📝 Finish saying what the executor lock and the workflow host already do

The previous commit moved the inventories and left three passages behind, each
still describing the state before the merge it was reconciling.

`start.md` called single-executor ownership, atomic lifecycle transitions,
cancellation and deletion unbuilt. They are #466's, owned by the executor lock;
only durable suspension and releasing the executor at a checkpoint remain #367.

`runtime.md` said `xmd workflow cancel` asks an active executor to stop, which
is the one thing cancellation never does. It refuses without mutation against a
live executor and directs the caller to interrupt the foreground process;
without one, an eligible retained state transitions to `cancelled` under the
exact lock; a completed or failed outcome stays authoritative.

The specification called `<Repository>` and `<Worktree>` unimplemented alongside
`<Agent.AddDir>`, which conflated a shipped composition with an unbuilt Agent
boundary, and opened its lifecycle paragraph with "the rest of the lifecycle is
not built" before listing what #466 shipped. Both now lead with what is built
and end with what is not.

The sweeps carry each of those exact forms as a forbidden pattern, self-tested
against the text that produced them, so a regression fails there rather than in
review.

Author: taras

specs/adversarial-implementation-workflow.md

@@ -599,15 +599,17 @@ History reads already-filtered retained protocol events, so it exposes no value
 the security policy has not already seen, and the authored source position it
 reports is descriptive evidence about an event rather than identity.
 
-The rest of the lifecycle is not built. Durable suspension and releasing the
-executor at a checkpoint, the single-executor ownership and atomic lifecycle
-transitions around them, and cancellation and deletion are shipped as #367's
-second slice (#466): the executor lock owns every transition, and a cancellation
-that meets a live executor refuses without mutation and directs the caller to
-interrupt the foreground process rather than signalling it. Durable suspension
-and releasing the executor at a checkpoint remain #367; versioned
-history checkpoints, compatible forks, `history --forkable`, and forkability
-reasons remain #368.
+The authority underneath is shipped as #367's second slice (#466). The executor
+lock owns every lifecycle transition, so single-executor ownership, atomic begin
+and settle, cancellation and deletion are built. Cancellation never reaches into
+a live document execution: meeting a live executor it refuses without mutation
+and directs the caller to interrupt the foreground process, while an eligible
+retained state transitions to `cancelled` under the exact lock, and a
+`completed` or `failed` outcome stays authoritative.
+
+What is not built is the wait. Durable suspension and releasing the executor at
+a checkpoint remain #367; versioned history checkpoints, compatible forks,
+`history --forkable`, and forkability reasons remain #368.
 
 **Still missing: who answered.** The journal records the validated decision, the
 question fingerprint, and the document execution it belongs to. It does not
@@ -695,8 +697,9 @@ is composition and isolation, not a security boundary — the security boundary
 the host's Agent ceiling and the Workspace the document's file operations resolve
 inside.
 
-`<Repository>` and `<Worktree>` (#293) and `<Agent.AddDir>` (#302) are not
-implemented. `API.Files` and its host provider are: every document file operation
+`<Repository>` and `<Worktree>` are built and registered by the workflow host
+(#293, shipped); `<Agent.AddDir>` (#302) and the durable Git and forge effects
+below them are not. `API.Files` and its host provider are: every document file operation
 routes through that provider, which confines document paths to `Env.cwd` while the
 host namespace is stable. That claim is about traversal rather than about the
 filesystem being stable — a directory that is real when it is read could be

workflows/adversarial-implementation/runtime.md

@@ -119,9 +119,15 @@ Three outcomes are distinct, and none of them is a failure of the document:
   is available.
 - **Interruption.** Losing the executor outside an authored wait, including
   Ctrl-C, leaves the run `interrupted` and resumable at the journal frontier.
-- **Cancellation.** `xmd workflow cancel <run-id>` asks an active executor to
-  stop and makes the run terminal. It retains the journal and Workspace for
-  inspection and does not undo completed local or external effects.
+- **Cancellation.** `xmd workflow cancel <run-id>` never reaches into a live
+  document execution. When the lock reports a live workflow executor it refuses
+  without mutation and directs the caller to interrupt that foreground process
+  instead. Without one, an eligible retained state — a stale `running` with no
+  root Close, or a `suspended` or `interrupted` run — transitions to `cancelled`
+  under the exact executor lock, validated inside the transaction that publishes
+  it. A `completed` or `failed` outcome is authoritative and cancellation
+  refuses. It retains the journal and Workspace for inspection and does not undo
+  completed local or external effects.
 
 An uncaught failure escaping the root is terminal too. Reusing that run's ID
 replays the retained failure rather than silently retrying it; a corrected

workflows/adversarial-implementation/start.md

@@ -335,11 +335,12 @@ shipped (#366), and a resume restores completed durable effects from the journal
 rebuilds ephemeral attachments, and continues the partial remainder at the
 retained frontier. Reading a run back is shipped too: `xmd workflow status`,
 `list`, and `history` report immutable lifecycle snapshots without advancing
-anything (#460). What is still missing is the wait itself — releasing the
-executor at a checkpoint, and the single-executor ownership and atomic lifecycle
-transitions around it, remain #367 and unbuilt, as do cancellation and deletion.
-So a question asked today is answered inside the document execution that asked
-it. Gating is expressed by nesting, which
+anything (#460). So is the authority underneath: the executor lock owns
+lifecycle transitions, so single-executor ownership, atomic begin and settle,
+cancellation and deletion are shipped (#466). What is still missing is the wait
+itself — durable suspension, and releasing the executor at a checkpoint, remain
+#367. So a question asked today is answered inside the document execution that
+asked it. Gating is expressed by nesting, which
 prevents the remaining stages from running but does not stop the document
 execution: it still reaches the final-gate report inside the root's `<Output>`
 and completes.