feat(analysis): add question-shaped run queries

AGENTS.md

@@ -14,7 +14,7 @@ reference in `docs/ptc-lisp-specification.md`, and built-ins in
 To debug the runtime itself (not a manifest under it) — query canonical
 traces or private inspection records (model exchanges, generated source,
 capability payloads) non-interactively — use `mix ptc repl --profile
-inspection-analysis-v2 --private-unattended`. See ["Private analysis without a
+private-run-analysis-v1 --private-unattended`. See ["Private analysis without a
 terminal"](docs/guides/kernel-repl.md#private-analysis-without-a-terminal).
 
 ## Working Style

CHANGELOG.md

@@ -9,18 +9,24 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
+- Replaced the split log/inspection analysis vocabularies with one six-operation
+  `analysis/*` read model shared by PTC-Lisp, the Viewer, Elixir embedders, and
+  the new one-shot `ptc transcript` command. Public and private authority remain
+  separate sealed recipes; private conversation reconstruction and failure
+  bundles no longer require callers to understand inspection record shapes.
+
 - Added the fixed, mission-only `ptc_private_trace_snapshot` provider source.
   It immutably captures ordinary and private canonical traces with per-run
   provenance, keeps inspection artifacts excluded, and classifies the run as
-  `private_inspection`. The private inspection-analysis profile now accepts
+  `private_inspection`. The private run-analysis profile now accepts
   private traces recursively while preserving V5 terminal-result hash
   correlation; ordinary trace readers remain normal-only.
 
 - Added exact successful terminal-result inspection for explicitly private
   captures. Inspection V5 binds one strictly JSON `run-result` record to the
-  canonical `run-stopped.data.result_hash`; `inspection/result` exposes the value
-  and hash through the bounded private analysis profile, while ordinary traces
-  retain only the hash.
+  canonical `run-stopped.data.result_hash`; `analysis/overview` exposes the
+  value and hash through the bounded private analysis profile, while ordinary
+  traces retain only the hash.
 
 - Added explicit named mission environments: manifests declare a bounded
   `missions` map with isolated data, continuations, APIs, and provider grants;
@@ -75,13 +81,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   grapheme-based. Oversized or unrepresentable String operations now return the
   documented bounded condition; locale-sensitive `.toLowerCase` and
   `.toUpperCase` and all legacy Java String aliases were removed.
-- Added the code-owned `log-analysis-v2` profile to `mix ptc repl`, with
+- Added the code-owned `run-analysis-v1` profile to `mix ptc repl`, with
   bounded multi-turn mission evaluation over an immutable trace capture,
   explicit whole-result cursor traversal, deterministic JSONL output for
   coding agents, safe profile discovery, and separate atomic analysis-trace
   persistence. Rejected log and inspection queries now fail instead of looking
-  like empty results, and both analysis profiles reuse the shipped `cap`
-  envelope and pagination helpers.
+  like empty results. The public and private authority recipes reuse the
+  shipped `cap` envelope and one semantic analysis component.
 - Added one typed MCP source with equivalent stateless Streamable HTTP and
   owned stdio transports. Stdio uses the optional precompiled
   `ptc_runner_launcher` companion, freezes launcher and server digests, and

README.md

@@ -144,11 +144,11 @@ Every run emits structured events: outcomes, errors, tool use, evaluations,
 limits, and resource use. They deliberately contain no prompts, model responses,
 tool payloads, or generated source.
 
-Analyzing them is itself a bounded run. The shipped `log.core` prelude exposes
-`log/runs`, `log/run`, `log/turns`, and `log/counters` to a mission whose only
-authority is querying one frozen capture of a trace directory — no filesystem,
-network, or model. An investigation can start as a REPL expression and graduate
-into a reusable analysis prelude.
+Analyzing them is itself a bounded run. The shipped `analysis` prelude exposes
+six question-shaped reads—runs, overview, activity, conversation, failure, and
+source—over one frozen evidence capture. A public recipe has only sanitized
+trace authority; a private recipe may additionally use a correlated inspection
+snapshot. Neither recipe gains filesystem, network, or model authority.
 
 When you need the exact prompt and the exact generated code, that is a separate
 opt-in artifact written with owner-only permissions, kept out of normal trace

docs/guides/building-agents.md

@@ -307,9 +307,10 @@ omitted according to the adapter.
 
 Canonical `capability-started` and `capability-stopped` events identify the
 selected alias and installation revision. Successful stopped events also carry
-the closed token map as `usage`, without response content. `log/counters`
-preserves aggregation per alias and revision in `llm_usage`. It additionally
-returns `llm_usage_by_model`, using an empty list when no model is attributable.
+the closed token map as `usage`, without response content. The internal counter
+projection, consumed by semantic run analysis, preserves aggregation per alias
+and revision in `llm_usage`. It additionally returns `llm_usage_by_model`, using
+an empty list when no model is attributable.
 Entries require an adapter-attested `resolved_model` in the run-started provider
 snapshot. `unattributed_model_calls` counts otherwise eligible calls that cannot
 be mapped uniquely. Model identity is not repeated on each capability event.
@@ -689,20 +690,19 @@ model response, generated source, or file payload in the canonical log. The
 zero `history_count` is expected: the first mission program used `return`, so
 there was no ordinary intermediate value to retain as `*1`.
 
-Inspect the run through the bounded log-analysis REPL:
+Inspect the run through the bounded run-analysis REPL:
 
 ```console
 mix ptc repl \
-  --profile log-analysis-v2 \
+  --profile run-analysis-v1 \
   --resource traces=tmp/file-agent-traces \
-  -e '(def run-id (get-in (log/runs {}) ["items" 0 "run_id"]))' \
-  -e '(log/run run-id)' \
-  -e '(log/turns run-id {"limit" 100})' \
-  -e '(log/counters {})'
+  -e '(def run-id (get-in (analysis/runs {}) ["items" 0 "run_id"]))' \
+  -e '(analysis/overview run-id)' \
+  -e '(analysis/activity run-id {"limit" 100})'
 ```
 
-Because this directory contains one run, index `0` selects it. `log/run` shows
-the complete status and capability/evaluation counters; `log/turns` shows the
+Because this directory contains one run, index `0` selects it. `overview` shows
+the complete status and capability/evaluation counters; `activity` shows the
 ordered sanitized events. Exact prompts, model responses, generated PTC-Lisp,
 and capability payloads require an explicitly enabled private inspection
 artifact; see [Running and debugging](running-and-debugging.md).

docs/guides/components-and-preludes.md

@@ -78,7 +78,7 @@ Requirements validate authority; they never create it.
 
 ## Select a shipped prelude
 
-Shipped libraries such as `runtime`, `cap`, `kernel`, `llm`, `fs`, `log.core`,
+Shipped libraries such as `runtime`, `cap`, `kernel`, `llm`, `fs`, `analysis`,
 and the agent and result libraries are selected by ID rather than copied into
 the project:
 
@@ -105,14 +105,11 @@ components. The analysis stack is a concrete example:
 | Component | Purpose |
 | --- | --- |
 | `cap` | Fail-safe capability-envelope handling and bounded cursor traversal |
-| `log.core` | One-page canonical trace queries |
-| `log.analysis` | Bounded whole-result trace traversal |
-| `inspection.core` | One-page and singular private inspection queries |
-| `inspection.analysis` | Bounded whole-result private inspection traversal |
-
-`log.core` and `inspection.core` depend on `cap`; each analysis layer depends
-on its matching core component and on `cap`. This keeps each helper in one
-place without granting new host capabilities. Adding an installed dependency
+| `analysis` | Six question-shaped public/private run-analysis operations |
+
+`analysis` depends on `cap`. Its Elixir read model joins validated canonical
+and private snapshots; the Lisp layer only unwraps the six bounded semantic
+capabilities. Adding an installed dependency
 does widen the resolved bundle and its callable namespaces, so fixed profiles
 pin the complete resolved component list and version user-visible surface
 changes.

docs/guides/embedding-in-elixir.md

@@ -54,7 +54,7 @@ installed closure before compiling it:
 
 ```elixir
 {:ok, components} =
-  PtcRunner.Kernel.Library.resolve_components([{:library, "log.analysis"}])
+  PtcRunner.Kernel.Library.resolve_components([{:library, "analysis"}])
 
 {:ok, bundle} = PtcRunner.Kernel.compile_bundle(components)
 ```

docs/guides/getting-started.md

@@ -145,19 +145,18 @@ mix ptc run examples/kernel-tutorial/01-orders/ptc.json \
 ```
 
 The JSON Lines file records the run, workflow evaluation, outcome, usage, and
-limits. Query the captured directory through the fixed log-analysis profile:
+limits. Query the captured directory through the fixed run-analysis profile:
 
 ```console
 mix ptc repl \
-  --profile log-analysis-v2 \
+  --profile run-analysis-v1 \
   --resource traces=tmp/tutorial-traces \
-  -e '(log.analysis/all-runs {"limit" 50} 10)'
+  -e '(analysis/runs {"limit" 50})'
 ```
 
 The profile queries one frozen capture of that directory and has no filesystem,
-network, model, private-inspection, or nested-evaluation authority. The final
-argument is a page bound; the
-[Kernel REPL guide](kernel-repl.md#log-analysis-mission-sessions) documents the
+network, model, private-inspection, or nested-evaluation authority. The
+[Kernel REPL guide](kernel-repl.md#run-analysis-mission-sessions) documents the
 `complete?` and `snapshot_hash` fields the result carries.
 
 ## Try the language directly

docs/guides/host-configuration.md

@@ -564,6 +564,12 @@ lists the derived capability names,
 the query contract, and [Running and debugging](running-and-debugging.md) covers
 producing the artifacts in the first place.
 
+A manifest that selects the trace snapshot only as the inspection provider's
+acquisition dependency may set its provider config to `{"expose": false}`.
+The trace provider still exports its opaque frozen snapshot to the paired
+inspection provider, but contributes no duplicate prompt-visible analysis
+capabilities.
+
 ## Data classes
 
 Every installation carries a data class and a set of classes it accepts:

docs/guides/kernel-maintainer.md

@@ -1295,10 +1295,10 @@ never include rendered headers or subprocess environment values.
 `PtcRunner.Kernel.SafeMetadata` owns the closed labels and annotation
 vocabulary.
 
-The Viewer and `PtcRunner.Kernel.TraceCapability` delegate to TraceLog rather
-than defining another event model. Custom `Inspect` implementations and
-redacted owner status are defense-in-depth; runtime code must still avoid
-logging payload-bearing structures directly.
+The Viewer and `PtcRunner.Kernel.RunAnalysis` delegate to the immutable
+snapshots rather than defining another event model. Custom `Inspect`
+implementations and redacted owner status are defense-in-depth; runtime code
+must still avoid logging payload-bearing structures directly.
 
 ## Providers and interactive frontends
 
@@ -1482,23 +1482,24 @@ so a write remains indeterminate.
 
 PtcRunner-owned canonical traces remain native rather than passing through
 MCP. Host-installed `ptc_trace_snapshot` and `ptc_private_trace_snapshot`
-providers use `TraceSnapshot` to capture one directory and `TraceCapability`
-to expose the same four canonical `TraceLog` queries used by `log-analysis-v2`.
+providers use `TraceSnapshot` to capture one directory and
+`RunAnalysisCapability` to expose the same six question-shaped operations used
+by `run-analysis-v1`.
 The former admits ordinary traces only; the latter is a private-authorized
 capture of ordinary and private traces with per-run provenance. A paired private
 `ptc_inspection_snapshot` receives that already captured trace through the
 provider acquisition service, validates all artifacts and correlations before
-publication, and exposes the shared `InspectionQuery` layer through
-`InspectionCapability`. Its `inspection-result` operation is singular rather
-than paginated, accepts only `run_id`, and applies both encoded-byte and
-retained-size result ceilings before returning the exact private value.
+publication, and composes both snapshots through the same
+`RunAnalysisCapability` builder. Callers receive `runs`, `overview`, `activity`,
+`conversation`, `failure`, and `source`; private evidence is unavailable rather
+than replaced with primitive inspection record families.
 
 Local analysis profiles are fixed, code-owned recipes selected through the
 closed `AnalysisProfileRegistry`. `AnalysisSessionBuilder` is the host entry;
 `AnalysisSession`, `SessionTrace`, and `AnalysisResources` share continuation,
 publication, and cleanup without letting a caller supply modules,
-capabilities, limits, or sink policy. `log-analysis-v2` remains the Viewer and
-ordinary terminal profile. `inspection-analysis-v2` adds correlated
+capabilities, limits, or sink policy. `run-analysis-v1` remains the Viewer and
+ordinary terminal profile. `private-run-analysis-v1` adds correlated
 private-authorized `TraceSnapshot` and `InspectionSnapshot` captures behind a private
 interactive-terminal gate. Browser or Lisp input does not supply profile
 internals or paths.
@@ -1514,8 +1515,8 @@ internals or paths.
 | Mutable resources | `Limits`, `RunState`, `BoundedWorker`, `Dispatcher` |
 | Subordinate execution | `Runner`, `Evaluation`, `RuntimeTools` |
 | Lisp internals | `Lisp.Eval`, `Lisp.Eval.Effects`, `Lisp.Eval.Capture`, `Lisp.Eval.Parallel`, `Lisp.Eval.ParallelRunner` |
-| Providers | `HostConfig`, `HostInstallation`, `ProviderRegistry`, `ProviderAcquisition`, `ProviderSession`, `LLMCapability`, `MCPSource`, `MCPProtocol`, `TraceCapability`, `InspectionCapability` |
-| Canonical/private evidence | `EventSink`, `TraceLog`, `TraceSnapshot`, `InspectionSink`, `InspectionArtifact`, `InspectionSnapshot`, `InspectionQuery`, `SafeMetadata` |
+| Providers | `HostConfig`, `HostInstallation`, `ProviderRegistry`, `ProviderAcquisition`, `ProviderSession`, `LLMCapability`, `MCPSource`, `MCPProtocol`, `RunAnalysisCapability` |
+| Canonical/private evidence | `EventSink`, `TraceLog`, `TraceSnapshot`, `InspectionSink`, `InspectionArtifact`, `InspectionSnapshot`, `InspectionQuery`, `RunAnalysis`, `SafeMetadata` |
 | Interactive evaluation | `ReplSession`, `AnalysisProfileRegistry`, `AnalysisSessionBuilder`, `AnalysisSession`, `SessionTrace` |
 
 Modules grouped as Kernel internals in ExDoc remain documented for maintenance