NetDocuments investigation — design spec

2026-09-17 addendum — evidentiary grounding and v5 continuation (implemented in the lane worktree)

Opened in progress and implemented on 2026-09-17; final verification and paid synthetic adjudication are recorded below, with historical metadata and enablement unchanged. This addendum supersedes historical v4 receipt wording, not authorization, concurrency, accounting, retention or request limits. Exact quotation is not entailment: definitions, obligations and conditional scenarios do not establish approval, pending/non-approval or adoption. Explicit dated acts/status records support their corresponding scoped conclusions; a factual budget answer need not exhaust the corpus.

• Bounded durable receipt-origin and completed-work snapshots distinguish current, retained, superseded and legacy-unknown synthesis. Replay is independent; prior completed work is explicitly labeled, not charged as current work. Missing legacy provenance remains unknown. A later completed generation prevents an older replay from claiming fresh synthesis.
• Coverage prose is server-derived from recorded searches, refresh/drift flags, distinct fetched documents and repeated/incomplete windows; it is not an exhaustive corpus or unread-lead inventory. Model coverage prose is separate and marked with origin/historical provenance. Immutable tool bodies are unchanged. Guidance follows the emitted continuation handle, not a blanket “budget ceiling”.
• Lua derives counter saturation from existing limits and preserves typed non-counter terminal authority across generations and older replay. Known terminal claims are generation-neutral; safe completed-receipt replay still fresh-checks citations. Terminal lineages advertise neither continuation nor research-get execution retry. Revocation wipes source context and forbids replay while preserving terminal authority; uncertainty or cited-material change withholds unsafe synthesis. Unpersisted observations after uncertain storage failure may need bounded rediscovery through the existing recovery generations.
• Four synthetic Opus 5 low fixtures and bounded exact exposed-window reports separate mechanical grounding/accounting from independent semantic review. Initial answer, actual-handle corrective guidance and exact replay are recorded separately. Semantic heuristics cannot veto mechanical exit; truncation explicitly withholds semantic judgment. Coverage narration may report observed metadata and completed operations, never characterize unseen material or infer absence/status from it.

Final verification: runtime 5,194 Vitest + 139 and 77 Bun tests passed, 171 skipped; five scoped suites 369 passed with one opt-in PostgreSQL proof unrun; connector limiter eight passed; eval 72 passed; 14 temporary mutants failed as intended and were restored. bun run lint && bun run typecheck && bun run eval:gate:cheap exited 0. Cheap router gated cases passed 4/4; four nongated boundary cases scored 0/5 versus an earlier 5/5: variability, not a claimed regression fix or all-router-case pass. Memory passed 9/9 with a 48-active versus 20-cap warning. Final prompt pressure proof: system 4,974 bytes, rejected preflight 120,241, largest accepted preflight 101,952, largest actual request 85,689; limit remains 120,000. See contract §10.

Paid rerun c74b2c690f0018c353de174b53555e6e12100189c3af6359fb27b9a6477b2e72: four fixtures, six reports, six answers and 21 findings; independent Astra LOW and Fable MEDIUM semantic PASS, with no report-truncated evidence. Corrective generation 1 produced new current synthesis with one new research read and two model calls. Replay used zero models, zero research reads and $0 model cost, while accounting for four revalidations.

The first paid run failed whole-report acceptance only on unread-content characterization; a generic three-line prompt correction fixed that discipline, and the latest run contains no such extrapolation. An immediately self-corrected lead ID is a minor presentation defect, not a materially false final claim. The factual zero-hit find result remains independently unverified because query/hits are not exposed; only the operation's occurrence is corroborated. Exact source-length assertions are not uniformly independently verified. Semantic PASS is not blanket metadata verification; final gates passed with the nongated diagnostics noted above, and no CI/PR, merge, deploy or enablement is claimed.

2026-09-14 top addendum — direct-first research with a shared server-side research record (implemented in the lane worktree 2026-09-14; default-off)

Status and authority. Approved design, amended 2026-09-14 after two independent reviews (omp Astra HIGH and a fresh Fable HIGH in Claude Code); the design and amendments below are implemented. kwiss approved implementation and the fixed 30-minute retention; the two former open product questions are closed. Implementation status, 2026-09-14: implemented by the Fable HIGH worker (normal Claude Code subscription) in the lane worktree, uncommitted, default-off behind APP_NETDOCS_INVESTIGATION_ENABLED. Verification: independent focused suites 216 passed, 2 skipped, 0 failed (research 45 passed; investigation 124 passed, 1 skipped; state 47 passed, 1 skipped); full runtime 5554 passed; cheap eval coverage 11/11, retrieval 27/28, router 4/4, memory 9/9; actual MCP smoke 2 direct reads, save/get, Opus 5 low escalation with 3 findings, 3 citations, 2 documents in 109.7s; exact-quote save/get 4 calls, 2.8s on a 22911-character window; web production build passed. Test seat deviation recorded: independent non-Claude tests are written by the omp @write Astra HIGH seat at its unchanged configured model and effort, because no dedicated test-writer seat exists. kwiss approved the direction (the host's own model researches with the ordinary NetDocuments tools, saves and retrieves research state, and escalates to deep search when direct work is insufficient) and asked for a concrete design before any worker starts. Agreed scope: direct-first research, one shared server-side research record, escalation to north__netdocs_deep_search defaulting to Opus 5 low on the approved Bedrock ZDR route. Out of scope: new product features or UI, ingestion, a generic platform, third-party services, cloud writes, wider model selection. Motivating evidence: the same private budget question passed once through actual MCP with Opus 5 low (both expected workbooks, 5 validated citations, 81 s, $0.926140) and once through a fresh direct Fable low host (both workbooks in 67 s, 7 of 8 quotes exact). That is one budget-discovery case; nothing here claims full-workbook, latest or approval coverage, or release readiness. Seat deviation, recorded with its reason: this design was authored by Devin Fusion (Claude Fable 5.1 high with an SWE-2 medium sidekick) because kwiss explicitly asked for it, in place of the @plan Astra seat; no product code was written. The plan review ran as Astra HIGH rather than the seat table's effort because custody and paid lineage span two stores (the research record and the investigation state); the Fable HIGH review is the normal Claude Code subscription.

Source of truth. The 2026-09-14 lane tree and scorecard govern; the 2026-09-11 traversal, limit tables and frozen-exposure paragraphs below are history. Preserved from the current code, unchanged: access checks on every new typed read, one deduplicated revalidation of carried history on an actual resume, fresh exact cited-window re-reads at publication and replay, the immutable transcript, three money-turn slots, $5/$15/$50 money guards, charge ledgers without TTL, the 524,288-byte context, fixed 30-minute expiry, three live investigations per actor. No per-model traversal returns; no money key or unknown liability is reset when a content format changes.

Review amendments, 2026-09-14 — implemented corrections that replace any contradictory draft statement below

1. Decisions closed. Retention is the fixed 30-minute TTL. The existing model selector stays; a record-started escalation only defaults to Opus 5 low. Bounds, money guards and unknown-money liabilities are unchanged.
2. Foreign handles never mutate. A foreign, invalid or mismatched-binding handle fails without touching any owner record or slot set; nothing is deleted on a foreign-handle lookup. Only owner-authorized, server-observed source revocation can invalidate owner state.
3. Retained observations are revalidated on actual retrieval. Before get, the escalation import or a later resume exposes retained source metadata, quotes or notes, the server runs one bounded, deduplicated fresh validation of the carried source observations, the same policy as the investigator's resume: revoked or materially changed observations withhold the old content; an outage or deadline withholds it and keeps the private state. This runs on retrieval and resume only, never around each model thought. Imported direct observations live in an explicit, non-citable researchImport field of the investigation context, never as fabricated native tool messages or sources[] entries, so later resumes cannot bypass it; stripping title and url is insufficient because IDs, notes and citations can also disclose retained material. Revalidation of a direct observation re-reads its ORIGINAL exposed range and fingerprint (up to 60,000 characters); native observations keep their 3,500-code-point window semantics; a direct fingerprint is never truncated to the first 3,500 code points to fit native validation.
4. Actionable typed leads are kept. The record saves the server-observed typed search result IDs, the response next_page_token and reported counts, find-hit offsets and the source args and fingerprints, marked historical; no rendered-MCP parsing and no reliance on host notes to reconstruct leads. Aggregate bytes are bounded and an omission is an explicit record_full / omitted status, never silent loss. Every direct operation that influenced the research is captured when a handle is supplied, including browse and list_attributes schema provenance; their ordinary no-handle behaviour is unchanged.
5. Paid handoff is idempotent. Before any investigation is created, one server-generated stable investigation nonce plus the pinned selection and request are persisted atomically in the record. state.start gains a trusted create-or-recover form keyed by that nonce that checks identity, request and selection, atomically seeds the immutable researchImport descriptor and snapshot into the NEW investigation context on creation, never overwrites an existing context, and never overwrites money or unknown liabilities. A retry after pending-before-create, create-before-link or a lost response recovers the same session, and a lost create response before the first claim recovers generation zero with its import, never an empty ordinary-resume context; the link is persisted before any model execution; concurrent calls cannot create separate lineages. Eviction protection begins atomically with that persistence: a record with a pending creation or linking, or a persisted link, is never evicted, and a concurrent fourth open is refused when no unprotected record exists. A context seeded with researchImport expires no later than the record it came from (fixed 30 minutes from the record's open); the trusted create form pins that bound with the nonce, request and selection, recovery never extends it, ordinary starts keep their own 30 minutes, and the money and late-settlement records keep their ordinary TTL. Ordinary continuation semantics are unchanged.
6. Stable linkage and read-only inspection. The record keeps its link to the investigation. get resolves the latest persisted active, continuation or completed generation, including after a lost finish reply, and returns current checked progress and the handle without a model call and without touching budget or admission counters; a duplicate escalation uses that latest state, never a generation-zero replay. During an active handoff, direct mutations of the imported snapshot are refused so the model never resumes a moving import; no-handle direct reads stay available. The getter returns safe structured progress, never private model reasoning.
7. Confidentiality stated as it is. No full server-read bodies or search snippets are stored; bounded citation quotes and the untrusted host notes and pending text are stored as plain private Redis JSON. Sentinel tests target source observations, not all host text. Retrieval checks run under bounded deadlines: an unfinished check says unavailable, preserves state and never implies verified. Eight windows per save is a maximum, not a guarantee that all eight finish within the 45 s tool budget; there is no two-window cap.

Why a separate typed read journal, not the investigation transcript

The investigation context (investigationContextSchema) is model-coupled: every sources[] entry points at a stored LangChain tool reply (message index, the "Dangling source" refinement), citation resolution reads the quote out of that stored body, a claim takes the per-actor executing lock and charges active time against a 600,000 ms lifetime, and the envelope allows three generations. A direct-first host has no server-side model turn: its reads are many, often parallel, spread over minutes, and return up to 60,000 characters that the transcript cannot hold (one such window at four bytes per code point exceeds the 120,000-byte wire cap by itself). Forcing direct reads into that transcript would mean synthesising tool turns, truncating bodies the host actually saw (so an honest host quote fails as "unobserved"), and spending the investigation's time and slot budgets on non-model work. A separate research record is therefore genuinely simpler: a typed, append-only provenance journal with no model transcript, no money and no generations. It reuses the source schema fields, investigationFingerprint, the HMAC handle scheme, the identity binding, the production Redis client and the typed read client; it does not reuse the envelope, the claim/lease protocol or the Lua money block.

The record

• Identity and handle. {organization, actor, binding} exactly as the investigator computes it (binding from createNetDocsReadClient().authorize(), so a connector, scope, mode, endpoint or token-lease change is a different identity, with the same token-refresh sensitivity the investigator has today). Handle <nonce>.r.<hmac>, domain netdocs-research:v1, signed through the same injected signHandle (server HMAC-SHA256 over BETTER_AUTH_SECRET, as createInvestigationState does today); it cannot parse as a continuation handle. Storage, described as it is: plain JSON written by Lua (cjson.encode, SET … PXAT) into the private Redis the investigation state already uses, keyed app:netdocs-research:{record}:record:<digest(nonce)> plus global/org/actor slot sets (300/30/3), readable only through a valid signed handle whose identity digest matches, with a fixed TTL. It is not application-encrypted, the investigation envelope is not either, and this design adds no encryption layer. A fourth open for one actor evicts that actor's oldest unprotected record; a record is protected from the moment its escalation nonce, request and selection are persisted, through pending creation and linking and while linked, and open is refused when no unprotected record exists. A foreign, invalid or mismatched-binding handle fails without mutating any owner record or slot set.
• Shape (researchRecordSchema, new leaf netdocs-research-record.ts): {version: 1, request ≤ 4,000, opened, expires, revision, sequence, sources[] ≤ 80, notes ≤ 4,000 chars, pending[] ≤ 20 × 200 chars, citations[] ≤ 12, escalation?}, whole envelope ≤ 32,768 UTF-8 bytes so an import leaves most of the 120,000-byte wire to the investigation. A source is investigationSourceSchema without message, call and historical, plus returned (search hits) and served (fetch characters): operation, canonical args, document, offset, offsetConfirmed, total, incomplete, title, url, at, source (provider or fallback), fingerprint, failed. A search source also keeps the typed result IDs, next_page_token and reported counts, a find source its hit offsets, all marked historical, within a bounded aggregate byte budget (overflow is an explicit record_full / omitted status). No full server-read body or search snippet is ever stored; bounded citation quotes (≤ 300) and host notes/pending text are stored as plain private Redis JSON. The record is provenance of what the server itself served, never evidence.
• Retention. Fixed 30 minutes from open (INVESTIGATION_LIMITS.expiresMs), non-sliding; save does not extend it. This is scratch continuation for one working session, the same class as a continuation handle. It is not saved research across days, and the tool descriptions and procedure text say so. Longer or sliding retention of confidential provenance is the product decision listed at the end, not taken here.
• Trust. Host notes and pending are stored and returned verbatim as UNTRUSTED host text; they never become sources, citations or policy. A citation reaches verified only when the server's own fresh re-read contains the quote exactly.

Operations: one MCP tool, north__netdocs_research, and one optional field on three direct reads

1. open {request} → {research_handle, expires_at, procedure}. Authorizes (binding), creates the record, returns the research procedure text below. No provider read.
2. Recorded direct reads. north__netdocs_search, north__netdocs_fetch and north__netdocs_find_in_document accept an optional research_handle. With it, the adapter runs the read through createNetDocsReadClient (netdocs.ts:164), which invokes the same inner tool under readScope so the typed result is taken from the existing captureRead hook (netdocs.ts:128), never by parsing the rendered MCP text; a new option authorization: "pooled" keeps the ordinary RLS pool path rather than the raw-socket investigation path and its four slots, and the read() result gains the rendered host text next to the typed data. Consequences, stated plainly: a recorded read is always a fresh provider read (inside readScope the 10-minute document session cache is bypassed), the served-ID mismatch refusal applies, the binding is checked against the record on every append, and the reply's first server-authored line is research: recorded or research: not_recorded reason=<record_full|omitted|expired|binding_changed|not_enabled>; the read result itself is returned either way. north__netdocs_browse and north__netdocs_list_attributes also accept the handle and are recorded as schema provenance when it is supplied; without it they behave exactly as today. Without the field every direct read behaves exactly as today; the inner LangChain schemas and the product toolbelt are unchanged, the field exists on the MCP definitions only.
3. save {research_handle, revision, notes?, pending?, citations?} → {revision, citations[]}. Revision CAS (stale on mismatch; the host re-gets). Each citation {document, quote ≤ 300} is verified only against a recorded fetch source of that document: the server re-runs that source's typed fetch fresh (same offset and served length, up to 60,000 characters), requires the quote as an exact substring of the fresh text, and stores {document, quote, offset | null, window: {offset, served}, status, verified_at}, where offset is the absolute code-point position when the provider confirmed the window offset. Statuses: verified; unobserved (in no recorded window, or not exact); changed (recorded fingerprint differs); revoked (access withdrawn: the record is deleted and the call fails closed); unavailable (outage or deadline: record kept, nothing claimed). At most 12 citations and 8 distinct windows per save; more is refused before any read. Text the host pasted into notes is never checked as a citation.
4. get {research_handle} → the record, after authorize() and a binding match (mismatch or another actor: restart, nothing disclosed, nothing mutated). Before any retained source metadata, quote or note is exposed, the carried source observations are revalidated once, fresh and deduplicated, exactly as the investigator's resume does: revoked or materially changed observations are withheld, an outage or deadline withholds them as unavailable and keeps the state. Sources remain provenance, and the host must fetch to quote. When the record links an investigation, get also resolves its latest persisted generation (active, continuation or completed, including after a lost finish reply) and returns checked progress and the current handle without a model call or any counter change. Citations are re-verified fresh, a located one through a 3,500-code-point window at its offset and an unlocated one through its originating window, deduplicated by document and window; a deadline mid-way leaves the rest unavailable. This is the one deduplicated revalidation on an actual resume in the direct flow. Also returned: a coverage summary (searches with their observed next_page and reported marked historical, documents with windows read), notes, pending, expires_at, and the procedure text.
5. Escalation. north__netdocs_deep_search {research_handle, model?, effort?} is a third start form, never mixed with request or continuation_handle. Order: load and authorize the record as in get; atomically persist a server-generated stable investigation nonce with the pinned selection and request into escalation before anything is created; state.start in its trusted create-or-recover form keyed by that nonce (identity, request and selection checked; the immutable researchImport descriptor and snapshot seeded atomically into the new context on creation; an existing context, money and unknown liabilities never overwritten), default pair opus/low when omitted (explicit supported pairs unchanged); persist the link before any model execution. A retry after pending-before-create, create-before-link or a lost response recovers the same session, and concurrent calls cannot create separate lineages. A later call on a linked record continues from the latest persisted generation, never a generation-zero replay: no new slot, no new reservation. While the handoff is active, appends and saves against the imported snapshot are refused; no-handle direct reads stay available. The first DATA message carries the import block: recorded sources as provenance, the fresh citation statuses from the import-time recheck (the same bounded recheck as get, charged as refresh attempts), notes and pending as UNTRUSTED caller text, and the statement that nothing imported is evidence and that located citations name the netdocs_fetch offset to read. Nothing from the record enters the transcript as a citable body, so the investigator's existing exact-quote, revocation and change guards hold unchanged; a revoked cited document at import stops authorization/research_cited_revoked with its content withheld; the record and its link are retained. The imported provenance lives in the context's non-citable researchImport field, so later resumes of the escalated investigation revalidate it once, at their original exposed range and fingerprint, and cannot bypass it.

Byte and trust mismatch, resolved

Direct fetch serves up to 60,000 characters, possibly from the in-process session cache; the investigator retains 3,500-code-point provider windows. The record takes neither body: it stores served length, offset, a fingerprint and, for citations, the bounded quote the host asked to verify, and every verification is a fresh provider read. A host may therefore quote from a 60,000-character window and still obtain verified, because the check re-reads that window rather than a truncated copy; the escalated investigator never sees direct text at all and re-reads 3,500-code-point windows at the located offsets. Recorded reads bypass the session cache by construction, so source: "session" never appears in a record.

Host procedure (returned by open and get; three lines in the server instructions point to it)

Open a record before the first read and pass its handle on every search, fetch and find; only recorded reads exist for the record. Search for an anchor, fetch promising IDs, treat identity as a hypothesis until a fetched passage confirms it, cite only from fetched text, save notes, pending and citations after each milestone and before a turn ends, and report a quote as verified only with the server's verified status from the latest save or get. Objective escalation signals, readable from receipts: six or more recorded searches with no fetched window containing the sought material; a needed document whose totalCharacters exceeds 60,000 and whose find_in_document returned no hit; more than four pending leads at turn end; identity unresolved across two or more candidate matters after fetching one document each. When one holds, call north__netdocs_deep_search {research_handle} and follow its continuation handles. These are instructions and signals, not enforcement: North cannot make a host obey them and does not claim to detect an untruthful host.

Rejected additions

Host-supplied provenance or snippets as sources; window text in the record; writing research into north__memory_save (generic durable memory); implicit association through the MCP session ID (dies with the host process, merges topics); a per-thought traversal of the record; sliding or longer retention; a separate verify tool (folded into save); seed tool turns synthesised into the investigator transcript (leads are cheaper and keep one evidence rule); a research skill in the legal skills catalogue; any change to model selection, money caps, HTTP caps or the three-slot investigation cap. Releasing an actor slot when an investigation finishes (a finished generation holds its slot for 30 minutes, which caused start_busy during the benchmark) is not needed for this scope and is deferred explicitly: the concrete fix is a ZREM of the session from the three slot sets on the terminal finish with money keys untouched, to be designed on its own.

As built, 2026-09-14 (names that differ from the draft prose above)

Leaves: netdocs-read-provenance.ts (provenanceOf over raw typed data, full served range, plus the shared canonicalArgs/hitMaterial helpers the investigator now imports), netdocs-research-record.ts (limits, schemas, researchImportOf, a Lua store with three ops: create with protected-aware eviction, get, and revision-CAS put; the record travels as one opaque JSON string, so Lua never re-encodes an array) and netdocs-research.ts (runNetDocsResearch(...).open/save/get/record). One LangChain tool netdocs_research (createNetDocsResearchTool in netdocs.ts, MCP-only) carries open|save|get for the host and the server-side record op that the five direct MCP reads reach when they carry research_handle; the reply's first line is research: recorded id=r<n> revision=<n> or research: omitted reason=<record_full|restart|escalated|stale|deadline>. Escalation and linking are two put writes on the record (nonce, model, effort first; the generation-0 handle second); the state module's start takes an origin (nonce, seeded researchImport, bounded expiry) and gains a read-only inspect op. Revalidation reserves the connector's own operation budget before each fresh read and reports the rest unavailable when the 45 s tool deadline cannot fit it. Withheld observations are persisted with only operation, args and fingerprint. No drop op, no analytics event, no product-toolbelt exposure.

Decisions taken by kwiss, 2026-09-14

Retention is the fixed 30 minutes from open, non-sliding. Record-started escalation keeps the existing model selector and only defaults to Opus 5 low. Neither question is open.

2026-09-14 top addendum — what the first actual run of this design showed (in progress, default-off)

Observed (pre-R2 server, Opus 5 low, approved Bedrock pin): the cumulative context works as designed (26 entries, two generations, 12 model calls, no snapshots), but the run produced no answer: 11 useful reads (8 search, 2 find-in-document, 1 fetch) against 154 refresh reads and 24 denials; one partially fetched ~39k-character source; neither budget workbook reached; a negative/limited-coverage finalization refused for a 1,035-character coverage_statement against the schema-disclosed 800 maximum; the generation-1 receipt never reached the client within 360 s for a cause not observed. Ledger $0.850860 actual, $0 unknown. Not a semantic pass; not a causal comparison with the Fable CLI experiment (different model and route).

Policy question raised, not decided: the strict pre/post-model full-history revalidation costs about fourteen refreshes per useful read at this corpus size. A candidate relaxation (fresh access on new reads, on resume and at citation publication only, same actor-bound history) would leave a mid-generation source edit or revocation in already-read context until the next model call. The strict policy stays in force until kwiss decides. R2 and R3 repairs (coverage, double-resume, text-only ACL) are verified by suites and converged reviews; the final tree has not rerun the question. Feature stays default-off; PR #423 draft with a known conflict.

2026-09-14 top addendum — native research agent with cumulative context (in progress, default-off)

Approved direction. kwiss approved a fast-track cutover from the deterministic snapshot loop to a real internal research agent: the model holds one cumulative assistant/tool conversation and chooses every typed read itself; deterministic code executes each call under the existing guards, records it, and never rewrites an observed turn. Basis: a 67-second fresh Fable CLI experiment (20 read-only NetDocs calls, 4 cited documents, 7/8 exact quotes). This supersedes the 2026-09-11 "model chooses direction; code executes the frontier" ownership below, and the earlier rule that forbade transcript replay: the replacement guarantee is per-source fresh re-verification before any model replay. Implemented by a Fable LOW worker (recorded deviation from Fable high); reviews and acceptance are still open.

Revised policy

• Context: the full ordered transcript and the observed source/citation records are the durable state (Redis, envelope version 7; money and late settlement untouched). No selected snapshots, frontier, dependency trees, eviction or summaries. Every exposed tool reply stays in context or the investigation stops with terminal context_pressure.
• Ceilings: 24 lifetime model calls shared by decisions, corrections and the finalization; money ($3.03 reservation, $5/turn, $15/handle, $50/org-day), 80 research / 200 attempts / 200 refresh, 440/488 HTTP, 300 s/600 s active time and the 120,000-byte wire cap are unchanged. Fresh windows are 3,500 code points with explicit partial/offset metadata; the 60,000-character direct tool reads are unaffected.
• Batches: at most four calls per assistant turn, executed sequentially with durable pending/dispatched/completed/refused tracking; interrupted calls receive truthful not-executed or outcome-unknown replies before model replay. OpenRouter's bounded wire pins parallel_tool_calls=false, so batching applies to direct routes.
• Access and history (user decision 2026-09-14, superseding the per-turn traversal): connection authorization is not document ACL. Access is checked on every new typed read (binding and ACL; a withdrawn document fails the investigation closed), carried sources are repeated through their originating typed operations once, when a generation resumes, deduplicated by operation and range, and reused only when identities, titles, content metadata and text are materially identical; cited sources are re-read exactly before publication or replay. There is no whole-history re-verification before or after model turns (that policy cost 2 × Σ sources refresh attempts per run and was withdrawn by the user). Earlier text of this item, retained for the record: carried sources were repeated before every model turn and again after the model answered; token/total/timestamp drift (including the modified stamp) is reported as fresh coverage, never rewritten into history. Changed or missing material stops the whole batch before dispatch as unverifiable history (restart, not alleged revocation); actual revocation fails closed; outages retain private state and resume only within remaining capacity. The assistant turn and its pending batch are durable before the post-model check. Source identity is the server-owned transcript position; the provider's call ID is correlation only. A handle is advertised only while lifetime model/attempt/research capacity remains.
• Publication: investigation_finalize stays a structured tool; exact document-bound quotes validate against the stored tool body and a fresh read at every publication and replay, with no approximate repair. Withheld findings are never published from stale evidence.
• Honest ceilings: a saturated transcript, model, attempt or research ceiling never emits a continuation handle; the reply says a resume cannot add capacity. It may take fewer than 20 research reads before 200 attempts are spent on a resume-heavy path; the demonstrated CLI trajectory is not promised.

Behavior proofs added

Consumer-contract tests cover: answer over a 5-turn cumulative transcript with the whole history on the wire; a refused fifth call; malformed arguments, unknown tools, unobserved quotes and text-only turns corrected without spending reads; the 24-call ceiling and context pressure as terminal stops; an interrupted batch resumed with truthful replies and re-verified history; cancellation with no later dispatch and a settled liability; changed cited material and a revoked cited source at publication; unknown settlement after transport loss; token/total drift preserving evidence while changed text stops replay; finalized-receipt replay without model or research. The Lua contract (reference transport and actual Lua) proves quote/document/session forgeries are refused and the batch record is bounded to stored turns. The eval matrix runs the real investigator over the synthetic JSON-RPC corpus, including forced continuation. Real-provider acceptance is not claimed.

2026-09-11 top addendum — approved production integration of the deterministic loop

In-progress / default-off; approved for implementation after plan-review convergence, not implemented or semantically accepted. The user explicitly approved integration and continuation without interruptions unless post-implementation tests fail; no repeated user-approval gate. This addendum and the matching integration plan supersede prior unproven replacement acceptance, completion-driven architecture choices and stale limits wherever they conflict. Older sections remain historical evidence, including failures, not a green baseline. Read-only acceptance under the established lane identity and $50 lane allowance is already authorized. No merge, deploy or enablement is authorized.

Evidence boundary

The private reference source has SHA256 7948acc3ba06dfe0301041103fbd3932c55d88a4529aacb46e80203ac7090c40 (hash checked in this planning pass). Its clean unhinted end-to-end run reports 3 model calls, 39 research reads, 38 refresh reads, 20 pages, 257 unique candidates, 12 distinct documents, 396,866ms and 418,225 microUSD; zero failures or throttles, all accepted citations freshly validated. Six pending pages and 249 pending reads remained. This establishes one successful scenario, not exhaustive search, general reliability, a controlled speed comparison or success through production deep-search. Private cached continuation windows were withheld, never treated as fresh evidence. No confidential names, IDs, quotes, corpus or private script artifacts are copied into this addendum.

Ownership: model chooses research direction; code executes the frontier

Port the reference behavior into packages/agent-runtime/src/tools/netdocs-investigation.ts:createNetDocsInvestigator. The model proposes bounded searches, prioritizes exact returned document IDs, requests explicit revisits and interprets exposed evidence. Deterministic code discovers pages and fetches candidates. Replace the old per-read model tool dispatch and step/execute orchestration; do not retain it as a parallel fallback. Keep the existing typed five-operation read allowlist internal, with no recursive deep-search, REST, background platform, auth/connector-storage change, target-specific search hints or titles-to-ID aliases.

1. Queue every candidate from a successful typed search page, deduplicated by provider document ID with memberships in its originating pages. Ranking changes order, never eligibility: zero-score candidates remain queued. Equivalent searches reuse their traversal rather than resetting it.
2. Alternate page and document work when both are available. Page work rotates round-robin across active queries; explicit model priorities precede generic relevance within document work. Preserve the fairness position across yields. Empty or duplicate-only pages with advancing cursors are progress; repeated/cyclic cursors are incomplete, not completion.
3. Keep each in-flight item pending until its result, candidate memberships, unprocessed page remainder, next cursor/window offset and counters are checkpointed together under the current fence. Persist unprocessed work before advancing a cursor. A storage refusal must leave the last durable page position recoverable, not silently skip its remaining candidates.
4. Continue document windows only from provider-confirmed progress. No hidden per-query page cap or per-document window cap may masquerade as completion. Global budget/storage limits retain the recoverable frontier and report partial coverage. Missing offset, uncertain end or lost process-local cursor requires an explicit caveat/restart path with deduplication, never an invented span or uninterrupted-coverage claim.
5. Revisits live-read known, currently authorized IDs before re-exposure, including material omitted by the bounded model projection. Model priority cannot authorize an unknown ID. Persisted IDs are server bookkeeping, not evidence or permission: refresh their originating dependencies before exposure or derived dispatch.
6. Model-only exhaustion or admission failure disables further model calls, not already-authorized mechanical traversal. Drain pending reads under remaining read/HTTP/time/access/state and applicable financial guards. Decision five may be followed by more reads, never a sixth model call; preserve the frontier and report partial only when guards block that work.

State and finite retention

Extend netdocs-investigation-state.ts:investigationContextSchema, emptyInvestigationContext and invalidateInvestigationMaterial, not a new store. Store the deduplicated queue, query/page provenance, exact dependency fingerprints, pending cursors and page remainder, window continuation, fairness position, priorities/revisits, cooldown and cumulative progress. Dependency fingerprints cover exposed IDs, title, metadata, content and relevant pagination/completeness facts, not text alone. Keep missing/changed/revoked dependency state durable through interruption and invalidate dependent queries, candidates, observations and receipts transitively.

Port the proven fetch/exposure settings: 12,000-character fetched windows, 3,500-character exposed slices, at most 8 exposed windows and 12 exposed pages, with a 120,000-byte serialized wire guard. Current product retention is 6,000 code points per window: increase it to preserve the proven fetched window, not silently halve the evidence or expand exposure. Define production characters consistently as Unicode code points using the existing provider-facing offset/length and slicing semantics; bytes remain UTF-8 serialized bytes. The private loop uses JavaScript slices for some clipping, so name and justify that Unicode-safe normalization in review and verify non-BMP boundaries. Any other difference from the successful reference must likewise be named and justified in review.

Dynamically account for actual UTF-8 serialized queue/provenance, retained evidence, receipts, observations and replay bytes within existing 524,288-byte context and 2,097,152-byte envelope guards. Independent maxima need not fit simultaneously: 12 windows × 12,000 code points × 4 bytes = 576,000 before receipts. Reserve pending provenance and stop/continuation space before optional evidence. Preserve resumable unprocessed page remainder/cursor work under pressure; evict optional material or yield partial with honest omissions, never silently lose candidates or impose fixed smaller search quotas. If a pending dependency cannot remain available, park the work as unverifiable without losing its provenance.

Feasible example, not a new cap: 8 × 12,000 × 4 = 384,000 window bytes plus 100,000 measured bytes for all other serialized context fields/escaping = 484,000, leaving 40,288 for reserved headroom including stop space. Wire example: 6 × 3,500 × 4 = 84,000 plus 20,000 measured bytes for pages/framing/other fields = 104,000, leaving 16,000 below 120,000. Actual admission must measure serialization and reserve headroom; the example assumes those measured costs, not universal text sizes. At most 8 exposed windows/12 pages are upper bounds, not promised occupancy. Retained/exposed selections and envelope snapshots fit dynamic bytes, not the product of independent maxima.

Retain current identity/connection/scope/lease binding, HMAC handles, fixed 30-minute expiry, fenced claim/revision CAS, concurrency and replay-only claims. Preserve the existing THREE money-turn record slots, generation count and attempt.turn semantics, including old late settlement. A 600,000ms lifetime across these slots suffices for the planned two 300,000ms calls; do not add generations. Content-version incompatibility fails closed for content, but every cutover preserves money keys, historical liabilities and original-turn late settlement; no DB migration or ledger reset.

Budget contract: whole investigation, not fresh allowances on resume

Admission work is required, not a constant-only edit. Current commandSchema admits research/refresh before reading; Lua increments research at dispatch, and has no useful-outcome/total-typed-attempt protocol. Review a fenced admission/outcome transition across createInvestigationState, investigationStateLua, runtime read and eval createEvaluationState. Reserve attempt capacity before every typed dispatch and conservatively reserve potential useful work; settle classification idempotently without refunding the attempt. Unknown outcomes remain charged. In the reference, “useful” means a non-rate-limited research attempt, including a non-throttle failure, not necessarily a successful document. Preserve that explicit meaning rather than label attempted reads as successes. Retry-after cooldown preserves the same pending item and consumes time/attempts; permission denial invalidates access and is not retried as a throttle. No reported retry-after or insufficient remaining time yields an honest partial stop.

Before each model call, reserve typed-attempt capacity for the exact frozen exposed post-decision refresh set, including dependency traversal, and wall time for bounded model plus refresh (reference loop.ts:326–329). Protect that capacity from unrelated dispatch. If admission cannot fit, disable further model calls and continue mechanical work instead; this is the reference contract, not another strategy. Apply the same persisted cooldown policy to EVERY typed read, including pre-exposure/post-decision/final/replay refresh, replacing immediate refresh-throttle budget stops. Preserve pending item and phase across resume; feasible retry-after waits remain bounded by remaining guards. Throttle never means permission withdrawal.

Live access, frozen exposure and evidence-bound publication

Reuse netdocs.ts:createNetDocsReadClient typed results, not the private rendered-MCP-text parsers. Source verification: execute runs under readScope.run; readDocumentSession returns undefined while that scope exists (lines 1903–1904), and fetchNetDocs refuses returned-ID mismatch (lines 138–150). Scoped reads propagate the active deadline, signal and HTTP admission hook. Thus investigation fetches bypass session material; ordinary direct reads keep their cache. authorize is custody/binding only, never a document permission check. Retain explicit source/offset confirmation in the typed path and reject session-served material defensively rather than infer freshness from a recent timestamp.

1. Select a bounded prospective exposure. Traverse originating dependencies with a visited set and cycle/missing-dependency failure handling; live-refresh stale retained pages, discovery and document windows before exposing their data. Persist invalidation as it occurs so an interrupted refresh cannot leave a reusable stale snapshot.
2. Freeze exactly the successfully validated exposure, including the exact displayed substrings and dependency fingerprints. Removed/unverifiable items do not get replaced by unrefreshed inventory after selection. Protected source data stays inside UNTRUSTED_DATA; server counters and policy remain outside.
3. After the model returns, freshly revalidate the exact frozen exposed dependencies before any derived search, fetch priority, observation or finalization is accepted. Title/metadata changes count even when text is unchanged. Reject stale decisions; never substitute newer evidence into the old decision's dependency snapshot. Recheck dependencies again before later queued derived work as needed.
4. Bind finalization's document-ID schema to the frozen exposed IDs. Quotes must be exact exposed substrings, not merely present in larger retained text; no title alias, fuzzy repair or invisible retained citation. Locations are published only when the provider confirmed them. Separate internal code-point matching from a claimed provider location; update investigationCitationSchema, resolveInvestigationCitation, result types and consuming renderers where needed.
5. Lua resolve at netdocs-investigation-state.ts:514–531 currently accepts full retained text. Bind durable acceptance to the actual frozen exposed slice as well as TypeScript validation; update persisted exposure/citation schema, commands, Lua and eval mirror together. A quote found only after the exposed boundary is invalid even when the retained window contains it.
6. Final, deterministic partial and replayed publication all freshly validate exact-quote evidence and relevant dependencies, under remaining time/attempt/HTTP/money guards. If validation cannot finish or evidence changed, withhold affected findings and report safe partial status; no cached permission fallback. Checkpoint invalidation and the surviving frontier before finish; publish a handle only after durable finish and owned connection/body drainage. Cancellation or failed drainage suppresses provisional output.

Redis prune at netdocs-investigation-state.ts:722–735 currently conflates window eviction with revocation and empties snapshots on routine retention changes. Separate ordinary retention eviction from explicit revoked/changed dependency invalidation. Routine eviction must not itself erase valid snapshots; replay still independently live-validates every cited source and relevant dependencies. Failure to validate withholds affected evidence; no stale replay fallback.

Unproven branch and acceptance boundary

Inspected current refresh compares window text but not title; invalidation is accumulated until the refresh walk ends, and step dispatches model-derived reads without an exact post-model frozen-dependency refresh. These are concrete replacement acceptance cases, not assurances from prior green suites. Historical verified review causes also remain regression obligations: cold pre-investigator authorization escaping owned time; SSE waiting for EOF or implicit model streaming; persisted unfetched IDs exposed without fresh validation; sibling work lost on evidence replacement; advancing empty/duplicate pages stranded; MCP answers reduced to counts; supported search fields lost; local pre-dispatch body rejection retaining an unknown model reservation. Repairs on the unfinished branch need fresh evidence, not assumed closure.

Review adjudication: Main verified and kept all six corrections: mechanical drainage, retention/revocation separation, durable exposed-slice citations, unchanged three-slot money semantics, pre-model refresh admission and every-read cooldown. Byte-budget planning is accepted; the claim that all independent maxima must fit together or contextBytes must automatically rise is rejected. The aggregate byte guard is intentional.

Required behavior proofs: fifth decision then further authorized reads without a sixth model call; insufficient exact-refresh attempts or model-plus-refresh time skips the model but continues traversal; persisted cooldown through each refresh phase versus true permission denial; ordinary eviction preserves replay snapshots while revoked/changed sources fail fresh validation; quotes only after the exposed boundary fail TS/Lua/eval acceptance. Exercise Unicode/non-BMP and escaped-text state pressure, actual context/envelope/wire bytes with reserved stop space, honest omissions and resumable unprocessed cursor work without candidate loss. Prove three-slot accounting and original attempt.turn late settlement survive content-version cutover. Use the matching plan's existing behavior-test surfaces; no product implementation or test execution is claimed here.

Real acceptance is the original unhinted question through actual north__netdocs_deep_search with model: opus, effort: medium, following real returned continuation handles, plus the existing Astra acceptance flow with unchanged model semantics. No private bypass, direct fallback or transport-only exit code passes this gate. The answer must distinguish supported budget contents, project identity, filing scope, latest and approval; flattened text cannot establish workbook cells or ambiguous numeric associations. Pending work and bounded omissions must remain visible even when the specific question is answered. Read-only acceptance is already authorized under the established lane identity and $50 allowance; this documentation seat does not execute it.

Approved continuation, engineering decisions and release

The approved integration is 600,000ms active lifetime, existing 300,000ms per call and 5/80/200 whole-investigation ceilings, not a latency SLA or renewed spending request. Continue after plan-review convergence without repeated approval or interruptions unless post-implementation tests fail. Main resolves configuration/accounting without increasing financial caps; dynamic retention must prove byte fit and preserve pending provenance, while three money-turn slots remain unchanged. Public model/effort support stays pinned across resumes; no model switch remedies failed acceptance. Keep default-off pending fresh reviews, gates and separate enablement; no merge/deploy authorization. Rollback disables investigation start/resume on both surfaces while direct tools remain available; no legacy model-driven fallback, extra search strategy or retry platform.

Latest superseding design — completion first; design only

In-progress / default-off; not implemented or semantically accepted. The user's ok let's try that approved evidence-first planning, identity reconciliation and normal continuations; we don't care about the limits to be honest it's a critical feature so we need that supersedes the 34-path/5,600-LOC and 6-model/8-research/35-second/3-turn/105-second acceptance ceilings. Reliability and completed research govern acceptance, not fitting those numbers. This section takes precedence over every historical “current”, cap, routing and first-call requirement below; history and safety evidence remain intact.

Authority is not unlimited execution or spend. This assignment permits four existing documentation files only. Keep authorization, fresh ACLs, source-injection isolation, cancellation, owned local drainage and durable financial admission unchanged. Preserve $5/turn, $15/investigation and $50/organization UTC-day pending separate financial authorization; the approved EVAL authority is $50 aggregate, including historical actuals, unknowns and reservations, never $50 extra. No paid/live calls, services, workers, schema changes or enablement here.

Observed cause and chosen module

Source: packages/agent-runtime/src/tools/netdocs-investigation.ts:modelDecision sends request, guidance, correction, omissions and UNTRUSTED_DATA, but no authoritative remaining allowances. The prompt already says fetch promising documents, follow cited aliases and inspect both alternatives. Main's latest real pair nevertheless spent all eight research reads without a fetch. More prompt reminders or changing 8 to 80 alone do not establish completion.

Deepen createNetDocsInvestigator and createInvestigationState, retaining their start/resume interface and existing product/MCP adapters. No background platform, callback service, recursive agent or second connector. Replace private loop termination and structured planning inside these modules; keep Sonnet 4.6 initially. No evidence supports a stronger-model cure.

Evidence-first decisions and progress

1. Maintain explicit research obligations: identity unresolved/linked/contradicted; project budget contents; observed filing scope; latest-version evidence; approval evidence. Each supported claim has exact read citations and source dependencies. “Answered” concerns the supported question, not complete project coverage; unknown latest/approval must stay unknown.
2. Search for an anchor, then deliberately read a promising identity document before expanding similar-name searches. Link identities only from a retained passage; inspect contrary parcel/workstream evidence instead of merging names. Search the evidenced linked identity, then inspect each relevant financing alternative's contents. Two alternatives are an acceptance case, not a universal hardcoded two-document quota.
3. Each decision names its unresolved obligation, expected evidence gain and short serial read plan. Executor validates allowed operations, observed IDs and dependencies; a search-only repeat with no new scope, cursor, evidence or recovery reason returns structured stagnation feedback and requests a changed plan or honest yield. No blanket search quota or ban on justified refresh, discovery recovery, pagination or alias search.
4. Build progress before presentation truncation from freshly validated structured state: completed reads/windows, unresolved obligations, failed/pending traversals, omissions and whether an equivalent search added any usable evidence. Replace repeatedSearchSameLeads cleanly, including its presentation-order-dependent comparison; do not turn per-query counts into global novelty. Unknown/truncated comparisons remain unknown, never “exhausted”.
5. Ephemeral discovery's single exposure is deliberate ACL safety. Never persist/re-expose unfetched candidate IDs as authorized memory. A current decision may fetch a currently exposed lead; after a yield, rerun its authorized discovery query if necessary. Evidence-dependent plans, aliases, scope and feedback are pruned transitively on revocation. Source excerpts remain UNTRUSTED_DATA, not planner authority.

Authoritative feedback: extend fenced state replies with a server-generated allowance snapshot: claim/revision, absolute research-yield and hard deadlines, expiry, consumed research/model/ACL/HTTP work, remaining financial admission headroom after actuals plus unresolved reservations, and limiting reason. If no fixed count cap exists, say deadline/financial/rate-limiter constrained rather than inventing “remaining reads”. Include a trusted control object outside source data on every model decision; refresh after admission/settlement and ACL work, not from model arithmetic. It is informational, never an authorization token; atomic admission still decides each dispatch.

Actual defaults → proposed policy

Historical (inspected 2026-09-10): the limits in the left column are the measurements of that date and are retained as evidence; the current transport bound is the 120,000-byte cap recorded in the canonical contract §6/§7 and in the transport addendum below.

Accounting cutover: the inspected production Lua eval comparison is still 5,000,000 microUSD, whereas the eval harness and approved authority are 50,000,000. Reconcile the configured evaluation ceiling through the trusted state seam; never trust model/caller tool input or silently lift ordinary runtime caps. Preserve $3.03 full serial reservations, late/unknown charges, original UTC-day buckets and idempotent settlement. Versioned content expiry must not discard old monetary records; decode existing three-turn financial entries into the dynamic representation without reset, refund or loss of late settlement access.

Useful continuation, not timeout-shaped failure

Preserve public start {request} and resume {continuation_handle, guidance?}. On cooperative yield, stop new research, fresh-validate all contributing evidence, persist the pruned frontier and semantic obligations with fenced CAS, finish/rotate the opaque handle, then await owned connection/body drainage before publication. Return supported findings, identity-chain citations, pending actions, coverage gaps, limiting reason, expiry and a concrete continuation instruction. Distinguish cooperative yield from a hard deadline; no model call is required merely to manufacture a fallback receipt.

The host may resume the same tool normally, or present the useful partial result and offer continuation when its own turn ends; no automatic background work or guaranteed host obedience. Duplicate current handles replay only after fresh validation, never rerun charged research. Lost responses, stale writers, crash takeover and changed guidance keep fenced semantics. Old receipts outside the replay window give generic restart; unresolved financial attempts remain charged even then.

Cancellation/hard expiry always wins over publication, including during close: abort nested I/O, await owned local settlement, dispatch nothing later, and suppress unauthorized evidence or an undurable handle. Five seconds of publication headroom is an initial scheduling choice, not a guarantee that ACL/network drainage completes. If it cannot, return only safe generic status if deliverable; an existing handle may recover after lease expiry. A canceled first call can lose its handle. No remote rollback or exactly-once provider execution claim.

Semantic acceptance — still open

Use the unchanged natural question: the original private question (held only in the private oracle outside the repository; no confidential names, addresses or IDs appear here) Independently recover a cited identity chain and read both relevant budget contents. Separate “project budget exists in NetDocuments” from “filed under this exact matter”, and both from latest/approved. A partial 43-of-55 listing cannot establish filing under a third matter or absence. Do not invent amount/column associations from flattened numbers. Private expected IDs/addresses remain evaluation evidence, never production hints or fixture special cases.

Prove this through the full supported start → useful yield → resume → supported answer path, without the experiment's one-deep-call/12-tool ceilings. Direct fallback success and transport exit 0 are separate observations, not deep-search acceptance. Reuse syntheticCorpus's alias memo, different parcel, two financing alternatives, shuffled/held-out/no-alias/injection and long-window cases. Measure end-to-end and per-slice runtime, model/research/ACL/actual HTTP counts, actual plus unresolved cost, progress and unsupported claims; no paid matrix or new live authority is implied.

Transport addendum — 2026-09-11 approved multi-model bounded transport

Design decision. The investigator's model seam is selected per start, not per environment. A start may name model ∈ astra | opus | grok | muse and an effort; the pure selector (tools/netdocs-investigation-selection.ts) maps the friendly id to a canonical registry id and the registry alone owns supported efforts and defaults: Astra (openrouter:openai/gpt-6-astra) and Opus 5 (openrouter:anthropic/claude-opus-5) low, medium, high, xhigh, max, defaults low / medium; Grok 4.6 (openrouter:x-ai/grok-4.6) low, medium, high, xhigh, default low; Muse Spark 1.2 (openrouter:meta/muse-spark-1.2) minimal, low, medium, high, xhigh, default low. An omitted model preserves the env/default direct-Anthropic policy; a direct-Anthropic model runs with reasoning disabled (internal effort none, not a public selector). Fable and other catalogue entries are not selectable. An unsupported pair is refused before authorization, state or budget on both surfaces; resume accepts only the existing handle and guidance and rejects a model or effort. The effective pair is pinned on the envelope for every new production or eval start, echoed by every claim and re-validated before any work, so later env changes cannot switch it; envelopes predating pinning (both fields absent) resolve today's default, a partial or unsupported stored pair stops configuration. Accounting reports the effective pair. All four routes are client-approved and never fall back (Astra and Opus 5 are utility/eval-only; Grok 4.6 and Muse Spark 1.2 additionally keep their existing, intentionally preserved ordinary-chat support, which this addendum neither adds nor withdraws; the investigation's bounded effort stays utility/eval on every route): unavailability is a configuration stop, not a silent default. No chat rollout, default change or Anthropic-path change. The completion-driven redesign above is design-only and untouched by this addendum.

Routing. Astra Azure-only ZDR; Opus 5 Amazon Bedrock-only ZDR; Grok 4.6 xAI ZDR under the shared policy; Muse Spark 1.2 the sole approved non-ZDR exception (Meta, zdr: false) with data_collection: deny and no fallback retained. Every other unpinned route stays refused.

Bound. One bounded request shape for every route: complete serialized body at most 120,000 UTF-8 bytes (49,152 was the historical cap when this addendum was first written; the canonical contract §6 carries the current figure), zero retries at both SDK layers, non-streaming, the pinned effort sent as explicit native reasoning.effort, 4,000 total output tokens including reasoning for OpenRouter and 2,000 for direct Anthropic; effort raises no limit. Temperature follows the registry (Astra and Opus omit it; Grok and Muse keep the supported setting). A final guard on the SDK-serialized body pins slug, the model's provider policy (deny / no fallbacks / single pin / zdr except the Muse exception), usage accounting, tool_choice: auto and parallel_tool_calls: false, rejecting caching, aliases, routing and output overrides before dispatch. The unchanged 3,030,000 microUSD state reservation is the admission unit; a distinct bounded-price capability (wire bytes as the input-token ceiling at conservative regional ceilings 11/55, 5.5/27.5, 2/6 and 1.25/4.25 USD per million, verified 2026-09-11 separately from the global price date) must fit inside it: at the current 120,000-byte cap with 4,000 output tokens, Astra 1,540,000, Opus 5 770,000, Grok 4.6 264,000 and Muse 167,000 microUSD, direct Sonnet (2,000 output tokens) 390,000 microUSD, all inside 3,030,000 (the historical 760,672 / 380,336 figures were computed against the 49,152-byte cap and are kept as history only; the corresponding pricing regression is the core worker's to update). OpenRouter actuals are the payload's inclusive usage.cost only; invalid or missing cost is an unknown attempt. Owned fetch and body drainage settle before the attempt does.

Evidence and limit. Real MCP smoke on frozen source, 2026-09-11, env-selected: Astra low 3 receipts / 11 models / 18 research / 28 HTTP / $0.327326; Opus 5 medium 3 receipts / 14 models / 13 research / 23 HTTP / $1.120465; zero unknown, zero reserved, correct accounting.modelId. This proves transport, start/resume and accounting only and remains valid for those pinned routes. Per-start selection through actual tool calls on a server defaulting to Sonnet: grok/high and muse/minimal, three receipts each, canonical model and effort correct throughout, both inconclusive with no findings. Those runs exposed a pre-dispatch accounting defect (the local body guard can retain an unknown reservation), being fixed separately; no financial proof or final counts are claimed for those routes until Main re-runs. No run produced a finding, so Semantic acceptance — still open above stands as failed. Feature remains in progress and default-off.