diff --git a/docs/architecture/rfcs/controller-executor-unified-contract-v0.md b/docs/architecture/rfcs/controller-executor-unified-contract-v0.md
index 00e2bbe65e..1d2f0ceb86 100644
--- a/docs/architecture/rfcs/controller-executor-unified-contract-v0.md
+++ b/docs/architecture/rfcs/controller-executor-unified-contract-v0.md
@@ -2,12 +2,12 @@
 
 <a id="rfc-controller--executor-sessions-and-one-governed-work-contract-v0"></a>
 
-- **RFC status:** Accepted, existing contract. Router and binding-unit extensions are proposed.
+- **RFC status:** Accepted, existing contract. Router, binding-unit and session-discovery/shared-environment extensions are proposed.
 - **Supersedes / closes:** none
 - **Delivery maturity:** The single-worker EdgeBench entry is merged. #8484 qualifies a generic dual-role Turn on C1. Cross-admission continuity, multi-case benefit and conversation adoption remain open.
 - **Authors / owners:** LoopX maintainers; control-plane and runtime owners
 - **Created:** 2026-10-27
-- **Last normative revision:** 2026-11-10
+- **Last normative revision:** 2026-11-13
 - **Source revisions:** main `9508f4de93`, C1 `9d283862e3`. Section 11 distinguishes implementation-PR evidence, original controls and open qualification.
 - **Related contracts:** [Effect interpreter](agent-loop-effect-interpreter-v0.md), [Session execution modes](agent-session-execution-modes-v0.md), [Semantic handoff](capable-manager-semantic-handoff-v0.md), [Overall roadmap](loopx-overall-roadmap-v0.md)
 - **Language mirror:** [中文版](controller-executor-unified-contract-v0.zh-CN.md)
@@ -42,14 +42,17 @@ flowchart TB
   R <-->|Typed route / request operations| K[Existing Core owners and selected AuthorityStore]
   C1 <-->|Work admission / original settlement| K
   C2 <--> K
-  W1 --> H1[Scoped Host tools]
-  W2 --> H2[Scoped Host tools]
+  C1 --> H1[Unit workspace / scoped ordinary tools]
+  W1 --> H1
+  C2 --> H2[Unit workspace / scoped ordinary tools]
+  W2 --> H2
 ```
 
 | Reader question | Entry |
 | --- | --- |
 | Why split these roles, and what is missing? | Sections 1–4 and the [current source audit](#current-delivery-audit) |
 | How do the three layers and one Agent identity fit? | [System diagram](#system-topology), [binding unit](#agent-binding-unit) |
+| How does the controller inspect workers and read/write their environment? | [Session discovery and evidence](#worker-session-discovery), [shared workspace and tools](#shared-workspace-and-tools) |
 | What keeps work advancing without another user message? | [Primary execution loop](#controller-worker-main-loop) |
 | How do conversation, Stop and recovery work during execution? | [Asynchronous sequence](#asynchronous-control), [attention / preemption](#controller-attention-and-preemption), [failure isolation](#router-failure-recovery) |
 | What gets delivered, validated and deleted? | [Dependencies and slices](#delivery-path-from-current-state), [product acceptance](#superagent-acceptance), sections 8–11 |
@@ -76,11 +79,15 @@ no runtime, changes no default and starts no experiment.
    It reads the contract, reasons about work,
    talks to the executor and submits explicit typed Core operations. Core owns
    legal transitions and receipts; the controller is not a second authority.
+   It can also read/write project files and use ordinary host tools in the same
+   working environment as the worker, within current authorization.
 3. The executor receives a natural-language task conversation, original source
    material and ordinary host tools. It returns findings, artifacts, evidence
    and questions. It neither consumes a second Core packet view nor authors
    quota, Vision, lease or settlement fields. A small machine carrier records
-   routing and causality outside the task prose.
+   routing and causality outside the task prose. The controller can discover
+   and inspect its unit's worker sessions and work evidence on demand. Current
+   activity comes from host observations; historical indexes add history only.
 4. Save complete context, then compose two independent delivery layers:
    **Progressive by default across hosts**, and **Delta automatically only on
    qualified hosts**. Keep unread material discoverable from the current capture.
@@ -217,7 +224,7 @@ management tree.
 | Role / owner | Decisions and behavior it owns | Responsibilities it does not own |
 | --- | --- | --- |
 | Router / steward | Understand intent, discover context-affine capable units, propose reuse/creation, pass revisions, synthesize results and cross-task tradeoffs | Micromanage worker tools, claim/accept for receivers, copy Goal task stores or budgets |
-| Controller / within a unit | Select work from Goal, planning horizon and evidence; maintain continuity, interact with user/router, assess correction and acceptance, call Core | Become another authority or replace durable work with chat notes; approve every local tool step |
+| Controller / within a unit | Select work from Goal, planning horizon and evidence; maintain continuity, discover/inspect worker sessions, read/write and validate in the shared environment, interact with user/router, assess correction and acceptance, call Core | Become another authority or replace durable work with chat notes; approve every local tool step |
 | Worker / within a unit | Autonomously use tools, experiment, produce artifacts and report evidence/questions within admitted scope | Consume Core packets, author settlement or directly hold Core write access |
 | Core + managed execution + Host adapter | Existing typed rules, persistence, identity, dispatch, observation, stop and recovery | Infer authority/completion from prose or choose domain solutions for the model |
 
@@ -258,6 +265,83 @@ messages do not debit three business Turns, but all three model calls count in
 costs. Do not copy the team's resource allowance to every unit; the router adds
 no budget ledger.
 
+<a id="worker-session-discovery"></a>
+
+### Controller discovery of worker sessions and evidence
+
+The controller should have discovery comparable to [Obelisk session-evidence
+retrieval](obelisk-session-evidence-provider-v0.md): identify its unit's worker
+sessions, locate the session bound to current work, and inspect the authorized
+work history on demand. Waiting only for a worker's summary is insufficient for
+investigating failures, locating artifacts or recovering the original attempt.
+This is a delivery requirement, not a claim of complete support in current hosts.
+
+- **Locate before reading.** Reuse existing session/binding, request/attempt and
+  host-observation owners. Discover the role, native session, generation, original
+  request revision/Turn/attempt, actual provider/model and workspace under the
+  exact Goal lifetime/Agent, plus running/stopped/failed facts the host actually
+  observed. Expose provenance, observation time, coverage and continuation reads.
+  Multiple bindings, missing and unreadable records remain explicit uncertainty;
+  registration, names or recent timestamps cannot identify the current executor
+  or certify execution readiness.
+- **Inspect scoped work.** Locate authorized messages, tool calls/results,
+  failures, artifacts and original-source references by work, session and event;
+  read necessary context and subsequent pages. Preserve authorship, order and
+  versions. A summary is not the full source, and zero hits do not mean no work.
+  Raw internal reasoning, unrelated sessions and another audience's private
+  content remain inaccessible. Discovery grants no resume, steer, interrupt,
+  write or takeover authority.
+- **Separate current facts from historical recall.** Active attempts and fresh
+  state come from current host/Core owners. Optional providers such as Obelisk
+  add indexed historical evidence only within their independently authorized
+  scope. Retain default-off, same-Agent/project and source-access rules; a role
+  binding does not inherit archive access. Missing providers, stale indexes,
+  revoked sources, timeouts and zero hits expose coverage gaps. Basic session
+  discovery and authorized work must not wait for historical indexing. This
+  document neither installs/starts indexing nor creates a parallel session store.
+
+Use bounded indexes, on-demand bodies and existing event continuation. Account
+for scans, index maintenance, rereads, model input and latency; do not scan all
+history every Turn or inject duplicate transcripts into both sessions. Retrieval
+does not establish cost savings by itself.
+
+<a id="shared-workspace-and-tools"></a>
+
+### Ordinary read/write tools in one working environment
+
+Controller and worker should access **the same authorized working environment**:
+project/workspace, verifiable source revision, toolchain/dependencies, task
+resources and artifact namespace. The controller also has scoped filesystem
+read/write, search, test and ordinary process tools. It can inspect original
+artifacts, validate a problem and perform bounded local work directly. Sharing
+an environment does not merge native contexts, queues or continuity baselines.
+
+The host binds the actual cwd/worktree, versions, tools and read/write scope to
+the unit. Authorized controller writes must be readable by the worker; worker
+artifacts must be readable by the controller at their original version. Path
+aliases, containers and remote hosts must prove equivalent authorized resource
+and dependency mappings. Report unsupported arrangements explicitly, without
+silently choosing another checkout, copying stale artifacts or treating a remote
+environment as local.
+
+Ordinary tool sharing retains role permissions: the controller calls existing
+typed Core owners, while Core credentials and write entrypoints remain isolated
+from the worker. Each uses its authorized tools/credential broker, without
+copying all environment variables or credentials, changing authentication,
+providers or connection mode, or bypassing protected-operation confirmation.
+The host enforces read-only grants, revocation, path and audience boundaries at
+the actual call; sharing an environment does not expand authority.
+
+Read/write tools do not create another uncoordinated writer. The controller can
+inspect an active worker and perform non-conflicting operations permitted by
+authority and work ownership. Overlapping file, process or effect changes use
+existing claim/lease, request-revision and safe-boundary coordination. Before
+taking over the same business execution, observe and reconcile the original
+attempt, complete any required yielding/stopping and ownership handoff, then
+write. A message ACK is not process termination. Never overwrite uncommitted
+worker changes, launch duplicate work or create another settlement. Account for
+all ordinary tools and recovery in the combined cost.
+
 <a id="controller-worker-main-loop"></a>
 
 ### The primary loop: select, execute, assess, feed back and continue
@@ -781,9 +865,11 @@ roles. Do not create a second Goal/Todo/quota identity merely to split cognition
 Extend the existing session binding owner with role and generation, separate
 ordered queues and separate context baselines; do not write two native IDs into
 the current single Agent-scoped slot. One controller owns control dialogue;
-at most one executor attempt owns the selected work. The controller role is not
-another simultaneous business executor. Peer or parallel execution still needs
-its existing independent claim/lease/handoff contract.
+at most one executor attempt owns the selected work. The controller's ordinary
+read/write tools follow the ownership and conflict rules of the
+[shared working environment](#shared-workspace-and-tools), without an
+uncoordinated second business executor. Peer or parallel execution
+still needs its existing independent claim/lease/handoff contract.
 
 1. The existing entrypoint obtains fresh admission or resumes an owed receipt.
    It supplies the captured unified contract to the controller.
@@ -880,6 +966,8 @@ The complete field, consumer and qualification detail is in [the contract and co
 | One complete contract | Field/clause inventory; same captured normal, replan, wait, recovery and capability-off workloads through all active entrypoints; identical reconstructed semantic instance | One serializer unit test is insufficient; malformed/unsupported versions fail explicitly |
 | Lossless context delivery | Full/delta/recovery equivalence, missing/late/truncated pages, role/session mismatch and real native compaction/resume | Include all read/recovery costs; no second admission or spend |
 | Role isolation and recovery | Controller/executor crash windows, duplicate dispatch, late result, revision change, lease expiry and stop under actual host tools | No executor Core access; no stale result adoption or hidden business executor |
+| Discoverable worker sessions and inspectable evidence | Locate the real binding from the controller and read original messages, tool results and artifacts on demand; cover multiple bindings, restart/old generation, pagination, incomplete indexes, no provider and lost sources | No current-state inference from historical hits; reject foreign Agent/project/audience, unauthorized archives and internal reasoning; discovery never executes or takes over a session |
+| Shared environment with read/write on both sides | On the native host, verify controller write→worker read, worker artifact→controller versioned read, and actual toolchain/dependency parity | Reject read-only/revoked writes, out-of-scope paths, environment mismatch, Core-credential exposure and conflicting writes while the worker is busy; legitimate handoff still executes/settles once |
 | Semantic adoption | Original requirements → controller decision → actual executor work → independent verification → accepted result and original-audience return | Read receipt, valid JSON or successful replan alone cannot pass |
 | Intelligent mediation | Coherent delegation, changed/contrary evidence and result interpretation across ordinary continuation, shared-constraint change, controller loss and a small-task counterexample | Explain the actual decision consequence and retained obligations; fewer queries or a shorter handoff cannot pass |
 | Human interaction during execution | C6/C8 journey below through the real supported host and packaged conversation | Controller responsiveness, proactive delivery and feedback adoption require separate evidence; no inference from routing ACKs or previews |
@@ -1202,7 +1290,7 @@ are stable design references, not claims that a canonical Todo is complete.
 | --- | --- | --- |
 | **C1 — Unified contract; new-profile cutover dependency** | Interaction/work-context + quota/Turn owners: inventory fields/instruction clauses, capture/view/read-evidence mappings and versioned two-layer configuration; capture one schema and migrate ordinary quota/Turn producers and thin renderer | Single-session real-entry parity with necessary information, action binding and once-only settlement, plus §9's quota-baseline effectiveness/full-cost comparison; preserve explicit off and version-pinned readers until cutover qualifies |
 | **C2 — One context-delivery pipeline; C1** | Context owner + host observers: compose cross-host Progressive, independent qualified Delta, same-capture detail/recovery and conservative unread discovery; replace staged candidate delivery and duplicate packet branches | Unchanged unread constraints reach actual next-Turn work; qualify no-hook readers, exact evidence/continuity and all four layer combinations at complete cost; full fallback without a new admission; rollback encoding/configuration through the existing owner |
-| **C3 — Session binding and native lifecycle; C1 for cutover** | Session/runtime owner: extend existing binding for role/generation; reuse native create/resume/observe/interrupt and ordered queues | Two roles cannot overwrite the Agent native ID, cross-read baselines or race execution; recovery observes existing attempts before retry; disable new role admission to roll back |
+| **C3 — Session binding and native lifecycle; C1 for cutover** | Session/runtime owner: extend existing binding for role/generation; reuse native create/resume/observe/interrupt and ordered queues; expose sourced worker discovery and shared-environment/ordinary-tool access | Two roles cannot overwrite the Agent native ID, cross-read baselines or race execution; discovery and bidirectional read/write pass the permission/environment negative cases in §9; recovery observes existing attempts before retry; disable new role admission to roll back |
 | **C4 — Shared governed lifecycle; C1 for cutover** | Effect/Turn owner + outer worker adapters: converge duplicated prepare/dispatch/observe/validate/writeback/settle orchestration around existing typed operations and receipts | App/Turn/external worker agree on admission, original result and single debit under partial failure; scheduler effects retain their true host owner; switch callers back only after receipt reconciliation |
 | **C5 — Replan and result authoring boundary; C1 for cutover** | Goal/Vision and interaction owners: expose current facts and typed controller operations; remove ordinary executor obligations to manufacture Core writeback fields in the two-session profile | Fact-first decision preserves default/stride policy differences, all evidence and required validation; invalid proposed writes reject; single-session authoring remains qualified during rollout |
 | **C6 — Controller/executor exchange; C2–C5** | Manager/request + host owners: reuse versioned semantic requests and result return; replace schema-constrained executor work with natural-language work/material exchange; keep user interaction available during execution | Complete sources, local autonomy, Core isolation, ordinary result → assessment → feedback → further work without human prompting, actual feedback adoption through ordered revisions, original settlement/fresh continuation and independently accepted outcome; busy, conflict, stop and late-result cases in §9; return new work to qualified single-session profile on rollback |
diff --git a/docs/architecture/rfcs/controller-executor-unified-contract-v0.zh-CN.md b/docs/architecture/rfcs/controller-executor-unified-contract-v0.zh-CN.md
index fbe4a9293e..75e287ac87 100644
--- a/docs/architecture/rfcs/controller-executor-unified-contract-v0.zh-CN.md
+++ b/docs/architecture/rfcs/controller-executor-unified-contract-v0.zh-CN.md
@@ -2,12 +2,12 @@
 
 <a id="rfccontroller--executor-会话与统一受治理工作契约v0"></a>
 
-- **RFC 状态：** 已接受，适用于既有契约。Router 与绑定单元扩展待评审。
+- **RFC 状态：** 已接受，适用于既有契约。Router、绑定单元及会话发现/共享环境扩展待评审。
 - **替代 / 关闭：** 无
 - **交付成熟度：** 单 Worker 的 EdgeBench 入口已合入。#8484 在 C1 上验收通用双角色 Turn；跨准入延续、多题效果与成本、对话产品接入待验证。
 - **作者 / 负责人：** LoopX 维护者、控制面与运行时 owner
 - **创建日期：** 2026-10-27
-- **最近规范性修订：** 2026-11-10
+- **最近规范性修订：** 2026-11-13
 - **源码版本：** main `9508f4de93`、C1 `9d283862e3`。§11 区分实现 PR 的实测、原始对照及待验收边界。
 - **相关契约：** [Effect interpreter](agent-loop-effect-interpreter-v0.zh-CN.md)、[会话执行模式](agent-session-execution-modes-v0.zh-CN.md)、[语义交接](capable-manager-semantic-handoff-v0.zh-CN.md)、[整体路线图](loopx-overall-roadmap-v0.zh-CN.md)
 - **语言镜像：** [English](controller-executor-unified-contract-v0.md)
@@ -39,14 +39,17 @@ flowchart TB
   R <-->|路由 / 请求的 typed 操作| K[既有 Core owners 与所选 AuthorityStore]
   C1 <-->|工作准入 / 原身份结算| K
   C2 <--> K
-  W1 --> H1[受限 Host 工具]
-  W2 --> H2[受限 Host 工具]
+  C1 --> H1[同单元工作区 / 受限普通工具]
+  W1 --> H1
+  C2 --> H2[同单元工作区 / 受限普通工具]
+  W2 --> H2
 ```
 
 | 你要了解什么 | 阅读入口 |
 | --- | --- |
 | 为什么这样拆、当前差距 | 第 1–4 节；[最新源码核对](#current-delivery-audit) |
 | 三层关系与一个 Agent 的身份 | [系统图](#system-topology)、[绑定单元](#agent-binding-unit) |
+| Controller 如何了解 worker、在哪里读写 | [会话发现与证据读取](#worker-session-discovery)、[共享工作环境与读写](#shared-workspace-and-tools) |
 | 没有用户新消息时，工作怎么持续推进 | [执行主循环](#controller-worker-main-loop) |
 | 干活时怎么交流、停止、恢复 | [异步时序](#asynchronous-control)、[注意力与插队](#controller-attention-and-preemption)、[故障隔离](#router-failure-recovery) |
 | 怎么交付、验证和删代码 | [依赖与切片](#delivery-path-from-current-state)、[产品验收](#superagent-acceptance)、第 8–11 节 |
@@ -66,10 +69,12 @@ flowchart TB
 2. 在可选的双会话 profile 中，**controller 模型会话是该单元工作控制与结算的唯一模型客户端，
    也是控制工作的智能中介**。
    它读契约、判断工作、与 executor 沟通并提交显式 typed Core 操作。Core 拥有合法迁移与
-   回执；controller 不是第二个权威。
+   回执；controller 不是第二个权威。它也能在与 worker 相同的工作环境中，按当前授权
+   直接读写项目文件并使用普通宿主工具。
 3. Executor 接收自然语言任务对话、原始材料和普通宿主工具，返回发现、产物、证据与问题。
    它不消费第二份 Core packet 视图，不编写 quota、Vision、lease 或 settlement 字段。
-   任务正文之外的小型机器载体负责记录路由与因果关系。
+   任务正文之外的小型机器载体负责记录路由与因果关系。Controller 可发现并按需检查
+   本单元 worker 的会话与工作证据；当前活动来自宿主观察，历史索引只补充历史。
 4. 先保存完整上下文，再组合两个独立交付层：**跨 Host 默认 Progressive**，以及
    **仅在已资格化 Host 自动使用 Delta**。未读材料仍可从当前 capture 发现。
    Controller 与 executor 分别证明连续性，不能借用对方的基线；完整恢复始终可用。
@@ -179,7 +184,7 @@ Router 只汇总获授权的结果，不能因此读取所有单元的私有会
 | 角色 / owner | 负责的判断与行为 | 不承担的职责 |
 | --- | --- | --- |
 | Router（管家） | 理解用户意图，发现有上下文和能力的单元，选择复用/创建的提议，传递修订，汇总结果及跨任务取舍 | 不逐工具指挥 worker，不替接收方认领/验收，不复制各 Goal 的任务库与预算 |
-| Controller（单元内） | 结合 Goal、planning horizon 与证据选择工作，维护任务连续性，与用户/router 交互，判断纠偏与验收并调用 Core | 不成为第二权威，不用自己的聊天笔记代替工作状态；不必为每个工具步骤审批 |
+| Controller（单元内） | 结合 Goal、planning horizon 与证据选择工作，维护任务连续性，发现并检查 worker 会话，在共享工作环境中读写、核验，与用户/router 交互，判断纠偏与验收并调用 Core | 不成为第二权威，不用自己的聊天笔记代替工作状态；不必为每个工具步骤审批 |
 | Worker（单元内） | 在已准入范围内自主使用工具、实验、产出及报告证据/问题 | 不消费 Core packet，不编造结算，不直接持有 Core 写权限 |
 | Core + 受管执行 + Host adapter | 既有 typed 规则、持久化、身份、派发、观察、停止和恢复 | 不从自然语言猜权限/完成，不替模型决定领域方案 |
 
@@ -213,6 +218,58 @@ flowchart LR
 不等于扣三次业务 Turn，但这三次模型调用都必须计入成本。团队资源上限不能给每个单元
 各复制一份；router 不新增预算账本。
 
+<a id="worker-session-discovery"></a>
+
+### Controller 的 worker 会话发现与证据读取
+
+Controller 应有类似 [Obelisk 会话证据检索](obelisk-session-evidence-provider-v0.zh-CN.md)
+的发现能力：知道本单元有哪些 worker 会话，当前任务绑定了哪一个，并能按需读取允许
+查看的工作过程。只等待 worker 自报摘要不足以支持检查失败、定位产物和恢复原 attempt。
+这是一项待交付的产品要求，不代表现有 Host 已具备完整能力。
+
+- **先定位，再读取。** 复用现有 session/binding、request/attempt 和 Host observation
+  owner，发现精确 Goal lifetime/Agent 下的 role、native session、generation、原请求
+  revision/Turn/attempt、实际 provider/模型、工作区，以及宿主确实观察到的运行/停止/失败
+  事实。显示来源、观察时间、读取覆盖和继续读取入口；多个绑定、缺失和不可读保留明确
+  不确定性，不以注册、会话名称或最近更新时间推断当前执行者和可执行资格。
+- **按范围检查过程。** 可按任务、会话与事件定位获授权的消息、工具调用/结果、失败、
+  产物及原始材料引用，并读取必要的上下文和分页内容。保留原作者、顺序与版本；摘要
+  不是完整正文，零命中不是没有工作。原始内部推理、无关会话与其他受众的私密内容
+  不因此开放。读取发现不授予 resume、steer、interrupt、写入或接管权限。
+- **当前事实与历史召回分开。** 活跃 attempt 和新鲜状态由当前 Host/Core owner 提供。
+  Obelisk 等可选 provider 仅在独立授权范围内补充已索引的历史证据；默认关闭、同 Agent/
+  项目限制和来源访问校验沿原契约，不因角色绑定而自动继承 archive 权限。缺 provider、
+  索引过期、来源撤销、超时或零命中时明确覆盖缺口；基础会话发现与已授权工作无需等待
+  历史索引。本文不安装或启动索引，也不复制一套会话库。
+
+发现与阅读采用有界索引、按需正文和既有事件续读。记录扫描、索引维护、补读、模型输入
+和延迟成本；不每轮扫描全部历史或向两个会话重复注入 transcript，不预设检索必然省钱。
+
+<a id="shared-workspace-and-tools"></a>
+
+### 同一工作环境中的普通读写能力
+
+Controller 与 worker 应访问**同一个已授权工作环境**：同一项目/工作区、可核验的源码
+revision、工具链/依赖、任务资源及产物命名空间。Controller 也持有范围内的文件读写、
+搜索、测试和普通进程工具，可直接检查原始产物、验证问题并完成有边界的本地工作。
+同一环境不合并两个原生会话的上下文、队列或 continuity baseline。
+
+Host 将实际 cwd/worktree、版本、工具能力和可读写范围绑定到该单元。Controller 写入的
+获准材料应能由 worker 读取，worker 的产物也应能由 controller 按原版本读取。不同路径
+别名、容器或远程 Host 必须证明映射到同一获准资源和依赖；不支持时明确不支持，不能
+静默改用另一份 checkout、复制陈旧产物或把远程环境当成本地。
+
+普通工具共享仍保留角色权限：controller 经既有 typed owner 操作 Core；worker 的 Core
+凭据与写入口继续隔离。两者各用已授权的工具/凭据代理，不复制全部环境变量或凭据，
+不改变认证、provider、连接模式或 protected operation 的确认路径。只读授权、撤权、
+路径越界与受众限制仍由 Host 在实际调用时执行，不能靠“同环境”升级权限。
+
+读写能力不增加第二个未协调的写入方。Controller 可检查正在执行的 worker，并进行
+权限与所有权允许的非冲突操作；重叠文件、进程或 effect 的修改需沿既有 claim/lease、
+request revision 和安全边界协调。需要接续同一业务执行时，先观察并对账原 attempt，
+完成必要的让出/停止与所有权交接，再写入；消息 ACK 不证明原进程已退出。不得覆盖
+worker 未提交改动、重复启动任务或制造另一笔结算。所有普通工具与恢复成本合并计量。
+
 <a id="controller-worker-main-loop"></a>
 
 ### 执行主循环：选工作、执行、评估、反馈、继续
@@ -632,8 +689,8 @@ Executor 在委派范围内自主选择工具和步骤，不必每次调用工
 一个 Goal/Todo/quota 身份。扩展既有 session binding owner，加入 role/generation、
 独立有序队列及上下文基线；不能把两个 native ID 写进当前单一 Agent 级槽位。
 一个 controller 拥有控制对话，选定工作最多由一个 executor attempt 执行。Controller
-role 不是第二个并发业务 executor。Peer 或并行执行仍需既有独立 claim/lease/handoff
-契约。
+的普通读写遵守[共享工作环境](#shared-workspace-and-tools)的所有权与冲突约束，不形成
+未协调的第二个业务 executor。Peer 或并行执行仍需既有独立 claim/lease/handoff 契约。
 
 1. 既有入口取得新鲜准入或恢复应结回执，把捕获的统一契约交给 controller。
 2. Controller 围绕 Goal、未满足要求、已有结果和可行工作判断，Core 验证其选定操作。
@@ -719,6 +776,8 @@ capture/回执保留原版本/签名与 replay 身份，不能改写成新 schem
 | 一份完整契约 | 字段/条款盘点；同次捕获的正常、replan、wait、recovery、能力关闭负载经过全部活跃入口；重建语义实例相同 | 单 serializer 单测不足；畸形/不支持版本显式失败 |
 | 无损上下文交付 | Full/delta/recovery 等价；缺页、迟到、截断、role/session 不符与真实原生压缩/续接 | 合计所有读取/恢复成本，不重新准入/扣额 |
 | 角色隔离与恢复 | 实际 host tools 下的 controller/executor 崩溃窗口、重复 dispatch、迟到结果、revision 变化、lease 到期、Stop | Executor 不能访问 Core，不能采用过时结果或隐藏第二个业务 executor |
+| Worker 会话可发现、证据可检查 | 从 controller 定位真实绑定并按需读取原消息、工具结果与产物；覆盖多绑定、重启/旧 generation、分页、不完整索引、无 provider 与来源失效 | 当前状态不由历史命中推断；外 Agent/项目/受众、未授权 archive 和内部推理不可读；发现不执行/接管会话 |
+| 同环境且双方可读写 | 原生 Host 上验证 controller 写入→worker 读取、worker 产物→controller 按版本读取，以及真实工具链/依赖一致性 | 只读/撤权、越界路径、环境不匹配、Core 凭据泄露与忙碌 worker 的重叠写入须拒绝；合法交接后仍仅一次执行/结算 |
 | 语义采用 | 原始要求 → controller 判断 → executor 实际工作 → 独立验证 → 接受结果并回原受众 | 读回执、合法 JSON 或 replan 成功不能单独通过 |
 | 智能中介 | 普通继续、共同约束变化、controller 丢失和小任务反例中的连贯交接、变化／反向证据及结果解释 | 说明真实判断后果与保留义务；少查询或短交接均不足 |
 | 执行期间的人机交互 | 下表 C6/C8 旅程经真实受支持 host 和打包对话验证 | Controller 响应、主动投递和反馈采用分别需要证据；不能从路由 ACK 或预览推断 |
@@ -963,7 +1022,7 @@ judge 评分。分别记录最后验证的分数、黑盒调用次数、完整 t
 | --- | --- | --- |
 | **C1 — 统一契约；新 profile 切换依赖** | Interaction/work-context + quota/Turn owner：盘点字段/指令、capture/视图/读取证据映射及分版本双层配置；捕获同一 schema，迁移普通 quota/Turn producer 与 thin renderer | 单会话真实入口保留必要信息、动作绑定和一次结算，并完成第 9 节 quota 基线效果/完整成本对照；保留显式 off，cutover 合格前保留绑定版本的 reader |
 | **C2 — 一个上下文交付管线；C1** | Context owner + host observer：组合跨 Host Progressive、独立资格化 Delta、同 capture 详情/恢复和保守未读发现，替换分阶段候选交付及重复 packet 分支 | 未变未读约束抵达下一 Turn 实际工作；按完整成本验收无 Hook reader、精确证据/连续性和四种分层组合；full 回退不重新准入；经既有 owner 回退编码/配置 |
-| **C3 — 会话绑定与原生生命周期；切换依赖 C1** | Session/runtime owner：扩展 role/generation，复用 native create/resume/observe/interrupt 和有序队列 | 两角色不覆盖 Agent native ID、不借用基线、不竞态执行；重试前观察既有 attempt；关闭新角色准入即可开始回退 |
+| **C3 — 会话绑定与原生生命周期；切换依赖 C1** | Session/runtime owner：扩展 role/generation，复用 native create/resume/observe/interrupt 和有序队列，提供带来源的 worker 发现及共享环境/普通工具访问 | 两角色不覆盖 Agent native ID、不借用基线、不竞态执行；会话发现与双向读写通过第 9 节的权限/环境负例；重试前观察既有 attempt；关闭新角色准入即可开始回退 |
 | **C4 — 共享受治理生命周期；切换依赖 C1** | Effect/Turn owner + 外层 worker adapter：围绕既有 typed 操作与回执合并重复 prepare/dispatch/observe/validate/writeback/settle 编排 | App/Turn/external worker 在部分失败下对准入、原结果与一次扣额一致；scheduler effect 保留真实 host owner；核对回执后才切回旧调用方 |
 | **C5 — Replan 与结果编写边界；切换依赖 C1** | Goal/Vision 与 interaction owner：提供当前事实和 typed controller 操作，移除双会话 profile 中普通 executor 编造 Core 写回字段的义务 | 先看事实保留 default/stride policy 区别、全部证据与必要验证；非法写回拒绝；rollout 期间单会话编写仍合格 |
 | **C6 — Controller/executor 交流；C2–C5** | Manager/request + host owner：复用版本化语义请求与结果返回，用自然语言工作/材料交流替换 executor 的 schema 约束任务；执行时用户仍可交互 | 完整来源、局部自主、Core 隔离、无需人工催促的普通结果→评估→反馈→后续执行、有序 revision 下的反馈实际采用、原结算/新鲜接续与独立验收结果；第 9 节忙碌、冲突、Stop 和迟到结果场景；回退后新工作使用合格单会话 profile |