Unify read-only owner boundaries and fresh CLI verification

Tools/README.md

@@ -215,6 +215,8 @@ Runtime data belongs in `.cambium/`, not `Tools/`. [`runtime_paths.py`](executio
 
 [`audit_evidence_runtime`](execution/audit/audit_evidence_runtime.py) selects live evidence when due; close/Terminal validate its frozen selection, reconciliation and acceptance dependencies. Readable history is not a passing candidate; withdrawal still removes authority. `evidence_observation` shares mechanical facts only within one read-only action. New observations, locked checks, CAS and read-back remain independent.
 
+Terminal projection joins that same evidence observation. Profile admission owns the shared rebinding of identical Profile inputs within it, checking them on first use and again before the observation returns successfully. Gate-specific inputs still receive their own checks; independently called composers and new writer/read-back boundaries do not inherit an earlier currency result.
+
 Producers share `ReceiptPublication.locked_append` mechanics and the shared `audit_fingerprint` projection, not semantic authority.
 
 M atom results reference the original plan's obligation definition; their individual judgments, evidence references and fingerprints remain separately recorded and correctable. The seven emitted post-Delta Closed List facts are accepted against that plan at first publication, without a second full AuditReceipt. The eighth member keeps its native Gate. A close is authorized only by the final complete bundle: its existing reviewer attestation carries the shared plan reconciliation once, and the aggregate commits that exact evidence set. These changes do not remove independent substantive-review rounds or their acceptance boundaries.
@@ -330,7 +332,9 @@ Generators write Markdown/JSON projections; `--check` recomputes their bytes. Ea
 
 The required workflow budget is owned by [ci_impact.py](../.github/scripts/ci_impact.py): about 300 seconds is the target and 360 seconds the acceptance limit for the whole attempt, including preparation and the final gate. Exceeding 360 seconds fails acceptance but does not terminate work: jobs share a separate 1,800-second safety deadline so remote measurements can finish. At that safety boundary, `run_tests --deadline` stops isolated test groups and records incomplete work, not a natural completion time. The gate checks the current attempt, and publication verifies its actual completion time. Missing advisory history does not remove tests; a functional pass alone does not prove the budget was met. Nested cost scopes include work counts, so fewer outer requests cannot hide unchanged inner execution.
 
-Runner source views are invocation-scoped and recheck component discovery/bytes, projection and environment. Execution first re-derives and matches the caller's complete action identity, then consumes that invocation's exact audit step without a second stage selection. No step survives a producer dispatch or becomes a caller-supplied authorization. Independent producer admission, locked currentness and after-image read-back remain.
+Every Runner CLI-contract query uses the target compiler's fresh full check and rechecks component discovery/bytes, projection and environment before returning. Python parser declarations may read inputs beyond component hashes, so a previous query's success is not reused. Within each compilation, the entrypoint owner shares its source descriptors with parameter capture and source analysis. Execution first re-derives and matches the caller's complete action identity, then consumes that invocation's exact audit step without a second stage selection. No step survives a producer dispatch or becomes a caller-supplied authorization. Independent producer admission, locked currentness and after-image read-back remain.
+
+The MCP stdio Host prepares source-checked Python bytecode in a fresh private directory outside the distribution. Children still execute modules and parser defaults in new processes and perform full CLI validation; only source compilation is shared. Source changes invalidate bytecode by content, not timestamps. Adopter-local bytecode and previous sessions' caches are never adopted; automatic bytecode writes remain disabled. Preparation failures use the original source-only path, and normal or exceptional stdio exit releases the directory. This is not a validation cache or a runtime object.
 
 During one Runner operation, repeated runtime reads may carry the original Profile/Standards input pair through the runtime owner's existing revalidation interface. Every read still rebinds actual source bytes and validates current Queue, Coverage, Progress and evidence; changed inputs fail closed. The pair is released at operation exit and is never a saved runtime result or a cross-request authorization cache.