Deterministic, privacy-preserving human projection of sealed command outcomes.

Provider failures include the validated provider subject already present in the public command envelope. Project, host, manifest, component-override, and value-contract failures with a non-root, schema-authorized path include its JSON Pointer. A contract schema rejected before it compiles also names the document its pointer indexes, because a manifest may carry two and the pointer means nothing without it. Unusual contract-authored pointers and logical names use an escaped quoted representation before they enter a terminal. Rendering never derives labels from a rejected value, provider response, credential, or unvalidated path. Component compile failures with a proven byte span render the logical component name and canonical half-open byte range already present in the envelope; rendering does not retain or reopen component source. Local-only context includes artifact destination paths and remedies for destination collisions, and an unreadable application input: its caller-supplied positional path, or a loaded project's validated relative application path, is appended without entering the sealed diagnostic. A replay miss may include only its validated opaque request hash.