Durable discovery and bounded attention work. The directory is a hint, not
cognitive truth or execution authority. One live host owns each storage shard.
Typed product projections for trusted Rust hosts. These methods do not
authenticate an end user: the embedding application must enforce its owner
and source visibility policy before returning any data to a client.
Credentialed product access to durable attention and independent observations.
Installation is a trusted host capability; ordinary API bodies cannot grant it.