Certify loaded canvas scopes and publish completeness with runtime queries

headless/README.md

@@ -36,7 +36,8 @@ publication, release support promise, server deployment or full-goal completion
 implied by this local package.
 
 Experimental partial-model runtime: pass a validated prefix plus `loading` in
-`EngineOptions`. The marker requires recovery format 7 and keeps the scheduler held.
+`EngineOptions`. Version 1 uses recovery format 7; version 2 carries snapshot-bound direct canvas
+membership counts and uses format 8. Both keep the scheduler held.
 Loaded non-reference data fields and node geometry can be edited and undone; creation,
 deletions, ownership/reference changes, uploads, imports and AI admission wait.
 `engine.loading.accept(document, versions, state)` extends the captured prefix without
@@ -56,3 +57,22 @@ view's stream and asks the retained project owner to complete through a fresh re
 Reload recovers the durable prefix when that project is opened again. This is not a
 persistent HTTP cursor or a workspace-wide startup scan; partial-scope ACK/chunk
 interleaving and broader structural permissions remain unfinished.
+
+Scope-aware queries are obtained from `engine.editor.getQueries()` and share the
+same publication boundary as the root. `lookupElement(id)` returns `present`,
+`absent` (complete project), or `unloaded`; a missing ID in a partial model is not
+proof of absence. `membersResult(canvasId)` adds a completeness flag for direct
+members; `childCanvasesResult` covers published topology, while `incidentResult`
+requires the complete project because another owner may contain an incoming edge.
+Legacy array-returning methods enumerate loaded records only. Hit-query completeness
+also includes scope coverage. Derived indexes and coverage views are not persisted.
+
+An optional `canvasElementCounts` field in the version-1 stream header allows new
+clients to certify individual scopes. Missing metadata retains legacy conservative
+coverage. Counts include nodes and connections; they must cover exactly the declared
+active canvases, sum to the total, and never be exceeded by received records. A scope
+is ready only after its full count has entered the dependency-closed published prefix.
+Version-2 loading permits `connection.path` edits and history in a certified owner
+scope; endpoint, ownership, creation and deletion edits still wait. Neither scope
+completion nor receiving the last element replaces terminal/EOF validation or releases
+network scheduling. Partial-scope ACK/chunk interleaving remains pending.