}
+		if ok, startErr := lifeboat.EstablishBaseline(baseline); startErr != nil || !ok {
+			fatal(fmt.Errorf("initialize baseline: %v", startErr))
+		}
+		if ok, observeErr := lifeboat.Record(supervisor.Observation{ReleaseID: baseline.ID, Ready: true, Reason: "supervisor baseline"}); observeErr != nil || !ok {
+			fatal(fmt.Errorf("initialize baseline observation: %v", observeErr))
+		}
+		if ok, trafficErr := lifeboat.SetTraffic(supervisor.TrafficStable, stable, candidate); trafficErr != nil || !ok {
+			fatal(fmt.Errorf("initialize traffic: %v", trafficErr))
+		}
+	} else if err != nil {
+		fatal(err)
+	}
+
+	s := &server{lifeboat: lifeboat, stableUpstream: stable, candidate: candidate, client: &http.Client{Timeout: 30 * time.Second}}
+	public := http.NewServeMux()
+	public.HandleFunc("GET /healthz", s.health)
+	public.HandleFunc("GET /readyz", s.ready)
+	public.HandleFunc("/", s.proxy)
+	control := http.NewServeMux()
+	control.HandleFunc("GET /v1/state", s.state)
+	control.HandleFunc("POST /v1/releases/start", s.start)
+	control.HandleFunc("POST /v1/releases/start-set", s.startSet)
+	control.HandleFunc("POST /v1/releases/baseline", s.baseline)
+	control.HandleFunc("POST /v1/releases/baseline-set", s.baselineSet)
+	control.HandleFunc("POST /v1/releases/observe", s.observe)
+	control.HandleFunc("POST /v1/releases/observe-set", s.observeSet)
+	control.HandleFunc("POST /v1/releases/promote", s.promote)
+	control.HandleFunc("POST /v1/releases/rollback", s.rollback)
+	control.HandleFunc("POST /v1/traffic/canary", s.canary)
+	control.HandleFunc("POST /v1/traffic/promote", s.promoteTraffic)
+	control.HandleFunc("POST /v1/traffic/rollback", s.rollbackTraffic)
+
+	go func() {
+		if err := http.ListenAndServe(envOr("SUPERVISOR_CONTROL_ADDR", ":8095"), control); err != nil {
+			fatal(err)
+		}
+	}()
+	if err := http.ListenAndServe(envOr("LISTEN_ADDR", ":8080"), public); err != nil {
+		fatal(err)
+	}
+}
+
+func (s *server) health(w http.ResponseWriter, _ *http.Request) {
+	writeJSON(w, map[string]string{"runtime": "supervisor", "status": "ok"})
+}
+
+func (s *server) ready(w http.ResponseWriter, r *http.Request) {
+	state, err := s.lifeboat.Snapshot()
+	if err != nil || state.StableUpstream == "" {
+		http.Error(w, "supervisor state unavailable", http.StatusServiceUnavailable)
+		return
+	}
+	if state.StableReleaseSet != nil && !s.checkReleaseSet(r, state.StableReleaseSet) {
+		http.Error(w, "stable release set unavailable", http.StatusServiceUnavailable)
+		return
+	}
+	request, err := http.NewRequestWithContext(r.Context(), http.MethodGet, state.StableUpstream+"/healthz", nil)
+	if err != nil {
+		http.Error(w, "stable upstream unavailable", http.StatusServiceUnavailable)
+		return
+	}
+	response, err := s.client.Do(request)
+	if err != nil || response.StatusCode/100 != 2 {
+		if response != nil {
+			response.Body.Close()
+		}
+		http.Error(w, "stable upstream unavailable", http.StatusServiceUnavailable)
+		return
+	}
+	response.Body.Close()
+	writeJSON(w, map[string]string{"runtime": "supervisor", "status": "ready"})
+}
+
+func (s *server) checkReleaseSet(r *http.Request, releaseSet *supervisor.ReleaseSet) bool {
+	if releaseSet == nil || !releaseSet.Validate() {
+		return false
+	}
+	for _, name := range releaseSet.ComponentNames() {
+		component := releaseSet.Components[name]
+		request, err := http.NewRequestWithContext(r.Context(), http.MethodGet, component.ReadyURL, nil)
+		if err != nil {
+			return false
+		}
+		response, err := s.client.Do(request)
+		if err != nil || response.StatusCode/100 != 2 {
+			if response != nil {
+				response.Body.Close()
+			}
+			return false
+		}
+		response.Body.Close()
+	}
+	return true
+}
+
+func (s *server) proxy(w http.ResponseWriter, r *http.Request) {
+	state, err := s.lifeboat.Snapshot()
+	if err != nil {
+		http.Error(w, "supervisor state unavailable", http.StatusServiceUnavailable)
+		return
+	}
+	target := state.StableUpstream
+	selected := "stable"
+	if state.TrafficMode == supervisor.TrafficCandidate || (state.TrafficMode == supervisor.TrafficCanaryHeader && strings.EqualFold(r.Header.Get("X-Assistant-Canary"), "true")) {
+		target = state.CandidateUpstream
+		selected = "candidate"
+	}
+	parsed, err := url.Parse(target)
+	if err != nil || parsed.Scheme == "" || parsed.Host == "" {
+		http.Error(w, "invalid upstream", http.StatusServiceUnavailable)
+		return
+	}
+	proxy := httputil.NewSingleHostReverseProxy(parsed)
+	proxy.ModifyResponse = func(response *http.Response) error {
+		response.Header.Set("X-Assistant-Traffic-Target", selected)
+		return nil
+	}
+	proxy.ErrorHandler = func(writer http.ResponseWriter, _ *http.Request, _ error) {
+		http.Error(writer, "upstream unavailable", http.StatusBadGateway)
+	}
+	proxy.ServeHTTP(w, r)
+}
+
+func (s *server) state(w http.ResponseWriter, _ *http.Request) {
+	state, err := s.lifeboat.Snapshot()
+	if err != nil {
+		http.Error(w, "state unavailable", 503)
+		return
+	}
+	writeJSON(w, state)
+}
+func (s *server) start(w http.ResponseWriter, r *http.Request) {
+	var release supervisor.Release
+	if !decode(w, r, &release) {
+		return
+	}
+	ok, err := s.lifeboat.Start(release)
+	respond(w, ok, err)
+}
+func (s *server) startSet(w http.ResponseWriter, r *http.Request) {
+	var releaseSet supervisor.ReleaseSet
+	if !decode(w, r, &releaseSet) {
+		return
+	}
+	ok, err := s.lifeboat.StartSet(releaseSet)
+	respond(w, ok, err)
+}
+func (s *server) baseline(w http.ResponseWriter, r *http.Request) {
+	var release supervisor.Release
+	if !decode(w, r, &release) {
+		return
+	}
+	ok, err := s.lifeboat.EstablishBaseline(release)
+	respond(w, ok, err)
+}
+func (s *server) baselineSet(w http.ResponseWriter, r *http.Request) {
+	var releaseSet supervisor.ReleaseSet
+	if !decode(w, r, &releaseSet) {
+		return
+	}
+	ok, err := s.lifeboat.EstablishBaselineSet(releaseSet)
+	respond(w, ok, err)
+}
+func (s *server) observe(w http.ResponseWriter, r *http.Request) {
+	var observation supervisor.Observation
+	if !decode(w, r, &observation) {
+		return
+	}
+	ok, err := s.lifeboat.Record(observation)
+	respond(w, ok, err)
+}
+func (s *server) observeSet(w http.ResponseWriter, r *http.Request) {
+	var observation supervisor.ReleaseSetObservation
+	if !decode(w, r, &observation) {
+		return
+	}
+	ok, err := s.lifeboat.RecordSet(observation)
+	respond(w, ok, err)
+}
+func (s *server) promote(w http.ResponseWriter, _ *http.Request) {
+	state, snapshotErr := s.lifeboat.Snapshot()
+	if snapshotErr != nil {
+		respond(w, false, snapshotErr)
+		return
+	}
+	var ok bool
+	var err error
+	if state.CandidateReleaseSet != nil {
+		ok, err = s.lifeboat.PromoteSet()
+	} else {
+		ok, err = s.lifeboat.Promote()
+	}
+	respond(w, ok, err)
+}
+func (s *server) rollback(w http.ResponseWriter, _ *http.Request) {
+	state, snapshotErr := s.lifeboat.Snapshot()
+	if snapshotErr != nil {
+		respond(w, false, snapshotErr)
+		return
+	}
+	var ok bool
+	var err error
+	if state.CandidateReleaseSet != nil || state.RollbackTargetReleaseSet != nil {
+		ok, err = s.lifeboat.RollbackSet()
+	} else {
+		ok, err = s.lifeboat.Rollback()
+	}
+	respond(w, ok, err)
+}
+func (s *server) canary(w http.ResponseWriter, _ *http.Request) {
+	state, snapshotErr := s.lifeboat.Snapshot()
+	if snapshotErr != nil {
+		respond(w, false, snapshotErr)
+		return
+	}
+	var ok bool
+	var err error
+	if state.CandidateReleaseSet != nil {
+		ok, err = s.lifeboat.SetTrafficForSets(supervisor.TrafficCanaryHeader)
+	} else {
+		ok, err = s.lifeboat.SetTraffic(supervisor.TrafficCanaryHeader, s.stableUpstream, s.candidate)
+	}
+	respond(w, ok, err)
+}
+func (s *server) promoteTraffic(w http.ResponseWriter, _ *http.Request) {
+	ok, err := s.lifeboat.Promote()
+	respond(w, ok, err)
+}
+func (s *server) rollbackTraffic(w http.ResponseWriter, _ *http.Request) {
+	state, snapshotErr := s.lifeboat.Snapshot()
+	if snapshotErr != nil {
+		respond(w, false, snapshotErr)
+		return
+	}
+	// A ReleaseSet must roll back as a whole.  The legacy release-only method
+	// would merely flip the traffic mode while retaining a candidate upstream.
+	var ok bool
+	var err error
+	if state.StableReleaseSet != nil {
+		ok, err = s.lifeboat.RollbackSet()
+	} else {
+		ok, err = s.lifeboat.RollbackTraffic()
+	}
+	respond(w, ok, err)
+}
+
+func decode(w http.ResponseWriter, r *http.Request, value any) bool {
+	decoder := json.NewDecoder(http.MaxBytesReader(w, r.Body, 16<<10))
+	decoder.DisallowUnknownFields()
+	if err := decoder.Decode(value); err != nil {
+		http.Error(w, "invalid control request", 400)
+		return false
+	}
+	return true
+}
+func respond(w http.ResponseWriter, ok bool, err error) {
+	if err != nil {
+		http.Error(w, "control state unavailable", 503)
+		return
+	}
+	if !ok {
+		http.Error(w, "control transition rejected", 409)
+		return
+	}
+	writeJSON(w, map[string]bool{"ok": true})
+}
+func writeJSON(w http.ResponseWriter, value any) {
+	w.Header().Set("Content-Type", "application/json")
+	_ = json.NewEncoder(w).Encode(value)
+}
+func envOr(name, fallback string) string {
+	if value := strings.TrimSpace(os.Getenv(name)); value != "" {
+		return value
+	}
+	return fallback
+}
+func fatal(err error) { fmt.Fprintln(os.Stderr, err); os.Exit(1) }

contracts/artifact/types.go

@@ -5,6 +5,18 @@ import "git.cin.su/m/Assistant/platform/ids"
 import "errors"
 
 type ArtifactID ids.ID
+type MediaArtifact struct {
+	ID                   ArtifactID
+	ContentType          string
+	SizeBytes            int64
+	ContentDigest        string
+	SourceRef            string
+	RecordedAtUnixMillis int64
+}
+
+func (a MediaArtifact) Valid() bool {
+	return a.ID != "" && a.ContentType != "" && a.SizeBytes > 0 && a.ContentDigest != "" && a.SourceRef != "" && a.RecordedAtUnixMillis > 0
+}
 
 type AgentArtifactAttestation struct {
 	ArtifactID          ArtifactID

contracts/capability/intelligence.go

@@ -0,0 +1,56 @@
+package capability
+
+type IntelligencePath string
+
+const (
+	PathRule        IntelligencePath = "RULE"
+	PathReflex      IntelligencePath = "REFLEX"
+	PathSkill       IntelligencePath = "SKILL"
+	PathSmallLocal  IntelligencePath = "SMALL_LOCAL"
+	PathStrongLocal IntelligencePath = "STRONG_LOCAL"
+	PathExternal    IntelligencePath = "EXTERNAL"
+	PathResearch    IntelligencePath = "RESEARCH"
+	PathTeam        IntelligencePath = "TEAM"
+)
+
+type StrategyRequest struct {
+	RequiredQuality   int64
+	PreferLowLatency  bool
+	CostBudgetMicros  int64
+	RiskClass         string
+	FreshnessRequired bool
+	CostOfError       int64
+}
+type StrategyDecision struct {
+	Path     IntelligencePath
+	Reason   string
+	Escalate bool
+}
+
+// StrategyEligibility is supplied by Capability lifecycle resolution. It keeps
+// a requested cheap route from becoming an entitlement to use stale evidence.
+type StrategyEligibility struct {
+	RuleEligible   bool
+	ReflexEligible bool
+	SkillEligible  bool
+}
+
+func (r StrategyRequest) Select() StrategyDecision {
+	return r.SelectEligible(StrategyEligibility{RuleEligible: true, ReflexEligible: true, SkillEligible: true})
+}
+
+func (r StrategyRequest) SelectEligible(eligible StrategyEligibility) StrategyDecision {
+	if r.RiskClass == "HIGH" || r.CostOfError >= 800 {
+		return StrategyDecision{Path: PathStrongLocal, Reason: "high consequence requires deeper reasoning", Escalate: true}
+	}
+	if eligible.RuleEligible && r.RequiredQuality <= 500 && r.CostBudgetMicros > 0 {
+		return StrategyDecision{Path: PathRule, Reason: "bounded low-risk path"}
+	}
+	if eligible.ReflexEligible && r.PreferLowLatency {
+		return StrategyDecision{Path: PathReflex, Reason: "latency preference with later escalation"}
+	}
+	if eligible.SkillEligible {
+		return StrategyDecision{Path: PathSkill, Reason: "validated reusable strategy"}
+	}
+	return StrategyDecision{Path: PathSmallLocal, Reason: "no eligible reflex or skill; escalate to reasoning", Escalate: true}
+}

contracts/capability/multimodal.go

@@ -15,11 +15,15 @@ const (
 )
 
 type MultimodalResponse struct {
-	Operation      MultimodalOperation `json:"operation"`
-	Text           string              `json:"text"`
-	Provider       string              `json:"provider,omitempty"`
-	ObservedAt     int64               `json:"observed_at_unix_millis"`
-	ConfidenceNote string              `json:"confidence_note,omitempty"`
-	ContentType    string              `json:"content_type,omitempty"`
-	DataBase64     string              `json:"data_base64,omitempty"`
+	Operation        MultimodalOperation `json:"operation"`
+	Text             string              `json:"text"`
+	Provider         string              `json:"provider,omitempty"`
+	ObservedAt       int64               `json:"observed_at_unix_millis"`
+	ConfidenceNote   string              `json:"confidence_note,omitempty"`
+	ContentType      string              `json:"content_type,omitempty"`
+	DataBase64       string              `json:"data_base64,omitempty"`
+	Model            string              `json:"model,omitempty"`
+	ModelVersion     string              `json:"model_version,omitempty"`
+	ConfidenceMillis int64               `json:"confidence_millis,omitempty"`
+	EvidenceRef      string              `json:"evidence_ref,omitempty"`
 }

contracts/capability/reflex_v2.go

@@ -0,0 +1,77 @@
+package capability
+
+type ReflexID string
+type ReflexLifecycle string
+type ReflexKind string
+
+const (
+	ReflexCandidate         ReflexLifecycle = "CANDIDATE"
+	ReflexValidating        ReflexLifecycle = "VALIDATING"
+	ReflexActive            ReflexLifecycle = "ACTIVE"
+	ReflexDegraded          ReflexLifecycle = "DEGRADED"
+	ReflexStale             ReflexLifecycle = "STALE"
+	ReflexRevalidating      ReflexLifecycle = "REVALIDATING"
+	ReflexSuspended         ReflexLifecycle = "SUSPENDED"
+	ReflexRetired           ReflexLifecycle = "RETIRED"
+	ReflexDeterministicCode ReflexKind      = "DETERMINISTIC_CODE"
+	ReflexRule              ReflexKind      = "RULE"
+	ReflexWorkflow          ReflexKind      = "WORKFLOW"
+	ReflexQueryTemplate     ReflexKind      = "QUERY_TEMPLATE"
+	ReflexSmallModelChain   ReflexKind      = "SMALL_MODEL_CHAIN"
+	ReflexBoundedAdapter    ReflexKind      = "BOUNDED_ADAPTER_OPERATION"
+)
+
+type ShadowPolicy struct {
+	Enabled                  bool
+	SampleRateMillis         int64
+	ComparatorRef            string
+	MaxShadowCostMicros      *int64
+	EligibleErrorCostClasses []string
+}
+type RevalidationPolicy struct {
+	MaxAgeMillis                         *int64
+	RevalidateOnDependencyRevisionChange bool
+	RevalidateOnWorldVersionChange       bool
+	RevalidateAfterFailureCount          *int64
+	RevalidateAfterCorrectionCount       *int64
+	SampleAuditRateMillis                *int64
+}
+type Reflex struct {
+	ID             ReflexID
+	PrincipalID    string
+	SourceSkillRef SkillID
+	CreatedAt      int64
+}
+type ReflexRevision struct {
+	ReflexID                   ReflexID
+	Revision                   int64
+	SourceSkillRevision        int64
+	Kind                       ReflexKind
+	Applicability              ApplicabilitySpec
+	ImplementationRef          string
+	ImplementationVersion      string
+	ArtifactDigest             string
+	DependencyRefs             []string
+	ValidationEvidenceRefs     []SkillEvidenceRef
+	KnownFailureExperienceRefs []SkillEvidenceRef
+	Shadow                     ShadowPolicy
+	Revalidation               RevalidationPolicy
+	LastValidatedAt            int64
+	Lifecycle                  ReflexLifecycle
+	RecordedAt                 int64
+	SupersedesRevision         int64
+	ExecutionCount             int64
+	FailureCount               int64
+	DivergenceCount            int64
+}
+
+// ShadowComparison is evidence produced by a bounded shadow sample. It is not
+// permission to rewrite a Reflex; SELF/governed evaluation decide next steps.
+type ShadowComparison struct {
+	ReflexID       ReflexID
+	ReflexRevision int64
+	EvidenceRefs   []SkillEvidenceRef
+	VerifierPassed bool
+	Diverged       bool
+	ObservedAt     int64
+}

contracts/capability/resolution.go

@@ -70,6 +70,7 @@ const (
 	SkillCandidate  SkillLifecycleStatus = "CANDIDATE"
 	SkillEvaluating SkillLifecycleStatus = "EVALUATING"
 	SkillValidated  SkillLifecycleStatus = "VALIDATED"
+	SkillActive     SkillLifecycleStatus = "ACTIVE"
 	SkillDegraded   SkillLifecycleStatus = "DEGRADED"
 	SkillSuspended  SkillLifecycleStatus = "SUSPENDED"
 	SkillRetired    SkillLifecycleStatus = "RETIRED"
@@ -202,6 +203,15 @@ type SkillProfile struct {
 	ObservedFailureCount       int64
 	ObservedCorrectionCount    int64
 	RecordedAtUnixMillis       int64
+	// The fields below are the additive Gen2 lifecycle view. The older fields
+	// remain a compatibility projection; they are not another Skill registry.
+	Applicability             ApplicabilitySpec
+	DependencyRefs            []string
+	ValidationEvidenceRefs    []SkillEvidenceRef
+	IndependentEvaluationRefs []SkillEvidenceRef
+	KnownFailureConditions    []string
+	VerifiedOutcomeCount      int64
+	MustNotWorsenSatisfied    bool
 }
 
 type SkillOutcomeObservation struct {

contracts/capability/skill_v2.go

@@ -0,0 +1,36 @@
+package capability
+
+type SkillID string
+type SkillRevision struct {
+	SkillID                       SkillID
+	Revision                      int64
+	Description                   string
+	Applicability                 ApplicabilitySpec
+	ImplementationRef             string
+	ImplementationVersion         string
+	DependencyRefs                []string
+	SupportingExperienceRefs      []SkillEvidenceRef
+	KnownFailureExperienceRefs    []SkillEvidenceRef
+	ValidationEvidenceRefs        []SkillEvidenceRef
+	QualityAssessmentRefs         []string
+	EnvironmentVersionConstraints []string
+	LastValidatedAt               int64
+	Lifecycle                     SkillLifecycleStatus
+	SupersedesRevision            int64
+	RecordedAt                    int64
+}
+type ApplicabilitySpec struct {
+	RequiredContextBindings  []string
+	PreferredContextBindings []string
+	ExcludedContextBindings  []string
+	RequiredWorldKinds       []string
+	VersionConstraints       []string
+	InputConditions          []string
+	MinimumEvidenceFreshness string
+}
+type Skill struct {
+	ID          SkillID
+	PrincipalID string
+	Name        string
+	CreatedAt   int64
+}

contracts/cognitive/context_compiler.go

@@ -11,14 +11,24 @@ import (
 var ErrInvalidContextBudget = errors.New("context budget must be positive")
 
 type ContextCandidate struct {
-	Excerpt   ContextExcerpt
-	Relevance int
+	Excerpt         ContextExcerpt
+	Relevance       int
+	Lane            string
+	ContextScopeRef string
+	FreshnessState  string
+	Negative        bool
 }
 
 type ContextCompileInput struct {
-	Candidates []ContextCandidate
-	DataPolicy capability.DataPolicy
-	MaxBytes   int
+	Candidates           []ContextCandidate
+	DataPolicy           capability.DataPolicy
+	MaxBytes             int
+	TaskRef              string
+	FocusFrameRef        string
+	ContextScopeRef      string
+	FreshnessRequirement string
+	RiskClass            string
+	TokenBudget          int
 }
 
 type ContextOmission struct {
@@ -26,10 +36,77 @@ type ContextOmission struct {
 	Reason string
 }
 
+// ContextInclusion records the bounded compiler decision without exposing
+// source text. It is trace-only metadata and is never user-facing output.
+type ContextInclusion struct {
+	ID     ContextExcerptID
+	Lane   string
+	Reason string
+}
+
 type ContextBundle struct {
 	Excerpts  []ContextExcerpt
 	Omissions []ContextOmission
 	Bytes     int
+	Trace     ContextAssemblyTrace
+}
+
+type ContextAssemblyTrace struct {
+	Included        []ContextExcerptID
+	Inclusions      []ContextInclusion
+	Excluded        []ContextOmission
+	Coverage        string
+	CompilerVersion string
+}
+
+type IterativeRetrievalLane string
+
+const (
+	IterativeRetrievalCurrentFact        IterativeRetrievalLane = "CURRENT_FACT"
+	IterativeRetrievalPositiveExperience IterativeRetrievalLane = "POSITIVE_EXPERIENCE"
+	IterativeRetrievalNegativeExperience IterativeRetrievalLane = "NEGATIVE_EXPERIENCE"
+	IterativeRetrievalContradiction      IterativeRetrievalLane = "CONTRADICTION"
+	IterativeRetrievalHistoricalAnalogy  IterativeRetrievalLane = "HISTORICAL_ANALOGY"
+)
+
+// IterativeRetrievalRequest is the model-visible, storage-agnostic intent.
+// Principal, Scope, Focus and policy are deliberately absent: Core binds them
+// from the already-authorized request and never accepts them from a model.
+type IterativeRetrievalRequest struct {
+	Query           string
+	SemanticSubject string
+	Lane            IterativeRetrievalLane
+	Reason          string
+	RemainingBytes  int
+	Pass            int
+}
+
+// IterativeRetrievalBudget is a Core-enforced per-request budget.
+type IterativeRetrievalBudget struct {
+	MaxRounds        int
+	MaxFragments     int
+	MaxAddedBytes    int
+	MaxLatencyMillis int64
+}
+
+// IterativeRetrievalEnvelope is the trusted continuation input assembled by
+// Core. It is never produced by a provider or model adapter.
+type IterativeRetrievalEnvelope struct {
+	Request              IterativeRetrievalRequest
+	PrincipalID          string
+	ContextScopeRef      string
+	FocusFrameRef        string
+	TaskRef              string
+	FreshnessRequirement string
+	DataPolicy           capability.DataPolicy
+	Budget               IterativeRetrievalBudget
+	SeenExcerptIDs       []ContextExcerptID
+}
+type IterativeRetrievalResponse struct {
+	Candidates []ContextCandidate
+	Exhausted  bool
+	Reason     string
+	AddedBytes int
 }
 
 // CompileContext deterministically selects permitted, relevant excerpts for a
@@ -39,14 +116,9 @@ func CompileContext(input ContextCompileInput) (ContextBundle, error) {
 		return ContextBundle{}, ErrInvalidContextBudget
 	}
 	candidates := append([]ContextCandidate(nil), input.Candidates...)
-	sort.SliceStable(candidates, func(i, j int) bool {
-		if candidates[i].Relevance != candidates[j].Relevance {
-			return candidates[i].Relevance > candidates[j].Relevance
-		}
-		return string(candidates[i].Excerpt.ID) < string(candidates[j].Excerpt.ID)
-	})
 	bundle := ContextBundle{Excerpts: []ContextExcerpt{}, Omissions: []ContextOmission{}}
 	seen := make(map[ContextExcerptID]struct{}, len(candidates))
+	eligible := make([]ContextCandidate, 0, len(candidates))
 	for _, candidate := range candidates {
 		excerpt := candidate.Excerpt
 		if _, ok := seen[excerpt.ID]; ok {
@@ -54,8 +126,11 @@ func CompileContext(input ContextCompileInput) (ContextBundle, error) {
 			continue
 		}
 		seen[excerpt.ID] = struct{}{}
-		reason := permittedContextReason(excerpt, input.DataPolicy)
-		if reason != "" {
+		if input.ContextScopeRef != "" && candidate.ContextScopeRef != input.ContextScopeRef {
+			bundle.Omissions = append(bundle.Omissions, ContextOmission{ID: excerpt.ID, Reason: "context_scope"})
+			continue
+		}
+		if reason := permittedContextReason(excerpt, input.DataPolicy); reason != "" {
 			bundle.Omissions = append(bundle.Omissions, ContextOmission{ID: excerpt.ID, Reason: reason})
 			continue
 		}
@@ -63,14 +138,49 @@ func CompileContext(input ContextCompileInput) (ContextBundle, error) {
 			bundle.Omissions = append(bundle.Omissions, ContextOmission{ID: excerpt.ID, Reason: "empty"})
 			continue
 		}
+		eligible = append(eligible, candidate)
+	}
+	candidates = eligible
+	sort.SliceStable(candidates, func(i, j int) bool {
+		if candidates[i].Relevance != candidates[j].Relevance {
+			return candidates[i].Relevance > candidates[j].Relevance
+		}
+		return string(candidates[i].Excerpt.ID) < string(candidates[j].Excerpt.ID)
+	})
+	included := make(map[ContextExcerptID]struct{}, len(candidates))
+	include := func(candidate ContextCandidate, reason string) bool {
+		excerpt := candidate.Excerpt
 		bytes := len([]byte(excerpt.Text))
 		if bundle.Bytes+bytes > input.MaxBytes {
-			bundle.Omissions = append(bundle.Omissions, ContextOmission{ID: excerpt.ID, Reason: "budget"})
-			continue
+			return false
 		}
 		bundle.Excerpts = append(bundle.Excerpts, excerpt)
 		bundle.Bytes += bytes
+		bundle.Trace.Included = append(bundle.Trace.Included, excerpt.ID)
+		bundle.Trace.Inclusions = append(bundle.Trace.Inclusions, ContextInclusion{ID: excerpt.ID, Lane: candidate.Lane, Reason: reason})
+		included[excerpt.ID] = struct{}{}
+		return true
 	}
+	// Preserve one candidate from each semantic lane before filling by score so
+	// many similar current facts cannot erase a relevant failure or conflict.
+	for _, lane := range []string{"current-fact", "positive-experience", "negative-experience", "contradiction", "historical-analogy", "interaction"} {
+		for _, candidate := range candidates {
+			if candidate.Lane == lane && include(candidate, "lane_coverage") {
+				break
+			}
+		}
+	}
+	for _, candidate := range candidates {
+		if _, ok := included[candidate.Excerpt.ID]; ok {
+			continue
+		}
+		if !include(candidate, "salience") {
+			bundle.Omissions = append(bundle.Omissions, ContextOmission{ID: candidate.Excerpt.ID, Reason: "budget"})
+		}
+	}
+	bundle.Trace.Excluded = append([]ContextOmission(nil), bundle.Omissions...)
+	bundle.Trace.CompilerVersion = "context-compiler-v2-additive"
+	bundle.Trace.Coverage = "BOUNDED"
 	return bundle, nil
 }
 

contracts/cognitive/context_compiler_v2_test.go

@@ -0,0 +1,30 @@
+package cognitive_test
+
+import (
+	"git.cin.su/m/Assistant/contracts/capability"
+	"git.cin.su/m/Assistant/contracts/cognitive"
+	"testing"
+)
+
+func TestContextCompilerV2TraceAndBudgetRemainDeterministic(t *testing.T) {
+	b, err := cognitive.CompileContext(cognitive.ContextCompileInput{MaxBytes: 5, DataPolicy: capability.DataPolicyLocalOnly, TaskRef: "task", FocusFrameRef: "frame", ContextScopeRef: "company-a", Candidates: []cognitive.ContextCandidate{{Excerpt: cognitive.ContextExcerpt{ID: "a", Text: "123", Sensitivity: cognitive.SensitivityPrivateAllowed}, ContextScopeRef: "company-a", Relevance: 10}, {Excerpt: cognitive.ContextExcerpt{ID: "b", Text: "123456", Sensitivity: cognitive.SensitivityPrivateAllowed}, ContextScopeRef: "company-b", Relevance: 100}}})
+	if err != nil || len(b.Excerpts) != 1 || len(b.Trace.Excluded) != 1 {
+		t.Fatalf("bundle=%#v err=%v", b, err)
+	}
+}
+
+func TestContextCompilerPreservesNegativeLaneWithinBoundedBudget(t *testing.T) {
+	b, err := cognitive.CompileContext(cognitive.ContextCompileInput{MaxBytes: 27, DataPolicy: capability.DataPolicyLocalOnly, Candidates: []cognitive.ContextCandidate{
+		{Excerpt: cognitive.ContextExcerpt{ID: "current", Text: "current-value", Sensitivity: cognitive.SensitivityPrivateAllowed}, Lane: "current-fact", Relevance: 100},
+		{Excerpt: cognitive.ContextExcerpt{ID: "failure", Text: "known-failure", Sensitivity: cognitive.SensitivityPrivateAllowed}, Lane: "negative-experience", Relevance: 1, Negative: true},
+		{Excerpt: cognitive.ContextExcerpt{ID: "crowd", Text: "similar-current", Sensitivity: cognitive.SensitivityPrivateAllowed}, Lane: "current-fact", Relevance: 99},
+	}})
+	if err != nil || len(b.Excerpts) != 2 || b.Excerpts[0].ID != "current" || b.Excerpts[1].ID != "failure" {
+		t.Fatalf("bundle=%#v err=%v", b, err)
+	}
+	// The negative record fits and is retained before a lower-value crowd of
+	// similar facts can consume the remaining bounded budget.
+	if len(b.Trace.Inclusions) != 2 || b.Trace.Inclusions[0].Reason != "lane_coverage" || b.Trace.Inclusions[1].Reason != "lane_coverage" {
+		t.Fatalf("trace=%#v", b.Trace)
+	}
+}

contracts/cognitive/types.go

@@ -69,18 +69,19 @@ type AdvisoryRequest struct {
 // GatewayAdvisoryRequest describes the task and policy requirement. It cannot
 // name a provider, model or binding; Capability owns that selection.
 type GatewayAdvisoryRequest struct {
-	Version            ContractVersion
-	RequestID          RequestID
-	ActorID            identity.ActorID
-	PrincipalID        identity.PrincipalID
-	ScopeID            authority.ScopeID
-	Message            string
-	Context            []ContextExcerpt
-	Locale             string
-	MaxOutputBytes     int
-	DataPolicy         capability.DataPolicy
-	EgressAcknowledged bool
-	Meaning            TaskMeaning
+	Version                 ContractVersion
+	RequestID               RequestID
+	ActorID                 identity.ActorID
+	PrincipalID             identity.PrincipalID
+	ScopeID                 authority.ScopeID
+	Message                 string
+	Context                 []ContextExcerpt
+	Locale                  string
+	MaxOutputBytes          int
+	DataPolicy              capability.DataPolicy
+	EgressAcknowledged      bool
+	AllowIterativeRetrieval bool
+	Meaning                 TaskMeaning
 }
 
 // TaskMeaning is the trusted semantic summary produced by Core. It is not a
@@ -177,4 +178,5 @@ type GatewayAdvisoryResponse struct {
 	ReferencedExcerptIDs []ContextExcerptID
 	FinishReason         FinishReason
 	Usage                *ProviderUsage
+	IterativeRetrieval   *IterativeRetrievalRequest
 }

contracts/commit/execution_receipt.go

@@ -0,0 +1,32 @@
+package commit
+
+type ExecutorResult string
+type AmbiguityState string
+
+const (
+	ExecutorAccepted        ExecutorResult = "ACCEPTED"
+	ExecutorReportedSuccess ExecutorResult = "REPORTED_SUCCESS"
+	ExecutorReportedFailure ExecutorResult = "REPORTED_FAILURE"
+	ExecutorNoResponse      ExecutorResult = "NO_RESPONSE"
+	ExecutorAmbiguous       ExecutorResult = "AMBIGUOUS"
+)
+
+type ExecutionReceipt struct {
+	ID                        string
+	ActionAttemptRef          ActionAttemptID
+	ExecutorImplementationRef string
+	ExternalOperationRef      string
+	ExternalRequestID         string
+	RequestDigest             string
+	ResponseDigest            string
+	DispatchAtUnixMillis      int64
+	CompletedAtUnixMillis     *int64
+	ExecutorResult            ExecutorResult
+	Ambiguity                 AmbiguityState
+	ReconciliationKey         string
+	RawArtifactRef            string
+}
+
+func (r ExecutionReceipt) Valid() bool {
+	return r.ID != "" && r.ActionAttemptRef != "" && r.ExecutorImplementationRef != "" && r.RequestDigest != "" && r.ExecutorResult != "" && r.ReconciliationKey != "" && r.DispatchAtUnixMillis > 0
+}

contracts/configuration/README.md

@@ -0,0 +1,7 @@
+# Configuration contract boundary
+
+Configuration owns typed and versioned `SettingDefinition` and
+`SettingAssignment` records plus scoped resolution and change provenance.
+Effective configuration is a derived result. Secret values never enter a
+setting assignment; only a `SecretRef`/`CredentialRef` crosses the secrets
+boundary into an authorized adapter or runtime.

contracts/configuration/primitives.go

@@ -0,0 +1,7 @@
+package configuration
+
+import "git.cin.su/m/Assistant/platform/ids"
+
+// SemanticReference is a typed cross-owner reference; settings remain
+// Configuration-owned records.
+type SemanticReference = ids.SemanticRef

contracts/configuration/types.go

@@ -0,0 +1,101 @@
+package configuration
+
+import (
+	"fmt"
+	"git.cin.su/m/Assistant/contracts/secrets"
+	"git.cin.su/m/Assistant/platform/ids"
+)
+
+type SettingDefinitionID ids.StableID
+type SettingAssignmentID ids.StableID
+type ConfigurationRevision ids.Revision
+type ValueType string
+type ResolutionMode string
+type SettingLifecycle string
+type SettingSource string
+
+const (
+	ValueString            ValueType        = "STRING"
+	ValueInteger           ValueType        = "INTEGER"
+	ValueBoolean           ValueType        = "BOOLEAN"
+	ValueSecretRef         ValueType        = "SECRET_REF"
+	ResolutionMostSpecific ResolutionMode   = "MOST_SPECIFIC_WINS"
+	ResolutionFirstHuman   ResolutionMode   = "FIRST_EXPLICIT_HUMAN_WINS"
+	ResolutionMergeList    ResolutionMode   = "MERGE_LIST"
+	SettingActive          SettingLifecycle = "ACTIVE"
+	SettingDeprecated      SettingLifecycle = "DEPRECATED"
+	SettingRetired         SettingLifecycle = "RETIRED"
+	SourceHumanDirective   SettingSource    = "HUMAN_DIRECTIVE"
+	SourceMigrated         SettingSource    = "MIGRATED_CONFIG"
+	SourceSkillDefault     SettingSource    = "SKILL_DEFAULT"
+	SourceSystemDefault    SettingSource    = "SYSTEM_DEFAULT"
+	SourceGovernedChange   SettingSource    = "GOVERNED_CHANGE"
+)
+
+type SettingDefinition struct {
+	ID                   SettingDefinitionID
+	OwnerNamespace       string
+	StableKey            string
+	Revision             ConfigurationRevision
+	ValueType            ValueType
+	DefaultValue         string
+	Sensitivity          string
+	Lifecycle            SettingLifecycle
+	RecordedAtUnixMillis int64
+}
+type ScopeSelector struct {
+	PrincipalRef            string
+	RequiredContextBindings []string
+	ActivityRef             string
+	SkillRef                string
+	TaskRef                 string
+	SessionRef              string
+	TemporaryOverride       bool
+}
+type SettingAssignment struct {
+	ID                       SettingAssignmentID
+	PrincipalID              string
+	DefinitionRef            string
+	DefinitionRevision       ConfigurationRevision
+	Revision                 ConfigurationRevision
+	Selector                 ScopeSelector
+	TypedValue               string
+	SecretRef                *secrets.CredentialRef
+	EffectiveFromUnixMillis  int64
+	EffectiveUntilUnixMillis *int64
+	Source                   SettingSource
+	SourceRef                string
+	Lifecycle                SettingLifecycle
+	RecordedAtUnixMillis     int64
+}
+type EffectiveSetting struct {
+	DefinitionRef        string
+	Value                string
+	WinningAssignmentRef string
+	ResolutionTrace      []string
+}
+type BootstrapConfig struct {
+	NodeIdentity              string
+	ControlDatabaseLocator    string
+	RootSecretResolverLocator string
+	RecoveryLocator           string
+}
+
+// ConversationalConfigurationCommand is an intent, not an assignment. Only
+// Configuration may turn a SET command into durable state.
+
+func (d SettingDefinition) Validate() error {
+	if d.ID == "" || d.OwnerNamespace == "" || d.StableKey == "" || !ids.Revision(d.Revision).Valid() || d.ValueType == "" || d.Lifecycle == "" || d.RecordedAtUnixMillis < 1 {
+		return fmt.Errorf("invalid setting definition")
+	}
+	return nil
+}
+func (a SettingAssignment) Validate() error {
+	if a.ID == "" || a.PrincipalID == "" || a.DefinitionRef == "" || !ids.Revision(a.Revision).Valid() || a.Source == "" || a.Lifecycle == "" || a.RecordedAtUnixMillis < 1 {
+		return fmt.Errorf("invalid setting assignment")
+	}
+	if a.SecretRef != nil && a.TypedValue != "" {
+		return fmt.Errorf("secret assignment must not contain typed value")
+	}
+	return nil
+}

contracts/epistemics/freshness.go

@@ -0,0 +1,108 @@
+package epistemics
+
+import (
+	"fmt"
+	"git.cin.su/m/Assistant/contracts/world"
+)
+
+type VolatilityMode string
+
+const (
+	VolatilityImmutable    VolatilityMode = "IMMUTABLE"
+	VolatilityVersionBound VolatilityMode = "VERSION_BOUND"
+	VolatilityVerySlow     VolatilityMode = "VERY_SLOW"
+	VolatilitySlow         VolatilityMode = "SLOW"
+	VolatilityMedium       VolatilityMode = "MEDIUM"
+	VolatilityFast         VolatilityMode = "FAST"
+	VolatilityEphemeral    VolatilityMode = "EPHEMERAL"
+	VolatilityCustom       VolatilityMode = "CUSTOM"
+)
+
+type TemporalApplicability struct {
+	ObservedAtUnixMillis     int64
+	ValidFromUnixMillis      *int64
+	ValidUntilUnixMillis     *int64
+	LastVerifiedAtUnixMillis *int64
+	Volatility               VolatilitySpec
+	VersionBindings          []world.VersionBinding
+}
+type VolatilitySpec struct {
+	Mode                         VolatilityMode
+	ExpectedChangeIntervalMillis *int64
+	RevalidateAfterMillis        *int64
+	HardStaleAfterMillis         *int64
+	InvalidateOnVersionChange    bool
+	RevalidationPolicyRef        string
+}
+type FreshnessAssessmentState string
+
+const (
+	FreshnessAssessmentCurrent         FreshnessAssessmentState = "CURRENT"
+	FreshnessAssessmentAcceptable      FreshnessAssessmentState = "ACCEPTABLE"
+	FreshnessAssessmentAging           FreshnessAssessmentState = "AGING"
+	FreshnessAssessmentStale           FreshnessAssessmentState = "STALE"
+	FreshnessAssessmentVersionMismatch FreshnessAssessmentState = "VERSION_MISMATCH"
+	FreshnessAssessmentHistoricalOnly  FreshnessAssessmentState = "HISTORICAL_ONLY"
+	FreshnessAssessmentUnknown         FreshnessAssessmentState = "UNKNOWN"
+)
+
+type FreshnessAssessment struct {
+	SourceKnowledgeRef     string
+	TaskRef                string
+	State                  FreshnessAssessmentState
+	Reason                 string
+	AgeMillis              int64
+	VersionMatchState      string
+	RevalidationAttemptRef string
+	AssessedAtUnixMillis   int64
+}
+
+// FreshnessRequirement is supplied by the current task/focus owner. It is an
+// evaluation input, not Epistemics-owned task state, so freshness remains
+// relative to the decision being made.
+type FreshnessRequirement struct {
+	Mode                string
+	MaximumAgeMillis    *int64
+	RequiredVersionRefs []SemanticReference
+}
+
+// WithExactVersionBinding is a typed contract helper for callers that need to
+// attach an exact environment/version applicability constraint without taking
+// a direct dependency on the World package.
+func WithExactVersionBinding(value TemporalApplicability, subject, version SemanticReference) TemporalApplicability {
+	value.VersionBindings = append(value.VersionBindings, world.VersionBinding{SubjectRef: subject, VersionRef: version, MatchMode: world.VersionExact})
+	return value
+}
+
+type RevalidationRequest struct {
+	ID                    string
+	SourceKnowledgeRef    string
+	TaskRef               string
+	RequiredVersionRefs   []world.SemanticReference
+	RequestedAtUnixMillis int64
+}
+type RevalidationResponse struct {
+	RequestID             string
+	Assessment            FreshnessAssessment
+	NewEvidenceRefs       []EvidenceRef
+	CompletedAtUnixMillis int64
+}
+
+func (v VolatilitySpec) Validate() error {
+	if v.Mode == "" {
+		return fmt.Errorf("volatility mode is required")
+	}
+	return nil
+}
+func (t TemporalApplicability) Validate() error {
+	if t.ObservedAtUnixMillis < 1 {
+		return fmt.Errorf("observed time is required")
+	}
+	return t.Volatility.Validate()
+}
+func (a FreshnessAssessment) Validate() error {
+	if a.SourceKnowledgeRef == "" || a.TaskRef == "" || a.State == "" || a.AgeMillis < 0 || a.AssessedAtUnixMillis < 1 {
+		return fmt.Errorf("freshness assessment is incomplete")
+	}
+	return nil
+}

contracts/epistemics/outcome.go

@@ -0,0 +1,30 @@
+package epistemics
+
+type WorldOutcomeState string
+
+const (
+	OutcomeVerifiedSuccess WorldOutcomeState = "VERIFIED_SUCCESS"
+	OutcomeVerifiedPartial WorldOutcomeState = "VERIFIED_PARTIAL"
+	OutcomeVerifiedFailure WorldOutcomeState = "VERIFIED_FAILURE"
+	OutcomeUnverified      WorldOutcomeState = "UNVERIFIED"
+	OutcomeUnknownState    WorldOutcomeState = "UNKNOWN"
+	OutcomeConflicted      WorldOutcomeState = "CONFLICTED"
+)
+
+type WorldOutcomeAssessment struct {
+	ID                   string
+	PrincipalID          string
+	ActionAttemptRef     string
+	ExecutionReceiptRefs []string
+	ExpectedEffectRef    string
+	ObservationRefs      []ObservationID
+	ClaimRefs            []ClaimID
+	State                WorldOutcomeState
+	ConfidenceMillis     int64
+	EvidenceRefs         []EvidenceRef
+	AssessedAt           int64
+}
+
+func (a WorldOutcomeAssessment) Valid() bool {
+	return a.ID != "" && a.PrincipalID != "" && a.ActionAttemptRef != "" && a.State != "" && a.ConfidenceMillis >= 0 && a.ConfidenceMillis <= 1000 && a.AssessedAt > 0
+}

contracts/epistemics/primitives.go

@@ -0,0 +1,7 @@
+package epistemics
+
+import "git.cin.su/m/Assistant/platform/ids"
+
+// SemanticReference identifies evidence-related records without transferring
+// canonical ownership to Epistemics.
+type SemanticReference = ids.SemanticRef

contracts/epistemics/research.go

@@ -17,23 +17,27 @@ type CoverageState string
 type ConflictState string
 type EvidenceKind string
 type ResearchFindingState string
+type ReliabilityState string
 
 const (
-	FreshnessCurrent  FreshnessState       = "CURRENT"
-	FreshnessStale    FreshnessState       = "STALE"
-	FreshnessUnknown  FreshnessState       = "UNKNOWN"
-	CoverageComplete  CoverageState        = "COMPLETE"
-	CoveragePartial   CoverageState        = "PARTIAL"
-	CoverageUnknown   CoverageState        = "UNKNOWN"
-	ConflictNone      ConflictState        = "NONE"
-	ConflictPresent   ConflictState        = "PRESENT"
-	ConflictUnknown   ConflictState        = "UNKNOWN"
-	EvidenceObserved  EvidenceKind         = "OBSERVED"
-	EvidenceAssumed   EvidenceKind         = "ASSUMED"
-	FindingSupported  ResearchFindingState = "SUPPORTED"
-	FindingStale      ResearchFindingState = "STALE"
-	FindingConflicted ResearchFindingState = "CONFLICTED"
-	FindingUnknown    ResearchFindingState = "UNKNOWN"
+	FreshnessCurrent   FreshnessState       = "CURRENT"
+	FreshnessStale     FreshnessState       = "STALE"
+	FreshnessUnknown   FreshnessState       = "UNKNOWN"
+	CoverageComplete   CoverageState        = "COMPLETE"
+	CoveragePartial    CoverageState        = "PARTIAL"
+	CoverageUnknown    CoverageState        = "UNKNOWN"
+	ConflictNone       ConflictState        = "NONE"
+	ConflictPresent    ConflictState        = "PRESENT"
+	ConflictUnknown    ConflictState        = "UNKNOWN"
+	EvidenceObserved   EvidenceKind         = "OBSERVED"
+	EvidenceAssumed    EvidenceKind         = "ASSUMED"
+	FindingSupported   ResearchFindingState = "SUPPORTED"
+	FindingStale       ResearchFindingState = "STALE"
+	FindingConflicted  ResearchFindingState = "CONFLICTED"
+	FindingUnknown     ResearchFindingState = "UNKNOWN"
+	ReliabilityCurrent ReliabilityState     = "CURRENT"
+	ReliabilityAging   ReliabilityState     = "AGING"
+	ReliabilityUnknown ReliabilityState     = "UNKNOWN"
 )
 
 type ResearchPlan struct {
@@ -52,6 +56,21 @@ type Source struct {
 	Publisher string
 }
 
+type SourceReliabilityAssessment struct {
+	SourceRef              string
+	DomainRef              string
+	Freshness              FreshnessState
+	HistoryScoreMillis     int64
+	ReliabilityScoreMillis int64
+	State                  ReliabilityState
+	EvidenceRefs           []string
+	AssessedAtUnixMillis   int64
+}
+
+func (a SourceReliabilityAssessment) Valid() bool {
+	return a.SourceRef != "" && a.DomainRef != "" && a.Freshness != "" && a.HistoryScoreMillis >= 0 && a.HistoryScoreMillis <= 1000 && a.ReliabilityScoreMillis >= 0 && a.ReliabilityScoreMillis <= 1000 && a.State != "" && a.AssessedAtUnixMillis > 0
+}
+
 type SourceSnapshot struct {
 	ID                   SourceSnapshotID
 	SourceID             SourceID

contracts/epistemics/truth.go

@@ -1,5 +1,7 @@
 package epistemics
 
+import "git.cin.su/m/Assistant/platform/ids"
+
 type BeliefState string
 
 const (
@@ -9,19 +11,27 @@ const (
 )
 
 type Observation struct {
-	ID             ObservationID
-	SourceSnapshot SourceSnapshotID
-	Excerpt        SourceExcerptID
-	Text           string
-	ObservedAt     int64
+	ID              ObservationID
+	SourceSnapshot  SourceSnapshotID
+	Excerpt         SourceExcerptID
+	Text            string
+	ObservedAt      int64
+	PrincipalID     string
+	ContextScopeRef string
+	ObservationKind string
+	Payload         string
+	ExtractorRef    string
 }
 
 type Claim struct {
-	ID            ClaimID
-	Statement     string
-	ObservationID ObservationID
-	CitationID    CitationID
-	Verification  VerificationState
+	ID                   ClaimID
+	Statement            string
+	ObservationID        ObservationID
+	CitationID           CitationID
+	Verification         VerificationState
+	PropositionID        ids.ID
+	RevisedFrom          *ClaimID
+	RecordedAtUnixMillis int64
 }
 
 type Belief struct {

contracts/epistemics/types.go

@@ -24,6 +24,8 @@ type HelpMethodKind string
 type OutcomeClass string
 type ReflectionTriggerKind string
 type ReflectionCandidateState string
+type PropositionKind string
+type BeliefAssessmentState string
 
 const (
 	VerificationUnverified    VerificationState = "UNVERIFIED"
@@ -73,6 +75,12 @@ const (
 	ReflectionCandidateEvaluating ReflectionCandidateState = "EVALUATING"
 	ReflectionCandidateSuperseded ReflectionCandidateState = "SUPERSEDED"
 	ReflectionCandidateResolved   ReflectionCandidateState = "RESOLVED"
+	PropositionWorldFacet         PropositionKind          = "WORLD_FACET"
+	PropositionWorldRelation      PropositionKind          = "WORLD_RELATION"
+	PropositionOwnerDefined       PropositionKind          = "OWNER_DEFINED"
+	PropositionTextual            PropositionKind          = "TEXTUAL"
+	BeliefAssessmentCurrent       BeliefAssessmentState    = "CURRENT"
+	BeliefAssessmentSuperseded    BeliefAssessmentState    = "SUPERSEDED"
 )
 
 // SystemExpectation records what Domovoy expected a meaningful help path to
@@ -94,6 +102,7 @@ type SystemExpectation struct {
 // state or grants authority.
 type ExperienceRecord struct {
 	ID                            ExperienceRecordID
+	PrincipalID                   string
 	SourceKind                    ExperienceSourceKind
 	OriginalIntentID              OriginalIntentRef
 	SourceUtteranceID             SourceUtteranceRef
@@ -114,6 +123,24 @@ type ExperienceRecord struct {
 	VerificationEvidence          []EvidenceRef
 	ConfidenceMillis              int64
 	RecordedAtUnixMillis          int64
+	ProblemStatement              string
+	AttemptRef                    string
+	WhyAttempted                  string
+	ApplicabilityConditions       []string
+	ContextScopeRef               string
+	EpisodeRef                    string
+	GoalRef                       string
+	TaskRef                       string
+	WhySucceededOrFailed          string
+}
+
+// ConsolidationCandidate is a rebuildable Epistemics projection. It preserves
+// source ExperienceRecord references and cannot activate a Skill by itself.
+type ConsolidationCandidate struct {
+	EpisodeRef      string
+	ExperienceRefs  []ExperienceRecordID
+	PropositionText string
+	SkillCandidate  bool
 }
 
 // ReflectionCandidate records that broader reflection may be warranted.
@@ -134,3 +161,34 @@ type ReflectionCandidate struct {
 	ClaimedBy                string
 	ClaimExpiresAtUnixMillis int64
 }
+
+type Proposition struct {
+	ID           ids.ID
+	Kind         PropositionKind
+	SubjectRef   string
+	PredicateRef string
+	ObjectValue  string
+	ObjectRef    string
+	Qualifiers   []string
+	TextFallback string
+}
+
+type BeliefAssessment struct {
+	ID                   ids.ID
+	ClaimID              ClaimID
+	Revision             ids.Revision
+	State                BeliefAssessmentState
+	ConfidenceMillis     int64
+	EvidenceRefs         []EvidenceRef
+	AssessedAtUnixMillis int64
+}
+
+type EpisodeID ids.ID
+type Episode struct {
+	ID                   EpisodeID
+	PrincipalID          string
+	ExperienceRefs       []ExperienceRecordID
+	Summary              string
+	Outcome              OutcomeClass
+	RecordedAtUnixMillis int64
+}

contracts/identity/session.go

@@ -5,6 +5,14 @@ type CreatorCredentials struct {
 	Password string `json:"password"`
 }
 
+type CreatorAccount struct {
+	Username     string
+	ActorID      ActorID
+	PrincipalID  PrincipalID
+	PasswordHash string
+	Revision     int64
+}
+
 type CreatorSession struct {
 	ActorID       ActorID
 	PrincipalID   PrincipalID

contracts/identity/types.go

@@ -6,6 +6,30 @@ type ActorID ids.ID
 type PrincipalID ids.ID
 type IdentityID ids.ID
 
+type DataRealmKind string
+
+const (
+	DataRealmPersonal DataRealmKind = "PERSONAL"
+	DataRealmShared   DataRealmKind = "SHARED"
+	DataRealmPublic   DataRealmKind = "PUBLIC"
+)
+
+// PrincipalDataRealm is an identity-owned access boundary. It does not make
+// a speaker or World person referent an authenticated principal.
+type PrincipalDataRealm struct {
+	ID                   string
+	OwnerPrincipalID     PrincipalID
+	Kind                 DataRealmKind
+	MemberPrincipalIDs   []PrincipalID
+	Shared               bool
+	Revision             int64
+	RecordedAtUnixMillis int64
+}
+
+func (r PrincipalDataRealm) Valid() bool {
+	return r.ID != "" && r.OwnerPrincipalID != "" && (r.Kind == DataRealmPersonal || r.Kind == DataRealmShared || r.Kind == DataRealmPublic) && r.Revision > 0 && r.RecordedAtUnixMillis > 0 && (r.Kind != DataRealmShared || r.Shared)
+}
+
 // PrincipalBinding keeps the operational actor separate from the interest on
 // whose behalf it acts. A Creator is not exempt from this distinction.
 type PrincipalBinding struct {

contracts/interaction/types.go

@@ -25,6 +25,44 @@ type SemanticApplicability string
 type SemanticCandidateSource string
 type SemanticCandidateSelectionState string
 type InformationRequestKind string
+type ConfigurationCommandKind string
+type SpeakerAttribution struct {
+	SourceRef          string
+	PrincipalCandidate string
+	ConfidenceMillis   int64
+	Authenticated      bool
+	ObservationRef     string
+}
+type IngressModality string
+
+const (
+	IngressText   IngressModality = "TEXT"
+	IngressAudio  IngressModality = "AUDIO"
+	IngressImage  IngressModality = "IMAGE"
+	IngressVideo  IngressModality = "VIDEO"
+	IngressDevice IngressModality = "DEVICE"
+)
+
+type IngressEnvelope struct {
+	ID                   string
+	Modality             IngressModality
+	SourceRef            string
+	DeviceRef            string
+	LocationRef          string
+	PrincipalID          string
+	ArtifactRef          string
+	ObservationRef       string
+	ProviderRef          string
+	ModelRef             string
+	ModelVersion         string
+	ConfidenceMillis     int64
+	Degraded             bool
+	RecordedAtUnixMillis int64
+}
+
+func (e IngressEnvelope) Valid() bool {
+	return e.ID != "" && e.Modality != "" && e.SourceRef != "" && e.ConfidenceMillis >= 0 && e.ConfidenceMillis <= 1000 && e.RecordedAtUnixMillis > 0 && (!e.Degraded || e.ObservationRef == "")
+}
 
 const (
 	ChannelWebChat                               Channel                         = "WEB_CHAT"
@@ -75,6 +113,8 @@ const (
 	InformationRequestMemoryInventory            InformationRequestKind          = "MEMORY_INVENTORY"
 	InformationRequestTimeDifference             InformationRequestKind          = "TIME_DIFFERENCE"
 	InformationRequestResearchFailureExplanation InformationRequestKind          = "RESEARCH_FAILURE_EXPLANATION"
+	ConfigurationCommandSet                      ConfigurationCommandKind        = "SET"
+	ConfigurationCommandQuery                    ConfigurationCommandKind        = "QUERY"
 )
 
 type Conversation struct {
@@ -106,6 +146,18 @@ type OriginalHumanIntent struct {
 	RecordedAtUnixMillis int64
 	Text                 string
 }
+
+// ConfigurationCommand is Interaction-owned intent. Configuration remains
+// the only owner allowed to materialise a SettingAssignment.
+type ConfigurationCommand struct {
+	Kind              ConfigurationCommandKind
+	PrincipalID       string
+	DefinitionRef     string
+	TypedValue        string
+	TemporaryOverride bool
+	SessionRef        string
+	SourceRef         string
+}
 type InteractionRelation struct {
 	ID                   InteractionRelationID
 	FromUtteranceID      HumanUtteranceID

contracts/self/README.md

@@ -0,0 +1,9 @@
+# SELF contract boundary
+
+SELF owns evidence-backed competence, weakness, dependency, learning, and
+self-evaluation records. Raw evidence remains Epistemics-owned; capability
+health remains Capability-owned; tasks and development remain Work-owned;
+release switching remains Supervisor/runtime-owned.
+
+SELF is observational/evaluative and is not a mandatory request-path
+orchestrator or an authority source.

contracts/self/benchmark.go

@@ -0,0 +1,37 @@
+package self
+
+type BenchmarkCaseRef string
+type BenchmarkCase struct {
+	ID           string
+	PrincipalID  string
+	TaskClass    string
+	EvidenceRefs []SemanticReference
+	RecordedAt   int64
+}
+
+func (c BenchmarkCase) Valid() bool {
+	return c.ID != "" && c.PrincipalID != "" && c.TaskClass != "" && len(c.EvidenceRefs) > 0 && c.RecordedAt > 0
+}
+
+type PersonalBenchmark struct {
+	ID                     string
+	PrincipalID            string
+	ApprovedCaseRefs       []BenchmarkCaseRef
+	GoalProfile            []string
+	PreferenceEvidenceRefs []SemanticReference
+	RecordedAt             int64
+}
+type BenchmarkEvaluation struct {
+	CaseRef           BenchmarkCaseRef
+	Path              string
+	QualityMillis     int64
+	ReliabilityMillis int64
+	LatencyMillis     int64
+	CostMicros        int64
+	CorrectionCount   int64
+	EvidenceRefs      []SemanticReference
+}
+
+func (e BenchmarkEvaluation) Valid() bool {
+	return e.CaseRef != "" && len(e.EvidenceRefs) > 0 && e.QualityMillis >= 0 && e.ReliabilityMillis >= 0 && e.CorrectionCount >= 0
+}

contracts/self/primitives.go

@@ -0,0 +1,7 @@
+package self
+
+import "git.cin.su/m/Assistant/platform/ids"
+
+// SemanticReference lets SELF cite evidence and capabilities without owning
+// their canonical state.
+type SemanticReference = ids.SemanticRef

contracts/self/types.go

@@ -0,0 +1,244 @@
+package self
+
+import "fmt"
+
+type AssessmentID string
+type LearningLedgerEntryID string
+type AssessmentState string
+
+type LearningSignalKind string
+type DiagnosisClass string
+type EpistemicStatus string
+type InterventionClass string
+type DecisionRegretKind string
+type CandidateState string
+
+const (
+	SignalVerifiedFailure               LearningSignalKind = "VERIFIED_FAILURE"
+	SignalUserCorrection                LearningSignalKind = "USER_CORRECTION"
+	SignalRepeatedMistake               LearningSignalKind = "REPEATED_KNOWN_MISTAKE"
+	SignalReflexDivergence              LearningSignalKind = "REFLEX_DIVERGENCE"
+	SignalSkillFallback                 LearningSignalKind = "SKILL_FALLBACK"
+	SignalUnexpectedEscalation          LearningSignalKind = "UNEXPECTED_ESCALATION"
+	SignalOutcomeMismatch               LearningSignalKind = "OUTCOME_MISMATCH"
+	SignalRetryFallback                 LearningSignalKind = "RETRY_FALLBACK"
+	SignalStaleDependency               LearningSignalKind = "STALE_DEPENDENCY"
+	SignalDecisionRegret                LearningSignalKind = "DECISION_REGRET"
+	SignalBetterSolution                LearningSignalKind = "BETTER_SOLUTION"
+	DiagnosisMemoryMissing              DiagnosisClass     = "MEMORY_MISSING"
+	DiagnosisMemoryNotRetrieved         DiagnosisClass     = "MEMORY_NOT_RETRIEVED"
+	DiagnosisWrongScope                 DiagnosisClass     = "WRONG_SCOPE"
+	DiagnosisStaleKnowledge             DiagnosisClass     = "STALE_KNOWLEDGE"
+	DiagnosisContextSelection           DiagnosisClass     = "CONTEXT_SELECTION"
+	DiagnosisReasoningFailure           DiagnosisClass     = "REASONING_FAILURE"
+	DiagnosisSkillFailure               DiagnosisClass     = "SKILL_FAILURE"
+	DiagnosisReflexFailure              DiagnosisClass     = "REFLEX_FAILURE"
+	DiagnosisToolFailure                DiagnosisClass     = "TOOL_FAILURE"
+	DiagnosisProviderFailure            DiagnosisClass     = "PROVIDER_FAILURE"
+	DiagnosisOutcomeVerificationFailure DiagnosisClass     = "OUTCOME_VERIFICATION_FAILURE"
+	DiagnosisRoutingInefficiency        DiagnosisClass     = "ROUTING_INEFFICIENCY"
+	DiagnosisUnknown                    DiagnosisClass     = "UNKNOWN_CAUSE"
+	EpistemicKnown                      EpistemicStatus    = "KNOWN"
+	EpistemicSupported                  EpistemicStatus    = "SUPPORTED"
+	EpistemicHypothesis                 EpistemicStatus    = "HYPOTHESIS"
+	EpistemicUnknown                    EpistemicStatus    = "UNKNOWN"
+	InterventionConfiguration           InterventionClass  = "CONFIGURATION"
+	InterventionSkillReview             InterventionClass  = "SKILL_REVIEW"
+	InterventionReflexReview            InterventionClass  = "REFLEX_REVIEW"
+	InterventionRoutingReview           InterventionClass  = "ROUTING_REVIEW"
+	InterventionProviderReview          InterventionClass  = "PROVIDER_REVIEW"
+	InterventionContextReview           InterventionClass  = "CONTEXT_REVIEW"
+	RegretUnavailableThen               DecisionRegretKind = "INFORMATION_UNAVAILABLE_THEN"
+	RegretAvailableUnused               DecisionRegretKind = "INFORMATION_AVAILABLE_UNUSED"
+	RegretIgnoredInContext              DecisionRegretKind = "EVIDENCE_IGNORED_IN_CONTEXT"
+	CandidateProposed                   CandidateState     = "PROPOSED"
+	CandidateEvaluating                 CandidateState     = "EVALUATING"
+	CandidateKept                       CandidateState     = "KEPT"
+	CandidateRejected                   CandidateState     = "REJECTED"
+	CandidateRolledBack                 CandidateState     = "ROLLED_BACK"
+)
+
+const (
+	AssessmentCandidate  AssessmentState = "CANDIDATE"
+	AssessmentConfirmed  AssessmentState = "CONFIRMED"
+	AssessmentMonitoring AssessmentState = "MONITORING"
+	AssessmentResolved   AssessmentState = "RESOLVED"
+)
+
+type CompetenceAssessment struct {
+	ID                AssessmentID
+	PrincipalID       string
+	SubjectRef        SemanticReference
+	Revision          uint64
+	ContextMatcher    []string
+	QualityMillis     int64
+	ReliabilityMillis int64
+	ConfidenceMillis  int64
+	EvidenceRefs      []SemanticReference
+	LastValidatedAt   int64
+	AssessedAt        int64
+	SupersedesRef     *SemanticReference
+}
+type WeaknessPattern struct {
+	ID                    AssessmentID
+	PrincipalID           string
+	Revision              uint64
+	PatternKey            string
+	ContextMatcher        []string
+	FailureMode           string
+	DetectionEvidenceRefs []SemanticReference
+	State                 AssessmentState
+	RecordedAt            int64
+	TaskPattern           string
+	ScopeKey              string
+	EnvironmentVersion    string
+	DependencyRefs        []SemanticReference
+	Frequency             int
+	LastObservedAt        int64
+	Severity              int
+	AffectedComponent     string
+	AffectedStrategy      string
+	ConfidenceMillis      int64
+	EpistemicStatus       EpistemicStatus
+}
+type DependencyAssessment struct {
+	ID            AssessmentID
+	SubjectRef    SemanticReference
+	DependencyRef SemanticReference
+	ImpactClass   string
+	CurrentEffect string
+	EvidenceRefs  []SemanticReference
+	AssessedAt    int64
+}
+type ImprovementNeed struct {
+	ID                AssessmentID
+	PrincipalID       string
+	SubjectRef        SemanticReference
+	ProblemSummary    string
+	EvidenceRefs      []SemanticReference
+	ExpectedBenefit   string
+	Priority          int
+	State             string
+	CreatedAt         int64
+	Diagnosis         DiagnosisClass
+	DiagnosisStatus   EpistemicStatus
+	AffectedComponent string
+	ScopeKey          string
+	Risk              string
+	Intervention      InterventionClass
+	Hypothesis        string
+	EvaluationPlan    string
+	MustNotWorsen     string
+	RollbackPlan      string
+	ResourceCost      string
+}
+
+type LearningSignal struct {
+	ID                 string
+	PrincipalID        string
+	Kind               LearningSignalKind
+	TaskPattern        string
+	ScopeKey           string
+	SubjectRef         SemanticReference
+	EvidenceRefs       []SemanticReference
+	ExpectedOutcome    string
+	ActualOutcome      string
+	DependencyRefs     []SemanticReference
+	EnvironmentVersion string
+	ObservedAt         int64
+	Severity           int
+	UserImpact         int
+	CorrectionCount    int
+	DecisionRegret     DecisionRegretKind
+}
+
+type Diagnosis struct {
+	Class            DiagnosisClass
+	Status           EpistemicStatus
+	Rationale        string
+	EvidenceRefs     []SemanticReference
+	ConfidenceMillis int64
+}
+
+type ImprovementCandidate struct {
+	ID                   string
+	PrincipalID          string
+	NeedRef              SemanticReference
+	Hypothesis           string
+	ExpectedEffect       string
+	EvaluationPlan       string
+	MustNotWorsen        []string
+	RollbackPlan         string
+	ResourceCost         string
+	Creator              string
+	IndependentEvaluator string
+	State                CandidateState
+	EvidenceRefs         []SemanticReference
+	CreatedAt            int64
+}
+
+type ImprovementEvaluation struct {
+	CandidateRef      SemanticReference
+	Evaluator         string
+	EvidenceRefs      []SemanticReference
+	ExpectedQuality   int64
+	ActualQuality     int64
+	ExpectedLatency   int64
+	ActualLatency     int64
+	MustNotWorsenPass bool
+	Decision          CandidateState
+	EvaluatedAt       int64
+}
+type LearningLedgerEntry struct {
+	ID                   LearningLedgerEntryID
+	PrincipalID          string
+	ImprovementNeedRef   *SemanticReference
+	ObservedProblem      string
+	EvidenceRefs         []SemanticReference
+	Diagnosis            string
+	Hypothesis           string
+	ProposedChangeRef    SemanticReference
+	ExpectedImprovement  string
+	ActualEvaluationRefs []SemanticReference
+	DevelopmentGateRef   *SemanticReference
+	BeforeVersionRefs    []SemanticReference
+	AfterVersionRefs     []SemanticReference
+	Decision             string
+	SideEffects          []string
+	RollbackRef          *SemanticReference
+	RecordedAt           int64
+}
+
+func (a CompetenceAssessment) Validate() error {
+	if a.ID == "" || a.PrincipalID == "" || !a.SubjectRef.Valid() || a.Revision < 1 || a.ConfidenceMillis < 0 || a.ConfidenceMillis > 1000 || len(a.EvidenceRefs) == 0 || a.AssessedAt < 1 {
+		return fmt.Errorf("competence requires evidence")
+	}
+	return nil
+}
+func (l LearningLedgerEntry) Validate() error {
+	if l.ID == "" || l.PrincipalID == "" || l.ObservedProblem == "" || len(l.EvidenceRefs) == 0 || l.Decision == "" || l.RecordedAt < 1 {
+		return fmt.Errorf("learning ledger entry is incomplete")
+	}
+	return nil
+}
+
+func (s LearningSignal) Validate() error {
+	if s.ID == "" || s.PrincipalID == "" || s.Kind == "" || s.TaskPattern == "" || s.ScopeKey == "" || !s.SubjectRef.Valid() || len(s.EvidenceRefs) == 0 || s.ObservedAt < 1 {
+		return fmt.Errorf("learning signal is incomplete")
+	}
+	return nil
+}
+
+func (d Diagnosis) Validate() error {
+	if d.Class == "" || d.Status == "" || len(d.EvidenceRefs) == 0 || d.ConfidenceMillis < 0 || d.ConfidenceMillis > 1000 {
+		return fmt.Errorf("diagnosis requires bounded evidence")
+	}
+	return nil
+}
+
+func (c ImprovementCandidate) Validate() error {
+	if c.ID == "" || c.PrincipalID == "" || !c.NeedRef.Valid() || c.Hypothesis == "" || c.ExpectedEffect == "" || c.EvaluationPlan == "" || c.MustNotWorsen == nil || c.RollbackPlan == "" || c.Creator == "" || c.IndependentEvaluator == "" || c.Creator == c.IndependentEvaluator || len(c.EvidenceRefs) == 0 || c.CreatedAt < 1 {
+		return fmt.Errorf("candidate lacks independent bounded evaluation")
+	}
+	return nil
+}

contracts/situation/focus_v2.go

@@ -0,0 +1,141 @@
+package situation
+
+import (
+	"fmt"
+
+	"git.cin.su/m/Assistant/contracts/authority"
+	"git.cin.su/m/Assistant/contracts/identity"
+	"git.cin.su/m/Assistant/contracts/work"
+	"git.cin.su/m/Assistant/platform/clock"
+	"git.cin.su/m/Assistant/platform/ids"
+)
+
+type ContextScopeID ids.StableID
+type FocusFrameID ids.StableID
+type FocusTransitionID ids.StableID
+type FocusRevision ids.Revision
+
+type RoleKey string
+type MatchPolicy string
+type FocusFrameState string
+type FocusProvenance string
+type FocusTransitionOperation string
+
+const (
+	MatchRequired  MatchPolicy = "REQUIRED"
+	MatchPreferred MatchPolicy = "PREFERRED"
+	MatchRelated   MatchPolicy = "RELATED"
+	MatchExcluded  MatchPolicy = "EXCLUDED"
+
+	RolePerson       RoleKey = "PERSON"
+	RoleOrganization RoleKey = "ORGANIZATION"
+	RoleFamily       RoleKey = "FAMILY"
+	RoleEnvironment  RoleKey = "ENVIRONMENT"
+	RoleLocation     RoleKey = "LOCATION"
+	RoleSystem       RoleKey = "SYSTEM"
+	RoleDatabase     RoleKey = "DATABASE"
+	RoleRepository   RoleKey = "REPOSITORY"
+	RoleBranch       RoleKey = "BRANCH"
+	RoleVersion      RoleKey = "VERSION"
+	RoleActivity     RoleKey = "ACTIVITY"
+	RoleProject      RoleKey = "PROJECT"
+	RoleActiveEntity RoleKey = "ACTIVE_ENTITY"
+
+	FocusCandidate  FocusFrameState = "CANDIDATE"
+	FocusActive     FocusFrameState = "ACTIVE"
+	FocusSuspended  FocusFrameState = "SUSPENDED"
+	FocusExpired    FocusFrameState = "EXPIRED"
+	FocusSuperseded FocusFrameState = "SUPERSEDED"
+
+	FocusExplicitHuman          FocusProvenance = "EXPLICIT_HUMAN"
+	FocusUserConfirmed          FocusProvenance = "USER_CONFIRMED"
+	FocusInherited              FocusProvenance = "INHERITED"
+	FocusEntityReference        FocusProvenance = "ENTITY_REFERENCE"
+	FocusTaskReference          FocusProvenance = "TASK_REFERENCE"
+	FocusRepositoryReference    FocusProvenance = "REPOSITORY_REFERENCE"
+	FocusEnvironmentObservation FocusProvenance = "ENVIRONMENT_OBSERVATION"
+	FocusInferred               FocusProvenance = "INFERRED"
+
+	TransitionActivate  FocusTransitionOperation = "ACTIVATE"
+	TransitionSuspend   FocusTransitionOperation = "SUSPEND"
+	TransitionResume    FocusTransitionOperation = "RESUME"
+	TransitionSupersede FocusTransitionOperation = "SUPERSEDE"
+	TransitionExpire    FocusTransitionOperation = "EXPIRE"
+)
+
+type ContextBinding struct {
+	RoleKey          RoleKey
+	TargetRef        SemanticReference
+	MatchPolicy      MatchPolicy
+	Provenance       string
+	ConfidenceMillis int64
+	SourceRef        *SemanticReference
+}
+
+type ContextScope struct {
+	ID          ContextScopeID
+	PrincipalID identity.PrincipalID
+	Revision    FocusRevision
+	Bindings    []ContextBinding
+	RecordedAt  clock.Instant
+}
+
+type FocusFrame struct {
+	ID                 FocusFrameID
+	PrincipalID        identity.PrincipalID
+	ActorID            identity.ActorID
+	Revision           FocusRevision
+	AuthorityScopeRef  authority.ScopeID
+	ContextScopeRef    SemanticReference
+	GoalRef            *work.GoalID
+	TaskRef            *work.TaskID
+	SourceUtteranceRef string
+	Provenance         FocusProvenance
+	ConfidenceMillis   int64
+	State              FocusFrameState
+	ParentFrameRef     *FocusFrameID
+	ActivatedAt        clock.Instant
+	SuspendedAt        *clock.Instant
+	ExpiredAt          *clock.Instant
+	RecordedAt         clock.Instant
+}
+
+type FocusTransition struct {
+	TransitionID FocusTransitionID
+	FrameID      FocusFrameID
+	FromRevision FocusRevision
+	ToRevision   FocusRevision
+	Operation    FocusTransitionOperation
+	CauseRef     string
+	RecordedAt   clock.Instant
+}
+
+func (s ContextScope) Validate() error {
+	if s.ID == "" || s.PrincipalID == "" || !ids.Revision(s.Revision).Valid() || !s.RecordedAt.Valid() {
+		return fmt.Errorf("invalid context scope")
+	}
+	for _, b := range s.Bindings {
+		if b.RoleKey == "" || !b.TargetRef.Valid() || !validMatchPolicy(b.MatchPolicy) {
+			return fmt.Errorf("invalid context binding")
+		}
+	}
+	return nil
+}
+
+func (f FocusFrame) Validate() error {
+	if f.ID == "" || f.PrincipalID == "" || f.ActorID == "" || !ids.Revision(f.Revision).Valid() || !f.ContextScopeRef.Valid() || f.State == "" || f.Provenance == "" || !f.RecordedAt.Valid() {
+		return fmt.Errorf("invalid focus frame")
+	}
+	return nil
+}
+
+func (t FocusTransition) Validate() error {
+	if t.TransitionID == "" || t.FrameID == "" || !ids.Revision(t.FromRevision).Valid() || !ids.Revision(t.ToRevision).Valid() || t.Operation == "" || !t.RecordedAt.Valid() {
+		return fmt.Errorf("invalid focus transition")
+	}
+	return nil
+}
+
+func validMatchPolicy(p MatchPolicy) bool {
+	return p == MatchRequired || p == MatchPreferred || p == MatchRelated || p == MatchExcluded
+}

contracts/situation/focus_v2_test.go

@@ -0,0 +1,22 @@
+package situation_test
+
+import (
+	"testing"
+
+	"git.cin.su/m/Assistant/contracts/identity"
+	contract "git.cin.su/m/Assistant/contracts/situation"
+	"git.cin.su/m/Assistant/platform/clock"
+	"git.cin.su/m/Assistant/platform/ids"
+)
+
+func TestFocusV2ContractsValidateTypedScopeAndFrame(t *testing.T) {
+	rev := ids.Revision(1)
+	scope := contract.ContextScope{ID: "scope", PrincipalID: identity.PrincipalID("company-a"), Revision: contract.FocusRevision(rev), RecordedAt: clock.Instant(1), Bindings: []contract.ContextBinding{{RoleKey: contract.RoleOrganization, TargetRef: contract.SemanticReference{OwnerNamespace: "world", SemanticKind: "organization", StableID: "a"}, MatchPolicy: contract.MatchRequired}}}
+	if err := scope.Validate(); err != nil {
+		t.Fatal(err)
+	}
+	frame := contract.FocusFrame{ID: "frame", PrincipalID: scope.PrincipalID, ActorID: "actor", Revision: 1, ContextScopeRef: contract.SemanticReference{OwnerNamespace: "situation", SemanticKind: "context_scope", StableID: ids.StableID(scope.ID), Revision: &rev}, State: contract.FocusActive, Provenance: contract.FocusExplicitHuman, RecordedAt: 1}
+	if err := frame.Validate(); err != nil {
+		t.Fatal(err)
+	}
+}

contracts/situation/primitives.go

@@ -0,0 +1,7 @@
+package situation
+
+import "git.cin.su/m/Assistant/platform/ids"
+
+// SemanticReference keeps Situation references transport-neutral while
+// ContextScope semantics remain owned by Situation.
+type SemanticReference = ids.SemanticRef

contracts/work/consequence.go

@@ -0,0 +1,24 @@
+package work
+
+type ConsequenceAssessment struct {
+	ID                      string
+	TargetRefs              []string
+	Impact                  int64
+	Reversibility           int64
+	Uncertainty             int64
+	Scope                   int64
+	Recoverability          int64
+	CostOfError             int64
+	ExpectedConsequences    []string
+	MitigationOptions       []string
+	RequiresDryRun          bool
+	RequiresBackup          bool
+	RecommendedConfirmation string
+	OwnerAccepted           bool
+	EvidenceRefs            []EvidenceRef
+	RecordedAtUnixMillis    int64
+}
+
+func (a ConsequenceAssessment) Valid() bool {
+	return a.ID != "" && len(a.TargetRefs) > 0 && a.Impact >= 0 && a.Impact <= 1000 && a.Reversibility >= 0 && a.Reversibility <= 1000 && a.Uncertainty >= 0 && a.Uncertainty <= 1000 && a.Recoverability >= 0 && a.Recoverability <= 1000 && a.RecordedAtUnixMillis > 0
+}

contracts/work/freshness.go

@@ -0,0 +1,28 @@
+package work
+
+import "git.cin.su/m/Assistant/contracts/world"
+
+type FreshnessRequirementMode string
+type FreshnessFallbackPolicy string
+
+const (
+	FreshnessAny                 FreshnessRequirementMode = "ANY"
+	FreshnessPreferCurrent       FreshnessRequirementMode = "PREFER_CURRENT"
+	FreshnessRequireCurrent      FreshnessRequirementMode = "REQUIRE_CURRENT"
+	FreshnessRequireWithinAge    FreshnessRequirementMode = "REQUIRE_WITHIN_AGE"
+	FreshnessRequireVersionMatch FreshnessRequirementMode = "REQUIRE_VERSION_MATCH"
+	FreshnessLiveRequired        FreshnessRequirementMode = "LIVE_REQUIRED"
+	FallbackAllowStaleDisclosure FreshnessFallbackPolicy  = "ALLOW_STALE_WITH_DISCLOSURE"
+	FallbackHypothesisOnly       FreshnessFallbackPolicy  = "USE_AS_HYPOTHESIS_ONLY"
+	FallbackWaitForSource        FreshnessFallbackPolicy  = "WAIT_FOR_SOURCE"
+	FallbackAskOwner             FreshnessFallbackPolicy  = "ASK_OWNER"
+	FallbackStopUnknown          FreshnessFallbackPolicy  = "STOP_WITH_UNKNOWN"
+)
+
+type TaskFreshnessRequirement struct {
+	Mode                 FreshnessRequirementMode
+	MaximumAgeMillis     *int64
+	RequiredVersionRefs  []world.SemanticReference
+	RevalidationRequired bool
+	FallbackPolicy       FreshnessFallbackPolicy
+}

contracts/work/governed_evolution.go

@@ -0,0 +1,39 @@
+package work
+
+type EvolutionRunStage string
+
+const (
+	EvolutionNeedRecorded           EvolutionRunStage = "IMPROVEMENT_NEED"
+	EvolutionCandidateBuilt         EvolutionRunStage = "CANDIDATE"
+	EvolutionIndependentlyEvaluated EvolutionRunStage = "INDEPENDENT_EVALUATION"
+	EvolutionSandboxed              EvolutionRunStage = "SANDBOX_BUILD"
+	EvolutionBenchmarked            EvolutionRunStage = "BENCHMARK"
+	EvolutionCanaried               EvolutionRunStage = "CANARY"
+	EvolutionPromoted               EvolutionRunStage = "PROMOTION"
+	EvolutionRolledBack             EvolutionRunStage = "ROLLBACK"
+)
+
+type GovernedEvolutionResult struct {
+	NeedRef                  string
+	CandidateRef             string
+	EvaluationRef            string
+	Stages                   []EvolutionRunStage
+	EvidenceRefs             []EvidenceRef
+	LearningLedgerOutcomeRef string
+	Promoted                 bool
+	RollbackRef              string
+}
+
+// GovernedEvolutionOps are explicit gates. The caller supplies existing
+// development executor/supervisor operations; this interface grants no new
+// authority and has no autonomous promotion implementation.
+type GovernedEvolutionOps struct {
+	CreateCandidate       func() (EvolutionCandidate, error)
+	Evaluate              func(EvolutionCandidate) (EvolutionEvaluation, error)
+	SandboxBuild          func(EvolutionCandidate) (EvidenceRef, error)
+	Benchmark             func(EvolutionCandidate) (EvidenceRef, bool, error)
+	Canary                func(EvolutionCandidate) (EvidenceRef, bool, error)
+	Promote               func(EvolutionCandidate, EvolutionEvaluation) (string, error)
+	Rollback              func(EvolutionCandidate) (string, error)
+	LearningLedgerOutcome func(GovernedEvolutionResult) (string, error)
+}

contracts/work/long_running.go

@@ -0,0 +1,51 @@
+package work
+
+type LongRunningWorkID string
+type LongRunningState string
+
+const (
+	LongRunningProposed  LongRunningState = "PROPOSED"
+	LongRunningRunning   LongRunningState = "RUNNING"
+	LongRunningPaused    LongRunningState = "PAUSED"
+	LongRunningBlocked   LongRunningState = "BLOCKED"
+	LongRunningCompleted LongRunningState = "COMPLETED"
+	LongRunningExhausted LongRunningState = "EXHAUSTED"
+	LongRunningCancelled LongRunningState = "CANCELLED"
+)
+
+type Investigation struct {
+	ID                   LongRunningWorkID
+	Objective            string
+	HypothesisRefs       []EvidenceRef
+	AttemptRefs          []AgentRunID
+	FindingRefs          []EvidenceRef
+	Blockers             []string
+	CheckpointRefs       []AgentCheckpointID
+	NextStep             string
+	State                LongRunningState
+	Revision             int64
+	TimeBudgetMillis     int64
+	CostBudgetMicros     int64
+	MaxAttempts          int
+	RecordedAtUnixMillis int64
+}
+
+// InvestigationCheckpoint is the durable boundary between attempts. A
+// checkpoint is written only after an attempt has been verified, so a worker
+// restart can resume at NextStep without replaying that attempt.
+type InvestigationCheckpoint struct {
+	ID                   AgentCheckpointID
+	InvestigationID      LongRunningWorkID
+	CompletedAttemptRefs []AgentRunID
+	CompletedFindingRefs []EvidenceRef
+	NextStep             string
+	RecordedAtUnixMillis int64
+}
+
+func (c InvestigationCheckpoint) Valid() bool {
+	return c.ID != "" && c.InvestigationID != "" && c.NextStep != "" && c.RecordedAtUnixMillis > 0
+}
+
+func (w Investigation) Valid() bool {
+	return w.ID != "" && w.Objective != "" && w.State != "" && w.Revision > 0 && w.TimeBudgetMillis >= 0 && w.CostBudgetMicros >= 0 && w.MaxAttempts >= 0 && w.RecordedAtUnixMillis > 0
+}

contracts/work/perspective.go

@@ -0,0 +1,32 @@
+package work
+
+type PerspectiveID string
+type PerspectiveSpec struct {
+	ID                     PerspectiveID
+	ObjectiveLens          string
+	FocusRef               string
+	RetrievalProfileRef    string
+	SkillRefs              []string
+	ToolRefs               []string
+	EvaluationCriteria     []string
+	CapabilityRequirements []string
+	ExpectedOutputShape    string
+	Critic                 bool
+}
+type SpecialistAssignment struct {
+	Perspective  PerspectiveSpec
+	SubtaskRef   string
+	FocusRef     string
+	SkillRefs    []string
+	ToolRefs     []string
+	EvidenceRefs []EvidenceRef
+}
+type TeamDecision struct {
+	UseTeam     bool
+	Reason      string
+	Assignments []SpecialistAssignment
+}
+
+func (p PerspectiveSpec) Valid() bool {
+	return p.ID != "" && p.ObjectiveLens != "" && p.FocusRef != "" && len(p.SkillRefs) > 0 && len(p.ToolRefs) > 0 && len(p.EvaluationCriteria) > 0 && p.ExpectedOutputShape != ""
+}

contracts/work/self_evolution.go

@@ -0,0 +1,36 @@
+package work
+
+type EvolutionChangeLevel string
+
+const (
+	EvolutionKnowledge  EvolutionChangeLevel = "KNOWLEDGE"
+	EvolutionBehavior   EvolutionChangeLevel = "BEHAVIOR"
+	EvolutionCapability EvolutionChangeLevel = "CAPABILITY"
+	EvolutionCore       EvolutionChangeLevel = "CORE"
+)
+
+type EvolutionCandidate struct {
+	ID                    string
+	ProposalRef           string
+	ChangeLevel           EvolutionChangeLevel
+	CreatorIdentity       string
+	BaseVersionRef        string
+	CandidateVersionRef   string
+	MustNotWorsen         []string
+	SandboxEvidenceRefs   []EvidenceRef
+	BenchmarkEvidenceRefs []EvidenceRef
+	RollbackRef           string
+	State                 string
+}
+type EvolutionEvaluation struct {
+	CandidateRef         string
+	EvaluatorIdentity    string
+	Approved             bool
+	EvidenceRefs         []EvidenceRef
+	MustNotWorsenPassed  bool
+	RecordedAtUnixMillis int64
+}
+
+func (e EvolutionEvaluation) ValidFor(c EvolutionCandidate) bool {
+	return e.CandidateRef == c.ID && e.EvaluatorIdentity != "" && e.EvaluatorIdentity != c.CreatorIdentity && e.Approved && e.MustNotWorsenPassed && len(e.EvidenceRefs) > 0 && e.RecordedAtUnixMillis > 0
+}

contracts/world/README.md

@@ -0,0 +1,9 @@
+# World contract boundary
+
+World owns typed, versioned referents and vocabulary: `WorldObject`, kind and
+facet/relation definitions, aliases, identity-resolution decisions, and
+merge/split lineage. It does not own observations, claims, beliefs, or the
+truth of values about a referent; those remain Epistemics-owned evidence.
+
+Cross-owner references are typed semantic references. They do not create
+cross-owner foreign keys, joins, writes, or a generic `Entity(any)` API.

contracts/world/primitives.go

@@ -0,0 +1,322 @@
+package world
+
+import (
+	"fmt"
+
+	"git.cin.su/m/Assistant/contracts/identity"
+	"git.cin.su/m/Assistant/platform/clock"
+	"git.cin.su/m/Assistant/platform/ids"
+)
+
+// SemanticReference is the transport envelope used by World contracts. It is
+// a reference only; it does not expose another owner's storage.
+type SemanticReference = ids.SemanticRef
+
+// VersionBinding is a typed applicability constraint. Absence of VersionRef
+// means unknown, never an implicit "latest".
+type VersionMatchMode string
+
+const (
+	VersionExact            VersionMatchMode = "EXACT"
+	VersionCompatibleFamily VersionMatchMode = "COMPATIBLE_FAMILY"
+	VersionAtOrBefore       VersionMatchMode = "AT_OR_BEFORE"
+	VersionUnknown          VersionMatchMode = "UNKNOWN"
+)
+
+type VersionBinding struct {
+	SubjectRef SemanticReference
+	VersionRef SemanticReference
+	MatchMode  VersionMatchMode
+}
+
+type EnvironmentReference struct {
+	EnvironmentRef SemanticReference
+	VersionRef     *SemanticReference
+}
+
+func (b VersionBinding) Validate() error {
+	if !b.SubjectRef.Valid() || !b.VersionRef.Valid() {
+		return fmt.Errorf("version binding references are invalid")
+	}
+	if b.MatchMode != VersionExact && b.MatchMode != VersionCompatibleFamily && b.MatchMode != VersionAtOrBefore && b.MatchMode != VersionUnknown {
+		return fmt.Errorf("version binding match mode is invalid")
+	}
+	return nil
+}
+
+func (r EnvironmentReference) Validate() error {
+	if !r.EnvironmentRef.Valid() {
+		return fmt.Errorf("environment reference is invalid")
+	}
+	if r.VersionRef != nil && !r.VersionRef.Valid() {
+		return fmt.Errorf("environment version reference is invalid")
+	}
+	return nil
+}
+
+type PrincipalRealm string
+
+const (
+	RealmPersonal PrincipalRealm = "PERSONAL"
+	RealmShared   PrincipalRealm = "SHARED"
+	RealmPublic   PrincipalRealm = "PUBLIC"
+	RealmSystem   PrincipalRealm = "SYSTEM"
+)
+
+type SensitivityClass string
+
+const (
+	SensitivityPublic          SensitivityClass = "PUBLIC"
+	SensitivityPrivate         SensitivityClass = "PRIVATE"
+	SensitivityRestricted      SensitivityClass = "RESTRICTED"
+	SensitivitySecretReference SensitivityClass = "SECRET_REFERENCE"
+)
+
+type ValueTypeKind string
+
+const (
+	ValueString    ValueTypeKind = "STRING"
+	ValueInteger   ValueTypeKind = "INTEGER"
+	ValueDecimal   ValueTypeKind = "DECIMAL"
+	ValueBoolean   ValueTypeKind = "BOOLEAN"
+	ValueTime      ValueTypeKind = "TIME"
+	ValueDuration  ValueTypeKind = "DURATION"
+	ValueEnum      ValueTypeKind = "ENUM"
+	ValueReference ValueTypeKind = "REFERENCE"
+	ValueBinaryRef ValueTypeKind = "BINARY_REF"
+	ValueList      ValueTypeKind = "LIST"
+	ValueStruct    ValueTypeKind = "STRUCT"
+)
+
+type ValueField struct {
+	Name string
+	Type ValueTypeSpec
+}
+
+type ValueTypeSpec struct {
+	Kind          ValueTypeKind
+	Element       *ValueTypeSpec
+	Fields        []ValueField
+	EnumValues    []string
+	ReferenceKind string
+}
+
+type WorldObjectID ids.StableID
+type KindDefinitionID ids.StableID
+type WorldAliasID ids.StableID
+type PersonReferent struct {
+	WorldObjectRef   SemanticReference
+	DisplayName      string
+	ConfidenceMillis int64
+}
+
+func (p PersonReferent) Valid() bool {
+	return p.WorldObjectRef.Valid() && p.DisplayName != "" && p.ConfidenceMillis >= 0 && p.ConfidenceMillis <= 1000
+}
+
+type FacetDefinitionID ids.StableID
+type RelationDefinitionID ids.StableID
+type ResolutionDecisionID ids.StableID
+type LineageID ids.StableID
+
+type LifecycleState string
+
+const (
+	LifecycleActive          LifecycleState = "ACTIVE"
+	LifecycleMerged          LifecycleState = "MERGED"
+	LifecycleSplit           LifecycleState = "SPLIT"
+	LifecycleRetired         LifecycleState = "RETIRED"
+	LifecycleUnknownIdentity LifecycleState = "UNKNOWN_IDENTITY"
+)
+
+type WorldObject struct {
+	ID                WorldObjectID
+	PrincipalID       identity.PrincipalID
+	KindDefinitionRef SemanticReference
+	KindRevision      ids.Revision
+	Lifecycle         LifecycleState
+	CreatedAt         clock.Instant
+}
+
+type WorldObjectKindDefinition struct {
+	ID               KindDefinitionID
+	KindKey          string
+	Revision         ids.Revision
+	DisplayName      string
+	ParentKindRef    *SemanticReference
+	Lifecycle        LifecycleState
+	DefinitionDigest string
+	RecordedAt       clock.Instant
+}
+
+type WorldAlias struct {
+	ID          WorldAliasID
+	PrincipalID identity.PrincipalID
+	ObjectID    WorldObjectID
+	Alias       string
+	RecordedAt  clock.Instant
+}
+
+type FacetDefinition struct {
+	ID               FacetDefinitionID
+	KindKey          string
+	Revision         ids.Revision
+	FacetKey         string
+	ValueType        ValueTypeSpec
+	DefinitionDigest string
+	RecordedAt       clock.Instant
+}
+
+type RelationDefinition struct {
+	ID               RelationDefinitionID
+	KindKey          string
+	Revision         ids.Revision
+	RelationKey      string
+	TargetKindKey    string
+	DefinitionDigest string
+	RecordedAt       clock.Instant
+}
+
+type ResolutionDecision string
+
+const (
+	ResolutionSame       ResolutionDecision = "SAME"
+	ResolutionDistinct   ResolutionDecision = "DISTINCT"
+	ResolutionMerge      ResolutionDecision = "MERGE"
+	ResolutionSplit      ResolutionDecision = "SPLIT"
+	ResolutionUnresolved ResolutionDecision = "UNRESOLVED"
+)
+
+type IdentityResolutionCandidate struct {
+	ObjectRef  SemanticReference
+	Evidence   []SemanticReference
+	Confidence int64
+}
+
+type IdentityResolutionDecisionRecord struct {
+	ID               ResolutionDecisionID
+	PrincipalID      identity.PrincipalID
+	Candidates       []IdentityResolutionCandidate
+	Decision         ResolutionDecision
+	Evidence         []SemanticReference
+	ConfidenceMillis int64
+	DecidedAt        clock.Instant
+	Revision         ids.Revision
+}
+
+type WorldLineage struct {
+	ID            LineageID
+	Operation     ResolutionDecision
+	SourceRefs    []SemanticReference
+	SuccessorRefs []SemanticReference
+	RecordedAt    clock.Instant
+}
+
+func (w WorldObject) Validate() error {
+	if w.ID == "" || !w.KindDefinitionRef.Valid() || !w.KindRevision.Valid() || !validLifecycle(w.Lifecycle) || !w.CreatedAt.Valid() {
+		return fmt.Errorf("world object is incomplete")
+	}
+	return nil
+}
+
+func (k WorldObjectKindDefinition) Validate() error {
+	if k.ID == "" || k.KindKey == "" || !k.Revision.Valid() || k.DisplayName == "" || !validLifecycle(k.Lifecycle) || k.DefinitionDigest == "" || !k.RecordedAt.Valid() {
+		return fmt.Errorf("world kind definition is incomplete")
+	}
+	if k.ParentKindRef != nil && !k.ParentKindRef.Valid() {
+		return fmt.Errorf("world kind parent reference is invalid")
+	}
+	return nil
+}
+
+func (a WorldAlias) Validate() error {
+	if a.ID == "" || a.ObjectID == "" || a.Alias == "" || !a.RecordedAt.Valid() {
+		return fmt.Errorf("world alias is incomplete")
+	}
+	return nil
+}
+
+func (f FacetDefinition) Validate() error {
+	if f.ID == "" || f.KindKey == "" || !f.Revision.Valid() || f.FacetKey == "" || f.DefinitionDigest == "" || !f.RecordedAt.Valid() {
+		return fmt.Errorf("facet definition is incomplete")
+	}
+	return f.ValueType.Validate()
+}
+
+func (r RelationDefinition) Validate() error {
+	if r.ID == "" || r.KindKey == "" || !r.Revision.Valid() || r.RelationKey == "" || r.TargetKindKey == "" || r.DefinitionDigest == "" || !r.RecordedAt.Valid() {
+		return fmt.Errorf("relation definition is incomplete")
+	}
+	return nil
+}
+
+func (d IdentityResolutionDecisionRecord) Validate() error {
+	if d.ID == "" || !validDecision(d.Decision) || len(d.Candidates) == 0 || d.ConfidenceMillis < 0 || !d.DecidedAt.Valid() || !d.Revision.Valid() {
+		return fmt.Errorf("identity resolution decision is incomplete")
+	}
+	for _, candidate := range d.Candidates {
+		if !candidate.ObjectRef.Valid() || candidate.Confidence < 0 || candidate.Confidence > 1000 {
+			return fmt.Errorf("identity resolution candidate is invalid")
+		}
+		for _, evidence := range candidate.Evidence {
+			if !evidence.Valid() {
+				return fmt.Errorf("identity resolution evidence reference is invalid")
+			}
+		}
+	}
+	return nil
+}
+
+func (l WorldLineage) Validate() error {
+	if l.ID == "" || (l.Operation != ResolutionMerge && l.Operation != ResolutionSplit) || len(l.SourceRefs) == 0 || len(l.SuccessorRefs) == 0 || !l.RecordedAt.Valid() {
+		return fmt.Errorf("world lineage is incomplete")
+	}
+	return nil
+}
+
+func validLifecycle(value LifecycleState) bool {
+	return value == LifecycleActive || value == LifecycleMerged || value == LifecycleSplit || value == LifecycleRetired || value == LifecycleUnknownIdentity
+}
+
+func validDecision(value ResolutionDecision) bool {
+	return value == ResolutionSame || value == ResolutionDistinct || value == ResolutionMerge || value == ResolutionSplit || value == ResolutionUnresolved
+}
+
+func (s ValueTypeSpec) Validate() error {
+	if s.Kind == "" {
+		return fmt.Errorf("value type kind is required")
+	}
+	switch s.Kind {
+	case ValueList:
+		if s.Element == nil {
+			return fmt.Errorf("list element type is required")
+		}
+		return s.Element.Validate()
+	case ValueStruct:
+		if len(s.Fields) == 0 {
+			return fmt.Errorf("struct fields are required")
+		}
+		seen := map[string]struct{}{}
+		for _, field := range s.Fields {
+			if field.Name == "" {
+				return fmt.Errorf("struct field name is required")
+			}
+			if _, ok := seen[field.Name]; ok {
+				return fmt.Errorf("duplicate struct field %q", field.Name)
+			}
+			seen[field.Name] = struct{}{}
+			if err := field.Type.Validate(); err != nil {
+				return fmt.Errorf("field %s: %w", field.Name, err)
+			}
+		}
+	case ValueEnum:
+		if len(s.EnumValues) == 0 {
+			return fmt.Errorf("enum values are required")
+		}
+	case ValueReference:
+		if s.ReferenceKind == "" {
+			return fmt.Errorf("reference kind is required")
+		}
+	}
+	return nil
+}

contracts/world/primitives_test.go

@@ -0,0 +1,17 @@
+package world
+
+import "testing"
+
+func TestValueTypeSpecValidatesTypedRecursiveShape(t *testing.T) {
+	spec := ValueTypeSpec{Kind: ValueStruct, Fields: []ValueField{{Name: "name", Type: ValueTypeSpec{Kind: ValueString}}, {Name: "refs", Type: ValueTypeSpec{Kind: ValueList, Element: &ValueTypeSpec{Kind: ValueReference, ReferenceKind: "world.object"}}}}}
+	if err := spec.Validate(); err != nil {
+		t.Fatalf("ValueTypeSpec.Validate() = %v", err)
+	}
+}
+
+func TestValueTypeSpecRejectsDuplicateFields(t *testing.T) {
+	spec := ValueTypeSpec{Kind: ValueStruct, Fields: []ValueField{{Name: "same", Type: ValueTypeSpec{Kind: ValueString}}, {Name: "same", Type: ValueTypeSpec{Kind: ValueString}}}}
+	if err := spec.Validate(); err == nil {
+		t.Fatal("duplicate fields were accepted")
+	}
+}

contracts/world/types_test.go

@@ -0,0 +1,22 @@
+package world
+
+import (
+	"testing"
+
+	"git.cin.su/m/Assistant/platform/clock"
+	"git.cin.su/m/Assistant/platform/ids"
+)
+
+func TestWorldObjectValidationKeepsReferentSeparateFromClaims(t *testing.T) {
+	object := WorldObject{ID: "object-1", KindDefinitionRef: ids.SemanticRef{OwnerNamespace: "world", SemanticKind: "kind", StableID: "kind-1"}, KindRevision: 1, Lifecycle: LifecycleActive, CreatedAt: clock.Instant(1)}
+	if err := object.Validate(); err != nil {
+		t.Fatalf("WorldObject.Validate() = %v", err)
+	}
+}
+
+func TestIdentityResolutionRequiresEvidenceBackedCandidates(t *testing.T) {
+	decision := IdentityResolutionDecisionRecord{ID: "decision-1", Decision: ResolutionSame, Candidates: []IdentityResolutionCandidate{{ObjectRef: ids.SemanticRef{OwnerNamespace: "world", SemanticKind: "object", StableID: "object-1"}, Confidence: 900}}, DecidedAt: clock.Instant(1), Revision: 1}
+	if err := decision.Validate(); err != nil {
+		t.Fatalf("IdentityResolutionDecisionRecord.Validate() = %v", err)
+	}
+}

database/bootstrap/002_gen2_roles_and_schemas.sql

@@ -0,0 +1,58 @@
+-- Gen2 owner-role provisioning for the dedicated bootstrap/migration principal.
+-- This is intentionally separate from feature migrations and may be run repeatedly.
+BEGIN;
+
+DO $$
+BEGIN
+  IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'world_role') THEN
+    CREATE ROLE world_role LOGIN;
+  END IF;
+  IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'configuration_role') THEN
+    CREATE ROLE configuration_role LOGIN;
+  END IF;
+  IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'self_role') THEN
+    CREATE ROLE self_role LOGIN;
+  END IF;
+END
+$$;
+
+DO $$
+DECLARE
+  role_name TEXT;
+  can_login BOOLEAN;
+BEGIN
+  FOREACH role_name IN ARRAY ARRAY['world_role', 'configuration_role', 'self_role'] LOOP
+    SELECT rolcanlogin INTO can_login FROM pg_roles WHERE rolname = role_name;
+    IF can_login IS DISTINCT FROM TRUE THEN
+      RAISE EXCEPTION 'Gen2 owner role % exists but is not a V1-compatible LOGIN role', role_name;
+    END IF;
+  END LOOP;
+END
+$$;
+
+CREATE SCHEMA IF NOT EXISTS world AUTHORIZATION world_role;
+CREATE SCHEMA IF NOT EXISTS configuration AUTHORIZATION configuration_role;
+CREATE SCHEMA IF NOT EXISTS self AUTHORIZATION self_role;
+
+REVOKE ALL ON SCHEMA world, configuration, self FROM PUBLIC;
+
+DO $$
+DECLARE
+  schema_name TEXT;
+  expected_owner TEXT;
+  actual_owner TEXT;
+BEGIN
+  FOREACH schema_name IN ARRAY ARRAY['world', 'configuration', 'self'] LOOP
+    expected_owner := schema_name || '_role';
+    SELECT pg_get_userbyid(nspowner)
+      INTO actual_owner
+      FROM pg_namespace
+     WHERE nspname = schema_name;
+    IF actual_owner IS DISTINCT FROM expected_owner THEN
+      RAISE EXCEPTION 'Gen2 schema % is owned by %, expected %', schema_name, actual_owner, expected_owner;
+    END IF;
+  END LOOP;
+END
+$$;
+
+COMMIT;

database/migrations/046_world_foundation.sql

@@ -0,0 +1,82 @@
+BEGIN;
+
+CREATE SCHEMA IF NOT EXISTS world;
+SET ROLE world_role;
+
+CREATE TABLE IF NOT EXISTS world.kind_definitions (
+  kind_definition_id TEXT PRIMARY KEY,
+  kind_key TEXT NOT NULL,
+  revision BIGINT NOT NULL CHECK (revision > 0),
+  display_name TEXT NOT NULL,
+  parent_owner_namespace TEXT NOT NULL DEFAULT '',
+  parent_semantic_kind TEXT NOT NULL DEFAULT '',
+  parent_stable_id TEXT NOT NULL DEFAULT '',
+  parent_revision BIGINT,
+  lifecycle TEXT NOT NULL,
+  definition_digest TEXT NOT NULL,
+  recorded_at_unix_millis BIGINT NOT NULL CHECK (recorded_at_unix_millis > 0),
+  UNIQUE (kind_key, revision)
+);
+
+CREATE TABLE IF NOT EXISTS world.objects (
+  world_object_id TEXT PRIMARY KEY,
+  principal_id TEXT,
+  kind_owner_namespace TEXT NOT NULL,
+  kind_semantic_kind TEXT NOT NULL,
+  kind_stable_id TEXT NOT NULL,
+  kind_revision BIGINT,
+  lifecycle TEXT NOT NULL,
+  created_at_unix_millis BIGINT NOT NULL CHECK (created_at_unix_millis > 0)
+);
+
+CREATE TABLE IF NOT EXISTS world.aliases (
+  world_alias_id TEXT PRIMARY KEY,
+  principal_id TEXT,
+  world_object_id TEXT NOT NULL,
+  alias TEXT NOT NULL,
+  recorded_at_unix_millis BIGINT NOT NULL CHECK (recorded_at_unix_millis > 0)
+);
+
+CREATE TABLE IF NOT EXISTS world.facet_definitions (
+  facet_definition_id TEXT PRIMARY KEY,
+  kind_key TEXT NOT NULL,
+  revision BIGINT NOT NULL CHECK (revision > 0),
+  facet_key TEXT NOT NULL,
+  value_type JSONB NOT NULL,
+  definition_digest TEXT NOT NULL,
+  recorded_at_unix_millis BIGINT NOT NULL CHECK (recorded_at_unix_millis > 0),
+  UNIQUE (kind_key, facet_key, revision)
+);
+
+CREATE TABLE IF NOT EXISTS world.relation_definitions (
+  relation_definition_id TEXT PRIMARY KEY,
+  kind_key TEXT NOT NULL,
+  revision BIGINT NOT NULL CHECK (revision > 0),
+  relation_key TEXT NOT NULL,
+  target_kind_key TEXT NOT NULL,
+  definition_digest TEXT NOT NULL,
+  recorded_at_unix_millis BIGINT NOT NULL CHECK (recorded_at_unix_millis > 0),
+  UNIQUE (kind_key, relation_key, revision)
+);
+
+CREATE TABLE IF NOT EXISTS world.identity_resolution_decisions (
+  resolution_decision_id TEXT PRIMARY KEY,
+  principal_id TEXT,
+  candidates JSONB NOT NULL,
+  decision TEXT NOT NULL,
+  evidence JSONB NOT NULL,
+  confidence_millis BIGINT NOT NULL CHECK (confidence_millis >= 0),
+  decided_at_unix_millis BIGINT NOT NULL CHECK (decided_at_unix_millis > 0),
+  revision BIGINT NOT NULL CHECK (revision > 0)
+);
+
+CREATE TABLE IF NOT EXISTS world.lineage (
+  lineage_id TEXT PRIMARY KEY,
+  operation TEXT NOT NULL,
+  source_refs JSONB NOT NULL,
+  successor_refs JSONB NOT NULL,
+  recorded_at_unix_millis BIGINT NOT NULL CHECK (recorded_at_unix_millis > 0)
+);
+
+RESET ROLE;
+COMMIT;

database/migrations/047_situation_focus_v2.sql

@@ -0,0 +1,47 @@
+BEGIN;
+
+SET ROLE situation_role;
+
+CREATE TABLE IF NOT EXISTS situation.context_scopes (
+  context_scope_id TEXT PRIMARY KEY,
+  principal_id TEXT NOT NULL,
+  revision BIGINT NOT NULL CHECK (revision > 0),
+  bindings JSONB NOT NULL,
+  recorded_at_unix_millis BIGINT NOT NULL CHECK (recorded_at_unix_millis > 0)
+);
+
+CREATE TABLE IF NOT EXISTS situation.focus_frames (
+  focus_frame_id TEXT PRIMARY KEY,
+  principal_id TEXT NOT NULL,
+  actor_id TEXT NOT NULL,
+  revision BIGINT NOT NULL CHECK (revision > 0),
+  authority_scope_ref TEXT NOT NULL,
+  context_scope_ref JSONB NOT NULL,
+  goal_ref TEXT,
+  task_ref TEXT,
+  source_utterance_ref TEXT,
+  provenance TEXT NOT NULL,
+  confidence_millis BIGINT NOT NULL CHECK (confidence_millis >= 0),
+  state TEXT NOT NULL,
+  parent_frame_ref TEXT,
+  activated_at_unix_millis BIGINT NOT NULL CHECK (activated_at_unix_millis > 0),
+  suspended_at_unix_millis BIGINT,
+  expired_at_unix_millis BIGINT,
+  recorded_at_unix_millis BIGINT NOT NULL CHECK (recorded_at_unix_millis > 0)
+);
+
+CREATE TABLE IF NOT EXISTS situation.focus_transitions (
+  transition_id TEXT PRIMARY KEY,
+  focus_frame_id TEXT NOT NULL,
+  from_revision BIGINT NOT NULL CHECK (from_revision > 0),
+  to_revision BIGINT NOT NULL CHECK (to_revision > 0),
+  operation TEXT NOT NULL,
+  cause_ref TEXT NOT NULL,
+  recorded_at_unix_millis BIGINT NOT NULL CHECK (recorded_at_unix_millis > 0)
+);
+
+CREATE INDEX IF NOT EXISTS focus_transitions_frame_order ON situation.focus_transitions(focus_frame_id, recorded_at_unix_millis, transition_id);
+GRANT SELECT, INSERT, UPDATE ON situation.context_scopes, situation.focus_frames, situation.focus_transitions TO situation_role;
+
+RESET ROLE;
+COMMIT;

database/migrations/048_configuration_foundation.sql

@@ -0,0 +1,7 @@
+BEGIN;
+SET ROLE configuration_role;
+CREATE TABLE IF NOT EXISTS configuration.setting_definitions (setting_definition_id TEXT PRIMARY KEY, owner_namespace TEXT NOT NULL, stable_key TEXT NOT NULL, revision BIGINT NOT NULL CHECK(revision>0), value_type TEXT NOT NULL, default_value TEXT, sensitivity TEXT NOT NULL, lifecycle TEXT NOT NULL, recorded_at_unix_millis BIGINT NOT NULL);
+CREATE TABLE IF NOT EXISTS configuration.setting_assignments (setting_assignment_id TEXT PRIMARY KEY, principal_id TEXT NOT NULL, definition_ref JSONB NOT NULL, revision BIGINT NOT NULL CHECK(revision>0), selector JSONB NOT NULL, typed_value TEXT, secret_ref TEXT, effective_from_unix_millis BIGINT NOT NULL, effective_until_unix_millis BIGINT, source TEXT NOT NULL, source_ref TEXT NOT NULL, lifecycle TEXT NOT NULL, recorded_at_unix_millis BIGINT NOT NULL);
+GRANT SELECT, INSERT, UPDATE ON configuration.setting_definitions, configuration.setting_assignments TO configuration_role;
+RESET ROLE;
+COMMIT;

database/migrations/049_self_foundation.sql

@@ -0,0 +1,7 @@
+BEGIN;
+SET ROLE self_role;
+CREATE TABLE IF NOT EXISTS self.competence_assessments (assessment_id TEXT PRIMARY KEY, principal_id TEXT NOT NULL, subject_ref JSONB NOT NULL, revision BIGINT NOT NULL CHECK(revision>0), context_matcher JSONB NOT NULL, confidence_millis BIGINT NOT NULL, evidence_refs JSONB NOT NULL, assessed_at_unix_millis BIGINT NOT NULL);
+CREATE TABLE IF NOT EXISTS self.learning_ledger (entry_id TEXT PRIMARY KEY, principal_id TEXT NOT NULL, observed_problem TEXT NOT NULL, evidence_refs JSONB NOT NULL, diagnosis TEXT NOT NULL, hypothesis TEXT NOT NULL, decision TEXT NOT NULL, recorded_at_unix_millis BIGINT NOT NULL);
+GRANT SELECT, INSERT, UPDATE ON self.competence_assessments, self.learning_ledger TO self_role;
+RESET ROLE;
+COMMIT;

database/migrations/050_work_long_running.sql

@@ -0,0 +1,22 @@
+BEGIN;
+SET ROLE work_role;
+CREATE TABLE IF NOT EXISTS work.long_running_work (
+  investigation_id TEXT PRIMARY KEY, objective TEXT NOT NULL,
+  hypothesis_refs TEXT[] NOT NULL DEFAULT ARRAY[]::TEXT[], attempt_refs TEXT[] NOT NULL DEFAULT ARRAY[]::TEXT[],
+  finding_refs TEXT[] NOT NULL DEFAULT ARRAY[]::TEXT[], blockers TEXT[] NOT NULL DEFAULT ARRAY[]::TEXT[],
+  checkpoint_refs TEXT[] NOT NULL DEFAULT ARRAY[]::TEXT[], next_step TEXT NOT NULL, state TEXT NOT NULL,
+  revision BIGINT NOT NULL, time_budget_millis BIGINT NOT NULL, cost_budget_micros BIGINT NOT NULL,
+  max_attempts INTEGER NOT NULL, recorded_at_unix_millis BIGINT NOT NULL,
+  CHECK (investigation_id <> ''), CHECK (objective <> ''), CHECK (next_step <> ''), CHECK (revision > 0), CHECK (time_budget_millis >= 0), CHECK (cost_budget_micros >= 0), CHECK (max_attempts >= 0), CHECK (recorded_at_unix_millis > 0)
+);
+CREATE TABLE IF NOT EXISTS work.investigation_checkpoints (
+  checkpoint_id TEXT PRIMARY KEY, investigation_id TEXT NOT NULL, completed_attempt_refs TEXT[] NOT NULL DEFAULT ARRAY[]::TEXT[],
+  completed_finding_refs TEXT[] NOT NULL DEFAULT ARRAY[]::TEXT[], next_step TEXT NOT NULL, recorded_at_unix_millis BIGINT NOT NULL,
+  CHECK (checkpoint_id <> ''), CHECK (investigation_id <> ''), CHECK (next_step <> ''), CHECK (recorded_at_unix_millis > 0)
+);
+CREATE TABLE IF NOT EXISTS work.investigation_attempts (
+  investigation_id TEXT NOT NULL, attempt_ref TEXT NOT NULL, verified_at_unix_millis BIGINT NOT NULL,
+  PRIMARY KEY (investigation_id, attempt_ref), CHECK (investigation_id <> ''), CHECK (attempt_ref <> ''), CHECK (verified_at_unix_millis > 0)
+);
+RESET ROLE;
+COMMIT;

database/migrations/051_identity_principal_realms.sql

@@ -0,0 +1,11 @@
+BEGIN;
+SET ROLE identity_role;
+CREATE TABLE IF NOT EXISTS identity.principal_data_realms (
+  realm_id TEXT PRIMARY KEY, owner_principal_id TEXT NOT NULL, realm_kind TEXT NOT NULL,
+  member_principal_ids TEXT[] NOT NULL DEFAULT ARRAY[]::TEXT[], shared BOOLEAN NOT NULL DEFAULT FALSE,
+  revision BIGINT NOT NULL, recorded_at_unix_millis BIGINT NOT NULL,
+  CHECK (realm_id <> ''), CHECK (owner_principal_id <> ''), CHECK (realm_kind IN ('PERSONAL','SHARED','PUBLIC')),
+  CHECK (realm_kind <> 'SHARED' OR shared), CHECK (revision > 0), CHECK (recorded_at_unix_millis > 0)
+);
+RESET ROLE;
+COMMIT;

database/migrations/052_identity_creator_accounts.sql

@@ -0,0 +1,20 @@
+BEGIN;
+SET ROLE identity_role;
+CREATE TABLE IF NOT EXISTS identity.creator_accounts (
+  username TEXT PRIMARY KEY,
+  actor_id TEXT NOT NULL,
+  principal_id TEXT NOT NULL,
+  password_hash TEXT NOT NULL,
+  revision BIGINT NOT NULL DEFAULT 1,
+  password_changed_at TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  CHECK (username <> ''),
+  CHECK (actor_id <> ''),
+  CHECK (principal_id <> ''),
+  CHECK (password_hash <> ''),
+  CHECK (revision > 0),
+  UNIQUE (actor_id, principal_id)
+);
+CREATE INDEX IF NOT EXISTS creator_accounts_binding_idx ON identity.creator_accounts (actor_id, principal_id);
+REVOKE ALL ON identity.creator_accounts FROM PUBLIC;
+RESET ROLE;
+COMMIT;

database/migrations/053_gen2_adaptive_experience_scope.sql

@@ -0,0 +1,17 @@
+BEGIN;
+
+SET ROLE epistemics_role;
+
+ALTER TABLE epistemics.experience_records
+    ADD COLUMN IF NOT EXISTS principal_id TEXT NOT NULL DEFAULT '',
+    ADD COLUMN IF NOT EXISTS context_scope_ref TEXT NOT NULL DEFAULT '',
+    ADD COLUMN IF NOT EXISTS problem_statement TEXT NOT NULL DEFAULT '',
+    ADD COLUMN IF NOT EXISTS applicability_conditions TEXT[] NOT NULL DEFAULT ARRAY[]::TEXT[],
+    ADD COLUMN IF NOT EXISTS why_succeeded_or_failed TEXT NOT NULL DEFAULT '';
+
+CREATE INDEX IF NOT EXISTS experience_records_principal_scope_recorded_idx
+    ON epistemics.experience_records (principal_id, context_scope_ref, recorded_at_unix_millis DESC);
+
+RESET ROLE;
+
+COMMIT;

database/migrations/054_experience_skill_reflex_learning_lifecycle.sql

@@ -0,0 +1,79 @@
+BEGIN;
+
+SET ROLE capability_role;
+
+ALTER TABLE capability.skill_profiles
+  ADD COLUMN IF NOT EXISTS applicability JSONB NOT NULL DEFAULT '{}'::jsonb,
+  ADD COLUMN IF NOT EXISTS dependency_refs TEXT[] NOT NULL DEFAULT '{}',
+  ADD COLUMN IF NOT EXISTS validation_evidence_refs TEXT[] NOT NULL DEFAULT '{}',
+  ADD COLUMN IF NOT EXISTS independent_evaluation_refs TEXT[] NOT NULL DEFAULT '{}',
+  ADD COLUMN IF NOT EXISTS known_failure_conditions TEXT[] NOT NULL DEFAULT '{}',
+  ADD COLUMN IF NOT EXISTS verified_outcome_count BIGINT NOT NULL DEFAULT 0,
+  ADD COLUMN IF NOT EXISTS must_not_worsen_satisfied BOOLEAN NOT NULL DEFAULT FALSE;
+
+ALTER TABLE capability.skill_profile_heads DROP CONSTRAINT IF EXISTS skill_profile_heads_status_check;
+ALTER TABLE capability.skill_profile_heads
+  ADD CONSTRAINT skill_profile_heads_status_check CHECK (status IN ('CANDIDATE','EVALUATING','VALIDATED','ACTIVE','DEGRADED','SUSPENDED','RETIRED'));
+
+CREATE TABLE IF NOT EXISTS capability.reflex_revisions (
+  reflex_id TEXT NOT NULL,
+  revision BIGINT NOT NULL CHECK (revision > 0),
+  principal_id TEXT NOT NULL,
+  source_skill_id TEXT NOT NULL,
+  source_skill_revision BIGINT NOT NULL CHECK (source_skill_revision > 0),
+  kind TEXT NOT NULL,
+  applicability JSONB NOT NULL,
+  implementation_ref TEXT NOT NULL,
+  implementation_version TEXT NOT NULL DEFAULT '',
+  artifact_digest TEXT NOT NULL DEFAULT '',
+  dependency_refs TEXT[] NOT NULL DEFAULT '{}',
+  validation_evidence_refs TEXT[] NOT NULL DEFAULT '{}',
+  known_failure_experience_refs TEXT[] NOT NULL DEFAULT '{}',
+  shadow_policy JSONB NOT NULL DEFAULT '{}'::jsonb,
+  revalidation_policy JSONB NOT NULL DEFAULT '{}'::jsonb,
+  last_validated_at BIGINT NOT NULL DEFAULT 0,
+  lifecycle TEXT NOT NULL,
+  supersedes_revision BIGINT NOT NULL DEFAULT 0,
+  execution_count BIGINT NOT NULL DEFAULT 0,
+  failure_count BIGINT NOT NULL DEFAULT 0,
+  divergence_count BIGINT NOT NULL DEFAULT 0,
+  recorded_at BIGINT NOT NULL CHECK (recorded_at > 0),
+  PRIMARY KEY (reflex_id, revision),
+  CHECK (lifecycle IN ('CANDIDATE','VALIDATING','ACTIVE','DEGRADED','STALE','REVALIDATING','SUSPENDED','RETIRED'))
+);
+CREATE TABLE IF NOT EXISTS capability.reflex_heads (
+  reflex_id TEXT PRIMARY KEY,
+  revision BIGINT NOT NULL,
+  lifecycle TEXT NOT NULL,
+  updated_at TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP
+);
+GRANT SELECT, INSERT, UPDATE ON capability.reflex_revisions, capability.reflex_heads TO capability_role;
+
+RESET ROLE;
+SET ROLE self_role;
+
+CREATE TABLE IF NOT EXISTS self.improvement_needs (
+  improvement_need_id TEXT PRIMARY KEY,
+  principal_id TEXT NOT NULL,
+  subject_ref JSONB NOT NULL,
+  problem_summary TEXT NOT NULL,
+  evidence_refs JSONB NOT NULL,
+  expected_benefit TEXT NOT NULL,
+  priority INTEGER NOT NULL,
+  state TEXT NOT NULL,
+  created_at_unix_millis BIGINT NOT NULL
+);
+ALTER TABLE self.learning_ledger
+  ADD COLUMN IF NOT EXISTS improvement_need_ref JSONB,
+  ADD COLUMN IF NOT EXISTS proposed_change_ref JSONB,
+  ADD COLUMN IF NOT EXISTS expected_improvement TEXT NOT NULL DEFAULT '',
+  ADD COLUMN IF NOT EXISTS evaluation_refs JSONB NOT NULL DEFAULT '[]'::jsonb,
+  ADD COLUMN IF NOT EXISTS development_gate_ref JSONB,
+  ADD COLUMN IF NOT EXISTS before_version_refs JSONB NOT NULL DEFAULT '[]'::jsonb,
+  ADD COLUMN IF NOT EXISTS after_version_refs JSONB NOT NULL DEFAULT '[]'::jsonb,
+  ADD COLUMN IF NOT EXISTS side_effects JSONB NOT NULL DEFAULT '[]'::jsonb,
+  ADD COLUMN IF NOT EXISTS rollback_ref JSONB;
+GRANT SELECT, INSERT, UPDATE ON self.improvement_needs, self.learning_ledger TO self_role;
+
+RESET ROLE;
+COMMIT;

database/migrations/055_self_weakness_diagnosis_and_benchmark.sql

@@ -0,0 +1,74 @@
+BEGIN;
+
+SET ROLE self_role;
+
+CREATE TABLE IF NOT EXISTS self.learning_signals (
+  signal_id TEXT PRIMARY KEY,
+  principal_id TEXT NOT NULL,
+  kind TEXT NOT NULL,
+  task_pattern TEXT NOT NULL,
+  scope_key TEXT NOT NULL,
+  subject_ref JSONB NOT NULL,
+  evidence_refs JSONB NOT NULL,
+  expected_outcome TEXT NOT NULL DEFAULT '',
+  actual_outcome TEXT NOT NULL DEFAULT '',
+  dependency_refs JSONB NOT NULL DEFAULT '[]'::jsonb,
+  environment_version TEXT NOT NULL DEFAULT '',
+  observed_at_unix_millis BIGINT NOT NULL,
+  severity INTEGER NOT NULL DEFAULT 0,
+  user_impact INTEGER NOT NULL DEFAULT 0,
+  correction_count INTEGER NOT NULL DEFAULT 0,
+  decision_regret TEXT NOT NULL DEFAULT ''
+);
+
+CREATE TABLE IF NOT EXISTS self.weakness_patterns (
+  assessment_id TEXT PRIMARY KEY,
+  principal_id TEXT NOT NULL,
+  revision BIGINT NOT NULL CHECK (revision > 0),
+  pattern_key TEXT NOT NULL,
+  task_pattern TEXT NOT NULL,
+  scope_key TEXT NOT NULL,
+  environment_version TEXT NOT NULL DEFAULT '',
+  dependency_refs JSONB NOT NULL DEFAULT '[]'::jsonb,
+  failure_mode TEXT NOT NULL,
+  detection_evidence_refs JSONB NOT NULL,
+  frequency INTEGER NOT NULL,
+  last_observed_at_unix_millis BIGINT NOT NULL,
+  severity INTEGER NOT NULL,
+  affected_component TEXT NOT NULL,
+  affected_strategy TEXT NOT NULL DEFAULT '',
+  confidence_millis BIGINT NOT NULL,
+  epistemic_status TEXT NOT NULL,
+  state TEXT NOT NULL,
+  recorded_at_unix_millis BIGINT NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS self.improvement_candidates (
+  candidate_id TEXT PRIMARY KEY,
+  principal_id TEXT NOT NULL,
+  need_ref JSONB NOT NULL,
+  hypothesis TEXT NOT NULL,
+  expected_effect TEXT NOT NULL,
+  evaluation_plan TEXT NOT NULL,
+  must_not_worsen JSONB NOT NULL,
+  rollback_plan TEXT NOT NULL,
+  resource_cost TEXT NOT NULL,
+  creator TEXT NOT NULL,
+  independent_evaluator TEXT NOT NULL,
+  state TEXT NOT NULL,
+  evidence_refs JSONB NOT NULL,
+  created_at_unix_millis BIGINT NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS self.personal_benchmark_cases (
+  case_id TEXT PRIMARY KEY,
+  principal_id TEXT NOT NULL,
+  task_class TEXT NOT NULL,
+  evidence_refs JSONB NOT NULL,
+  recorded_at_unix_millis BIGINT NOT NULL
+);
+
+GRANT SELECT, INSERT, UPDATE ON self.learning_signals, self.weakness_patterns, self.improvement_candidates, self.personal_benchmark_cases TO self_role;
+
+RESET ROLE;
+COMMIT;

deploy/apply-migrations.sh

@@ -25,6 +25,16 @@ psql_exec() {
   docker exec -i "$POSTGRES_CONTAINER" psql -v ON_ERROR_STOP=1 -U "$POSTGRES_SUPERUSER" -d "$DATABASE" "$@"
 }
 
+# Owner roles and schemas are provisioned by the dedicated bootstrap boundary,
+# before feature migrations run. This keeps role creation out of migrations and
+# makes existing PostgreSQL volumes converge idempotently as well.
+GEN2_BOOTSTRAP="$REPO_DIR/database/bootstrap/002_gen2_roles_and_schemas.sql"
+if [[ ! -f "$GEN2_BOOTSTRAP" ]]; then
+  echo "migration runner: Gen2 bootstrap is missing" >&2
+  exit 1
+fi
+psql_exec < "$GEN2_BOOTSTRAP"
+
 psql_exec -c "CREATE TABLE IF NOT EXISTS public.assistant_migration_history (migration_id TEXT PRIMARY KEY, applied_at_unix_millis BIGINT NOT NULL CHECK (applied_at_unix_millis > 0));"
 
 if [[ -n "${MIGRATION_BASELINE:-}" ]]; then

deploy/docker-compose.candidate-slot.yml

@@ -0,0 +1,151 @@
+# This file deliberately owns only one inactive release slot.  It joins the
+# stable project's shared network as an external resource, but has a distinct
+# Compose project name supplied by run-production-canary.sh.  Do not add
+# durable services or stable services here.
+services:
+  research-runtime:
+    build:
+      context: ..
+      dockerfile: deploy/images/runtime.Dockerfile
+      args: { TARGET: research-runtime, SOURCE_REVISION: "${ASSISTANT_SOURCE_REVISION:-unknown}" }
+    restart: "no"
+    environment:
+      LISTEN_ADDR: :8087
+      RESEARCH_SOURCE_ROOT: /var/lib/research-sources
+      RESEARCH_HTTP_ALLOWED_HOSTS: assistant.cin.su,git.cin.su
+      RESEARCH_SEARCH_URL_TEMPLATE: ${RESEARCH_SEARCH_URL_TEMPLATE:-https://www.bing.com/search?q=%s}
+      RESEARCH_SEARCH_ALLOWED_HOSTS: ${RESEARCH_SEARCH_ALLOWED_HOSTS:-www.bing.com}
+      POSTGRES_HOST: postgres
+      POSTGRES_PORT: "5432"
+      POSTGRES_DATABASE: ${POSTGRES_DB:-assistant}
+      EPISTEMICS_POSTGRES_USER: epistemics_role
+      EPISTEMICS_POSTGRES_CREDENTIAL_REF: credential://domovoy/epistemics/db-password/v1
+      SECRET_BACKEND_ROOT: /run/secrets
+    volumes:
+      - assistant_core_secrets:/run/secrets:ro
+      - assistant_research_sources:/var/lib/research-sources:ro
+    networks:
+      shared:
+        aliases: [research-runtime-candidate]
+    healthcheck:
+      test: ["CMD-SHELL", "wget -qO- http://localhost:8087/healthz >/dev/null && wget -qO- http://localhost:8087/readyz >/dev/null"]
+      interval: 10s
+      timeout: 10s
+      retries: 20
+
+  core-runtime:
+    build:
+      context: ..
+      dockerfile: deploy/images/runtime.Dockerfile
+      args: { TARGET: core-runtime, SOURCE_REVISION: "${ASSISTANT_SOURCE_REVISION:-unknown}" }
+    restart: "no"
+    environment:
+      LISTEN_ADDR: ":8080"
+      POSTGRES_HOST: postgres
+      POSTGRES_PORT: "5432"
+      POSTGRES_DATABASE: ${POSTGRES_DB:-assistant}
+      POSTGRES_USER: situation_role
+      POSTGRES_PASSWORD: ${SITUATION_DB_PASSWORD}
+      IDENTITY_POSTGRES_USER: identity_role
+      IDENTITY_POSTGRES_PASSWORD: ${IDENTITY_DB_PASSWORD}
+      CREATOR_USERNAME: ${CREATOR_USERNAME}
+      WORK_POSTGRES_USER: work_role
+      WORK_POSTGRES_PASSWORD: ${WORK_DB_PASSWORD}
+      CAPABILITY_POSTGRES_USER: capability_role
+      CAPABILITY_POSTGRES_PASSWORD: ${CAPABILITY_DB_PASSWORD}
+      SELF_POSTGRES_USER: self_role
+      SELF_POSTGRES_CREDENTIAL_REF: credential://domovoy/self/db-password/v1
+      EPISTEMICS_POSTGRES_USER: epistemics_role
+      EPISTEMICS_POSTGRES_CREDENTIAL_REF: credential://domovoy/epistemics/db-password/v1
+      INTERACTION_POSTGRES_USER: interaction_role
+      INTERACTION_POSTGRES_CREDENTIAL_REF: credential://domovoy/interaction/db-password/v1
+      SECRET_BACKEND_ROOT: /run/secrets
+      COGNITIVE_ADMISSION_POLICY_ID: creator-advisory-local-v1
+      COGNITIVE_ADMISSION_MAX_CONCURRENT: ${COGNITIVE_ADMISSION_MAX_CONCURRENT:-1}
+      COGNITIVE_ADMISSION_MAX_ACCEPTED_PER_HOUR: ${COGNITIVE_ADMISSION_MAX_ACCEPTED_PER_HOUR:-60}
+      COGNITIVE_ADMISSION_MAX_INPUT_BYTES: ${COGNITIVE_ADMISSION_MAX_INPUT_BYTES:-81920}
+      COGNITIVE_ADMISSION_MAX_OUTPUT_BYTES: ${COGNITIVE_ADMISSION_MAX_OUTPUT_BYTES:-16384}
+      COGNITIVE_RUNTIME_URL: http://cognitive-worker-candidate:8083
+      RESEARCH_RUNTIME_URL: http://research-runtime-candidate:8087
+    volumes:
+      - assistant_core_secrets:/run/secrets:ro
+    networks:
+      shared:
+        aliases: [core-runtime-candidate]
+    healthcheck:
+      test: ["CMD-SHELL", "wget -qO- http://localhost:8080/healthz >/dev/null && wget -qO- http://localhost:8080/readyz >/dev/null"]
+      interval: 10s
+      timeout: 20s
+      retries: 20
+
+  cognitive-worker:
+    build:
+      context: ..
+      dockerfile: deploy/images/runtime.Dockerfile
+      args: { TARGET: cognitive-worker, SOURCE_REVISION: "${ASSISTANT_SOURCE_REVISION:-unknown}" }
+    restart: "no"
+    environment:
+      LISTEN_ADDR: ":8083"
+      CORE_RUNTIME_URL: http://core-runtime-candidate:8080
+      LOCAL_CPU_PROVIDER_URL: http://docker.cin.su:18082/v1
+      LOCAL_CPU_PROVIDER_API_KEY_FILE: ${LOCAL_CPU_PROVIDER_API_KEY_FILE:-}
+      LOCAL_CPU_PROVIDER_CREDENTIAL_REF: ${LOCAL_CPU_PROVIDER_CREDENTIAL_REF:-credential://domovoy/local-cpu/provider-api-key/v1}
+      LOCAL_MEDIUM_PROVIDER_URL: ${LOCAL_MEDIUM_PROVIDER_URL:-http://llm-local-gateway:8080/v1}
+      LOCAL_MEDIUM_PROVIDER_API_KEY_FILE: ${LOCAL_MEDIUM_PROVIDER_API_KEY_FILE:-/run/secrets/llm_local_gateway_api_key}
+      LOCAL_MEDIUM_PROVIDER_CREDENTIAL_REF: ${LOCAL_MEDIUM_PROVIDER_CREDENTIAL_REF:-credential://domovoy/local-medium/provider-api-key/v1}
+      LOCAL_GPU_PROVIDER_TIMEOUT: ${LOCAL_GPU_PROVIDER_TIMEOUT:-60s}
+      LOCAL_LIFEBOAT_PROVIDER_URL: http://cognitive-lifeboat:8086/v1
+      LOCAL_IMAGE_PROVIDER_KIND: ${LOCAL_IMAGE_PROVIDER_KIND:-comfyui}
+      LOCAL_IMAGE_PROVIDER_URL: ${LOCAL_IMAGE_PROVIDER_URL:-http://comfyui:8188}
+      LOCAL_IMAGE_MODEL: ${LOCAL_IMAGE_MODEL:-z_image_turbo_bf16.safetensors}
+      COGNITIVE_OWNER_PRINCIPAL_ID: domovoy-creator-principal
+      COGNITIVE_ALLOW_CANARY: "true"
+    volumes:
+      - assistant_core_secrets:/run/secrets:ro
+    networks:
+      shared:
+        aliases: [cognitive-worker-candidate]
+      llm-local: {}
+    healthcheck:
+      test: ["CMD-SHELL", "wget -qO- http://localhost:8083/healthz >/dev/null && wget -qO- http://localhost:8083/readyz >/dev/null"]
+      interval: 10s
+      timeout: 20s
+      retries: 20
+
+  creator-web:
+    build:
+      context: ..
+      dockerfile: deploy/images/runtime.Dockerfile
+      args: { TARGET: creator-web, SOURCE_REVISION: "${ASSISTANT_SOURCE_REVISION:-unknown}" }
+    restart: "no"
+    environment:
+      LISTEN_ADDR: ":8084"
+      CORE_RUNTIME_URL: http://core-runtime-candidate:8080
+      CONTINUITY_RUNTIME_URL: http://continuity-runtime:8081
+      COMMIT_RUNTIME_URL: http://commit-runtime:8082
+      COGNITIVE_RUNTIME_URL: http://cognitive-worker-candidate:8083
+      AGENT_WORKER_URL: http://agent-worker:8090
+      ASSISTANT_BUILD_REVISION: ${ASSISTANT_SOURCE_REVISION:-unknown}
+    networks:
+      shared:
+        aliases: [creator-web-candidate]
+    healthcheck:
+      test: ["CMD-SHELL", "wget -qO- http://localhost:8084/healthz >/dev/null"]
+      interval: 10s
+      timeout: 5s
+      retries: 20
+
+volumes:
+  assistant_core_secrets:
+    external: true
+  assistant_research_sources:
+    name: assistant_research_sources
+    external: true
+
+networks:
+  shared:
+    name: assistant_default
+    external: true
+  llm-local:
+    name: llm-local_default
+    external: true

deploy/docker-compose.prod.yml

@@ -65,20 +65,17 @@ services:
       POSTGRES_PASSWORD: ${SITUATION_DB_PASSWORD}
       IDENTITY_POSTGRES_USER: identity_role
       IDENTITY_POSTGRES_PASSWORD: ${IDENTITY_DB_PASSWORD}
-      CREATOR_BOOTSTRAP_TOKEN_FILE: /run/secrets/creator_bootstrap_token
-      CREATOR_SESSION_SIGNING_KEY_FILE: /run/secrets/creator_session_signing_key
       CREATOR_USERNAME: ${CREATOR_USERNAME}
-      CREATOR_PASSWORD_FILE: /run/secrets/creator_password
       WORK_POSTGRES_USER: work_role
       WORK_POSTGRES_PASSWORD: ${WORK_DB_PASSWORD}
       CAPABILITY_POSTGRES_USER: capability_role
       CAPABILITY_POSTGRES_PASSWORD: ${CAPABILITY_DB_PASSWORD}
+      SELF_POSTGRES_USER: self_role
+      SELF_POSTGRES_CREDENTIAL_REF: credential://domovoy/self/db-password/v1
       EPISTEMICS_POSTGRES_USER: epistemics_role
       EPISTEMICS_POSTGRES_CREDENTIAL_REF: credential://domovoy/epistemics/db-password/v1
-      EPISTEMICS_POSTGRES_PASSWORD_FILE: /run/secrets/epistemics_db_password
       INTERACTION_POSTGRES_USER: interaction_role
       INTERACTION_POSTGRES_CREDENTIAL_REF: credential://domovoy/interaction/db-password/v1
-      INTERACTION_POSTGRES_PASSWORD_FILE: /run/secrets/interaction_db_password
       SECRET_BACKEND_ROOT: /run/secrets
       COGNITIVE_ADMISSION_POLICY_ID: creator-advisory-local-v1
       COGNITIVE_ADMISSION_MAX_CONCURRENT: ${COGNITIVE_ADMISSION_MAX_CONCURRENT:-1}
@@ -88,6 +85,11 @@ services:
     depends_on: { postgres: { condition: service_healthy } }
     volumes:
       - assistant_core_secrets:/run/secrets:ro
+    healthcheck:
+      test: ["CMD-SHELL", "wget -qO- http://localhost:8080/healthz >/dev/null && wget -qO- http://localhost:8080/readyz >/dev/null"]
+      interval: 10s
+      timeout: 20s
+      retries: 20
 
   agent-canary:
     profiles: ["agent-canary"]
@@ -182,7 +184,6 @@ services:
       POSTGRES_DATABASE: ${POSTGRES_DB:-assistant}
       EPISTEMICS_POSTGRES_USER: epistemics_role
       EPISTEMICS_POSTGRES_CREDENTIAL_REF: credential://domovoy/epistemics/db-password/v1
-      EPISTEMICS_POSTGRES_PASSWORD_FILE: /run/secrets/epistemics_db_password
       SECRET_BACKEND_ROOT: /run/secrets
     depends_on: { postgres: { condition: service_healthy } }
     volumes:
@@ -202,12 +203,16 @@ services:
       POSTGRES_DATABASE: ${POSTGRES_DB:-assistant}
       EPISTEMICS_POSTGRES_USER: epistemics_role
       EPISTEMICS_POSTGRES_CREDENTIAL_REF: credential://domovoy/epistemics/db-password/v1
-      EPISTEMICS_POSTGRES_PASSWORD_FILE: /run/secrets/epistemics_db_password
       SECRET_BACKEND_ROOT: /run/secrets
     depends_on: { postgres: { condition: service_healthy } }
     volumes:
       - assistant_core_secrets:/run/secrets:ro
       - assistant_research_sources:/var/lib/research-sources:ro
+    healthcheck:
+      test: ["CMD-SHELL", "wget -qO- http://localhost:8087/healthz >/dev/null && wget -qO- http://localhost:8087/readyz >/dev/null"]
+      interval: 10s
+      timeout: 10s
+      retries: 20
 
   continuity-runtime:
     build: { context: .., dockerfile: deploy/images/runtime.Dockerfile, args: { TARGET: continuity-runtime, SOURCE_REVISION: "${ASSISTANT_SOURCE_REVISION:-unknown}" } }
@@ -253,8 +258,10 @@ services:
       LOCAL_CPU_PROVIDER_URL: http://docker.cin.su:18082/v1
       LOCAL_CPU_PROVIDER_API_KEY_FILE: ${LOCAL_CPU_PROVIDER_API_KEY_FILE:-}
       LOCAL_CPU_PROVIDER_CREDENTIAL_REF: ${LOCAL_CPU_PROVIDER_CREDENTIAL_REF:-credential://domovoy/local-cpu/provider-api-key/v1}
-      LOCAL_MEDIUM_PROVIDER_URL: ${LOCAL_MEDIUM_PROVIDER_URL:-http://llm-local-api:8080/v1}
-      LOCAL_MEDIUM_PROVIDER_API_KEY_FILE: ${LOCAL_MEDIUM_PROVIDER_API_KEY_FILE:-}
+      # The medium chat route is served by the authenticated local gateway.
+      # llm-local-api is the embeddings service and must not be used for chat.
+      LOCAL_MEDIUM_PROVIDER_URL: ${LOCAL_MEDIUM_PROVIDER_URL:-http://llm-local-gateway:8080/v1}
+      LOCAL_MEDIUM_PROVIDER_API_KEY_FILE: ${LOCAL_MEDIUM_PROVIDER_API_KEY_FILE:-/run/secrets/llm_local_gateway_api_key}
       LOCAL_MEDIUM_PROVIDER_CREDENTIAL_REF: ${LOCAL_MEDIUM_PROVIDER_CREDENTIAL_REF:-credential://domovoy/local-medium/provider-api-key/v1}
       LOCAL_GPU_PROVIDER_TIMEOUT: ${LOCAL_GPU_PROVIDER_TIMEOUT:-60s}
       LOCAL_LIFEBOAT_PROVIDER_URL: http://cognitive-lifeboat:8086/v1
@@ -263,10 +270,17 @@ services:
       LOCAL_IMAGE_MODEL: ${LOCAL_IMAGE_MODEL:-z_image_turbo_bf16.safetensors}
       COGNITIVE_OWNER_PRINCIPAL_ID: domovoy-creator-principal
       COGNITIVE_ALLOW_CANARY: "true"
-    depends_on: [core-runtime, cognitive-lifeboat]
     volumes:
       - assistant_core_secrets:/run/secrets:ro
     networks: [default, llm-local]
+    depends_on:
+      core-runtime: { condition: service_started }
+      cognitive-lifeboat: { condition: service_healthy }
+    healthcheck:
+      test: ["CMD-SHELL", "wget -qO- http://localhost:8083/healthz >/dev/null && wget -qO- http://localhost:8083/readyz >/dev/null"]
+      interval: 10s
+      timeout: 20s
+      retries: 20
 
   cognitive-lifeboat:
     image: ghcr.io/ggml-org/llama.cpp:server
@@ -277,7 +291,7 @@ services:
       - --port
       - "8086"
       - --model
-      - /models/Qwen3-8B-Q4_K_M.gguf
+      - /models/Qwen3.8-27B-UD-Q2_K_XL.gguf
       - --alias
       - domovoy-lifeboat
       - --jinja
@@ -299,6 +313,29 @@ services:
       timeout: 3s
       retries: 10
 
+  supervisor:
+    build: { context: .., dockerfile: deploy/images/runtime.Dockerfile, args: { TARGET: supervisor, SOURCE_REVISION: "${ASSISTANT_SOURCE_REVISION:-unknown}" } }
+    restart: unless-stopped
+    environment:
+      LISTEN_ADDR: ":8080"
+      SUPERVISOR_CONTROL_ADDR: ":8095"
+      SUPERVISOR_STATE_PATH: /var/lib/supervisor/release-state.json
+      SUPERVISOR_STABLE_UPSTREAM: http://creator-web:8084
+      SUPERVISOR_CANDIDATE_UPSTREAM: http://creator-web-candidate:8084
+      SUPERVISOR_BASELINE_RELEASE: ${ASSISTANT_SOURCE_REVISION:-unknown}
+    ports:
+      - "${CREATOR_WEB_PORT:-18080}:8080"
+      - "127.0.0.1:${SUPERVISOR_CONTROL_PORT:-18085}:8095"
+    depends_on:
+      creator-web: { condition: service_healthy }
+    volumes:
+      - assistant_supervisor_state:/var/lib/supervisor
+    healthcheck:
+      test: ["CMD-SHELL", "wget -qO- http://localhost:8080/healthz >/dev/null && wget -qO- http://localhost:8080/readyz >/dev/null"]
+      interval: 10s
+      timeout: 5s
+      retries: 20
+
   creator-web:
     build: { context: .., dockerfile: deploy/images/runtime.Dockerfile, args: { TARGET: creator-web, SOURCE_REVISION: "${ASSISTANT_SOURCE_REVISION:-unknown}" } }
     restart: unless-stopped
@@ -310,8 +347,11 @@ services:
       COGNITIVE_RUNTIME_URL: http://cognitive-worker:8083
       AGENT_WORKER_URL: http://agent-worker:8090
       ASSISTANT_BUILD_REVISION: ${ASSISTANT_SOURCE_REVISION:-unknown}
-    ports: ["${CREATOR_WEB_PORT:-18080}:8084"]
-    depends_on: [core-runtime, continuity-runtime, commit-runtime, cognitive-worker]
+    depends_on:
+      core-runtime: { condition: service_started }
+      continuity-runtime: { condition: service_started }
+      commit-runtime: { condition: service_started }
+      cognitive-worker: { condition: service_healthy }
     healthcheck:
       test: ["CMD-SHELL", "wget -qO- http://localhost:8084/healthz >/dev/null"]
       interval: 10s
@@ -333,6 +373,7 @@ volumes:
     external: true
   assistant_research_sources:
     name: assistant_research_sources
+  assistant_supervisor_state:
 
 networks:
   llm-local:

deploy/images/postgres.Dockerfile

@@ -4,5 +4,6 @@ LABEL org.opencontainers.image.revision=$SOURCE_REVISION \
       org.opencontainers.image.source="https://git.cin.su/m/Assistant.git"
 
 COPY database/bootstrap/001_roles_and_schemas.sql /docker-entrypoint-initdb.d/001_roles_and_schemas.sql
+COPY database/bootstrap/002_gen2_roles_and_schemas.sql /docker-entrypoint-initdb.d/002_gen2_roles_and_schemas.sql
 COPY deploy/images/002_owner_passwords.sh /docker-entrypoint-initdb.d/002_owner_passwords.sh
 RUN chmod 0555 /docker-entrypoint-initdb.d/002_owner_passwords.sh

deploy/images/runtime.Dockerfile

@@ -11,6 +11,7 @@ ARG SOURCE_REVISION=unknown
 LABEL org.opencontainers.image.revision=$SOURCE_REVISION \
       org.opencontainers.image.source="https://git.cin.su/m/Assistant.git"
 RUN addgroup -S assistant && adduser -S -G assistant assistant
+RUN mkdir -p /var/lib/supervisor && chown assistant:assistant /var/lib/supervisor
 USER assistant
 COPY --from=build /out/runtime /usr/local/bin/assistant-runtime
 ENTRYPOINT ["/usr/local/bin/assistant-runtime"]

deploy/production-stable-updater.sh

@@ -0,0 +1,55 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Stable-only production updater. Candidate slots are managed exclusively by
+# their isolated release command and Supervisor; this controller never starts
+# or reconciles a candidate service.
+BASE_DIR="${BASE_DIR:-/home/m/assistant-deploy}"
+REPO_DIR="${REPO_DIR:-$BASE_DIR/repo}"
+ENV_FILE="${ENV_FILE:-$BASE_DIR/production-compose.env}"
+COMPOSE_FILE="$REPO_DIR/deploy/docker-compose.prod.yml"
+LOG_FILE="${LOG_FILE:-$BASE_DIR/deploy.log}"
+LOCK_FILE="${LOCK_FILE:-/tmp/assistant-stable-deploy.lock}"
+stable_services=(postgres core-runtime continuity-runtime commit-runtime cognitive-worker creator-web notification-receiver research-runtime agent-worker work-graph-runtime)
+
+exec 9>"$LOCK_FILE"
+flock -n 9 || exit 0
+log() { printf '%s %s\n' "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "$*" >>"$LOG_FILE"; }
+fail() { log "FAILED: $*"; exit 1; }
+compose() { docker compose --env-file "$ENV_FILE" -f "$COMPOSE_FILE" "$@"; }
+
+cd "$REPO_DIR"
+git fetch --prune origin main >>"$LOG_FILE" 2>&1
+git merge --ff-only origin/main >>"$LOG_FILE" 2>&1 || fail "stable checkout is not a fast-forward to origin/main"
+revision="$(git rev-parse HEAD)"
+[[ "$revision" =~ ^[0-9a-f]{40}$ ]] || fail "invalid source revision"
+
+if ! REPO_DIR="$REPO_DIR" ENV_FILE="$ENV_FILE" bash "$REPO_DIR/deploy/apply-migrations.sh" >>"$LOG_FILE" 2>&1; then
+  fail "migration application failed"
+fi
+compose config >/dev/null 2>>"$LOG_FILE" || fail "stable compose config validation failed"
+
+all_current=1
+for service in "${stable_services[@]}"; do
+  container="assistant-${service}-1"
+  label="$(docker inspect "$container" --format '{{index .Config.Labels "org.opencontainers.image.revision"}}' 2>/dev/null || true)"
+  [[ "$label" == "$revision" ]] || all_current=0
+done
+if [[ "$all_current" == 1 ]]; then log "SKIP stable revision=$revision"; exit 0; fi
+
+log "BUILD stable revision=$revision"
+ASSISTANT_SOURCE_REVISION="$revision" compose build --build-arg "SOURCE_REVISION=$revision" "${stable_services[@]}" >>"$LOG_FILE" 2>&1
+log "UP stable revision=$revision"
+ASSISTANT_SOURCE_REVISION="$revision" compose up -d --no-build "${stable_services[@]}" >>"$LOG_FILE" 2>&1
+
+for attempt in $(seq 1 30); do
+  if curl -fsS --max-time 5 https://assistant.cin.su/healthz >/dev/null 2>&1; then break; fi
+  [[ "$attempt" == 30 ]] && fail "public health failed"
+  sleep 10
+done
+for service in "${stable_services[@]}"; do
+  container="assistant-${service}-1"
+  label="$(docker inspect "$container" --format '{{index .Config.Labels "org.opencontainers.image.revision"}}' 2>/dev/null || true)"
+  [[ "$label" == "$revision" ]] || fail "artifact drift container=$container"
+done
+log "OK stable revision=$revision"