Small bounded navigation API over one immutable run-evidence capture.

The prompt-facing contract has four operations: runs discovers runs, open returns singular metadata and a collection catalog, read delegates one bounded collection page to its trace or private-inspection snapshot owner, and counters delegates the canonical trace aggregate — including adapter-attested model usage — to the captured TraceSnapshot. Collection names, filters, authority, and order come from one closed registry. No operation diagnoses evidence or aggregates primitive pages before returning to Lisp.

Public captures expose only canonical activity. Private captures add exact exchanges, reconstructed turns, generated source with static prelude-call facts, effective prelude source, and workflow execution diagnostics. The catalog identifies snapshot and sequence domains, identifier locations, and raw collections whose items carry an explicit completeness field. Each collection the private inspection record counts also reports the item_count that run retained, so an empty page is a measured zero rather than an unexplained absence. Private error and source items carry typed relationships that package exact follow-up reads without performing them or diagnosing their evidence.