Deliver Card activation in budgeted pieces and earn the delivery claim

[KimGLee]

The gap this closes

K13/19 requires an activation payload to have entered a worker's execution context before a runtime may call it running. Its Execution-context Delivery section claimed an admission proved exactly that:

This proves that the exact tool-result payload entered the named host session.

It did not. The claim was minted before the result left the server, so a host that externalizes an oversized tool result left the payload outside the model context while the receipt still asserted machine delivery — and no gate could observe the divergence.

A 2026-08-22 measurement against a live host made it concrete. Server delivery was complete and all 23 content hashes matched, but the single 231,164-byte result was spilled to a file and only a 2KB preview reached the model. The divergence was noticed by accident, because a test session happened to report the host's spill marker. No production path would have caught it.

What changes

card-first-readback-v3. Admission stops embedding bytes and freezes a piece manifest instead — one record per deliverable file with its hash and size. The bytes travel afterwards through --deliver-activation-piece, one file per tool result, inside MAX_ACTIVATION_PIECE_ENVELOPE_BYTES (49152). The measured object is the serialized delivery, not the source file: 50,495 bytes of Card source arrived as a 231,164-byte result, so envelope overhead exceeded the payload itself. Admission fails closed when any frozen piece would exceed the budget, which turns an oversized leaf into a governance problem at its own boundary rather than a transport accident mid-batch.

A piece is always a whole file. Splitting one across results would break the only check the receiving end can make: the frozen hash binds the complete file, a model cannot rehash fragments, and no party could prove a reassembly was faithful.

Admission no longer claims delivery. It records host-bound or prepared. Completion is earned per piece: each delivery carries a single-use nonce after the content, returned by --ack-activation-piece from the same context. The nonce is one part of three and never the whole — a host can show a head-and-tail summary, keep structural fields while externalizing content, or leave an agent reading a spilled file's tail. Only the server hash, a conformant adapter, and the ack together are delivery evidence. The protocol says so in those words, so a later reader cannot mistake a returned nonce for a proof of presence.

queued -> open stops binding the host session. That v1-era rule protected a claim v3 no longer makes there, and keeping it would re-couple the Queue lifecycle to the context lifecycle K13/19 separates. open still proves the frozen Bundle equals current bytes; the context binding moves to the new delivery gate. Sealed v1/v2 receipts replay under their own shape.

New leaf K13/20 Assignment State and Delivery Gate. pending → delivering → delivered → running, where delivered requires the ack set to equal the frozen manifest exactly, every ack to bind the same assignment/context/bundle/attempt, and the adapter to resolve to a current conformance registration. Delivery evidence never transfers between contexts. The admission criteria for a new leaf were answered before writing it, and are in the commit message.

Conformance is measured, not assumed. Tools/tests/inline_probe_server.py returns a payload of an exact size with a nonce at its very end; host_conformance_probe.py emits the two-control procedure and judges the result. Both controls are mandatory — a positive result alone certifies nothing, because a probe that cannot fail cannot certify.

Measured against Claude Code 2.1.223:

payload	tail nonce	externalized	control
49152 B (= budget)	present	no	positive passes
57344 B	absent	yes	negative passes
65536 B	absent	yes	negative passes

That result carries a warning, recorded in the registry: the inline ceiling sits between 49152 and 57344 bytes, so the budget has no headroom. Raising MAX_ACTIVATION_PIECE_ENVELOPE_BYTES without re-measuring would not make this adapter refuse a larger piece — it would silently externalize it, restoring the exact failure mode v3 removes.

Scope, stated plainly

This is Core-ready, not a closure. K13/20 is normative text; the Assignment state machine has no executable implementation because no reference runtime exists to host it. The primitives it consumes — piece delivery receipts, acks, and the frozen piece set — are implemented and tested, so landing a runtime is wiring rather than design. The host-side remainder of D-008 stays open until a runtime enforces delivered → running.

Why one PR and not three

The design split this into three PRs, one per layer. The implementation collapsed layers 1 and 2 into one governance decision, and the reason is measurable rather than a matter of taste: v3's own text says completion is earned at the K13/20 gate, so layer 1 carries three wiki links to a page layer 2 introduces. Checked out alone, layer 1 fails wiki-link-integrity with missing=3. An intermediate state that fails a registered gate must not reach main, so the two land together. Layer 3 is separable but small, and splitting it would leave the receipt template referencing a registry that does not exist yet.

Connected closure

Every capability implementation's SHA is pinned in Tools/compiled/metadata-execution-contract.json, so changing these tools without regenerating the compiled artifacts fails profile-load and cascades — one run showed 1061 of 2029 tests failing from that single root cause. Regenerated here: metadata-execution-contract, cli-contract, mcp-tools, and the five host-config products. check_queue's producer version moves to 1.25.0 in K00/12 for its changed accept set.

Adding the Budgeted Piece Delivery section pushed K13/19 past its registered 7.5KB cap and stamp_cards --check refused it. That is the mechanism working, so the cap was raised to 11KB through K00/16 with its reason and re-split condition recorded, rather than worked around. The section was deliberately not split further: a reader who had the byte budget without the conformance requirement would conclude that a small result is a proven one, which is the error this protocol exists to remove. K13/20 enters the R01 and R07 loading boundaries, both Cards give it an explicit source_files disposition, and R01/R07/R09 were regenerated and re-stamped.

Verification

make check                        pass
Tools/tests/test_card_activation  21/21
Tools/tests/test_host_conformance 9/9
Tools/tests/test_check_queue      166
Tools/tests/test_update_queue     181
Tools/tests/test_mcp_server       71
full suite                        2106 tests

The full suite reports 3 failures, all from an unrelated uncommitted README/ROADMAP rewrite in the working tree that pins text in README.zh-CN.md. These commits touch only Tools/ and kernel/; git diff --name-only confirms no README, ROADMAP, or profiles/ path is included. CI on a clean checkout should be green.

Closes #132