diff --git a/Cargo.toml b/Cargo.toml
index 3f67575e..7f859149 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -22,8 +22,7 @@ publish = false
 # KEK derivation behind a passphrase. Both with default features off: the
 # `getrandom` default would pull a second randomness source into a component
 # that already has one seam for it (`Rng` over `wasi:random`), and
-# `password-hash` (PHC strings) is unused — the kernel stores its own
-# parameter record.
+# `password-hash` (PHC strings) is unused.
 aes-gcm = { version = "0.11", default-features = false, features = ["aes", "alloc"] }
 argon2 = { version = "0.6", default-features = false, features = ["alloc"] }
 # docs/design.md "Sync engine: subduction sans-IO": the engine drives
@@ -85,19 +84,19 @@ stream-dom-guest = { git = "https://github.com/polymorph-components/polymorph-st
 # on `digest` 0.10, which is `sha2` 0.10's — a newer hmac would pull a second
 # `digest` into the graph and not accept this `Sha256` at all.
 hmac = { version = "0.12", default-features = false }
-# The pairing code's alphabet (PAIRING.md §1): `BASE32_NOPAD_VISUAL` is the
+# The pairing code's alphabet: `BASE32_NOPAD_VISUAL` is the
 # confusable-free base32 variant, which is what makes a 79-character code
 # something a person can read off one screen and type into another.
 # `default-features = false` + `alloc`: the `std` default buys only `Error`
 # impls this never surfaces.
 data-encoding = { version = "2.11", default-features = false, features = ["alloc"] }
-# The pairing ceremony's hash (PAIRING.md §2): BLAKE3 for the nonce
+# The pairing ceremony's hash: BLAKE3 for the nonce
 # commitment and for the SAS transcript, byte-for-byte as the contract
 # spells it. Not sha2 — the contract names BLAKE3 and two devices must
 # derive the same six digits. `default-features = false` keeps it `no_std`
 # and portable-Rust, so the wasm32-wasip2 build needs no C toolchain.
 blake3 = { version = "1.8", default-features = false }
-# docs/design.md Milestones M3c: every app-tree commit blob crosses the wire
+# docs/design.md "Read-back and partitions": every app-tree commit blob crosses the wire
 # and rests in storage as a keyhive envelope, so a relay or a store holds
 # ciphertext only. Pinned by full sha (unreleased, moving) at the rev the
 # design was written against. All three crates are pure Rust — ed25519-dalek,
diff --git a/README.md b/README.md
index 8794926a..1fa1e1ee 100644
--- a/README.md
+++ b/README.md
@@ -34,13 +34,13 @@ confinement.
 | `e2e/` | Playwright scenarios |
 | `docs/` | `design.md`, the authority for everything above |
 
-`docs/design.md` is the authority for rulings, contracts and milestones;
+`docs/design.md` is the authority for architecture and contracts;
 read it before arguing with anything here.
 
 Run `just --list` for the available recipes; `just e2e` runs the Playwright
 suite against a local iroh relay.
 
-**Status (M0–M4 landed):** three realms with TodoMVC; devices with two
+**Implemented:** three realms with TodoMVC; devices with two
 tiers of rest, sealed OPFS checkpoints and a swept index; `tasks` as an
 automerge document synced between devices over subduction and the iroh
 relay; pairing by code + SAS into a device group that is the sync policy;
diff --git a/apps/hostile/src/lib.rs b/apps/hostile/src/lib.rs
index d35c60de..093fa819 100644
--- a/apps/hostile/src/lib.rs
+++ b/apps/hostile/src/lib.rs
@@ -1,30 +1,9 @@
-//! The frame-teardown fixture: an app that names a tag the policy refuses.
-//!
-//! docs/design.md "M1" records the gap this fills — "the frame-teardown
-//! integration test waits for a hostile fixture component — M2". Every other
-//! app in this repository is well-behaved, so the path from a policy
-//! rejection through the receiver's stream abort, `web/frame.ts`'s error
-//! report, `shell.close-frame` and `apps.abort` to a `session-ended` event in
-//! the strip has never been exercised end to end. This crate is the one input
-//! that exercises it.
-//!
-//! It is not an attack: it is a single `<script>` element, which
-//! `web/policy.ts`'s tag table does not contain (`TAGS` has no `script`, and
-//! it never will — a producer that could name one would be running code in
-//! the frame's realm rather than describing pixels). The frame's CSP would
-//! refuse to execute it anyway; the point of the fixture is that the stream
-//! never gets that far, because the policy check happens on the
-//! `create-element` op before the element is ever attached.
-//!
-//! Ships only from `deno task build:fixtures`; the production site build does
-//! not carry it (`web/build.ts`).
+//! Test-only fixture that emits a forbidden `<script>` element, exercising
+//! policy rejection and frame teardown before the element is attached.
 
 use dioxus::prelude::*;
 
-/// Bindings for `polyvisor:app/app` — same shape and same reasons as
-/// `apps/todomvc/src/lib.rs`'s, which is the crate this skeleton is copied
-/// from. The world is `app`, not the bare stream-dom producer, because
-/// `export!` must match what the kernel serves.
+/// The full app world must match what the kernel serves.
 #[cfg(target_arch = "wasm32")]
 #[allow(clippy::empty_docs)]
 mod bindings {
@@ -61,8 +40,7 @@ impl bindings::Guest for Component {
 #[cfg(target_arch = "wasm32")]
 bindings::export!(Component with_types_in bindings);
 
-/// Keeps the root component reachable off the component target, so a native
-/// `clippy -D warnings` type-checks it rather than dead-coding it away.
+/// Keep the fixture type-checked by native clippy.
 #[cfg(not(target_arch = "wasm32"))]
 #[doc(hidden)]
 pub fn __launch_root() {
@@ -71,13 +49,7 @@ pub fn __launch_root() {
 
 pub fn app() -> Element {
     rsx! {
-        // Rendered first so the fixture is legible in a screenshot of a run
-        // that somehow got further than it should. Whether it survives to the
-        // DOM is undefined and not asserted: the first render is one mutation
-        // batch, and a rejection aborts the whole batch.
         div { "about to misbehave" }
-        // The refusal. `web/policy.ts` `checkOp` returns `tag <script>` here,
-        // which closes the stream and reports a `PolicyError`.
         script { "1" }
     }
 }
diff --git a/apps/todomvc/src/lib.rs b/apps/todomvc/src/lib.rs
index 4153c00b..a9e18fbd 100644
--- a/apps/todomvc/src/lib.rs
+++ b/apps/todomvc/src/lib.rs
@@ -1,43 +1,17 @@
-//! polyvisor's TodoMVC app: `world app` from `wit/app.wit`.
-//!
-//! Ported from polymorph-stream-dom's `guests/dioxus/todomvc/src/lib.rs`
-//! (rev 1974923), which is itself DioxusLabs/dioxus @ v0.7.10
-//! `examples/01-app-demos/todomvc.rs` (MIT/Apache-2.0). Components, names and
-//! structure are kept recognisable; what changed is where the state lives.
-//!
-//! **The list is not ours.** The example keeps a `HashMap<u32, TodoItem>` in a
-//! signal and mutates it in place. Here the schema authority is the `tasks`
-//! service (`wit/app.wit`, interface `tasks`): the signal holds a *snapshot*,
-//! every mutation is a service call, and the snapshot is re-fetched after it.
-//! See [`refresh`] for what that costs and what is missing.
-//!
-//! The module is split the way `stream-dom-dioxus` splits its own: everything
-//! that names WIT bindings is `#[cfg(target_arch = "wasm32")]`, so a plain
-//! `cargo clippy --workspace` still type-checks the components against the
-//! `#[cfg(not(target_arch = "wasm32"))]` stub in [`service`].
+//! TodoMVC over `polyvisor:app/tasks`. The signal is a service snapshot;
+//! mutations go to the service and then refresh it.
+//! UI structure derives from DioxusLabs' Dioxus TodoMVC example (v0.7.10,
+//! MIT/Apache-2.0), via polymorph-stream-dom rev 1974923.
 
 use dioxus::prelude::*;
 
-// ---------------------------------------------------------------------------
-// The component world
-// ---------------------------------------------------------------------------
-
-/// Bindings for `polyvisor:app/app`.
-///
-/// Generated here rather than reached through `stream_dom_dioxus::launch!`:
-/// `launch!` exports the bare `polymorph:stream-dom/producer` world, which
-/// has no `tasks` import. The `with:` remaps make this world's stream-dom
-/// types *the same Rust types* as `stream_dom_guest::bindings`', so the
-/// `EventTarget` / `DomEvent` this world's `handle-event` receives can be
-/// handed straight to `stream_dom_dioxus::driver`.
+/// Generated here because the exported app world includes `tasks`; the
+/// remaps keep stream-dom event types identical to the driver's.
 #[cfg(target_arch = "wasm32")]
 #[allow(clippy::empty_docs)]
 mod bindings {
-    // No `async:` option, for the reason spelled out in
-    // `runtime/component/src/component.rs`: one blanket mode lowers WIT-sync
-    // functions with the async canonical option, which the canonical ABI
-    // forbids and only wasmtime and polyengine's translator catch. Omitting
-    // it makes each function follow its own WIT declaration.
+    // WIT annotations decide async lowering; blanket async would incorrectly
+    // lower synchronous resource functions.
     wit_bindgen::generate!({
         path: "../../wit",
         world: "app",
@@ -71,32 +45,21 @@ impl bindings::Guest for Component {
 #[cfg(target_arch = "wasm32")]
 bindings::export!(Component with_types_in bindings);
 
-/// Keeps the root component reachable off the component target, so a native
-/// `clippy -D warnings` type-checks it rather than dead-coding it away. Same
-/// trick, and same reason, as `stream_dom_dioxus::launch!`'s non-wasm arm.
+/// Keep the UI type-checked by native clippy.
 #[cfg(not(target_arch = "wasm32"))]
 #[doc(hidden)]
 pub fn __launch_root() {
     let _ = app;
 }
 
-// ---------------------------------------------------------------------------
-// The service
-// ---------------------------------------------------------------------------
-
-/// One task, as the components see it. A plain mirror of
-/// `polyvisor:app/tasks.todo-item` so the components name no bindings and the
-/// `id` stays what the service says it is: an opaque `string`.
+/// UI-facing mirror of `polyvisor:app/tasks.todo-item`.
 #[derive(Clone, PartialEq, Eq)]
-pub struct TodoItem {
+struct TodoItem {
     pub id: String,
     pub title: String,
     pub completed: bool,
 }
 
-/// `polyvisor:app/tasks`, one thin layer up: the generated bindings' types
-/// mapped onto [`TodoItem`], and every `result<_, string>` kept as
-/// `Result<_, String>`.
 #[cfg(target_arch = "wasm32")]
 mod service {
     use super::TodoItem;
@@ -132,7 +95,6 @@ mod service {
     }
 }
 
-/// `polyvisor:app/route`, thin like [`service`] above.
 #[cfg(target_arch = "wasm32")]
 mod route {
     use crate::bindings::polyvisor::app::route;
@@ -146,8 +108,6 @@ mod route {
     }
 }
 
-/// Off the component target there is no host to answer it; same reason as
-/// `service`'s native stub just below.
 #[cfg(not(target_arch = "wasm32"))]
 mod route {
     pub fn get() -> String {
@@ -157,10 +117,7 @@ mod route {
     pub fn set(_route: &str) {}
 }
 
-/// Off the component target there is no service and no host to answer it.
-/// The stub exists only so the components below type-check under a native
-/// `cargo clippy --workspace --all-targets`; it is never linked into the
-/// component.
+/// Native stub used only to type-check the UI.
 #[cfg(not(target_arch = "wasm32"))]
 mod service {
     use super::TodoItem;
@@ -186,32 +143,15 @@ mod service {
     }
 }
 
-/// Replace the snapshot with a fresh one from the service.
-///
-/// This is the *only* thing that refreshes: it runs on mount and after each
-/// of our own mutations. `tasks.revision` is a cheap monotonic probe and this
-/// app never calls it, because there is nothing in the app world to call it
-/// *from* — no timer, no wakeup, no incoming event that is not already one of
-/// our own mutations. So a change applied by another session (or a sync) is
-/// invisible here until the user touches something.
-///
-/// That is the documented shape of the contract, not an oversight:
-/// `wit/app.wit`'s `tasks` doc calls the interface "poll-shaped on purpose"
-/// and names "a change feed ... once apps have an event path that wants one"
-/// as the expected additive next step (docs/design.md "Contracts"). When that
-/// lands, this function is what it replaces.
-///
-/// A failed fetch leaves the previous snapshot in place. M1 has no surface to
-/// report an error on.
+/// Refresh after mount and local mutations. Without an app event path,
+/// remote changes become visible on the next local mutation.
 async fn refresh(mut items: Signal<Vec<TodoItem>>) {
     if let Ok(fresh) = service::items().await {
         items.set(fresh);
     }
 }
 
-/// Run one mutation, then re-read the list. Every write path goes through
-/// here, which is what keeps "mutate then re-fetch" from being restated six
-/// times.
+/// Run one mutation, then re-read the list.
 fn mutate(items: Signal<Vec<TodoItem>>, work: impl Future<Output = ()> + 'static) {
     spawn(async move {
         work.await;
@@ -219,10 +159,6 @@ fn mutate(items: Signal<Vec<TodoItem>>, work: impl Future<Output = ()> + 'static
     });
 }
 
-// ---------------------------------------------------------------------------
-// The app
-// ---------------------------------------------------------------------------
-
 #[derive(PartialEq, Eq, Clone, Copy)]
 enum FilterState {
     All,
@@ -237,7 +173,6 @@ enum FilterState {
 const STYLESHEET: &str = "asset:0f827d119b7bec30534b1767e8ab8ee0f2890c98f93baa1159dcf1a46f10bc17";
 
 pub fn app() -> Element {
-    // The snapshot. Owned by the `tasks` service; this is a cached view of it.
     let items = use_signal(Vec::<TodoItem>::new);
     // The route is this app's own prior output, relayed back by the visor —
     // not user-typed input (`wit/app.wit` `route`: "a route this app is
@@ -250,7 +185,6 @@ pub fn app() -> Element {
         _ => FilterState::All,
     });
 
-    // On mount: the first snapshot.
     use_future(move || refresh(items));
 
     let active_todo_count = use_memo(move || items.read().iter().filter(|i| !i.completed).count());
@@ -514,8 +448,6 @@ fn ListFooter(
     }
 }
 
-// ---------------------------------------------------------------------------
-
 /// The bundle's `manifest.json` and `assets/` must agree on the asset handle,
 /// which is `sha256(asset bytes)` (`runtime/crates/kernel/src/apps.rs`, "Asset
 /// handles"). Nothing else checks that at build time, so this does.
diff --git a/docs/design.md b/docs/design.md
index c5bc479d..361f26bf 100644
--- a/docs/design.md
+++ b/docs/design.md
@@ -1,9 +1,7 @@
 # polyvisor — design record
 
-Rulings for the rebooted tree. Each entry states what is decided and why,
-so later work argues with the reason instead of re-deriving it. Nothing
-here is a compatibility promise: **the whole framework is unstable until
-declared otherwise.** Open questions live in the issue tracker.
+Current architecture and constraints. Open questions live in the issue
+tracker; implementation history lives in Git.
 
 ## Project maturity and tradeoffs
 
@@ -108,10 +106,7 @@ Rules for `polyvisor:internal`:
    `events.next` import from that queue. So an event born of network
    activity alone — the other device confirming a pairing, an enrollment
    landing, a peer closing — reaches the screen with nothing pressed on
-   this device. (This was briefly a non-parking `event-source.drain`
-   while polyengine#292 stood; 0.6.6 fixed it and 0.6.7 fixes the lift
-   regression that fix introduced, polyengine#312.) No callbacks, no
-   second mechanism. What the glue itself observes (a frame torn down by
+    this device. What the glue itself observes (a frame torn down by
    the receiver) enters the same path through `apps.abort`, so the visor
    has one source of truth for session endings; `apps.close` — the
    visor's own act — emits nothing.
@@ -124,38 +119,16 @@ providers by semver track (`@0.3`), so both resolve to one host.
 
 ## No JSPI
 
-Verified against polyengine's source: `NeedsJspi` is raised only for
-(a) a sync-typed import whose host returns a Promise (requires a
-`suspending()` mark), (b) a stackful async lift, (c) a sync lower onto an
-unresolved subtask, (d) blocking built-ins from a frame that cannot
-return a code. The callback ABI — what wit-bindgen emits — needs none of
-it. The old tree required JSPI for one reason: `std::fs` in the engine's
-checkpoint path bound `wasi:filesystem@0.2` (sync WIT) over OPFS
-(Promise-only).
-
-Ruling: the runtime uses `wasi:filesystem@0.3` (async in WIT) through
-generated bindings, not `std::fs`; every glue-implemented import is
-async in WIT; every embedder forces `jspi: false`, so a regression
-anywhere fails loudly.
-
-**No realm is an exception.** The worker was one through M3a: the composed
-iroh endpoint authenticates its QUIC connections with rustls, whose
-`Signer::sign` is synchronous, and an identity built from platform key
-handles (`polymorph:iroh/identity-from-keys`) reaches its key through an
-async import — a sync lower of an async import, which is exactly what JSPI
-exists for, so the accept side of every connection needed it (with
-`jspi: false` the acceptor stalled in `CertificateVerify`). The general
-fact stands: a platform-held, non-extractable key as the TLS identity
-implies JSPI in a browser. polymorph-iroh's `identity-from-seed` (behind
-the `guest-ed25519-signing` feature) takes the other side of that: the
-identity holds its private key in the endpoint component's memory and
-signs there with ed25519-dalek. So every realm is `jspi: false` and the
-browser floor is wasm multi-memory alone. The trade, recorded: identity
-signatures run in wasm rather than in the platform's native crypto, and
-the device seed rests in the endpoint's memory for the endpoint's
-lifetime — it was already in the kernel's, and passed through guest memory
-at every bind, so this widens where it rests and not whether it is
-there.
+Every embedder forces `jspi: false`; the browser floor is wasm
+multi-memory. Use wit-bindgen's callback ABI and async host imports.
+Filesystem operations use generated `wasi:filesystem@0.3` bindings,
+not `std::fs` (whose synchronous imports cannot host OPFS promises).
+
+The iroh endpoint uses `identity-from-seed`, enabled by
+`guest-ed25519-signing`. Its synchronous TLS signer runs in guest memory;
+a platform-held key requiring an async host call would need JSPI. The
+trade is wasm signing and a copy of the device seed in the endpoint for
+its lifetime, alongside the kernel's copy.
 
 ## The app frame
 
@@ -170,19 +143,10 @@ there.
   (component bytes, port) arrives by `postMessage`.
 - **The app component runs in the frame's main thread.** The stream-dom
   receiver binds to the frame's own DOM same-realm.
-- **No worker inside the frame.** Dedicated workers must be same-origin
-  with their creator and an opaque origin matches nothing in practice
-  (`blob:` workers fail in sandboxed frames; a `data:` worker is the one
-  variant that could work and is not planned). When apps move off the
-  main thread (#45, honest `worker.terminate()`), the design is the
-  stream-dom worker tier laid out across the sandbox: the component runs
-  in a dedicated Worker spawned by the visor on the home origin; the
-  frame holds only the receiver, the policy and the asset resolver, fed
-  frames over a port. Recorded trade: a polyengine bug that let guest
-  code escape to JS would land on the home origin rather than a
-  storage-less, network-less one. The component's own authority is
-  unchanged either way. `web/frame.ts` keeps its polyengine use behind
-  one seam so that move is a deletion.
+- **No worker inside the frame.** Dedicated workers require a matching
+  origin; the sandbox has an opaque origin. Moving execution into a
+  home-origin worker is deferred (#45) and would weaken containment of a
+  guest-to-JS escape while enabling `worker.terminate()`.
 - **Policy** is stream-dom's `Policy` object: pinned to the receiver's
   `PROTOCOL_VERSION`, `check(op)` over a table-driven allowlist (tags,
   attributes per tag, properties — never `innerHTML` — event names, URL
@@ -198,8 +162,8 @@ there.
   frame fetches every asset over its session port (`apps.asset`) before
   the producer runs and mints one `blob:` URL per handle. Asset `href` is
   legal only on `<link>`; an `<a href>` is a fragment. The kernel is the
-  only fetcher and re-hashes what it serves; until installation lands
-  (M2) it fetches bundles from the home origin over `wasi:http`.
+  only fetcher and re-hashes what it serves. Bundles currently come from
+  the home origin over `wasi:http`.
 
 ## The kernel is one component
 
@@ -221,25 +185,22 @@ form. Polyvisor owns five implementations:
 | Trait | Implementation |
 |---|---|
 | `Transport` | one per connection over `polymorph:iroh` streams, relay-only: WebRTC is off in the worker because a SharedWorker has no `RTCPeerConnection` (the host backend never resolves there). Framing per `subduction_iroh` (u32 BE length prefix) so native subduction peers interoperate |
-| `Storage` | M3a: an in-memory item store serialized into the sealed checkpoint with the automerge docs. Items in their own files under the state root is the follow-up once checkpoint size matters |
+| `Storage` | an in-memory item store serialized into the sealed checkpoint with the automerge docs |
 | `Policy` | group membership, read off the user-system document (`polyvisor:us`): a remote peer may read/write exactly while its key is a member. App-tree envelopes are keyhive's (M3c, `engine/src/vault.rs`) |
-| `Signer` / `NodeEffect::Sign` | M3a: `ed25519-dalek` over a seed held in the sealed checkpoint (the seed posture; the same seed builds the iroh identity, through `polymorph:iroh/identity-from-seed`). Later: a non-extractable platform key — signing is an effect with external custody, which is exactly what that needs |
+| `Signer` / `NodeEffect::Sign` | `ed25519-dalek` over the sealed device seed, also used by the iroh identity |
 | `Clock` | `wasi:clocks@0.3` |
 
-Why the branch rather than the released crates: one driver loop the
-checkpoint can stop the world against (the legacy core spawned its own
-tasks and slept on Rust channels — the source of a whole class of old
-wedges), signing as an effect (the legacy `Signer` was infallible, so a
-platform key could only trap), and a wire that is byte-compatible with
-legacy by design. Cost: an unreleased tree with moving APIs; the five
-trait impls are the whole exposure, and every rev bump is its own PR
-behind the interop gate. `subduction_iroh` itself is native-only (upstream
-iroh + tokio) and cannot be used in a component; its conventions are the
-reference, not its code.
-
-keyhive is pinned to git `main` for the CGKA transitive-authority fix
-(66a6632: relay access no longer grants CGKA membership) that the
-released 0.5.0 lacks; the pull ≠ read tier separation depends on it.
+The sans-IO branch provides one driver loop that checkpointing can pause
+and explicit signing effects. `subduction_iroh` is native-only; its wire
+conventions are the reference, not its implementation. Native-peer
+interop is deferred until a native peer exists.
+
+App trees are keyhive-sealed. Two system trees remain plaintext:
+`polyvisor:us` (group membership: endpoint public keys and petnames), and
+the keyhive-events tree (signed, content-free operations). Keyhive's git
+pin includes the transitive-authority fix separating relay access from
+group membership. Pairing enrolls a device with the group's current
+decryption heads, allowing it to read the group's history.
 
 ## Read-back and partitions
 
@@ -373,9 +334,6 @@ handing out handles.
   does not. The one silent case, a user closing the popup mid-flow, is
   covered by a ten-minute bound on the waiting side; provider codes do
   not outlive that.
-- **No kernel change.** The pending ceremony in the kernel is replaced
-  by the next `oauth-start`; its state is random and its code one-shot,
-  so a stale one costs nothing.
 - **COOP `same-origin` on the home origin is the general form** of all
   of this: the browsing-context-group swap makes a null opener actually
   mean "no handle", and it covers windows we never opened. It is an
@@ -413,13 +371,11 @@ the handshake.
   `argon2`) with the key as bytes: a non-extractable WebCrypto handle
   persisted in IndexedDB would rest under the same profile protection,
   so it buys nothing at this tier. The signing identity is a seed in the
-  same sealed checkpoint (M3a); platform-held keys enter with the passkey
-  PRF rung (M5); the transport's TLS signer is in-guest instead (see
-  "No JSPI").
+  same sealed checkpoint; the transport's TLS signer is in-guest (see
+  "No JSPI"). Passkey unseal is deferred.
 - **Checkpoints** are AES-GCM over the kernel's serialized state, written
   to `/<id>/gen-<n>/` on the OPFS root through `wasi:filesystem@0.3` after
-  every mutation (state is small until the engine lands; a debounce is a
-  later optimization). Commit protocol: state, then MANIFEST (generation +
+  every mutation. Commit protocol: state, then MANIFEST (generation +
   digest), then the generation pointer in `kv` — the pointer is the commit
   point, a failed write never advances it, and a load falls back one
   generation. The kernel never lists a directory: `read-directory` is one
@@ -431,20 +387,12 @@ the handshake.
 - **Switching devices is a reload** (`shell.switch-device`): the anchor
   changes and the page restarts against another worker. Erase destroys
   the namespace and the index row, then switches to a fresh device.
-- **A tab with no anchor adopts the last kept device.** The anchor is
-  per tab, and a fresh tab — a typed URL, a bookmark, an installed app's
-  window — has none; minting a new device there made "new tab, new
-  stranger" the default, and which tabs shared a device turned on how
-  the tab had been opened (Chromium copies `sessionStorage` on duplicate
-  and `window.open`, on nothing else). So the glue keeps one more
-  pointer, in `localStorage`: the id of the last device this profile saw
-  as *durable*, written whenever `device.status` reports that tier and
-  never for an ephemeral (they are swept). A tab with no anchor takes it;
-  only a profile with no kept device — or an explicit
-  `switch-device(none)`, which clears the pointer too — mints. The
-  pointer names a worker and grants nothing: a passphrase device still
-  opens sealed, and a rests-open one was already the profile's. Several
-  devices in one profile remain possible; they stop being an accident.
+- **A tab with no anchor adopts the last kept device.** The glue keeps
+  its id in `localStorage`, updated when `device.status` reports a durable
+  device. Without this pointer, or after `switch-device(none)` clears it,
+  a fresh tab mints a device. The pointer grants no authority: passphrase
+  devices still open sealed. Explicit switching supports multiple devices
+  in one profile.
 
 ## Visor and apps render through stream-dom
 
@@ -455,10 +403,9 @@ trust table and boot cache are kernel state served over `device`/`apps`,
 so the visor has no persistence import of its own and the same component
 runs under a native shell.
 
-Known costs carried from the visor-dioxus spike: ~400 KB gzipped
-floor; predicates become bools at the WIT boundary; a Dioxus component
-that writes a signal it never reads renders once forever — invisible to
-native tests, so browser gates are mandatory for every visor change.
+A Dioxus component that writes a signal it never reads does not subscribe
+to updates. Native tests cannot catch the resulting frozen UI, so visor
+changes require browser verification.
 
 ## Routing
 
@@ -467,9 +414,8 @@ running app and a route the app chose, so "this app, here" can be
 bookmarked. The fragment is the only place for it — it never reaches the
 server, and it is the one part of the URL an app frame's `href` policy
 already treats as same-document (`web/policy.ts`). Two parts, two
-owners: the visor owns the grammar (`<kind>/<rest>`, `app` the only kind
-today; anything else is refused by `route-decode` exactly as an
-unreadable token is), and the app owns the
+owners: the visor owns the grammar (`app/<token>` or `launch/<app-id>`;
+unknown kinds are refused by `route-decode`), and the app owns the
 text inside `route`, which the visor carries byte-for-byte and never
 interprets.
 
@@ -574,100 +520,38 @@ interprets.
   would be a device of its own. Unverified and to be probed: that the
   fragment survives in `start_url` (a `?launch=` query is an acceptable
   fallback for this kind exactly because the package id is public).
-- **Struck: pairing codes in the fragment.** A code is either short
-  enough to type or key material that does not belong in a URL at all;
-  the fragment was a transport looking for a route.
 
 ## Pins, with reasons
 
-| Dependency | Pin | Reason |
-|---|---|---|
-| Rust | 1.98.1 | current stable; satisfies stream-dom (1.98), subduction (1.91), keyhive (1.90) |
-| `wit-bindgen` | `=0.60.0`, workspace-wide | must equal stream-dom's pin: `StreamReader<u8>` (a wit-bindgen runtime type) crosses the delegation from our world's `run` into `stream_dom_dioxus::driver::run`. Different wit-bindgen versions *can* coexist in one component (the `wasip3_task_set` weak-symbol ABI exists for exactly that), but not across a shared runtime type. Bumps follow stream-dom's. `generate!` never sets `async: true`: that lowers sync WIT functions (resource constructors) async, which the canonical ABI forbids and only the translator catches; WIT's own `async func` annotations are the source of truth |
-| `@polyengine/*` | 0.6.7, one version across the graph | first release where an async export may park on a guest waker (#292) without the 0.6.6 lift regression (#312); brand symbols are per-version, so a partial upgrade fails at `instanceof` |
-| `dioxus` | `=0.7.10` | dioxus-core state is shared with `stream-dom-dioxus`; skew breaks the build |
-| polymorph-stream-dom | git rev (see Cargo.toml / deno.json) | unpublished, moving; policy object and asset handles landed in #15; the Dioxus `asset:<hex>` attribute spelling landed in #19 |
-| subduction | git `sansio` rev | above |
-| keyhive | git rev `a509a2d` | `keyhive_core` / `keyhive_crypto` / `beekem`, unreleased and moving. The sealed plaintext is keyhive's own `Envelope` and the read-back walk is keyhive's own `try_causal_decrypt`, so a rev bump is a wire-format change for every stored blob: its own PR |
-| `@polymorph/*` | 0.6.1 (webcrypto, websocket), 0.6.2 (webrtc-datachannels) | the cuts current at the polyengine 0.6.7 pin; taken within the `^0.6` range |
-| polymorph-iroh | git rev `8ca991e` | the endpoint component is built from source, not taken from the jsr package: the runtime binds its identity through `identity-from-seed`, which the package gates behind the cargo feature `guest-ed25519-signing` and its published artifact excludes. `just endpoint` clones and builds the pin; the vendored `runtime/wit/deps/polymorph-iroh/iroh.wit` is that revision's |
-| `wasi:*` WIT | 0.3.1 (consolidated WASI release) | what `@polyengine/wasi` serves on the `@0.3` track |
+Versions live in the manifests, lockfiles, `rust-toolchain.toml`, and
+`justfile`. Constraints on changing them:
+
+- `wit-bindgen` and Dioxus must match stream-dom's versions: Rust types
+  cross their shared boundary. WIT's `async func` annotations control
+  lowering; never blanket-enable `generate!`'s `async: true` for sync
+  resource constructors.
+- Polyengine packages sharing branded runtime values must resolve to the
+  same version. The tree consumes releases from JSR; dependency age is
+  zero so fixes can be tested immediately.
+- Keyhive owns the stored envelope format; upgrading it may change that
+  format. Subduction's sans-IO APIs are also unreleased and moving.
+- The iroh endpoint is built from the revision in `justfile` with
+  `guest-ed25519-signing`; the published artifact omits that feature.
+  Its vendored WIT must match the source revision.
 
 ## Delivery
 
-- Same repository; the pre-reboot tree is tag `pre-reboot` / branch
-  `archive/v0`. Nothing carries verbatim; it is mined by reading.
-- One embedding: one device per page, the runtime in a SharedWorker.
-  Multi-device and multi-user scenarios are several browser contexts
-  against one relay.
-- Rust producers only (Dioxus). A JS producer on-ramp waits for a
-  stream-dom JS adapter.
+- Rust producers (Dioxus), browser embedding. One SharedWorker per device;
+  tabs may share a device. Multi-device tests use isolated browser contexts
+  against a local relay and fake Drive.
 - Gates: `cargo test` (native, per crate), `deno test` (glue), and
   Playwright on real Chromium for every claim about pixels or realms.
   The archive's scenarios are reference material, not a parity obligation;
   retain coverage for current claims rather than historical scenario names.
 
-### Milestones
-
-- **M0** archive, skeleton, this record, both WIT packages, CI.
-- **M1** three realms, one TodoMVC: stub kernel with in-memory `tasks`;
-  visor strip + settings sheet; frame loader under policy; ports.
-  Gates: app renders in the opaque frame; zero network requests from
-  the frame; `jspi: false`;
-  the frame policy's unit tests. (The frame-teardown integration test
-  waits for a hostile fixture component — M2. The path was exercised
-  anyway: the policy caught the TodoMVC example's outbound `href`.)
-- **M2** devices survive: the index, namespaces, the two tiers of rest,
-  checkpoint/resume on OPFS, locks and the sweep, entry/keep/unseal/erase
-  in the visor, and the hostile-fixture frame-teardown scenario. Reload
-  survival with worker respawn as the normal case.
-- **M3a** the engine in the loop: `tasks` becomes an automerge document
-  from the start, the sans-IO subduction driver with polyvisor's trait
-  implementations, an iroh transport over the composed endpoint
-  component, manual dial by endpoint id, two devices converging over a
-  local relay in e2e. Policy is allow-all until M3b. Wire compatibility
-  with native subduction peers is a gate only when a native peer exists
-  (headless, parked). **M3b** pairing (code + commit/reveal SAS + dual
-  confirm), the device group as the user-system document, sync policy =
-  group membership, reconnect at boot. **M3c** keyhive/BeeKEM: envelope
-  encryption of every *app* tree, so relays and stores hold app content
-  as ciphertext only; the group's keyhive membership derived from the
-  user-system document. Two trees stay plaintext by ruling:
-  `polyvisor:us`, because it is what tells a device which group — and so
-  which keyhive document — it belongs to, and it carries only endpoint
-  public keys and petnames a relay already sees; and the keyhive-events
-  tree, keyhive's own signed, content-free operation log. Enrollment is
-  total read-back: the adder hands the joiner every content key it holds
-  over the SAS-authenticated pairing connection, so a new device reads
-  the group's entire history; the read-back window for shared documents
-  is an open policy item, and shared documents do not exist yet.
-  Sequenced after M3b because device↔device sync already runs inside
-  authenticated QUIC — content encryption is what untrusted *storage*
-  (M4) needs, and building the group first gives keyhive a membership
-  to key.
-- **M4** storage: Google Drive as the first (and, for now, only) dumb
-  store — user-only, keyed object names, the OAuth ceremony split
-  between kernel (PKCE, exchange, sealed tokens) and shell (the popup),
-  push and pull after every local change, at boot, and on demand; a fake
-  Drive in e2e. Provider-as-component (the `provider` world, per-
-  destination egress, the picker) waits for a second provider: one
-  backend does not justify a boundary. S3 is deferred; Drive is what a
-  person has.
-- Parked, as issues: the passkey PRF unseal rung (#166), recovery kits
-  (#167); app worker (above); native shell; JS producers; S3 and the
-  provider component boundary (a second provider).
-
-## polyengine is consumed from JSR
-
-Found in M1: an import awaited from a Dioxus event handler never resumed
-until the next event. Root cause (polyengine, fixed upstream in #289): a
-`driveAsync` loop parked on `Promise.race([...pendingHostCalls, ...])`
-holds a snapshot; an export entered through the synchronous `drive` path
-fires no driver-arrival, so a host call registered during it is
-invisible to the parked race, and the settlement pump stands down while
-the parked driver counts. A stream-dom producer is the routine victim —
-its `readDirect` session keeps a driver parked whenever one long poll
-is outstanding. The fix shipped in polyengine 0.6.4; the tree consumes
-it at a caret JSR pin. `deno.json` sets `minimumDependencyAge` to zero:
-polyengine releases are cut minutes before this tree takes them, and
-Deno's 24 h age gate would otherwise refuse them.
+### Deferred scope
+
+Passkey unseal (#166), recovery kits (#167), app worker (#45), native
+shell, JS producers, and additional stores. Drive is the only provider;
+a provider-component abstraction waits for a second one. Shared-document
+history policy is undecided; shared documents do not exist yet.
diff --git a/e2e/fake-drive.ts b/e2e/fake-drive.ts
index 7f671138..be884a61 100644
--- a/e2e/fake-drive.ts
+++ b/e2e/fake-drive.ts
@@ -1,5 +1,5 @@
 // A fake Google Drive: exactly the requests the kernel's store makes, and
-// nothing else (m4-context.md "Fake Drive").
+// nothing else.
 //
 // WHAT THIS IS NOT: a Drive emulator. It implements the OAuth half the
 // ceremony needs (`/auth`'s headless consent, `/token`'s two grants) and
diff --git a/e2e/run.ts b/e2e/run.ts
index 1d14cc47..8f8f56e9 100644
--- a/e2e/run.ts
+++ b/e2e/run.ts
@@ -1,7 +1,5 @@
-// The M1 gates on real Chromium (docs/design.md "Delivery": "Playwright on
-// real Chromium for every claim about pixels or realms", and "M1": "app
-// renders in the opaque frame; zero network requests from the frame; no
-// JSPI").
+// Real Chromium, per docs/design.md "Delivery": claims about pixels or
+// realms need it, mocks don't prove them.
 //
 // The server sets neither COOP nor COEP: a SharedWorker needs none, and
 // setting them would make this harness diverge from what a home origin
@@ -236,17 +234,10 @@ async function open(ctx: BrowserContext, origin: string): Promise<Page> {
 // ---------------------------------------------------------------------------
 // The visor, as these scenarios drive it
 //
-// Every selector and every label below is the visor's own tree (visor/src/
-// ui.rs): `#visor-root` carrying `.unclaimed` until the device is open and
-// the `--hue` inline style when it is (nothing else ever paints it),
-// `#visor-strip` with its two halves `#visor-app` and `#visor-self`,
-// `#visor-drawer` holding one `.pane` per tenant, `.sheet` / `.sheet-error`
-// / `.app-row` / `.device-row`. They live in one block so a visor rename is
-// one edit here rather than six.
-//
-// The drawer is no longer a toggle: with nothing running it is pinned open
-// on the app list, so "close" means "back to the app list" and pressing the
-// half whose sheet is already showing does nothing at all.
+// Every selector below is the visor's own tree (visor/src/ui.rs), kept in
+// one block so a rename there is one edit here. With nothing running, the
+// drawer is pinned open on the app list rather than closed, so pressing the
+// half whose sheet is already showing does nothing.
 // ---------------------------------------------------------------------------
 
 const strip = (page: Page) => page.locator("#visor-strip");
@@ -257,15 +248,9 @@ const appsButton = (page: Page) => page.locator("#visor-app");
 /** The strip's right half: who this is, and this device's settings. */
 const settingsButton = (page: Page) => page.locator("#visor-self");
 
-/** Wait for the drawer to hold exactly one pane, done sliding and not on its
- * way out.
- *
- * A tenant switch renders two panes for the length of the slide — the one
- * arriving still wearing an `enter-` class — and a click into a moving
- * target lands wherever the animation had got to. A drawer in mid-close is
- * one pane and no `enter` class, so "settled" has to exclude `closing` too
- * (visor/src/ui.rs `drawer_class`) or this passes on a pane that is
- * leaving. */
+/** Wait for the drawer to hold exactly one settled pane: a tenant switch
+ * renders two for the length of the slide, and a click into a moving target
+ * lands wherever the animation had got to (visor/src/ui.rs `drawer_class`). */
 async function paneSettled(page: Page): Promise<void> {
   await drawer(page).waitFor({ timeout: 10_000 });
   await page.waitForFunction(
@@ -324,14 +309,10 @@ async function launchApp(
     await page.waitForSelector("#app-zone iframe[sandbox]", {
       timeout: 30_000,
     });
-    // The frame is not the end of the launch: the visor closes the drawer
-    // over it (visor/src/ui.rs `apply`, the `(Some(t), None)` arm), and that
-    // close outlives the frame's arrival — first as an open drawer whose
-    // `closing` render has not landed yet, then as a mounted `closing`
-    // drawer, which is `inert` and so hands every press to the scrim
-    // underneath. Returning inside that window makes the caller press a
-    // drawer that is on its way out. `Drawer::Closed` unmounts the element,
-    // so its absence is the visor's own statement that the launch is over.
+    // The visor closes the drawer over the frame, and that close outlives
+    // the frame's arrival — returning inside that window risks pressing a
+    // drawer that is still mid-close (`inert`, taking no press). Its
+    // absence is the visor's own statement that the launch is over.
     await page.waitForFunction(
       () => document.querySelector("#visor-drawer") === null,
       undefined,
@@ -367,19 +348,14 @@ async function saveDraft(page: Page): Promise<void> {
 }
 
 /**
- * Raise the running app's own sheet, from wherever the drawer is.
- *
- * Not by pressing the strip's app half from another pane. With a session
- * running, every clean pane offers `Close` and that is the supported way
- * out (visor/src/ui.rs `dismissal`); pressing the half for the tenant
- * already on screen is worse than useless, since a dirty draft parks the
- * transition and the dialog that raises makes the strip `inert` — after
- * which no press can land at all.
+ * Raise the running app's own sheet, from wherever the drawer is, via the
+ * pane's own `Close` control rather than pressing the strip's app half from
+ * another pane — that press is a no-op while a dirty draft has parked the
+ * transition behind a confirmation dialog.
  */
 async function toAppSheet(page: Page): Promise<void> {
-  // Settled first. A drawer in mid-close is `inert`, and so is one under
-  // the dialog (visor/src/ui.rs, `flag(confirming || shutting)`): its
-  // buttons take no press and the scrim behind takes it instead.
+  // A drawer mid-close, or one under the confirmation dialog, is `inert`
+  // and takes no press.
   await page.waitForFunction(
     () => {
       const d = document.querySelector("#visor-drawer");
@@ -427,30 +403,14 @@ async function setAppGlyph(
     exact: true,
   });
   await tile.waitFor({ timeout: 10_000 });
-  // Selected until it stays selected. Unlike the settings sheet, the app sheet
-  // seeds its draft from a kernel read that lands AFTER the pane is on
-  // screen (visor/src/ui.rs: the `AppInfo` arm spawns `read_app_meta` and
-  // calls `seed_draft` only when it comes back), so a choice made the
-  // instant the pane settles can be wiped by that seed arriving — leaving a
-  // clean draft, no "unsaved changes" dialog, and nothing saved. The seed
-  // happens once per transition, so this converges immediately.
-  const deadline = performance.now() + 15_000;
-  for (;;) {
-    await tile.click();
-    const picker = drawer(page).locator(".glyph-picker");
-    const search = picker.getByRole("searchbox", {
-      name: "Enter glyph or search",
-    });
-    await search.fill(glyph);
-    await picker.getByRole("button", { name: `Use ${expected}`, exact: true })
-      .click();
-    await page.waitForTimeout(300);
-    if ((await tile.textContent()) === expected) break;
-    check(
-      performance.now() < deadline,
-      "the app sheet's glyph tile would not hold a value",
-    );
-  }
+  await tile.click();
+  const picker = drawer(page).locator(".glyph-picker");
+  const search = picker.getByRole("searchbox", {
+    name: "Enter glyph or search",
+  });
+  await search.fill(glyph);
+  await picker.getByRole("button", { name: `Use ${expected}`, exact: true })
+    .click();
   await saveDraft(page);
   await page.waitForFunction(
     (want) =>
@@ -860,21 +820,13 @@ async function shot(page: Page, name: string): Promise<void> {
 // ---------------------------------------------------------------------------
 // Devices, as these scenarios drive it
 //
-// Everything here is shaped by one fact about the visor: it holds no state
-// of its own and no timer exists in its world (visor/src/ui.rs), so nothing
-// on screen refreshes on its own. `device.status`, `sync.peers`,
-// `sync.members` and `pairing.status` are read on the press that opens the
-// Settings tenant and on the Devices section's own "Refresh" button — so
-// pressing Refresh is how this harness re-reads any of them. That is not a
-// workaround for a missing feature; polling chrome is a thing the milestone
-// deliberately does not have.
-//
-// Pairing phases are the exception, and they are not a press: the kernel
-// pushes `events.pairing-changed` on every transition and the runtime's
-// `events.next` parks, so a phase the OTHER device caused reaches this
-// screen with nothing pressed here (internal.wit `interface events`). The
-// scenarios below therefore wait on those without pressing Refresh, which
-// is what makes them exercise the push path at all.
+// The visor has no timer and holds no state of its own: `device.status`,
+// `sync.peers` and `sync.members` are read on the press that opens Settings
+// and on its "Refresh" button, so that press is the only way this harness
+// re-reads any of them. Pairing phases are the exception — the kernel
+// pushes `events.pairing-changed`, so a phase the OTHER device caused
+// reaches this screen with nothing pressed here, and the scenarios below
+// wait on those without pressing Refresh to prove exactly that.
 // ---------------------------------------------------------------------------
 
 const devicesSheet = (page: Page) => sheet(page, "Devices");
@@ -1058,17 +1010,14 @@ async function waitForConnectedPeer(page: Page, peer: string): Promise<void> {
 // ---------------------------------------------------------------------------
 // Storage, as these scenarios drive it
 //
-// The section is Settings → "Storage" (visor/src/ui.rs `StorageSection`),
-// and like everything else in that drawer it is only ever as fresh as the
-// press that read it: the state line comes from `storage.status`, re-read
-// on the press that opens Settings and after every act in the section.
+// Settings → "Storage" is re-read the same way Devices is: on the press
+// that opens it and after every act in the section.
 //
-// The ceremony runs headless. "Connect Google Drive" opens a popup at the
-// URL the kernel minted; the fake's `/auth` 302s straight back to this
-// page's URL with `code` and `state`, that returning load broadcasts the
-// pair on the ceremony's BroadcastChannel and closes itself (web/boot.ts —
-// the popup is opened `noopener`, so there is no opener to post to), and the
-// waiting `shell.open-popup` resolves with it. No consent screen to click.
+// The ceremony runs headless: "Connect Google Drive" opens a popup at the
+// kernel-minted URL, the fake's `/auth` 302s straight back with `code` and
+// `state`, and that returning load broadcasts the pair on the ceremony's
+// BroadcastChannel for `shell.open-popup` to resolve with. No consent
+// screen to click.
 // ---------------------------------------------------------------------------
 
 const storageSheet = (page: Page) => sheet(page, "Storage");
@@ -1205,13 +1154,11 @@ async function addTodo(page: Page, title: string): Promise<void> {
 }
 
 /** Reload the page and put TodoMVC back on screen: a fresh mount, which is
- * a fresh `tasks.items` read. A reload with the app open leaves `#app/<token>`
- * in the URL, and the visor auto-restores whatever fragment it finds after
- * boot (docs/design.md "Routing"), so this — and every other
- * reload-with-the-app-open site below — waits for that restore rather than
- * pressing "Apps" itself, which would race the visor's own click. With no
- * app open (a page that arrived at the bare origin) there is no fragment,
- * and the press is the only way. */
+ * a fresh `tasks.items` read. With the app open, the URL still carries
+ * `#app/<token>` and the visor restores it on boot, so this waits for that
+ * restore rather than pressing "Apps" itself and racing the visor's own
+ * click; with no app open there is no fragment, and the press is the only
+ * way. */
 async function remountTodoMvc(page: Page): Promise<void> {
   const bookmarked = await page.evaluate(() =>
     location.hash.startsWith("#app/")
@@ -1231,18 +1178,10 @@ async function remountTodoMvc(page: Page): Promise<void> {
  * Wait for a todo that was written on the *other* device.
  *
  * Nothing pushes into a mounted app: `polyvisor:app/tasks` is pull-only and
- * the TodoMVC guest re-reads after its own mutations and at mount
- * (apps/todomvc/src/lib.rs). So a remote change is on this device's disk
- * long before it is on this device's screen, and the only honest way to
- * observe it is to make the app read again — which is what the remount
- * between attempts does.
+ * the TodoMVC guest re-reads only at mount and after its own mutations, so
+ * a remote change shows up only on the next remount.
  */
 async function waitForRemoteTodo(page: Page, title: string): Promise<void> {
-  // The app re-reads `tasks.items` only on mount and after its own
-  // mutations (wit/app.wit `tasks`: a change feed is the additive next
-  // step), so a remote change shows up on the next mount. Remounting costs
-  // a wasm instance per realm; a few seconds between attempts keeps the
-  // whole wait inside a handful of them.
   const deadline = performance.now() + 60_000;
   for (;;) {
     try {
@@ -1469,11 +1408,10 @@ const scenarios: Scenario[] = [
       await toggle.click();
       await app.locator("li.completed").first().waitFor({ timeout: 15_000 });
 
-      // ONE tab, on purpose. M1 kept a second page open so the SharedWorker
-      // would outlive the reload; M2's claim is the stronger one
-      // (docs/design.md "Devices"): "the worker respawns on every single-tab
-      // reload — checkpoint + rehydrate, not worker-memory luck". A second
-      // tab here would hide exactly the failure this scenario is for.
+      // ONE tab, on purpose: a second tab would keep the SharedWorker alive
+      // across the reload, hiding a claim this scenario exists to check —
+      // that the todo survives from checkpoint + rehydrate, not from
+      // worker memory.
       await page.reload();
       await visorReady(page);
       await page.waitForSelector("#app-zone iframe[sandbox]", {
@@ -1497,16 +1435,12 @@ const scenarios: Scenario[] = [
     async run(ctx, origin, browser) {
       const page = await open(ctx, origin);
       await visorReady(page);
-      // A device with no route key yet mints one on its first encode
-      // (README/dispatch: "minted on first use"); "kept" is not what that
-      // needs, but every other scenario that leans on a device surviving
-      // more than one page is kept first, and this one reloads twice.
+      // Kept first, since every reload below needs the same route key.
       await keepDevice(page, "the workbench");
       await launchTodoMvc(page);
-      // TodoMVC's footer — and the filter links in it — only renders with
-      // at least one todo (apps/todomvc/src/lib.rs: the footer is gated on
-      // `!items.read().is_empty()`), and the todo persists on this device,
-      // so one add here is enough for the reopened app in step (c) too.
+      // The footer's filter links only render with at least one todo
+      // (apps/todomvc/src/lib.rs), and that todo persists on this device,
+      // so one add here also covers the reopened app in step (c) below.
       await addTodo(page, "bookmark this filter");
 
       const h0 = await page.evaluate(() => location.hash);
@@ -1570,11 +1504,8 @@ const scenarios: Scenario[] = [
         )
       );
 
-      // Closing the session is the glue's own act of clearing the bar
-      // (internal.wit `shell`: "clears it in close-frame") — no navigation
-      // involved, so this is the one place that is not also covered by the
-      // notice-only checks below. The strip's left half opens the running
-      // app's sheet, and "Close app" is in there.
+      // Closing the session (not navigation) also clears the bar — the one
+      // case the notice-only checks below don't cover.
       await page.locator("#visor-app").click();
       await paneSettled(page);
       await drawer(page).getByRole("button", { name: "Close app", exact: true })
@@ -1585,12 +1516,10 @@ const scenarios: Scenario[] = [
         { timeout: 10_000 },
       );
 
-      // A fragment that is not a token this device's route key sealed:
-      // `not-found`, and the visor says so in its own voice rather than
-      // opening anything. `goto` to a URL that differs only in its fragment
-      // is a same-document navigation — no boot, and the visor ignores
-      // `hashchange` by ruling (docs/design.md "Routing") — so the reload
-      // is what makes this a bookmark being opened rather than a bar edit.
+      // A fragment this device's route key never sealed: the visor says so
+      // rather than opening anything. The reload is what makes this a
+      // bookmark being opened rather than a same-document hash edit, which
+      // the visor ignores by ruling (docs/design.md "Routing").
       await page.goto(origin + "/#app/not-a-real-token");
       await page.reload();
       await visorReady(page);
@@ -1628,13 +1557,10 @@ const scenarios: Scenario[] = [
   },
 
   {
-    // The case the per-tab anchor used to break (docs/design.md "Devices",
-    // last bullet): a bookmark opened in a genuinely fresh tab — no
-    // sessionStorage anchor, because Chromium only copies that on
-    // duplicate/`window.open`, not on a plain navigation to a URL typed or
-    // clicked elsewhere. Before LAST, this minted a brand-new device with
-    // no route key, so the token could never decrypt. With LAST, the fresh
-    // tab adopts the profile's kept device and the bookmark just opens.
+    // A bookmark opened in a genuinely fresh tab: Chromium only copies
+    // sessionStorage on duplicate/`window.open`, not on a plain navigation,
+    // so this tab has no device anchor of its own and must adopt the
+    // profile's kept device to decrypt the token at all.
     name: "bookmark-in-a-new-tab",
     async run(ctx, origin) {
       const page = await open(ctx, origin);
@@ -2154,10 +2080,9 @@ const scenarios: Scenario[] = [
       await keepDevice(page, "laptop");
 
       // Dropping only the tab's own anchor is a lost anchor, not a new
-      // device: `device.status` wrote LAST when this device was kept above
-      // (docs/design.md "Devices", last bullet), and it is still there.
-      // `deviceId` adopts it, so this reload is the SAME device and the
-      // picker never appears at all.
+      // device: LAST still names the device kept above, and `deviceId`
+      // adopts it, so this reload is the SAME device and the picker never
+      // appears.
       await page.evaluate((key) => sessionStorage.removeItem(key), ANCHOR);
       await page.reload();
       await visorReady(page);
@@ -2168,12 +2093,9 @@ const scenarios: Scenario[] = [
         "a lost anchor with a kept LAST device showed the picker anyway",
       );
 
-      // Now drop LAST too: an explicit new device, per the design's "only a
-      // profile with no kept device ... mints". This is exactly what
-      // `shell.switch-device(none)` does; doing it here rather than through
-      // a button keeps this scenario to what the WIT guarantees, so it does
-      // not depend on which control the visor happens to offer for a
-      // second device.
+      // Now drop LAST too — an explicit new device, done directly rather
+      // than through a button so this scenario depends only on what
+      // `shell.switch-device(none)` guarantees.
       await page.evaluate((key) => sessionStorage.removeItem(key), ANCHOR);
       await page.evaluate((key) => localStorage.removeItem(key), LAST);
       await page.reload();
@@ -2314,15 +2236,10 @@ const scenarios: Scenario[] = [
         const onB = await sasDigits(b);
         eq(onA, onB, "the two devices showed different pairing digits");
 
-        // B presses "No" — `pairing.cancel` (runtime/crates/kernel/src/
-        // pairing.rs `pairing_cancel`). The canceller's own phase goes
-        // straight to `Idle` (pairing.rs:220 `set_phase(Phase::Idle)`); it
-        // is the OTHER side that lands on a `Failed` phase, from whichever
-        // race it sees first: the Cancel frame itself (`cancelled()`,
-        // pairing.rs:664, "the other device cancelled") or the transport
-        // closing ahead of it (pairing.rs:668, "the other device went
-        // away") — both are the kernel's own words for "the other side is
-        // gone", so both count.
+        // B presses "No" (`pairing.cancel`). B's own phase goes straight to
+        // Idle; A lands on a failed phase, whether from the cancel itself
+        // or from the transport closing first — both are the kernel's own
+        // words for "the other side is gone," so both count.
         await devicesSheet(b).getByRole("button", { name: "No", exact: true })
           .click();
 
@@ -2348,8 +2265,8 @@ const scenarios: Scenario[] = [
           );
         }
 
-        // The canceller (B) lands on `Idle` too, same as pairing.rs:220 —
-        // its offer/claim controls are back, not stuck mid-ceremony.
+        // The canceller (B) also lands on Idle: its offer/claim controls
+        // are back, not stuck mid-ceremony.
         await refreshSettings(b);
         check(
           await devicesSheet(b).getByRole("button", {
@@ -2402,21 +2319,12 @@ const scenarios: Scenario[] = [
 
   {
     // The store as a sync path: what one device pushed, another device of
-    // the SAME group pulls — with no live connection between them.
-    //
-    // Two claims, and the scenario is arranged around keeping each of them
-    // from being answered by the other path:
-    //
-    //   * ISOLATION. B, connected to the same Drive account but not in A's
-    //     group, has a different naming key, so every object A wrote sits
-    //     at a name B cannot derive. It sees nothing of A's. Asserted
-    //     while the two are unpaired, so no live path exists at all.
-    //   * THE STORE CARRIES. Pairing does bring a live path up, and it is
-    //     fast — so the todo this claim turns on is written while B's page
-    //     is CLOSED (no page, no worker, no endpoint), and A is gone
-    //     entirely before B comes back. The fake's `alt=media` counter is
-    //     the corroboration: B read objects out of the store, which a
-    //     device that converged over the wire never does.
+    // the SAME group pulls, with no live connection between them. Two
+    // claims: unrelated groups derive different names and so read nothing
+    // of each other's (checked unpaired, so no live path exists at all);
+    // and after pairing, the store alone carries a todo written while B is
+    // offline and read after A is gone — `mediaReads` corroborates that B
+    // actually read it from the store rather than over a live connection.
     name: "drive-round-trip",
     async run(ctx, origin, browser, drive) {
       const ctxB = await browser.newContext();
@@ -2471,22 +2379,11 @@ const scenarios: Scenario[] = [
         await waitForMember(a, idB);
         await waitForMember(b, idA);
 
-        // B goes offline: navigating the tab away takes its SharedWorker
-        // with it (a worker lives while a client holds it), and with the
-        // worker goes the endpoint A could reach B on. Its device survives
-        // — the OPFS and the sealed tokens are the context's.
-        //
-        // NAVIGATED, not closed, and this is the whole reason: the device
-        // anchor is `sessionStorage` (web/boot.ts), which is per TAB — but
-        // a second tab is no longer reliably a second device (docs/design.md
-        // "Devices", last bullet): B here is ephemeral, so its LAST pointer
-        // was never written and a second tab would still mint fresh, but a
-        // KEPT device's second tab would instead ADOPT it — same group,
-        // same tokens, B's own worker still up. Closing this tab is
-        // therefore not a dependable way to take B offline for either case;
-        // navigating it away is, because it is the same client dropping
-        // its hold on B's SharedWorker (a worker lives while a client holds
-        // it) regardless of what any other tab would resolve to.
+        // B offline: navigating away (not closing the tab) drops its hold
+        // on its SharedWorker regardless of what a second tab would resolve
+        // to, and the device anchor is per-tab sessionStorage anyway, so
+        // this is the one dependable way to take B offline while keeping
+        // its checkpoint (OPFS, sealed tokens) alive under the context.
         await b.goto("about:blank");
 
         // Written while B could not be listening, so the store is the only
@@ -2902,9 +2799,8 @@ const scenarios: Scenario[] = [
     async run(ctx, origin) {
       const page = await open(ctx, origin);
       await visorReady(page);
-      // The strip paints before the worker answers, and M2's boot is slower
-      // than M1's (OPFS preopen, checkpoint read) — so wait for the mark
-      // rather than sampling it the instant the first pixel lands.
+      // The strip paints before the worker answers (OPFS preopen, checkpoint
+      // read), so wait for the mark rather than sampling it at first pixel.
       await page.waitForFunction(
         () =>
           ((globalThis as Record<string, unknown>).__polyvisor as {
@@ -2913,13 +2809,11 @@ const scenarios: Scenario[] = [
         undefined,
         { timeout: 30_000 },
       );
-      // Both realms on this side instantiated, and every `instantiate` call
-      // in the repository — visor, frame and worker alike — passes
-      // `{ jspi: false }` (web/jspi_test.ts pins that at the source level).
-      // Under that option polyengine refuses a sync-typed import that
-      // returns a Promise, so the visor having rendered its strip and the
-      // worker having answered `booted` — which needs the runtime
-      // component's exports, and its endpoint's in-guest signer — proves no
+      // Every `instantiate` call in the repository passes `{ jspi: false }`
+      // (web/jspi_test.ts pins that at the source level), under which
+      // polyengine refuses a sync-typed import that returns a Promise. So
+      // the strip rendering and the worker answering `booted` — which needs
+      // the runtime's exports and its endpoint's in-guest signer — proves no
       // import took a suspending path.
       const marks = await page.evaluate(() =>
         (globalThis as Record<string, unknown>).__polyvisor
@@ -3193,9 +3087,8 @@ const scenarios: Scenario[] = [
       await strip(page).getByText("the workbench").waitFor({ timeout: 15_000 });
 
       // With an app running there is a scrim as well, and it is a press
-      // target: pressing it while the dialog stands used to replace the
-      // parked transition, so "Revert" closed the drawer instead of opening
-      // the sheet the user had actually asked for.
+      // target, so it must not silently answer the dialog in place of one
+      // of the three named buttons.
       await launchTodoMvc(page);
       await openSettingsSheet(page);
       await field.fill("typed over the app");
@@ -3221,11 +3114,11 @@ const scenarios: Scenario[] = [
   },
 
   {
-    // Two handheld widths. The Devices section is long machine identifiers
-    // next to short framework-voice facts about them, which is the shape
-    // that used to lay one over the other. Nothing may be answered by
-    // hiding: the whole identifier stays reachable — wrapped or locally
-    // scrolled — while neither the page nor the drawer scrolls sideways.
+    // Two handheld widths. The Devices section pairs long machine
+    // identifiers with short framework-voice facts, so nothing may be
+    // answered by hiding: the whole identifier stays reachable — wrapped or
+    // locally scrolled — while neither the page nor the drawer scrolls
+    // sideways.
     name: "visor-narrow-layout",
     async run(ctx, origin) {
       const page = await open(ctx, origin);
@@ -3236,9 +3129,8 @@ const scenarios: Scenario[] = [
         .locator("input").fill("Ada Lovelace-Byron the Elder");
       await saveDraft(page);
 
-      // The unnamed case is the one that overlapped: with no petname, a
-      // device is shown by its endpoint id — tens of characters of machine
-      // text beside "this device" and an age.
+      // The unnamed case, where an id and a short fact sit closest: with no
+      // petname, a device is shown by its endpoint id alone.
       const id = await endpointId(page);
       check(id.length > 20, `the endpoint id is implausibly short: ${id}`);
       await waitInDevices(
@@ -3519,11 +3411,10 @@ async function main(): Promise<void> {
       } catch (err) {
         failures++;
         console.error(`FAIL ${scenario.name}: ${(err as Error).message}`);
-        // What the visor was showing when the wait gave up, per open page:
-        // the M3a flakes were diagnosed from exactly this line. EVERY
-        // context, not just this scenario's own: a scenario with a second
-        // device fails at that device as often as at this one, and dumping
-        // only `ctx` prints nothing at all when the failure is over there.
+        // What the visor was showing when the wait gave up, per open page —
+        // EVERY context, not just this scenario's own: a scenario with a
+        // second device fails at that device as often as at this one, and
+        // dumping only `ctx` prints nothing when the failure is over there.
         for (
           const page of browser?.contexts().flatMap((c) => c.pages()) ?? []
         ) {
diff --git a/runtime/component/src/component.rs b/runtime/component/src/component.rs
index 723cbbf2..0dc15d66 100644
--- a/runtime/component/src/component.rs
+++ b/runtime/component/src/component.rs
@@ -513,7 +513,6 @@ impl guest::device::Guest for Component {
     async fn meta(scope: guest::device::MetaScope) -> Result<Vec<(String, String)>, Error> {
         let scope = match scope {
             guest::device::MetaScope::User => polyvisor_kernel::MetaScope::User,
-            guest::device::MetaScope::Device => polyvisor_kernel::MetaScope::Device,
             guest::device::MetaScope::App(id) => polyvisor_kernel::MetaScope::App(id),
         };
         Ok(kernel()?
@@ -528,7 +527,6 @@ impl guest::device::Guest for Component {
     ) -> Result<(), Error> {
         let scope = match scope {
             guest::device::MetaScope::User => polyvisor_kernel::MetaScope::User,
-            guest::device::MetaScope::Device => polyvisor_kernel::MetaScope::Device,
             guest::device::MetaScope::App(id) => polyvisor_kernel::MetaScope::App(id),
         };
         kernel()?
@@ -677,12 +675,6 @@ impl guest::apps::Guest for Component {
     async fn launch(app: String) -> Result<u32, Error> {
         kernel()?.launch(&app).map_err(map_error)
     }
-    async fn session_app(session: u32) -> Result<guest::apps::AppInfo, Error> {
-        kernel()?
-            .session_app(session)
-            .map(app_info)
-            .map_err(map_error)
-    }
     async fn component(session: u32) -> Result<guest::apps::ComponentArtifacts, Error> {
         let artifacts = kernel()?.component(session).await.map_err(map_error)?;
         Ok(guest::apps::ComponentArtifacts {
@@ -758,19 +750,12 @@ fn unavailable_service() -> String {
 }
 
 impl guest::app_services::Guest for Component {
-    async fn tasks_revision(session: u32) -> Result<u64, String> {
-        kernel()
-            .map_err(|_| unavailable_service())?
-            .tasks_revision(session)
-            .await
-    }
     async fn tasks_items(session: u32) -> Result<guest::app_services::Snapshot, String> {
         let snapshot = kernel()
             .map_err(|_| unavailable_service())?
             .tasks_items(session)
             .await?;
         Ok(guest::app_services::Snapshot {
-            revision: snapshot.revision,
             items: snapshot
                 .items
                 .into_iter()
diff --git a/runtime/crates/engine/Cargo.toml b/runtime/crates/engine/Cargo.toml
index 306ebe2b..67423736 100644
--- a/runtime/crates/engine/Cargo.toml
+++ b/runtime/crates/engine/Cargo.toml
@@ -35,8 +35,3 @@ subduction_runtime.workspace = true
 
 [dev-dependencies]
 futures = { workspace = true, features = ["executor"] }
-future_form.workspace = true
-# The fragment-identity test decodes a checkpoint's `Signed<Fragment>` to
-# compare head and boundary; both are already dependencies of the library.
-sedimentree_core.workspace = true
-subduction_crypto.workspace = true
diff --git a/runtime/crates/engine/src/doc.rs b/runtime/crates/engine/src/doc.rs
index d6d72843..d232d4c2 100644
--- a/runtime/crates/engine/src/doc.rs
+++ b/runtime/crates/engine/src/doc.rs
@@ -35,7 +35,6 @@ pub struct TodoItem {
 /// `polyvisor:app/tasks.snapshot`.
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct TaskSnapshot {
-    pub revision: u64,
     pub items: Vec<TodoItem>,
 }
 
@@ -89,8 +88,8 @@ impl AppDoc {
         self.core.save()
     }
 
-    /// The number of changes in the document's history — what `tasks.revision`
-    /// promises an app.
+    /// The number of changes in the document's history. Used to order and
+    /// uniquely name local additions.
     pub fn revision(&self) -> u64 {
         self.core.revision()
     }
@@ -138,7 +137,6 @@ impl AppDoc {
         }
         items.sort_by(|a, b| a.0.cmp(&b.0).then_with(|| a.1.id.cmp(&b.1.id)));
         TaskSnapshot {
-            revision: self.revision(),
             items: items.into_iter().map(|(_, item)| item).collect(),
         }
     }
diff --git a/runtime/crates/engine/src/lib.rs b/runtime/crates/engine/src/lib.rs
index a5f76944..f7df74c7 100644
--- a/runtime/crates/engine/src/lib.rs
+++ b/runtime/crates/engine/src/lib.rs
@@ -303,13 +303,6 @@ impl<T: Transport<Local> + 'static> Engine<T> {
         self.with_app(app, |doc| Ok(doc.snapshot()))
     }
 
-    /// The app document's revision: the number of changes in its history, so
-    /// it advances on a remote change exactly as it does on a local one.
-    pub async fn tasks_revision(&self, app: &str) -> Result<u64, String> {
-        self.open_app(app).await?;
-        self.with_app(app, |doc| Ok(doc.revision()))
-    }
-
     /// Append a task, returning the id the document gave it.
     pub async fn tasks_add(&self, app: &str, title: String) -> Result<String, String> {
         self.mutate(app, move |doc| doc.add(title)).await
@@ -951,8 +944,8 @@ impl<T: Transport<Local> + 'static> Engine<T> {
     /// Not the seed — the kernel holds that, in the same sealed checkpoint,
     /// and two copies of an identity is one copy too many to keep in step.
     ///
-    /// Async, and fallible, since M3c: it now also carries this device's
-    /// keyhive, whose archive is an async read.
+    /// Async and fallible because it carries this device's keyhive, whose
+    /// archive is an async read.
     pub async fn snapshot(&self) -> Result<Snapshot, String> {
         // The vault's own state first, and outside the `apps` borrow: reading
         // keyhive's archive is async.
@@ -980,13 +973,6 @@ impl<T: Transport<Local> + 'static> Engine<T> {
 
     // -- internals -----------------------------------------------------------
 
-    /// How many authenticated connections are live. Test introspection for
-    /// the registry `pump_events` shrinks.
-    #[must_use]
-    pub fn live_connections(&self) -> usize {
-        self.conns.borrow().len()
-    }
-
     /// Every tree this device holds a document for.
     fn trees(&self) -> Vec<SedimentreeId> {
         let mut trees: Vec<SedimentreeId> = self.apps.borrow().values().map(AppDoc::tree).collect();
@@ -1008,21 +994,10 @@ impl<T: Transport<Local> + 'static> Engine<T> {
         // already and would otherwise never build the keyhive that document
         // names.
         self.open_vault().await?;
-        // Also before the early return, and for a second reason: a checkpoint
-        // written before the store existed restores a group document with no
-        // name key beside it, and that device would otherwise never mint one
-        // — it has a group already, so it never takes the founding branch
-        // below, and `storage` would sit there with nothing to name.
-        //
-        // Minting here is safe for a joiner too: `adopt_us` replaces the key
-        // along with the document, because the names it must derive are the
-        // ones the group already writes under.
-        if self.name_key.borrow().is_none() {
-            *self.name_key.borrow_mut() = Some(self.name_key_seed);
-        }
         if self.us.borrow().is_some() {
             return Ok(());
         }
+        *self.name_key.borrow_mut() = Some(self.name_key_seed);
         let tree = us_tree();
         {
             let mut doc = UsDoc::empty(self.seed);
@@ -1450,9 +1425,8 @@ impl<T: Transport<Local> + 'static> Engine<T> {
         Ok(())
     }
 
-    /// Replace an app commit's plaintext change with its keyhive envelope.
-    /// This is the whole of M3c's claim: what reaches the driver — and so the
-    /// wire, the relay and storage — is ciphertext.
+    /// Replace an app commit's plaintext change with its keyhive envelope, so
+    /// what reaches the driver, wire, relay and storage is ciphertext.
     async fn seal(
         &self,
         commit: subduction_protocol::command::NewCommit,
@@ -1510,7 +1484,7 @@ impl<T: Transport<Local> + 'static> Engine<T> {
         // for the same app returns from the check above without waiting for
         // the subscription to be placed. That is deliberate: it reads an
         // empty-but-live document a moment early rather than blocking on the
-        // network, and callers poll `revision` for what arrives after.
+        // network. A later service read observes what the event pump applies.
         let conns: Vec<_> = self.conns.borrow().clone();
         for conn in conns {
             conn.sync_tree(tree, true)
diff --git a/runtime/crates/engine/src/storage.rs b/runtime/crates/engine/src/storage.rs
index 34eac7de..ba5ee4f5 100644
--- a/runtime/crates/engine/src/storage.rs
+++ b/runtime/crates/engine/src/storage.rs
@@ -38,20 +38,15 @@ use subduction_runtime::storage::{FetchedItems, Storage};
 #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
 pub struct Snapshot {
     pub apps: Vec<AppState>,
-    /// The user-system document and its tree. `#[serde(default)]` because
-    /// checkpoints written before the group existed have no such field, and
-    /// a device must still boot from one.
-    #[serde(default)]
+    /// The user-system document and its tree.
     pub us: Option<TreeState>,
     /// The keyhive-events tree (`crate::keyhive_tree`): the membership and
     /// CGKA operations that let this device's peers open its envelopes. It has
     /// no automerge document — `TreeState::doc` is empty — because its commits
     /// *are* the state.
-    #[serde(default)]
     pub keyhive: Option<TreeState>,
     /// This device's keyhive itself, including secrets. Sealed with the rest
     /// of the checkpoint.
-    #[serde(default)]
     pub vault: Option<crate::vault::VaultState>,
     /// The group's store-name key (docs/design.md M4, the Drive record): the
     /// 32 bytes every name in the user's own store is HMAC'd under, so two
@@ -60,10 +55,7 @@ pub struct Snapshot {
     /// which is why it rests here rather than being derived from the seed:
     /// it belongs to the *group*, and the seed is one device's.
     ///
-    /// `Option` because a checkpoint written before M4 has no such field, and
-    /// because a device that has never opened its group document has no group
-    /// to have a key for.
-    #[serde(default)]
+    /// `None` while a device has not opened its group document.
     pub name_key: Option<[u8; 32]>,
 }
 
@@ -89,11 +81,10 @@ pub struct TreeState {
 /// The store is names plus opaque bytes, but the two item kinds decode into
 /// different envelopes (`Signed<LooseCommit>` vs `Signed<Fragment>`) and are
 /// checked differently, so the record has to say which it is.
-#[derive(Debug, Clone, Copy, Default, PartialEq, Eq, Serialize, Deserialize)]
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
 #[serde(rename_all = "lowercase")]
 pub enum ItemKind {
     /// One automerge change.
-    #[default]
     Commit,
     /// A roll-up of a commit range: one automerge bundle.
     Fragment,
@@ -120,10 +111,6 @@ pub struct StoreItem {
     pub commit: [u8; 32],
     pub signed: Vec<u8>,
     pub blob: Vec<u8>,
-    /// `#[serde(default)]` — `Commit` — because objects written before
-    /// fragments existed carry no such field, and a device must still read
-    /// its group's older objects.
-    #[serde(default)]
     pub kind: ItemKind,
 }
 
diff --git a/runtime/crates/engine/src/us.rs b/runtime/crates/engine/src/us.rs
index 40f8b2fe..5c943aab 100644
--- a/runtime/crates/engine/src/us.rs
+++ b/runtime/crates/engine/src/us.rs
@@ -195,9 +195,7 @@ impl UsDoc {
         found
     }
 
-    /// The keyhive group and document ids this group seals its app content
-    /// to, if the document names them. A group founded before M3c has no such
-    /// entry; the founder writes one on its next boot.
+    /// The keyhive group and document ids this group seals its app content to.
     pub fn keyhive(&self) -> Option<([u8; 32], [u8; 32])> {
         let doc = self.core.read();
         let (_value, keyhive) = doc.get(ROOT, KEYHIVE).ok().flatten()?;
diff --git a/runtime/crates/engine/src/vault.rs b/runtime/crates/engine/src/vault.rs
index 908eeec8..97efe3fe 100644
--- a/runtime/crates/engine/src/vault.rs
+++ b/runtime/crates/engine/src/vault.rs
@@ -1,5 +1,4 @@
-//! The keyhive instance this device seals its app content with
-//! (docs/design.md, Milestones **M3c**).
+//! The keyhive instance this device seals its app content with.
 //!
 //! ## What is enveloped, and what is not
 //!
@@ -36,13 +35,11 @@
 //!
 //! BeeKEM gives a member the *current* epoch key when it is added; content
 //! sealed before that is not derivable from it. A device that has just been
-//! paired would therefore see the group's history as undecryptable noise. The
-//! fix, taken from the archived engine's PAIRING.md §4b ("causal-key
-//! read-back"), is to seal each commit's plaintext together with the keys of
-//! its parents, so a reader that can open any commit can walk backwards from
-//! it. The container is keyhive's own [`Envelope`] and the walk is keyhive's
-//! own `CiphertextStoreExt::try_causal_decrypt` — PAIRING.md §4b is explicit
-//! that this must not be a parallel format, and it is right: the walk
+//! paired would therefore see the group's history as undecryptable noise.
+//! Causal-key read-back seals each commit's plaintext together with the keys
+//! of its parents, so a reader that can open any commit can walk backwards
+//! from it. The container is keyhive's own [`Envelope`] and the walk is
+//! keyhive's own `CiphertextStoreExt::try_causal_decrypt`: the walk
 //! `bincode`-deserializes an `Envelope` out of every plaintext it opens
 //! (keyhive_core store/ciphertext.rs:189), so a look-alike struct with a
 //! different `ancestors` encoding would fail on every non-genesis commit.
@@ -114,11 +111,7 @@ pub struct VaultState {
     /// (`design/causal_encryption.md` §"Decryption Head"). Secret, and sealed
     /// with the rest of the checkpoint.
     ///
-    /// `alias`: an M3c checkpoint wrote the whole key map under `chunk_keys`.
-    /// Loading one is harmless — the full map is a superset of the head set,
-    /// and the extra entries are pruned the first time their descendants are
-    /// opened or sealed.
-    #[serde(alias = "chunk_keys", default)]
+    #[serde(default)]
     pub heads: Vec<(Cref, [u8; 32])>,
 }
 
@@ -307,8 +300,8 @@ impl Vault {
             )
             .await
             .map_err(|e| format!("keyhive add_member: {e:?}"))?;
-        // Forced key rotation at the enrollment boundary (PAIRING.md §2). The
-        // next seal would advance the epoch anyway, but "anyway" is not a
+        // Force key rotation at the enrollment boundary. The next seal would
+        // advance the epoch anyway, but "anyway" is not a
         // boundary: doing it here means the joiner's first readable epoch
         // begins at the moment it was admitted rather than at whenever someone
         // next happened to write.
diff --git a/runtime/crates/engine/tests/converge.rs b/runtime/crates/engine/tests/converge.rs
index c5bd077d..38e9865d 100644
--- a/runtime/crates/engine/tests/converge.rs
+++ b/runtime/crates/engine/tests/converge.rs
@@ -239,8 +239,7 @@ fn two_devices_converge_in_both_directions() {
         assert_eq!(titles(&seen), vec!["buy milk", "walk the dog"]);
         assert!(b.changes.get() > 0, "the pump reported the remote change");
 
-        // The reverse direction: B toggles, A sees it, and A's revision moves.
-        let before = ea.tasks_revision(APP).await.unwrap();
+        // The reverse direction: B toggles and A sees the changed item.
         let id = seen.items[0].id.clone();
         eb.tasks_set_completed(APP, &id, true).await.unwrap();
 
@@ -249,11 +248,7 @@ fn two_devices_converge_in_both_directions() {
             items.items[0].completed.then_some(items)
         })
         .await;
-        assert!(
-            after.revision > before,
-            "a remote change advances the revision: {before} -> {}",
-            after.revision
-        );
+        assert!(after.items[0].completed);
         assert!(a.changes.get() > 0, "a's pump saw the remote change");
     });
 }
@@ -379,7 +374,7 @@ fn a_restored_engine_does_not_re_mint_the_id_it_last_used() {
 }
 
 #[test]
-fn a_dead_connection_leaves_the_registry() {
+fn a_dead_connection_notifies_the_caller_once() {
     let mut pool = LocalPool::new();
     let a = device(&pool, 10, None);
     let b = device(&pool, 11, None);
@@ -396,12 +391,10 @@ fn a_dead_connection_leaves_the_registry() {
                 *inbound.borrow_mut() = Some(eb.connect(tb, Direction::Inbound, None).await);
             })
             .await;
-        assert_eq!(ea.live_connections(), 1);
-
         // B goes away: its end of the wire closes, which A's read loop sees
         // as a clean close and reports as `ConnectionClosed`.
         Transport::<Local>::disconnect(&b_wire).await;
-        until(|| async { (ea.live_connections() == 0).then_some(()) }).await;
+        until(|| async { (a.closed.get() == 1).then_some(()) }).await;
         assert_eq!(
             a.closed.get(),
             1,
@@ -497,9 +490,9 @@ fn a_group_this_device_is_not_in_is_not_adopted() {
     });
 }
 
-/// M3c's whole claim, from the outside: what rests in storage — and so what
-/// crosses the wire and sits on a relay — is a keyhive envelope, and a party
-/// holding those bytes without being in the group gets nothing from them.
+/// What rests in storage — and so what crosses the wire and sits on a relay —
+/// is a keyhive envelope, and a party holding those bytes without being in the
+/// group gets nothing from them.
 #[test]
 fn commits_at_rest_are_envelopes_a_stranger_cannot_open() {
     let mut pool = LocalPool::new();
@@ -559,10 +552,10 @@ fn commits_at_rest_are_envelopes_a_stranger_cannot_open() {
 /// commit only — not the whole read-back set — still materializes the entire
 /// ancestry behind it.
 ///
-/// This is the mechanism PAIRING.md §4b calls causal-key read-back, and it is
-/// the reason the sealed plaintext is keyhive's own `Envelope` rather than a
-/// look-alike: the walk deserializes an `Envelope` out of every plaintext it
-/// opens, so a parallel format would fail here and nowhere else.
+/// This causal-key read-back is why the sealed plaintext is keyhive's own
+/// `Envelope` rather than a look-alike: the walk deserializes an `Envelope`
+/// out of every plaintext it opens, so a parallel format would fail here and
+/// nowhere else.
 #[test]
 fn a_joiner_walks_the_ancestry_from_a_single_key() {
     use sedimentree_core::loose_commit::LooseCommit;
@@ -842,45 +835,6 @@ fn a_store_does_not_get_to_decide_what_an_item_is() {
     });
 }
 
-#[test]
-fn a_checkpoint_written_before_the_store_existed_still_mints_a_name_key() {
-    // The pre-M4 shape: a device with a group document and no name key. It
-    // never takes the founding branch again, so a mint that only ran there
-    // would leave it with a store it cannot name a single object in.
-    let mut pool = LocalPool::new();
-    let sealed = {
-        let a = device(&pool, 1, None);
-        let ea = Rc::clone(&a.engine);
-        pool.run_until(async move {
-            ea.tasks_add(APP, "buy milk".into()).await.unwrap();
-            ea.snapshot().await.unwrap()
-        })
-    };
-    assert!(sealed.us.is_some(), "the device founded its group");
-    let pre_m4 = Snapshot {
-        name_key: None,
-        ..sealed
-    };
-
-    let restored = device(&pool, 1, Some(pre_m4));
-    let engine = Rc::clone(&restored.engine);
-    pool.run_until(async move {
-        assert_eq!(engine.name_key(), None, "nothing was restored");
-        // The first touch of the group document is what mints it.
-        let _members = engine.members().await.unwrap();
-        assert!(
-            engine.name_key().is_some(),
-            "a restored device can name its store's objects"
-        );
-        // And it is carried from then on.
-        assert_eq!(
-            engine.snapshot().await.unwrap().name_key,
-            engine.name_key(),
-            "the mint rides the next checkpoint"
-        );
-    });
-}
-
 /// The frontier is a set, and divergence is what makes it bigger than one.
 ///
 /// Two devices write while apart, so the document has two branches off one
diff --git a/runtime/crates/kernel/src/apps.rs b/runtime/crates/kernel/src/apps.rs
index 79c3e9f7..faaa789a 100644
--- a/runtime/crates/kernel/src/apps.rs
+++ b/runtime/crates/kernel/src/apps.rs
@@ -32,6 +32,7 @@
 use std::cell::RefCell;
 use std::collections::BTreeMap;
 
+use data_encoding::HEXLOWER;
 use serde::Deserialize;
 use sha2::{Digest, Sha256};
 
@@ -276,11 +277,5 @@ fn failed(url: &str, reason: &str) -> Error {
 /// Hex to bytes. `None` for anything that is not exactly a sha256 digest's
 /// worth of hex digits.
 fn unhex(text: &str) -> Option<Vec<u8>> {
-    if text.len() != 64 {
-        return None;
-    }
-    text.as_bytes()
-        .chunks(2)
-        .map(|pair| u8::from_str_radix(std::str::from_utf8(pair).ok()?, 16).ok())
-        .collect()
+    (text.len() == 64).then(|| HEXLOWER.decode(text.as_bytes()).ok())?
 }
diff --git a/runtime/crates/kernel/src/checkpoint.rs b/runtime/crates/kernel/src/checkpoint.rs
index a7f4a652..b12fe820 100644
--- a/runtime/crates/kernel/src/checkpoint.rs
+++ b/runtime/crates/kernel/src/checkpoint.rs
@@ -7,7 +7,7 @@
 //!
 //! ```text
 //! /<id>/gen-<n>/state      nonce || AES-256-GCM(DEK, aad = <id>) over JSON
-//! /<id>/gen-<n>/MANIFEST   { v, generation: n, sha256: hex(state bytes) }
+//! /<id>/gen-<n>/MANIFEST   { generation: n, sha256: hex(state bytes) }
 //! kv  dev/<id>/gen         n — the pointer, and the commit point
 //! ```
 //!
@@ -37,10 +37,11 @@
 //! write is `n + 1` while the torn `n` and the loaded `n - 1` are both still
 //! on disk, and only removing both collects them.
 
+use data_encoding::HEXLOWER;
 use serde::{Deserialize, Serialize};
 use sha2::{Digest, Sha256};
 
-use crate::device::{Device, SCHEMA};
+use crate::device::Device;
 use crate::seal::Dek;
 use crate::{Error, ErrorCode, Files, Platform, Rng};
 
@@ -49,7 +50,6 @@ use crate::{Error, ErrorCode, Files, Platform, Rng};
 /// session no frame is attached to.
 #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
 pub struct Snapshot {
-    v: u32,
     pub device: Device,
     /// The device's Ed25519 seed. Sealed like everything else here: it is the
     /// whole of the device's identity to its peers, and to iroh.
@@ -60,15 +60,12 @@ pub struct Snapshot {
     pub engine: Option<polyvisor_engine::Snapshot>,
     /// The durable store's binding: the sealed OAuth tokens and how the last
     /// sync went (`crate::drive`). Sealed like everything else here, which is
-    /// the whole reason a bearer never crosses the port. `#[serde(default)]`
-    /// because a checkpoint written before M4 has no such field.
-    #[serde(default)]
+    /// the whole reason a bearer never crosses the port.
     pub storage: Option<crate::drive::Sealed>,
 }
 
 #[derive(Debug, Serialize, Deserialize)]
 struct ManifestJson {
-    v: u32,
     generation: u64,
     /// Lowercase hex sha256 of the `state` file's bytes exactly as written.
     sha256: String,
@@ -141,9 +138,8 @@ pub async fn write(
     })?;
     let state = dek.seal(rng, &plain, id.as_bytes())?;
     let manifest = serde_json::to_vec(&ManifestJson {
-        v: SCHEMA,
         generation,
-        sha256: hex(&Sha256::digest(&state)),
+        sha256: HEXLOWER.encode(&Sha256::digest(&state)),
     })
     .map_err(|e| {
         Error::new(
@@ -221,16 +217,15 @@ async fn read_generation(
     let dir = gen_dir(id, generation);
     let manifest = files.read(format!("{dir}/MANIFEST")).await?;
     let manifest: ManifestJson = serde_json::from_slice(&manifest).ok()?;
-    if manifest.v != SCHEMA || manifest.generation != generation {
+    if manifest.generation != generation {
         return None;
     }
     let state = files.read(format!("{dir}/state")).await?;
-    if hex(&Sha256::digest(&state)) != manifest.sha256 {
+    if HEXLOWER.encode(&Sha256::digest(&state)) != manifest.sha256 {
         return None;
     }
     let plain = dek.open(&state, id.as_bytes()).ok()?;
-    let snapshot: Snapshot = serde_json::from_slice(&plain).ok()?;
-    (snapshot.v == SCHEMA).then_some(snapshot)
+    serde_json::from_slice(&plain).ok()
 }
 
 impl Snapshot {
@@ -241,7 +236,6 @@ impl Snapshot {
         storage: Option<crate::drive::Sealed>,
     ) -> Snapshot {
         Snapshot {
-            v: SCHEMA,
             device,
             seed,
             engine,
@@ -249,7 +243,3 @@ impl Snapshot {
         }
     }
 }
-
-fn hex(bytes: &[u8]) -> String {
-    bytes.iter().map(|b| format!("{b:02x}")).collect()
-}
diff --git a/runtime/crates/kernel/src/device.rs b/runtime/crates/kernel/src/device.rs
index 055e9738..4ab2cb53 100644
--- a/runtime/crates/kernel/src/device.rs
+++ b/runtime/crates/kernel/src/device.rs
@@ -9,10 +9,6 @@ use std::sync::LazyLock;
 
 use crate::{Error, ErrorCode};
 
-/// Bumped when a stored shape changes; a record from the future is an error
-/// rather than a silent partial read.
-pub const SCHEMA: u32 = 3;
-
 const WORDS: &str = include_str!("../eff_short_wordlist.txt");
 
 /// `polyvisor:internal/device.state`, plus the terminal state an erased
@@ -64,7 +60,6 @@ pub struct DeviceStatus {
 /// beyond the petname.
 #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
 pub struct IndexRow {
-    v: u32,
     pub id: String,
     pub petname: String,
     pub tier: Tier,
@@ -80,7 +75,6 @@ impl IndexRow {
     /// A fresh device: ephemeral, resting open, unnamed.
     pub fn fresh(id: &str, now: u64) -> IndexRow {
         IndexRow {
-            v: SCHEMA,
             id: id.to_string(),
             petname: String::new(),
             tier: Tier::Ephemeral,
@@ -91,22 +85,12 @@ impl IndexRow {
     }
 
     pub fn decode(bytes: &[u8]) -> Result<IndexRow, Error> {
-        let row: IndexRow = serde_json::from_slice(bytes).map_err(|e| {
+        serde_json::from_slice(bytes).map_err(|e| {
             Error::new(
                 ErrorCode::Failed,
                 format!("a device index row could not be read: {e}"),
             )
-        })?;
-        if row.v != SCHEMA {
-            return Err(Error::new(
-                ErrorCode::Failed,
-                format!(
-                    "a device index row is version {}; this runtime speaks {SCHEMA}",
-                    row.v
-                ),
-            ));
-        }
-        Ok(row)
+        })
     }
 
     pub fn encode(&self) -> Result<Vec<u8>, Error> {
@@ -128,9 +112,7 @@ pub struct Device {
     pub hue: u16,
     pub word: String,
     /// The user's own labels — petname, glyph, whatever the visor settles on
-    /// (internal.wit `meta-scope`). Absent from checkpoints written before
-    /// this field existed; `serde(default)` keeps those loading.
-    #[serde(default)]
+    /// (internal.wit `meta-scope`).
     pub meta: Meta,
 }
 
@@ -138,14 +120,12 @@ pub struct Device {
 #[derive(Debug, Clone, PartialEq, Eq, Default, Serialize, Deserialize)]
 pub struct Meta {
     pub user: BTreeMap<String, String>,
-    pub device: BTreeMap<String, String>,
     pub app: BTreeMap<String, BTreeMap<String, String>>,
 }
 
 /// Which map `meta`/`set_meta` reads or replaces.
 pub enum MetaScope {
     User,
-    Device,
     App(String),
 }
 
diff --git a/runtime/crates/kernel/src/drive.rs b/runtime/crates/kernel/src/drive.rs
index 5dbe20d4..3267dd99 100644
--- a/runtime/crates/kernel/src/drive.rs
+++ b/runtime/crates/kernel/src/drive.rs
@@ -142,11 +142,8 @@ pub struct Tokens {
 /// The store's checkpointed half.
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
 pub struct Sealed {
-    #[serde(default)]
     pub tokens: Option<Tokens>,
-    #[serde(default)]
     pub last_pull: u64,
-    #[serde(default)]
     pub last_push: u64,
 }
 
@@ -274,8 +271,8 @@ impl Kernel {
     /// app's, or (`None`) the group document's. A fragment is a commit range
     /// carried as one item (`docs/design.md` §"Read-back and partitions").
     ///
-    /// Test introspection, in the shape of `Engine::live_connections`:
-    /// which commit closes a fragment is the hash's decision, so a test that
+    /// Test introspection: which commit closes a fragment is the hash's
+    /// decision, so a test that
     /// wants the compacted case has to write until one appears and cannot
     /// predict the number. Nothing in the WIT world reads this.
     ///
diff --git a/runtime/crates/kernel/src/lib.rs b/runtime/crates/kernel/src/lib.rs
index 1b820cda..6b28cb6b 100644
--- a/runtime/crates/kernel/src/lib.rs
+++ b/runtime/crates/kernel/src/lib.rs
@@ -565,7 +565,6 @@ impl Kernel {
         let device = state.device.as_ref().expect("open implies a device");
         Ok(match scope {
             MetaScope::User => device.meta.user.clone(),
-            MetaScope::Device => device.meta.device.clone(),
             MetaScope::App(id) => device.meta.app.get(&id).cloned().unwrap_or_default(),
         })
     }
@@ -582,7 +581,6 @@ impl Kernel {
         self.with_device(|d| {
             match scope {
                 MetaScope::User => d.meta.user = meta,
-                MetaScope::Device => d.meta.device = meta,
                 MetaScope::App(id) => {
                     if meta.is_empty() {
                         d.meta.app.remove(&id);
@@ -880,7 +878,7 @@ impl Kernel {
     async fn write_checkpoint(&self) -> Result<(), Error> {
         // Taken before the state borrow: `Engine::snapshot` borrows the
         // engine's own cells, and nothing may hold two of ours at once. It is
-        // also async since M3c (it carries the device's keyhive), so the
+        // also async because it carries the device's keyhive, so the
         // engine handle is cloned out and the borrow released before awaiting.
         let engine = self.engine.borrow().clone();
         let engine = match engine {
@@ -962,17 +960,6 @@ impl Kernel {
         Ok(session)
     }
 
-    pub fn session_app(&self, session: SessionId) -> Result<AppInfo, Error> {
-        self.open()?;
-        let app = self.session_app_id(session)?;
-        self.registry.info(&app).ok_or_else(|| {
-            Error::new(
-                ErrorCode::UnknownApp,
-                format!("session {session} names an app that is no longer installed"),
-            )
-        })
-    }
-
     pub async fn component(&self, session: SessionId) -> Result<ComponentArtifacts, Error> {
         self.open()?;
         let app = self.session_app_id(session)?;
@@ -1130,11 +1117,6 @@ impl Kernel {
 
     // -- app services --------------------------------------------------------
 
-    pub async fn tasks_revision(&self, session: SessionId) -> Result<u64, String> {
-        let (app, engine) = self.app_engine(session)?;
-        engine.tasks_revision(&app).await
-    }
-
     pub async fn tasks_items(&self, session: SessionId) -> Result<Snapshot, String> {
         let (app, engine) = self.app_engine(session)?;
         engine.tasks_items(&app).await
diff --git a/runtime/crates/kernel/src/pairing.rs b/runtime/crates/kernel/src/pairing.rs
index 4ee858c6..21122dc1 100644
--- a/runtime/crates/kernel/src/pairing.rs
+++ b/runtime/crates/kernel/src/pairing.rs
@@ -1,8 +1,7 @@
 //! Device pairing: the ceremony that enrolls a device into the group
 //! (internal.wit `interface pairing`).
 //!
-//! The shape, and every rule it encodes, is the pinned pairing contract
-//! (PAIRING.md §1–§2):
+//! The protocol rules are:
 //!
 //! - The **joiner** shows a code — `0x01 ‖ its endpoint key(32) ‖ token(16)`
 //!   in `BASE32_NOPAD_VISUAL`, 79 characters. The **adder** types or scans it
@@ -18,7 +17,7 @@
 //!   users compare them, and **both** confirm. Only then does the adder write
 //!   the joiner into the user-system document and send it over.
 //! - The joiner **adopts** that document — its group of one is discarded —
-//!   acknowledges with ENROLLED (PAIRING.md §2 step 8, added here), and only
+//!   acknowledges with ENROLLED, and only
 //!   then dials the adder on the subduction ALPN. That order is load-bearing:
 //!   the membership check on a subduction connection consults the group, and
 //!   both sides must already agree on it before the dial.
@@ -47,7 +46,7 @@ use serde::{Deserialize, Serialize};
 
 use crate::{EngineTransport, Error, ErrorCode, Kernel, PAIRING_ALPN};
 
-/// How long an offer stands (PAIRING.md §1).
+/// How long an offer stands.
 const OFFER_TTL_MS: u64 = 120_000;
 
 /// The code's version byte. A different first byte is a different ceremony,
@@ -784,7 +783,7 @@ enum Frame {
         name_key: Vec<u8>,
     },
     /// Joiner → adder, last: the enrollment has been adopted *and*
-    /// checkpointed here (PAIRING.md §2 step 8). It carries nothing — the
+    /// checkpointed here. It carries nothing — the
     /// message is that it arrived at all.
     ///
     /// It exists for the connection's sake rather than the protocol's: the
@@ -803,7 +802,7 @@ async fn send_frame(transport: &dyn EngineTransport, frame: &Frame) -> Result<()
 }
 
 /// The next frame, or `None` for a clean end, a dead connection, or bytes
-/// that are not a frame at all — reject-on-unknown (PAIRING.md §2).
+/// that are not a frame at all. Unknown frames are rejected.
 async fn recv_frame(transport: &dyn EngineTransport) -> Option<Frame> {
     let bytes = transport.recv().await?;
     serde_json::from_slice(&bytes).ok()
@@ -847,7 +846,7 @@ fn nonce32(bytes: &[u8]) -> Result<[u8; 32], String> {
 
 // -- code and SAS ------------------------------------------------------------
 
-/// `BASE32_NOPAD_VISUAL(0x01 ‖ key ‖ token)` — 79 characters (PAIRING.md §1).
+/// `BASE32_NOPAD_VISUAL(0x01 ‖ key ‖ token)` — 79 characters.
 /// The visor displays it in groups of four; the groups are not part of it.
 fn encode_code(key: &[u8; 32], token: &[u8; 16]) -> String {
     let mut payload = Vec::with_capacity(49);
@@ -883,7 +882,7 @@ fn decode_code(code: &str) -> Result<([u8; 32], [u8; 16]), String> {
     Ok((key, token))
 }
 
-/// The six digits both users compare (PAIRING.md §2).
+/// The six digits both users compare.
 ///
 /// `transcript = 0x01 ‖ token ‖ joiner-key ‖ adder-key ‖ nonce_j ‖ nonce_a`;
 /// the SAS is the first four bytes of its BLAKE3 read big-endian, modulo
@@ -918,7 +917,7 @@ mod tests {
         let key = [7u8; 32];
         let token = [9u8; 16];
         let code = encode_code(&key, &token);
-        assert_eq!(code.len(), 79, "PAIRING.md §1: 79 characters");
+        assert_eq!(code.len(), 79);
         assert_eq!(decode_code(&code).unwrap(), (key, token));
         // Grouped in fours for display, and hyphenated: the same code.
         let grouped: String = code
diff --git a/runtime/crates/kernel/src/seal.rs b/runtime/crates/kernel/src/seal.rs
index d91c1ebc..6d738914 100644
--- a/runtime/crates/kernel/src/seal.rs
+++ b/runtime/crates/kernel/src/seal.rs
@@ -77,34 +77,12 @@ impl Dek {
 }
 
 /// The record written to `dev/<id>/dek-wrapped` when a device rests under a
-/// passphrase. Everything needed to re-derive the KEK, and nothing else: the
-/// parameters travel with the ciphertext so a later runtime raising the cost
-/// can still open an older device.
+/// passphrase.
 #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
 pub struct WrappedDek {
-    v: u32,
     pub salt: Vec<u8>,
     pub nonce: Vec<u8>,
     pub ct: Vec<u8>,
-    pub params: Argon2Params,
-}
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
-pub struct Argon2Params {
-    /// Memory cost in KiB.
-    pub m_cost: u32,
-    pub t_cost: u32,
-    pub p_cost: u32,
-}
-
-impl Default for Argon2Params {
-    fn default() -> Self {
-        Argon2Params {
-            m_cost: ARGON2_M_COST_KIB,
-            t_cost: ARGON2_T_COST,
-            p_cost: ARGON2_P_COST,
-        }
-    }
 }
 
 impl WrappedDek {
@@ -116,45 +94,31 @@ impl WrappedDek {
         rng.fill(&mut salt);
         let mut nonce = [0u8; NONCE_LEN];
         rng.fill(&mut nonce);
-        let params = Argon2Params::default();
-        let kek = derive_kek(passphrase, &salt, &params)?;
+        let kek = derive_kek(passphrase, &salt)?;
         let ct = encrypt(&kek, &nonce, &dek.0, id.as_bytes())?;
         Ok(WrappedDek {
-            v: crate::device::SCHEMA,
             salt: salt.to_vec(),
             nonce: nonce.to_vec(),
             ct,
-            params,
         })
     }
 
     /// The login. A wrong passphrase is indistinguishable from a corrupt
     /// record here; the caller turns both into `refused`.
     pub fn unwrap_with(&self, passphrase: &str, id: &str) -> Result<Dek, Error> {
-        let kek = derive_kek(passphrase, &self.salt, &self.params)?;
+        let kek = derive_kek(passphrase, &self.salt)?;
         let nonce: [u8; NONCE_LEN] = self.nonce.as_slice().try_into().map_err(|_| unreadable())?;
         let plain = decrypt(&kek, &nonce, &self.ct, id.as_bytes())?;
         Dek::decode(&plain)
     }
 
     pub fn decode(bytes: &[u8]) -> Result<WrappedDek, Error> {
-        let record: WrappedDek = serde_json::from_slice(bytes).map_err(|e| {
+        serde_json::from_slice(bytes).map_err(|e| {
             Error::new(
                 ErrorCode::Failed,
                 format!("the wrapped data key could not be read: {e}"),
             )
-        })?;
-        if record.v != crate::device::SCHEMA {
-            return Err(Error::new(
-                ErrorCode::Failed,
-                format!(
-                    "the wrapped data key is version {}; this runtime speaks {}",
-                    record.v,
-                    crate::device::SCHEMA
-                ),
-            ));
-        }
-        Ok(record)
+        })
     }
 
     pub fn encode(&self) -> Result<Vec<u8>, Error> {
@@ -167,18 +131,19 @@ impl WrappedDek {
     }
 }
 
-fn derive_kek(
-    passphrase: &str,
-    salt: &[u8],
-    params: &Argon2Params,
-) -> Result<[u8; DEK_LEN], Error> {
-    let params = argon2::Params::new(params.m_cost, params.t_cost, params.p_cost, Some(DEK_LEN))
-        .map_err(|e| {
-            Error::new(
-                ErrorCode::Failed,
-                format!("the key derivation parameters are not usable: {e}"),
-            )
-        })?;
+fn derive_kek(passphrase: &str, salt: &[u8]) -> Result<[u8; DEK_LEN], Error> {
+    let params = argon2::Params::new(
+        ARGON2_M_COST_KIB,
+        ARGON2_T_COST,
+        ARGON2_P_COST,
+        Some(DEK_LEN),
+    )
+    .map_err(|e| {
+        Error::new(
+            ErrorCode::Failed,
+            format!("the key derivation parameters are not usable: {e}"),
+        )
+    })?;
     let argon = argon2::Argon2::new(argon2::Algorithm::Argon2id, argon2::Version::V0x13, params);
     let mut kek = [0u8; DEK_LEN];
     argon
diff --git a/runtime/crates/kernel/tests/kernel.rs b/runtime/crates/kernel/tests/kernel.rs
index c80e4386..512a1f06 100644
--- a/runtime/crates/kernel/tests/kernel.rs
+++ b/runtime/crates/kernel/tests/kernel.rs
@@ -1468,7 +1468,7 @@ fn meta_persists_across_a_reload_and_is_unavailable_while_sealed() {
         "meta rides in the sealed checkpoint: unavailable while sealed"
     );
     assert_eq!(
-        block_on(reread.set_meta(MetaScope::Device, BTreeMap::new()))
+        block_on(reread.set_meta(MetaScope::App("app-1".into()), BTreeMap::new()))
             .unwrap_err()
             .code,
         ErrorCode::Unavailable
@@ -1494,7 +1494,7 @@ fn tasks_survive_a_reload_but_sessions_do_not() {
     let kernel = world.boot();
     // The old session id is gone with the worker that minted it.
     assert_eq!(
-        block_on(kernel.tasks_revision(1)),
+        block_on(kernel.tasks_items(1)),
         Err("unknown session".into()),
         "sessions are not persisted: a reload ends them"
     );
@@ -2050,11 +2050,10 @@ fn sessions_are_monotonic_and_close_is_idempotent() {
     let a = session(&kernel);
     let b = session(&kernel);
     assert_eq!((a, b), (1, 2));
-    assert_eq!(kernel.session_app(a).unwrap().id, "todomvc");
 
     kernel.close(a);
     assert_eq!(
-        kernel.session_app(a).unwrap_err().code,
+        kernel.assets(a).unwrap_err().code,
         ErrorCode::UnknownSession
     );
     kernel.close(a); // idempotent per internal.wit
@@ -2111,10 +2110,6 @@ fn an_asset_that_does_not_hash_to_its_handle_is_rejected() {
 #[test]
 fn unknown_sessions_are_rejected_everywhere() {
     let kernel = boot();
-    assert_eq!(
-        kernel.session_app(99).unwrap_err().code,
-        ErrorCode::UnknownSession
-    );
     assert_eq!(
         block_on(kernel.component(99)).unwrap_err().code,
         ErrorCode::UnknownSession
@@ -2128,7 +2123,7 @@ fn unknown_sessions_are_rejected_everywhere() {
         ErrorCode::UnknownSession
     );
     assert_eq!(
-        block_on(kernel.tasks_revision(99)),
+        block_on(kernel.tasks_items(99)),
         Err("unknown session".into())
     );
 }
@@ -2158,10 +2153,9 @@ fn tasks_are_shared_by_every_session_of_one_app() {
 }
 
 #[test]
-fn every_mutation_advances_the_revision_and_ids_order_the_items() {
+fn mutations_update_items_and_ids_preserve_creation_order() {
     let kernel = boot();
     let s = session(&kernel);
-    assert_eq!(block_on(kernel.tasks_revision(s)).unwrap(), 0);
 
     let first = block_on(kernel.tasks_add(s, "milk".into())).unwrap();
     let second = block_on(kernel.tasks_add(s, "bread".into())).unwrap();
@@ -2169,12 +2163,9 @@ fn every_mutation_advances_the_revision_and_ids_order_the_items() {
     // shared counter is not safe across two authors. The document records
     // each item's place instead, and `items` comes back in that order.
     assert_ne!(first, second);
-    assert_eq!(block_on(kernel.tasks_revision(s)).unwrap(), 2);
-
     block_on(kernel.tasks_set_completed(s, &first, true)).unwrap();
     block_on(kernel.tasks_set_title(s, &second, "rye".into())).unwrap();
     let snapshot = block_on(kernel.tasks_items(s)).unwrap();
-    assert_eq!(snapshot.revision, 4);
     assert_eq!(
         snapshot
             .items
@@ -2187,13 +2178,15 @@ fn every_mutation_advances_the_revision_and_ids_order_the_items() {
     assert_eq!(snapshot.items[1].title, "rye");
 
     block_on(kernel.tasks_remove(s, &first)).unwrap();
-    assert_eq!(block_on(kernel.tasks_revision(s)).unwrap(), 5);
     assert_eq!(block_on(kernel.tasks_items(s)).unwrap().items.len(), 1);
 
     // A failed mutation is not a mutation.
     assert!(block_on(kernel.tasks_remove(s, &first)).is_err());
     assert!(block_on(kernel.tasks_set_title(s, "nope", "x".into())).is_err());
-    assert_eq!(block_on(kernel.tasks_revision(s)).unwrap(), 5);
+    let items = block_on(kernel.tasks_items(s)).unwrap().items;
+    assert_eq!(items.len(), 1);
+    assert_eq!(items[0].id, second);
+    assert_eq!(items[0].title, "rye");
 }
 
 // -- events ------------------------------------------------------------------
@@ -2289,7 +2282,7 @@ fn abort_ends_the_session_and_announces_it_once() {
     kernel.abort(s, "the app's frame was closed: policy".into());
 
     assert_eq!(
-        kernel.session_app(s).unwrap_err().code,
+        kernel.assets(s).unwrap_err().code,
         ErrorCode::UnknownSession,
         "the session is no longer live"
     );
@@ -2767,8 +2760,8 @@ fn pairing_enrolls_the_joiner_and_the_two_devices_then_sync() {
 
 #[test]
 fn a_second_claim_is_refused_and_burns_the_ceremony_it_interrupted() {
-    // PAIRING.md §1: the token is single-claim. A code that reached a second
-    // party has leaked, so the second claim is refused *and* the bound
+    // The token is single-claim. A code that reached a second party has
+    // leaked, so the second claim is refused *and* the bound
     // session dies — both users start over rather than one of them finishing
     // a ceremony an eavesdropper watched.
     let here = World::default();
@@ -2918,8 +2911,8 @@ fn a_cancel_before_the_confirm_tells_the_other_side() {
 
 #[test]
 fn an_offer_expires_after_two_minutes() {
-    // PAIRING.md §1: the offer stands 120 s. After that the code is dead on
-    // both sides — the joiner says so, and a claim that arrives late is
+    // The offer stands 120 s. After that the code is dead on both sides —
+    // the joiner says so, and a claim that arrives late is
     // refused rather than quietly honoured.
     let here = World::default();
     let there = here.peer();
diff --git a/runtime/wit/internal.wit b/runtime/wit/internal.wit
index 4aa0c7fe..dc6a8917 100644
--- a/runtime/wit/internal.wit
+++ b/runtime/wit/internal.wit
@@ -193,12 +193,12 @@ interface device {
     set-hue: async func(hue: u16) -> result<_, error>;
     reroll-word: async func() -> result<string, error>;
 
-    /// The user's own labels for themself, this device, and each installed
-    /// app — petname, glyph, whatever the visor settles on. Free-form while
+    /// The user's own labels for themself and each installed app — petname,
+    /// glyph, whatever the visor settles on. Free-form while
     /// the field set is in flux: keys are the visor's vocabulary, values are
     /// user voice. Personal: rides in the sealed checkpoint with name/hue/
     /// word, so `unavailable` while sealed.
-    variant meta-scope { user, device, app(string) }
+    variant meta-scope { user, app(string) }
     meta: async func(scope: meta-scope) -> result<list<tuple<string, string>>, error>;
     /// Replaces the whole map for `scope`.
     set-meta: async func(scope: meta-scope, entries: list<tuple<string, string>>) -> result<_, error>;
@@ -408,9 +408,6 @@ interface apps {
     /// frame fetches `component`/`assets`/`asset` over that port, which
     /// the glue answers with the session already filled in.
     launch: async func(app: app-id) -> result<session-id, error>;
-    /// Which app a session runs (the frame shows nothing of its own; the
-    /// visor's strip plates this title).
-    session-app: async func(session: session-id) -> result<app-info, error>;
     component: async func(session: session-id) -> result<component-artifacts, error>;
     assets: async func(session: session-id) -> result<list<asset-info>, error>;
     asset: async func(session: session-id, handle: list<u8>) -> result<list<u8>, error>;
@@ -466,7 +463,6 @@ interface app-services {
     use types.{session-id};
     use polyvisor:app/tasks@0.1.0.{snapshot};
 
-    tasks-revision: async func(session: session-id) -> result<u64, string>;
     tasks-items: async func(session: session-id) -> result<snapshot, string>;
     tasks-add: async func(session: session-id, title: string) -> result<string, string>;
     tasks-set-completed: async func(session: session-id, id: string, completed: bool) -> result<_, string>;
@@ -503,8 +499,6 @@ interface shell {
     /// Read once per page load by the visor, after unseal, and handed to
     /// `apps.route-decode`; the visor never parses it.
     fragment: func() -> option<string>;
-    /// `location.reload()`.
-    reload: func();
     /// Re-anchor this tab to another device (or, with `none`, to a fresh
     /// one) and reload: the anchor is the tab's sessionStorage pointer and
     /// the worker is named after it, so a device switch is a page reload.
diff --git a/visor/src/component.rs b/visor/src/component.rs
index 6e25bedb..6aee3cb8 100644
--- a/visor/src/component.rs
+++ b/visor/src/component.rs
@@ -1,20 +1,9 @@
-//! The `visor` world: bindings, and the two producer exports.
-//!
-//! `stream_dom_dioxus::launch!` is deliberately not used: it exports the
-//! bare `producer` world, which has none of the visor's kernel imports
-//! (m1-context.md "Rust facts"). Instead this world's own `generate!`
-//! remaps the three `polymorph:stream-dom` interfaces onto
-//! `stream_dom_guest::bindings`, so the `StreamReader<u8>` and `DomEvent`
-//! that cross into `stream_dom_dioxus::driver` are the same types the
-//! driver was compiled against, and `run`/`handle-event` are two-line
-//! delegations.
+//! The visor world bindings and stream-dom producer exports. This cannot use
+//! `stream_dom_dioxus::launch!` because the visor has additional imports; the
+//! remaps keep the generated stream and event types identical to the driver.
 
-// No `async:` option, for the reason spelled out in
-// `runtime/component/src/component.rs`: one blanket mode lowers WIT-sync
-// functions with the async canonical option, which is illegal and only
-// wasmtime catches it. Every function in this world is `async func`
-// anyway, so following the WIT annotations is both correct today and
-// proof against a sync one arriving later.
+// WIT annotations decide async lowering; blanket async would incorrectly
+// lower synchronous functions.
 // `features`: not for this world, which imports nothing unstable — for the
 // package. `world runtime` in the same directory imports
 // `polymorph:iroh/identity-from-seed`, which is
diff --git a/visor/src/kernel.rs b/visor/src/kernel.rs
index 6c1646c2..75e8c356 100644
--- a/visor/src/kernel.rs
+++ b/visor/src/kernel.rs
@@ -257,8 +257,6 @@ pub(crate) async fn reroll_word() -> Result<String, String> {
 }
 
 /// Which map `meta`/`set_meta` reads or replaces (internal.wit `meta-scope`).
-/// The `device` scope exists in the contract but nothing in the visor edits
-/// it yet, so it has no variant here.
 #[derive(Clone, PartialEq, Debug)]
 pub(crate) enum MetaScope {
     User,
@@ -274,8 +272,7 @@ fn meta_scope(scope: MetaScope) -> api::device::MetaScope {
 
 pub(crate) type Meta = std::collections::BTreeMap<String, String>;
 
-/// The user's own labels for themself, this device, and one app
-/// (internal.wit `device.meta`).
+/// The user's own labels for themself or one app (internal.wit `device.meta`).
 pub(crate) async fn meta(scope: MetaScope) -> Result<Meta, String> {
     Ok(api::device::meta(meta_scope(scope))
         .await
diff --git a/visor/src/lib.rs b/visor/src/lib.rs
index e22cdc55..7be570a1 100644
--- a/visor/src/lib.rs
+++ b/visor/src/lib.rs
@@ -4,10 +4,8 @@
 //! and the drawer into its mount root, driving the kernel through the
 //! `device`/`apps`/`events` imports and the page through `shell`.
 //!
-//! Split for the same reason as the runtime component: everything with a
-//! testable answer — the voices, the drawer state machine, the stylesheet —
-//! is plain Rust and runs under a host `cargo test`, while the bindings and
-//! the UI that calls them are behind the wasm cfg.
+//! Plain state and presentation modules remain available to native tests;
+//! bindings and UI imports compile only for the component target.
 
 // Off the component target these modules' only consumers are their own
 // tests — the UI that uses them in earnest is wasm-only — so dead-code
diff --git a/visor/src/state.rs b/visor/src/state.rs
index e7c3370d..2b843f8b 100644
--- a/visor/src/state.rs
+++ b/visor/src/state.rs
@@ -88,25 +88,8 @@ pub(crate) fn boot_drawer(
     }
 }
 
-/// Ordering between a read that takes time and the writes it may race.
-///
-/// The visor reads kernel state in spawned tasks — `device.status` when
-/// Settings opens, `store.devices` during the boot — and a task that starts
-/// before a write completes after it. Its answer describes the world as it
-/// was *before* the write, so applying it afterwards silently undoes the
-/// write. Both of the visor's flakes were exactly this:
-///
-/// * a `device.status` read spawned by the Settings press landed after the
-///   user's set-name had been applied, and put the old name back;
-/// * the boot's `boot_drawer` decision — one read of `device.status` and
-///   one of `store.devices` — landed after the user had already opened a
-///   tenant, and closed the drawer under their hands.
-///
-/// So a write bumps the generation, and a read carries the generation it
-/// began with and applies its result only if nothing was written since.
-/// Losing a read is always safe: the next press reads again, and what it
-/// reads is newer than what was dropped. Losing a *write* is not, which is
-/// why the tie goes to the writer.
+/// Generation gate preventing an async read from overwriting a newer user
+/// action. Writes bump it; reads apply only at the generation they began.
 #[derive(Clone, Copy, PartialEq, Eq, Debug, Default)]
 pub(crate) struct Gate {
     writes: u64,
diff --git a/visor/src/ui.rs b/visor/src/ui.rs
index 2a4e6402..2fbe528d 100644
--- a/visor/src/ui.rs
+++ b/visor/src/ui.rs
@@ -40,10 +40,7 @@ use crate::state::{
 use crate::style::CSS;
 use crate::voice::{AppText, AppVoice, Voice, coarse_age};
 
-/// The two keys this visor writes into every meta map. internal.wit
-/// `device.meta` leaves the vocabulary to the visor ("keys are the visor's
-/// vocabulary, values are user voice"), so these two names are the whole
-/// of it, and they mean the same thing in all three scopes.
+/// Visor-owned keys, with the same meaning in user and app metadata.
 const PETNAME: &str = "petname";
 const GLYPH: &str = "glyph";
 
@@ -169,9 +166,7 @@ async fn save_draft(
     !failed
 }
 
-/// One app's labels (internal.wit `device.meta`, `meta-scope.app`). Read
-/// when a session opens — the strip's left half speaks for the running app
-/// — and again when its sheet is opened.
+/// Load the running app's labels when its session opens.
 async fn read_app_meta(id: String, mut app_meta: Signal<Meta>, mut notice: Signal<Option<Notice>>) {
     match kernel::meta(MetaScope::App(id)).await {
         Ok(m) => app_meta.set(m),
@@ -719,20 +714,10 @@ pub(crate) fn Visor() -> Element {
                 refresh_devices.call(());
                 refresh_storage.call(());
             }
-            // The sheet is about the running app, so its labels are read
-            // before they are seeded — the strip has them already, but a
-            // second device of the group may have relabelled it since.
+            // Seed synchronously before the pane can accept input; a later
+            // seed could overwrite a glyph selected while a read was in flight.
             Some(Tenant::AppInfo) => {
-                let id = session
-                    .read()
-                    .as_ref()
-                    .map(|(_, a): &(SessionId, App)| a.id.clone());
-                spawn(async move {
-                    if let Some(id) = id {
-                        read_app_meta(id, app_meta, notice).await;
-                    }
-                    seed_draft.call(());
-                });
+                seed_draft.call(());
             }
             _ => {}
         }
diff --git a/visor/src/voice.rs b/visor/src/voice.rs
index e15003a1..f2f5eae2 100644
--- a/visor/src/voice.rs
+++ b/visor/src/voice.rs
@@ -64,18 +64,8 @@ pub(crate) fn AppVoice(text: AppText) -> Element {
     }
 }
 
-/// How long ago, coarsely, in the framework's own voice.
-///
-/// Deliberately not a locale-formatted date. The entry picker runs before
-/// any seal opens, so this text sits next to a petname on a screen that is
-/// otherwise anonymous: an exact timestamp would be both a needless detail
-/// and a fingerprintable one, and a locale-formatted one would drag a
-/// formatting dependency into the trusted pixels. Coarse and English is
-/// what the sheet needs to tell two devices apart.
-///
-/// Both arguments are epoch milliseconds (`store.entry.last-used`). A
-/// timestamp in the future — clock skew, a row written by another tab —
-/// reads as "just now" rather than as nonsense.
+/// A coarse, non-identifying age for the pre-unseal device picker. Both
+/// arguments are epoch milliseconds; future timestamps clamp to "just now".
 pub(crate) fn coarse_age(now_ms: u64, then_ms: u64) -> String {
     let secs = now_ms.saturating_sub(then_ms) / 1_000;
     let mins = secs / 60;
diff --git a/web/boot.ts b/web/boot.ts
index f4609a51..0b1c04f3 100644
--- a/web/boot.ts
+++ b/web/boot.ts
@@ -927,12 +927,7 @@ async function main(): Promise<void> {
       closeFrame(session);
       return Promise.resolve();
     },
-    // `shell.reload` is the one sync func in internal.wit: it must not
-    // return a promise.
-    reload: () => {
-      location.reload();
-    },
-    // Also sync (internal.wit `shell.fragment`). `""` and `"#"` both read as
+    // Sync (internal.wit `shell.fragment`). `""` and `"#"` both read as
     // `undefined`: `location.hash` is `""` with none, and is `"#"` for a
     // literal bare `#` — neither names a fragment `apps.route-decode` could
     // ever accept, so there is nothing to hand it.
diff --git a/web/frame.ts b/web/frame.ts
index 24055aa5..d0ec9f1b 100644
--- a/web/frame.ts
+++ b/web/frame.ts
@@ -1,16 +1,5 @@
-// The frame loader: the entire contents of every app frame.
-//
-// It is constant — one build artifact, hash-pinned in the srcdoc's meta CSP
-// (web/boot.ts `frameSrcdoc`) — so the app's own code arrives as data over a
-// port and never as script. The frame is an opaque origin with no
-// `connect-src`: everything it renders comes down the mutation stream or out
-// of a `blob:` minted here from bytes the kernel served over the session
-// port. That is the e2e `frame-network-dead` claim, structurally.
-//
-// Its authority is exactly one session port (internal.wit "Realms"): the
-// app's `polyvisor:app/tasks` import and the three `polyvisor:internal/apps`
-// members that read its own bundle. It never states a session id; the worker
-// bound one to this port.
+// Constant loader for opaque, network-dead app frames. Component bytes and
+// the session-bound capability port arrive as data from the parent.
 
 import { artifactsFromEnvelope } from "@polyengine/runtime/embedder";
 
@@ -41,12 +30,7 @@ let mounted: MountedProducer | undefined;
  * exists an await later, which is not a guard. */
 let mounting = false;
 
-/** `polyvisor:app/route.get`'s answer: the route the mount message carried
- * ("" for a plain launch), fixed for this frame's lifetime — `wit/app.wit`
- * `route`: "the route the app was launched at". Served locally, never over
- * the session port: the port answers `tasks`/`apps`, and route is a
- * page-URL concern the glue owns on the other side of `postMessage`, not a
- * kernel call (internal.wit `shell.open-frame` docs). */
+/** Launch route, fixed for the frame lifetime and served locally. */
 let route = "";
 
 function teardown(message: string): void {
@@ -62,13 +46,7 @@ async function mount(
   port: MessagePort,
 ): Promise<void> {
   const imports = proxyInterfaces(port, [I.tasks]);
-  // `route` is local, not proxied over `port`: `get` reads the value the
-  // mount message carried and `set` relays to the parent, which is the one
-  // side that can touch `location` at all (internal.wit `shell.open-frame`:
-  // "the glue also writes the page fragment ... on every `route.set` the
-  // frame relays"). Same shape as a proxied interface — a record of
-  // camelCase methods, keyed by the verbatim WIT interface id — so it merges
-  // into `imports` exactly where a proxy would have gone.
+  // Only the parent can update the page URL.
   imports[I.route] = {
     get: () => route,
     set: (r: string) => {
diff --git a/web/mount.ts b/web/mount.ts
index 4000731c..b13d1f41 100644
--- a/web/mount.ts
+++ b/web/mount.ts
@@ -1,18 +1,6 @@
-// Mount a `polymorph:stream-dom` producer with extra WIT imports.
-//
-// `@polymorph/stream-dom-receiver`'s own `mount()` has no way to add imports,
-// and both producers here need some: the visor imports the kernel interfaces
-// and `shell`, the app imports `polyvisor:app/tasks`. So this is that
-// module's component-glue half — `createDriver` + `instantiate` + the
-// readDirect loop — copied from receiver/src/mount.ts at the pinned rev
-// (deno.json's import map) with `imports` merged in and the transports,
-// recording tap and remote backend dropped: nothing here uses them.
-//
-// JSPI is not an option this repository takes (docs/design.md "No JSPI"):
-// every realm-crossing import is `async func` and suspends through the
-// component model's async ABI, so a Promise from a sync-typed import is a
-// bug and the embedder should refuse it loudly. Hence `jspi: false` on the
-// `instantiate` below — pinned for every call site by web/jspi_test.ts.
+// Mount stream-dom producers with their additional WIT imports. This is the
+// receiver's createDriver/instantiate/readDirect path, with unused transports
+// omitted. JSPI stays explicitly disabled by design.
 
 import { instantiate } from "@polyengine/runtime/embedder";
 import type { InstantiateSource } from "@polyengine/runtime/embedder";
diff --git a/web/platform/no-node-datachannel.ts b/web/platform/no-node-datachannel.ts
index e087643d..69060adc 100644
--- a/web/platform/no-node-datachannel.ts
+++ b/web/platform/no-node-datachannel.ts
@@ -1,26 +1,6 @@
-// `node-datachannel`'s W3C polyfill, as it exists in a browser: it does not.
-//
-// `@polymorph/webrtc-datachannels` resolves `RTCPeerConnection` from the
-// global and falls back to this npm polyfill under Deno/Node, reaching it
-// through a DYNAMIC import so the bare specifier "never has to resolve in
-// the browser". That is true of the fallback *branch*, but not of the
-// bundle: `deno bundle` inlines dynamic imports, so shipping the real module
-// drags `node:url`/`node:path`/`node:module`/`node:stream`/`node:events`
-// into `worker.js` and leaves a module no browser can load at all.
-//
-// `--external` avoided that but left the bare `npm:` specifier in the
-// bundle, and a module SharedWorker whose graph names an unresolvable
-// specifier intermittently fails to start in headless Chromium — silently:
-// no `connect` event, no `error` event, just a worker that never runs
-// (measured at 6 stalls in 32 fresh contexts, versus 0 in 32 with the
-// specifier gone). deno.json maps the specifier here instead, so the
-// bundler inlines this file: no `node:*`, no unresolved specifier, and the
-// fallback branch keeps the shape it had — a rejected import.
-//
-// This is not a stub standing in for something a browser could do. WebRTC's
-// API is not exposed to workers at all, so a SharedWorker reaching this
-// branch has no peer connection available by any route, and saying so
-// plainly is the honest answer.
+// Browser-bundle replacement for `node-datachannel`. Deno's bundler otherwise
+// pulls Node modules into worker.js; SharedWorkers have neither that fallback
+// nor a global RTCPeerConnection.
 
 // No exports: the module body throws, so nothing downstream of the import
 // ever runs and a named binding would only be a shape suggesting otherwise.
diff --git a/web/platform/sockets.ts b/web/platform/sockets.ts
index e6a15824..6cb637b9 100644
--- a/web/platform/sockets.ts
+++ b/web/platform/sockets.ts
@@ -1,25 +1,7 @@
-// `wasi:sockets/types@0.3.0` — the UDP direct path, which this deployment
-// does not have.
-//
-// The endpoint component links this interface for its direct (UDP) path and
-// therefore names it as an import whether or not a deployment can serve it
-// (runtime/wit/deps/polymorph-iroh/iroh.wit, `world iroh-endpoint`). A
-// browser has no UDP socket, so the endpoint binds with `udp-bind-addr`
-// unset — "unset binds no socket" — and nothing here is ever called. What it
-// has to be is present and honest: every entry point answers
-// `error-code.not-supported`, which is what a browser host would answer.
-//
-// Vendored rather than imported. The upstream module is
-// `jsr:@polymorph/iroh@0.6.0`'s `src/sockets.ts`, but the package's only
-// export is its root, whose module graph statically pulls
-// `@polyengine/translator` — and a realm that ships the translator is
-// exactly what this repository's build is built to prevent (web/build.ts:
-// "so no realm ever loads the translator"). The upstream file's test
-// bookkeeping (a call log the endpoint exam asserts on) is dropped; what
-// remains is the resource and the refusal. `ComponentException` comes from
-// this repository's pinned `@polyengine/protocol`, which is the copy the
-// worker's runtime uses — a branded throw from a second copy would not be
-// recognized as one.
+// Browser host for the endpoint's linked UDP interface. Browsers provide no
+// UDP, so every operation returns WIT `not-supported`. This is local rather
+// than imported because the upstream package root pulls the translator into
+// worker.js; the branded exception must also use this runtime's protocol copy.
 
 import { ComponentException } from "@polyengine/protocol";
 
@@ -36,10 +18,7 @@ export type IpSocketAddress =
 type NotSupported = { kind: "not-supported" };
 
 function refuse(what: string): never {
-  // A host import signals a WIT `err` by throwing a BRANDED
-  // `ComponentException`: an unbranded throw becomes a trap naming the
-  // import instead of a guest-visible `err`, and the guest's own answer to
-  // "no UDP here" is to carry on over the relay.
+  // Unbranded throws become traps rather than the WIT error arm.
   const payload: NotSupported = { kind: "not-supported" };
   throw new ComponentException(
     payload,
diff --git a/web/translate.ts b/web/translate.ts
index 5945e83e..68064c82 100644
--- a/web/translate.ts
+++ b/web/translate.ts
@@ -1,8 +1,5 @@
-// Build-time translation CLI. The site never ships the translator
-// (~0.5 MB gzip) — each component is translated once here, producing an
-// envelope that `artifactsFromEnvelope` (web/mount.ts's `source`)
-// reconstitutes at load time. polyengine is consumed from JSR at a caret
-// pin (deno.json), so the packaged translator asset is the one to use.
+// Build-time translation CLI. The site ships translation envelopes, not the
+// translator.
 //
 // Usage:
 //   deno run -A web/translate.ts <component.wasm> [-o <out.plan.json>]
diff --git a/web/worker.ts b/web/worker.ts
index aee6d9bb..218df449 100644
--- a/web/worker.ts
+++ b/web/worker.ts
@@ -324,7 +324,6 @@ function mintSessionPort(
   const { port1, port2 } = new MessageChannel();
   serveInterfaces(port1, {
     [I.tasks]: {
-      revision: () => svc.tasksRevision(session),
       items: () => svc.tasksItems(session),
       add: (title: string) => svc.tasksAdd(session, title),
       setCompleted: (id: string, completed: boolean) =>
@@ -479,7 +478,6 @@ self.onconnect = (ev: MessageEvent) => {
       // open it at.
       installFragment: async (app: string) =>
         (await ready)[I.apps].installFragment(app),
-      sessionApp: async (s: number) => (await ready)[I.apps].sessionApp(s),
       component: async (s: number) => (await ready)[I.apps].component(s),
       assets: async (s: number) => (await ready)[I.apps].assets(s),
       asset: async (s: number, h: Uint8Array) =>
diff --git a/wit/app.wit b/wit/app.wit
index b28ac96b..8b9ddc36 100644
--- a/wit/app.wit
+++ b/wit/app.wit
@@ -1,8 +1,8 @@
 /// polyvisor:app — the public contract: everything code from outside this
 /// repository links against. Apps target `world app`; data services and
-/// providers target the worlds added beside it. This package is versioned
-/// deliberately and grows only additively; `runtime/wit` (polyvisor:internal)
-/// is the private half and changes freely.
+/// providers target the worlds added beside it. This package is public but
+/// unstable: it changes with known consumers while the project has no users.
+/// `runtime/wit` (polyvisor:internal) is the private half.
 ///
 /// An app's authority is its import set. The framework links each import
 /// according to the user's grants: an import the user has not granted is
@@ -16,9 +16,6 @@ package polyvisor:app@0.1.0;
 /// data — its schema, policy and migrations — and any number of apps
 /// project it. Apps never see documents; they see this.
 ///
-/// Poll-shaped on purpose: `revision` is a cheap monotonic probe and
-/// `items` a full snapshot. A change feed is the expected additive next
-/// step once apps have an event path that wants one.
 interface tasks {
     record todo-item {
         /// Stable, opaque, unique within the partition.
@@ -29,16 +26,10 @@ interface tasks {
 
     /// A consistent view of the partition.
     record snapshot {
-        /// Advances whenever a local or synced change is applied. Equal
-        /// revisions on one replica imply an unchanged snapshot; not
-        /// comparable across replicas.
-        revision: u64,
-        /// Items in stable (id) order.
+        /// Items ordered by creation position, then id to break concurrent ties.
         items: list<todo-item>,
     }
 
-    /// Apply any newly synced changes, then report the revision.
-    revision: async func() -> result<u64, string>;
     /// Apply any newly synced changes, then snapshot.
     items: async func() -> result<snapshot, string>;
     /// Create a task; returns its id.