diff --git a/.changeset/accuracy-and-contract-redesign.md b/.changeset/accuracy-and-contract-redesign.md
deleted file mode 100644
index 5e9fe0f..0000000
--- a/.changeset/accuracy-and-contract-redesign.md
+++ /dev/null
@@ -1,113 +0,0 @@
----
-'@refkit/core': minor
-'@refkit/mcp': minor
-'@refkit/provider-artic': minor
-'@refkit/provider-brave': minor
-'@refkit/provider-europeana': minor
-'@refkit/provider-flickr': minor
-'@refkit/provider-freesound': minor
-'@refkit/provider-gutendex': minor
-'@refkit/provider-internet-archive': minor
-'@refkit/provider-jamendo': minor
-'@refkit/provider-met': minor
-'@refkit/provider-nailbook': minor
-'@refkit/provider-openverse': minor
-'@refkit/provider-pexels': minor
-'@refkit/provider-pixabay': minor
-'@refkit/provider-poetrydb': minor
-'@refkit/provider-polyhaven': minor
-'@refkit/provider-rijksmuseum': minor
-'@refkit/provider-smithsonian': minor
-'@refkit/provider-unsplash': minor
-'@refkit/provider-wikimedia-commons': minor
----
-
-Accuracy and contract redesign: license **facts** drive every rights decision, providers
-only describe what their source knows, and the default search path ranks for the query
-without a host-supplied model.
-
-These are **breaking** changes to the public surface. Every package is still `0.x`, so
-they ship as `minor` per semver's pre-1.0 rule — nothing is aliased or shimmed, so read
-the removed/added lists before upgrading.
-
-### Rights: facts, not license ids
-
-- `LicenseId` is now an **open** string (`KnownLicenseId | (string & {})`); an id with no
-  row in `LICENSE_FACTS` resolves to the `unknown` row, which grants nothing.
-- Added `RightsRecord.facts?: LicenseFacts` — a source whose terms are narrower than the
-  label it declares supplies its own row. Added `factsOf(rights)`, `licenseFactsSchema`,
-  `isKnownLicenseId`, `isIndeterminate`, `compareRestrictiveness(factsA, factsB)` and
-  `permissivenessScore(facts)`.
-- **Removed** `stricterLicense(idA, idB)` (replaced by `compareRestrictiveness`) and the
-  reranker's internal `LICENSE_PERMISSIVENESS` table (replaced by `permissivenessScore`).
-- Cross-source conflict detection is keyed on facts, not labels: identical facts under
-  different ids (`CC0-1.0` vs `PD`) no longer conflict, the same id with narrower facts
-  now does, and `RightsConflict.licenses` lists the source-declared ids involved.
-- `rightsRecordSchema` now rejects a `licenseVersion` on a non-CC-family license.
-  `CC_VERSIONED_FAMILIES` and `ccVersionFor` moved from `provider-helpers` to `license`
-  (still exported from the package root).
-
-### Providers emit, core completes
-
-- Added `EmittedReference` — what `ReferenceProvider.search` now returns:
-  `modality, kind?, title?, description?, tags?, sourceUrl, canonicalUrl?, rights,
-  thumbnail?, preview?, perceptualHash?, visual?, text?, sourceScore?, raw?`. **Every
-  `@refkit/provider-*` factory's `search` signature changed accordingly.**
-- Core stamps `id`, `source`, `canonicalUrl`, `verifiedAt` and `relevance` and applies the
-  per-provider `limit`: added `completeReference`, `parseEmitted`, `emittedReferenceSchema`.
-  Providers no longer compute ids, write provenance, or post-truncate.
-- `Reference` and `EmittedReference` gained `description`, `tags: string[]` and
-  `sourceScore`. Met, Art Institute of Chicago, Wikimedia Commons and Rijksmuseum now
-  populate descriptive fields (and Art Institute also reports its upstream `_score`), which
-  directly sharpens ranking.
-- Added `okJson(res, label)` for provider mappers, `plainText`, and
-  `RefkitOptions.userAgent` (`'refkit-client/1'` by default; Art Institute's edge rejects
-  Node's default UA) plus `withDefaultUserAgent`.
-
-### One search channel, one control registry
-
-- **Removed** `SearchFilters`, `SearchInput.filters`, `NormalizedQuery.filters`,
-  `SearchMeta.appliedFilters`, `QueryFeature`, `ReferenceProvider.queryFeatures`, the legacy
-  feature→control routing, and the MCP `filters` parameter. Use `controls` /
-  `capabilities.controls`.
-- Control types and the `key → path` registry moved to `controls.ts`; added `CONTROL_PATHS`,
-  `SEARCH_CONTROL_KEYS`, `getControl`, `setControl`, `hasControl`,
-  `buildSearchControlsSchema`, `searchControlsSchema`, `searchControlKeySchema`,
-  `searchMetaSchema`, `providerSearchStatusSchema` and the `MODALITIES` tuple to the public
-  surface — `@refkit/mcp` imports only `buildSearchControlsSchema` and `searchMetaSchema`
-  from core, and derives its modality enum from the registered providers rather than
-  keeping a local copy.
-- Orchestrator stages are exported for testing and reuse: `selectProviders`,
-  `PROVIDER_SKIP_REASONS`, `runPass`, and `SearchMeta.passes` (per-pass latency, warnings
-  and rights conflicts now accumulate across cursor page advances).
-
-### Accuracy defaults
-
-- **Source confidence** (`RefkitOptions.sourceConfidence`, default on, floor `0.1`) weights
-  each source's rank-fusion contribution by how much of its batch mentions the query; each
-  fulfilled source reports `meta.providers[].confidence`. Added `sourceConfidence` and
-  `lexicalHit`; `MergeOptions.weights` applies the weights.
-- **Reranking is on by default**: `RefkitOptions.rerank` / `SearchInput.rerank` default to
-  `lexicalReranker()`, `false` returns raw fusion order. The lexical reranker now scores
-  over `title + description + tags + excerpt`, blends the incoming fused relevance
-  (`fusionWeight`, default `0.5`), and adds a same-source near-duplicate-title penalty
-  (`nearDuplicatePenalty`, `nearDuplicateThreshold`) and an optional `sourceScoreWeight`.
-  Added `refText` alongside `tokenize`. MCP's `rerank` parameter now defaults to true.
-- **Relevance threshold**: `SearchInput.minRelevance` drops results the ranker scored below
-  the bar (after rerank, before the gate) and reports `SearchMeta.threshold`
-  (`SearchThresholdMeta`). New MCP `minRelevance` parameter. The bar is graded against the
-  reranker's blended score and does not transfer to `rerank: false`.
-- **Query acceptance**: `ReferenceProvider.accepts?({ text, modalities })` lets a narrow
-  source decline queries it cannot answer — skipped with `reason: 'declined'`, bypassed by
-  an explicit `sources` whitelist, and an all-declined search returns an empty result
-  instead of throwing. `@refkit/provider-nailbook` declines queries that do not name nails;
-  `@refkit/provider-polyhaven` now matches each query token independently and ranks assets
-  by how many tokens they match.
-- **Whole-search deadline and gate context**: `SearchInput.deadlineMs` (bounds the whole
-  call, cursor advances included) and `SearchInput.gateContext.userJurisdiction` (forwarded
-  to the search-time gate, matching `evaluateUse`). Both are exposed as MCP parameters.
-
-The internal `@refkit/provider-testkit` (private, never published) dropped its id-prefix,
-providerId and licenseVersion conformance rules — core now guarantees all three — and
-completes emitted items exactly as the orchestrator does before asserting the rules that
-remain a satellite's own responsibility.
diff --git a/packages/core/CHANGELOG.md b/packages/core/CHANGELOG.md
index aafa399..dda4d04 100644
--- a/packages/core/CHANGELOG.md
+++ b/packages/core/CHANGELOG.md
@@ -1,5 +1,99 @@
 # @refkit/core
 
+## 0.9.0
+
+### Minor Changes
+
+- 4dfd41a: Accuracy and contract redesign: license **facts** drive every rights decision, providers
+  only describe what their source knows, and the default search path ranks for the query
+  without a host-supplied model.
+
+  These are **breaking** changes to the public surface. Every package is still `0.x`, so
+  they ship as `minor` per semver's pre-1.0 rule — nothing is aliased or shimmed, so read
+  the removed/added lists before upgrading.
+
+  ### Rights: facts, not license ids
+
+  - `LicenseId` is now an **open** string (`KnownLicenseId | (string & {})`); an id with no
+    row in `LICENSE_FACTS` resolves to the `unknown` row, which grants nothing.
+  - Added `RightsRecord.facts?: LicenseFacts` — a source whose terms are narrower than the
+    label it declares supplies its own row. Added `factsOf(rights)`, `licenseFactsSchema`,
+    `isKnownLicenseId`, `isIndeterminate`, `compareRestrictiveness(factsA, factsB)` and
+    `permissivenessScore(facts)`.
+  - **Removed** `stricterLicense(idA, idB)` (replaced by `compareRestrictiveness`) and the
+    reranker's internal `LICENSE_PERMISSIVENESS` table (replaced by `permissivenessScore`).
+  - Cross-source conflict detection is keyed on facts, not labels: identical facts under
+    different ids (`CC0-1.0` vs `PD`) no longer conflict, the same id with narrower facts
+    now does, and `RightsConflict.licenses` lists the source-declared ids involved.
+  - `rightsRecordSchema` now rejects a `licenseVersion` on a non-CC-family license.
+    `CC_VERSIONED_FAMILIES` and `ccVersionFor` moved from `provider-helpers` to `license`
+    (still exported from the package root).
+
+  ### Providers emit, core completes
+
+  - Added `EmittedReference` — what `ReferenceProvider.search` now returns:
+    `modality, kind?, title?, description?, tags?, sourceUrl, canonicalUrl?, rights,
+thumbnail?, preview?, perceptualHash?, visual?, text?, sourceScore?, raw?`. **Every
+    `@refkit/provider-*` factory's `search` signature changed accordingly.**
+  - Core stamps `id`, `source`, `canonicalUrl`, `verifiedAt` and `relevance` and applies the
+    per-provider `limit`: added `completeReference`, `parseEmitted`, `emittedReferenceSchema`.
+    Providers no longer compute ids, write provenance, or post-truncate.
+  - `Reference` and `EmittedReference` gained `description`, `tags: string[]` and
+    `sourceScore`. Met, Art Institute of Chicago, Wikimedia Commons and Rijksmuseum now
+    populate descriptive fields (and Art Institute also reports its upstream `_score`), which
+    directly sharpens ranking.
+  - Added `okJson(res, label)` for provider mappers, `plainText`, and
+    `RefkitOptions.userAgent` (`'refkit-client/1'` by default; Art Institute's edge rejects
+    Node's default UA) plus `withDefaultUserAgent`.
+
+  ### One search channel, one control registry
+
+  - **Removed** `SearchFilters`, `SearchInput.filters`, `NormalizedQuery.filters`,
+    `SearchMeta.appliedFilters`, `QueryFeature`, `ReferenceProvider.queryFeatures`, the legacy
+    feature→control routing, and the MCP `filters` parameter. Use `controls` /
+    `capabilities.controls`.
+  - Control types and the `key → path` registry moved to `controls.ts`; added `CONTROL_PATHS`,
+    `SEARCH_CONTROL_KEYS`, `getControl`, `setControl`, `hasControl`,
+    `buildSearchControlsSchema`, `searchControlsSchema`, `searchControlKeySchema`,
+    `searchMetaSchema`, `providerSearchStatusSchema` and the `MODALITIES` tuple to the public
+    surface — `@refkit/mcp` imports only `buildSearchControlsSchema` and `searchMetaSchema`
+    from core, and derives its modality enum from the registered providers rather than
+    keeping a local copy.
+  - Orchestrator stages are exported for testing and reuse: `selectProviders`,
+    `PROVIDER_SKIP_REASONS`, `runPass`, and `SearchMeta.passes` (per-pass latency, warnings
+    and rights conflicts now accumulate across cursor page advances).
+
+  ### Accuracy defaults
+
+  - **Source confidence** (`RefkitOptions.sourceConfidence`, default on, floor `0.1`) weights
+    each source's rank-fusion contribution by how much of its batch mentions the query; each
+    fulfilled source reports `meta.providers[].confidence`. Added `sourceConfidence` and
+    `lexicalHit`; `MergeOptions.weights` applies the weights.
+  - **Reranking is on by default**: `RefkitOptions.rerank` / `SearchInput.rerank` default to
+    `lexicalReranker()`, `false` returns raw fusion order. The lexical reranker now scores
+    over `title + description + tags + excerpt`, blends the incoming fused relevance
+    (`fusionWeight`, default `0.5`), and adds a same-source near-duplicate-title penalty
+    (`nearDuplicatePenalty`, `nearDuplicateThreshold`) and an optional `sourceScoreWeight`.
+    Added `refText` alongside `tokenize`. MCP's `rerank` parameter now defaults to true.
+  - **Relevance threshold**: `SearchInput.minRelevance` drops results the ranker scored below
+    the bar (after rerank, before the gate) and reports `SearchMeta.threshold`
+    (`SearchThresholdMeta`). New MCP `minRelevance` parameter. The bar is graded against the
+    reranker's blended score and does not transfer to `rerank: false`.
+  - **Query acceptance**: `ReferenceProvider.accepts?({ text, modalities })` lets a narrow
+    source decline queries it cannot answer — skipped with `reason: 'declined'`, bypassed by
+    an explicit `sources` whitelist, and an all-declined search returns an empty result
+    instead of throwing. `@refkit/provider-nailbook` declines queries that do not name nails;
+    `@refkit/provider-polyhaven` now matches each query token independently and ranks assets
+    by how many tokens they match.
+  - **Whole-search deadline and gate context**: `SearchInput.deadlineMs` (bounds the whole
+    call, cursor advances included) and `SearchInput.gateContext.userJurisdiction` (forwarded
+    to the search-time gate, matching `evaluateUse`). Both are exposed as MCP parameters.
+
+  The internal `@refkit/provider-testkit` (private, never published) dropped its id-prefix,
+  providerId and licenseVersion conformance rules — core now guarantees all three — and
+  completes emitted items exactly as the orchestrator does before asserting the rules that
+  remain a satellite's own responsibility.
+
 ## 0.8.0
 
 ### Minor Changes
diff --git a/packages/core/package.json b/packages/core/package.json
index 748941a..8f838ef 100644
--- a/packages/core/package.json
+++ b/packages/core/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@refkit/core",
-  "version": "0.8.0",
+  "version": "0.9.0",
   "description": "refkit core — neutral reference-retrieval brain: Reference/RightsRecord contract, license normalization, strict-deny use-gate, RRF merge/dedup, ReferenceProvider interfaces. Zero-network, zero-provider, only zod.",
   "type": "module",
   "license": "Apache-2.0",
diff --git a/packages/mcp/CHANGELOG.md b/packages/mcp/CHANGELOG.md
index a7330f8..165702c 100644
--- a/packages/mcp/CHANGELOG.md
+++ b/packages/mcp/CHANGELOG.md
@@ -1,5 +1,114 @@
 # @refkit/mcp
 
+## 0.8.0
+
+### Minor Changes
+
+- 4dfd41a: Accuracy and contract redesign: license **facts** drive every rights decision, providers
+  only describe what their source knows, and the default search path ranks for the query
+  without a host-supplied model.
+
+  These are **breaking** changes to the public surface. Every package is still `0.x`, so
+  they ship as `minor` per semver's pre-1.0 rule — nothing is aliased or shimmed, so read
+  the removed/added lists before upgrading.
+
+  ### Rights: facts, not license ids
+
+  - `LicenseId` is now an **open** string (`KnownLicenseId | (string & {})`); an id with no
+    row in `LICENSE_FACTS` resolves to the `unknown` row, which grants nothing.
+  - Added `RightsRecord.facts?: LicenseFacts` — a source whose terms are narrower than the
+    label it declares supplies its own row. Added `factsOf(rights)`, `licenseFactsSchema`,
+    `isKnownLicenseId`, `isIndeterminate`, `compareRestrictiveness(factsA, factsB)` and
+    `permissivenessScore(facts)`.
+  - **Removed** `stricterLicense(idA, idB)` (replaced by `compareRestrictiveness`) and the
+    reranker's internal `LICENSE_PERMISSIVENESS` table (replaced by `permissivenessScore`).
+  - Cross-source conflict detection is keyed on facts, not labels: identical facts under
+    different ids (`CC0-1.0` vs `PD`) no longer conflict, the same id with narrower facts
+    now does, and `RightsConflict.licenses` lists the source-declared ids involved.
+  - `rightsRecordSchema` now rejects a `licenseVersion` on a non-CC-family license.
+    `CC_VERSIONED_FAMILIES` and `ccVersionFor` moved from `provider-helpers` to `license`
+    (still exported from the package root).
+
+  ### Providers emit, core completes
+
+  - Added `EmittedReference` — what `ReferenceProvider.search` now returns:
+    `modality, kind?, title?, description?, tags?, sourceUrl, canonicalUrl?, rights,
+thumbnail?, preview?, perceptualHash?, visual?, text?, sourceScore?, raw?`. **Every
+    `@refkit/provider-*` factory's `search` signature changed accordingly.**
+  - Core stamps `id`, `source`, `canonicalUrl`, `verifiedAt` and `relevance` and applies the
+    per-provider `limit`: added `completeReference`, `parseEmitted`, `emittedReferenceSchema`.
+    Providers no longer compute ids, write provenance, or post-truncate.
+  - `Reference` and `EmittedReference` gained `description`, `tags: string[]` and
+    `sourceScore`. Met, Art Institute of Chicago, Wikimedia Commons and Rijksmuseum now
+    populate descriptive fields (and Art Institute also reports its upstream `_score`), which
+    directly sharpens ranking.
+  - Added `okJson(res, label)` for provider mappers, `plainText`, and
+    `RefkitOptions.userAgent` (`'refkit-client/1'` by default; Art Institute's edge rejects
+    Node's default UA) plus `withDefaultUserAgent`.
+
+  ### One search channel, one control registry
+
+  - **Removed** `SearchFilters`, `SearchInput.filters`, `NormalizedQuery.filters`,
+    `SearchMeta.appliedFilters`, `QueryFeature`, `ReferenceProvider.queryFeatures`, the legacy
+    feature→control routing, and the MCP `filters` parameter. Use `controls` /
+    `capabilities.controls`.
+  - Control types and the `key → path` registry moved to `controls.ts`; added `CONTROL_PATHS`,
+    `SEARCH_CONTROL_KEYS`, `getControl`, `setControl`, `hasControl`,
+    `buildSearchControlsSchema`, `searchControlsSchema`, `searchControlKeySchema`,
+    `searchMetaSchema`, `providerSearchStatusSchema` and the `MODALITIES` tuple to the public
+    surface — `@refkit/mcp` imports only `buildSearchControlsSchema` and `searchMetaSchema`
+    from core, and derives its modality enum from the registered providers rather than
+    keeping a local copy.
+  - Orchestrator stages are exported for testing and reuse: `selectProviders`,
+    `PROVIDER_SKIP_REASONS`, `runPass`, and `SearchMeta.passes` (per-pass latency, warnings
+    and rights conflicts now accumulate across cursor page advances).
+
+  ### Accuracy defaults
+
+  - **Source confidence** (`RefkitOptions.sourceConfidence`, default on, floor `0.1`) weights
+    each source's rank-fusion contribution by how much of its batch mentions the query; each
+    fulfilled source reports `meta.providers[].confidence`. Added `sourceConfidence` and
+    `lexicalHit`; `MergeOptions.weights` applies the weights.
+  - **Reranking is on by default**: `RefkitOptions.rerank` / `SearchInput.rerank` default to
+    `lexicalReranker()`, `false` returns raw fusion order. The lexical reranker now scores
+    over `title + description + tags + excerpt`, blends the incoming fused relevance
+    (`fusionWeight`, default `0.5`), and adds a same-source near-duplicate-title penalty
+    (`nearDuplicatePenalty`, `nearDuplicateThreshold`) and an optional `sourceScoreWeight`.
+    Added `refText` alongside `tokenize`. MCP's `rerank` parameter now defaults to true.
+  - **Relevance threshold**: `SearchInput.minRelevance` drops results the ranker scored below
+    the bar (after rerank, before the gate) and reports `SearchMeta.threshold`
+    (`SearchThresholdMeta`). New MCP `minRelevance` parameter. The bar is graded against the
+    reranker's blended score and does not transfer to `rerank: false`.
+  - **Query acceptance**: `ReferenceProvider.accepts?({ text, modalities })` lets a narrow
+    source decline queries it cannot answer — skipped with `reason: 'declined'`, bypassed by
+    an explicit `sources` whitelist, and an all-declined search returns an empty result
+    instead of throwing. `@refkit/provider-nailbook` declines queries that do not name nails;
+    `@refkit/provider-polyhaven` now matches each query token independently and ranks assets
+    by how many tokens they match.
+  - **Whole-search deadline and gate context**: `SearchInput.deadlineMs` (bounds the whole
+    call, cursor advances included) and `SearchInput.gateContext.userJurisdiction` (forwarded
+    to the search-time gate, matching `evaluateUse`). Both are exposed as MCP parameters.
+
+  The internal `@refkit/provider-testkit` (private, never published) dropped its id-prefix,
+  providerId and licenseVersion conformance rules — core now guarantees all three — and
+  completes emitted items exactly as the orchestrator does before asserting the rules that
+  remain a satellite's own responsibility.
+
+### Patch Changes
+
+- Updated dependencies [4dfd41a]
+  - @refkit/core@0.9.0
+  - @refkit/provider-artic@0.4.0
+  - @refkit/provider-gutendex@0.4.0
+  - @refkit/provider-internet-archive@0.5.0
+  - @refkit/provider-met@0.4.0
+  - @refkit/provider-nailbook@0.2.0
+  - @refkit/provider-openverse@0.5.0
+  - @refkit/provider-poetrydb@0.4.0
+  - @refkit/provider-polyhaven@0.4.0
+  - @refkit/provider-rijksmuseum@0.4.0
+  - @refkit/provider-wikimedia-commons@0.5.0
+
 ## 0.7.0
 
 ### Minor Changes
diff --git a/packages/mcp/package.json b/packages/mcp/package.json
index aa6a739..48b84a8 100644
--- a/packages/mcp/package.json
+++ b/packages/mcp/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@refkit/mcp",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "description": "MCP server for refkit — exposes license-normalized reference search as an agent tool.",
   "type": "module",
   "license": "Apache-2.0",
diff --git a/packages/provider-artic/CHANGELOG.md b/packages/provider-artic/CHANGELOG.md
index 52b9415..2cdbaee 100644
--- a/packages/provider-artic/CHANGELOG.md
+++ b/packages/provider-artic/CHANGELOG.md
@@ -1,5 +1,104 @@
 # @refkit/provider-artic
 
+## 0.4.0
+
+### Minor Changes
+
+- 4dfd41a: Accuracy and contract redesign: license **facts** drive every rights decision, providers
+  only describe what their source knows, and the default search path ranks for the query
+  without a host-supplied model.
+
+  These are **breaking** changes to the public surface. Every package is still `0.x`, so
+  they ship as `minor` per semver's pre-1.0 rule — nothing is aliased or shimmed, so read
+  the removed/added lists before upgrading.
+
+  ### Rights: facts, not license ids
+
+  - `LicenseId` is now an **open** string (`KnownLicenseId | (string & {})`); an id with no
+    row in `LICENSE_FACTS` resolves to the `unknown` row, which grants nothing.
+  - Added `RightsRecord.facts?: LicenseFacts` — a source whose terms are narrower than the
+    label it declares supplies its own row. Added `factsOf(rights)`, `licenseFactsSchema`,
+    `isKnownLicenseId`, `isIndeterminate`, `compareRestrictiveness(factsA, factsB)` and
+    `permissivenessScore(facts)`.
+  - **Removed** `stricterLicense(idA, idB)` (replaced by `compareRestrictiveness`) and the
+    reranker's internal `LICENSE_PERMISSIVENESS` table (replaced by `permissivenessScore`).
+  - Cross-source conflict detection is keyed on facts, not labels: identical facts under
+    different ids (`CC0-1.0` vs `PD`) no longer conflict, the same id with narrower facts
+    now does, and `RightsConflict.licenses` lists the source-declared ids involved.
+  - `rightsRecordSchema` now rejects a `licenseVersion` on a non-CC-family license.
+    `CC_VERSIONED_FAMILIES` and `ccVersionFor` moved from `provider-helpers` to `license`
+    (still exported from the package root).
+
+  ### Providers emit, core completes
+
+  - Added `EmittedReference` — what `ReferenceProvider.search` now returns:
+    `modality, kind?, title?, description?, tags?, sourceUrl, canonicalUrl?, rights,
+thumbnail?, preview?, perceptualHash?, visual?, text?, sourceScore?, raw?`. **Every
+    `@refkit/provider-*` factory's `search` signature changed accordingly.**
+  - Core stamps `id`, `source`, `canonicalUrl`, `verifiedAt` and `relevance` and applies the
+    per-provider `limit`: added `completeReference`, `parseEmitted`, `emittedReferenceSchema`.
+    Providers no longer compute ids, write provenance, or post-truncate.
+  - `Reference` and `EmittedReference` gained `description`, `tags: string[]` and
+    `sourceScore`. Met, Art Institute of Chicago, Wikimedia Commons and Rijksmuseum now
+    populate descriptive fields (and Art Institute also reports its upstream `_score`), which
+    directly sharpens ranking.
+  - Added `okJson(res, label)` for provider mappers, `plainText`, and
+    `RefkitOptions.userAgent` (`'refkit-client/1'` by default; Art Institute's edge rejects
+    Node's default UA) plus `withDefaultUserAgent`.
+
+  ### One search channel, one control registry
+
+  - **Removed** `SearchFilters`, `SearchInput.filters`, `NormalizedQuery.filters`,
+    `SearchMeta.appliedFilters`, `QueryFeature`, `ReferenceProvider.queryFeatures`, the legacy
+    feature→control routing, and the MCP `filters` parameter. Use `controls` /
+    `capabilities.controls`.
+  - Control types and the `key → path` registry moved to `controls.ts`; added `CONTROL_PATHS`,
+    `SEARCH_CONTROL_KEYS`, `getControl`, `setControl`, `hasControl`,
+    `buildSearchControlsSchema`, `searchControlsSchema`, `searchControlKeySchema`,
+    `searchMetaSchema`, `providerSearchStatusSchema` and the `MODALITIES` tuple to the public
+    surface — `@refkit/mcp` imports only `buildSearchControlsSchema` and `searchMetaSchema`
+    from core, and derives its modality enum from the registered providers rather than
+    keeping a local copy.
+  - Orchestrator stages are exported for testing and reuse: `selectProviders`,
+    `PROVIDER_SKIP_REASONS`, `runPass`, and `SearchMeta.passes` (per-pass latency, warnings
+    and rights conflicts now accumulate across cursor page advances).
+
+  ### Accuracy defaults
+
+  - **Source confidence** (`RefkitOptions.sourceConfidence`, default on, floor `0.1`) weights
+    each source's rank-fusion contribution by how much of its batch mentions the query; each
+    fulfilled source reports `meta.providers[].confidence`. Added `sourceConfidence` and
+    `lexicalHit`; `MergeOptions.weights` applies the weights.
+  - **Reranking is on by default**: `RefkitOptions.rerank` / `SearchInput.rerank` default to
+    `lexicalReranker()`, `false` returns raw fusion order. The lexical reranker now scores
+    over `title + description + tags + excerpt`, blends the incoming fused relevance
+    (`fusionWeight`, default `0.5`), and adds a same-source near-duplicate-title penalty
+    (`nearDuplicatePenalty`, `nearDuplicateThreshold`) and an optional `sourceScoreWeight`.
+    Added `refText` alongside `tokenize`. MCP's `rerank` parameter now defaults to true.
+  - **Relevance threshold**: `SearchInput.minRelevance` drops results the ranker scored below
+    the bar (after rerank, before the gate) and reports `SearchMeta.threshold`
+    (`SearchThresholdMeta`). New MCP `minRelevance` parameter. The bar is graded against the
+    reranker's blended score and does not transfer to `rerank: false`.
+  - **Query acceptance**: `ReferenceProvider.accepts?({ text, modalities })` lets a narrow
+    source decline queries it cannot answer — skipped with `reason: 'declined'`, bypassed by
+    an explicit `sources` whitelist, and an all-declined search returns an empty result
+    instead of throwing. `@refkit/provider-nailbook` declines queries that do not name nails;
+    `@refkit/provider-polyhaven` now matches each query token independently and ranks assets
+    by how many tokens they match.
+  - **Whole-search deadline and gate context**: `SearchInput.deadlineMs` (bounds the whole
+    call, cursor advances included) and `SearchInput.gateContext.userJurisdiction` (forwarded
+    to the search-time gate, matching `evaluateUse`). Both are exposed as MCP parameters.
+
+  The internal `@refkit/provider-testkit` (private, never published) dropped its id-prefix,
+  providerId and licenseVersion conformance rules — core now guarantees all three — and
+  completes emitted items exactly as the orchestrator does before asserting the rules that
+  remain a satellite's own responsibility.
+
+### Patch Changes
+
+- Updated dependencies [4dfd41a]
+  - @refkit/core@0.9.0
+
 ## 0.3.0
 
 ### Minor Changes
diff --git a/packages/provider-artic/package.json b/packages/provider-artic/package.json
index c0f084e..0e1038e 100644
--- a/packages/provider-artic/package.json
+++ b/packages/provider-artic/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@refkit/provider-artic",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "Art Institute of Chicago provider satellite for refkit.",
   "type": "module",
   "license": "Apache-2.0",
diff --git a/packages/provider-brave/CHANGELOG.md b/packages/provider-brave/CHANGELOG.md
index 687b224..b84240e 100644
--- a/packages/provider-brave/CHANGELOG.md
+++ b/packages/provider-brave/CHANGELOG.md
@@ -1,5 +1,104 @@
 # @refkit/provider-brave
 
+## 0.4.0
+
+### Minor Changes
+
+- 4dfd41a: Accuracy and contract redesign: license **facts** drive every rights decision, providers
+  only describe what their source knows, and the default search path ranks for the query
+  without a host-supplied model.
+
+  These are **breaking** changes to the public surface. Every package is still `0.x`, so
+  they ship as `minor` per semver's pre-1.0 rule — nothing is aliased or shimmed, so read
+  the removed/added lists before upgrading.
+
+  ### Rights: facts, not license ids
+
+  - `LicenseId` is now an **open** string (`KnownLicenseId | (string & {})`); an id with no
+    row in `LICENSE_FACTS` resolves to the `unknown` row, which grants nothing.
+  - Added `RightsRecord.facts?: LicenseFacts` — a source whose terms are narrower than the
+    label it declares supplies its own row. Added `factsOf(rights)`, `licenseFactsSchema`,
+    `isKnownLicenseId`, `isIndeterminate`, `compareRestrictiveness(factsA, factsB)` and
+    `permissivenessScore(facts)`.
+  - **Removed** `stricterLicense(idA, idB)` (replaced by `compareRestrictiveness`) and the
+    reranker's internal `LICENSE_PERMISSIVENESS` table (replaced by `permissivenessScore`).
+  - Cross-source conflict detection is keyed on facts, not labels: identical facts under
+    different ids (`CC0-1.0` vs `PD`) no longer conflict, the same id with narrower facts
+    now does, and `RightsConflict.licenses` lists the source-declared ids involved.
+  - `rightsRecordSchema` now rejects a `licenseVersion` on a non-CC-family license.
+    `CC_VERSIONED_FAMILIES` and `ccVersionFor` moved from `provider-helpers` to `license`
+    (still exported from the package root).
+
+  ### Providers emit, core completes
+
+  - Added `EmittedReference` — what `ReferenceProvider.search` now returns:
+    `modality, kind?, title?, description?, tags?, sourceUrl, canonicalUrl?, rights,
+thumbnail?, preview?, perceptualHash?, visual?, text?, sourceScore?, raw?`. **Every
+    `@refkit/provider-*` factory's `search` signature changed accordingly.**
+  - Core stamps `id`, `source`, `canonicalUrl`, `verifiedAt` and `relevance` and applies the
+    per-provider `limit`: added `completeReference`, `parseEmitted`, `emittedReferenceSchema`.
+    Providers no longer compute ids, write provenance, or post-truncate.
+  - `Reference` and `EmittedReference` gained `description`, `tags: string[]` and
+    `sourceScore`. Met, Art Institute of Chicago, Wikimedia Commons and Rijksmuseum now
+    populate descriptive fields (and Art Institute also reports its upstream `_score`), which
+    directly sharpens ranking.
+  - Added `okJson(res, label)` for provider mappers, `plainText`, and
+    `RefkitOptions.userAgent` (`'refkit-client/1'` by default; Art Institute's edge rejects
+    Node's default UA) plus `withDefaultUserAgent`.
+
+  ### One search channel, one control registry
+
+  - **Removed** `SearchFilters`, `SearchInput.filters`, `NormalizedQuery.filters`,
+    `SearchMeta.appliedFilters`, `QueryFeature`, `ReferenceProvider.queryFeatures`, the legacy
+    feature→control routing, and the MCP `filters` parameter. Use `controls` /
+    `capabilities.controls`.
+  - Control types and the `key → path` registry moved to `controls.ts`; added `CONTROL_PATHS`,
+    `SEARCH_CONTROL_KEYS`, `getControl`, `setControl`, `hasControl`,
+    `buildSearchControlsSchema`, `searchControlsSchema`, `searchControlKeySchema`,
+    `searchMetaSchema`, `providerSearchStatusSchema` and the `MODALITIES` tuple to the public
+    surface — `@refkit/mcp` imports only `buildSearchControlsSchema` and `searchMetaSchema`
+    from core, and derives its modality enum from the registered providers rather than
+    keeping a local copy.
+  - Orchestrator stages are exported for testing and reuse: `selectProviders`,
+    `PROVIDER_SKIP_REASONS`, `runPass`, and `SearchMeta.passes` (per-pass latency, warnings
+    and rights conflicts now accumulate across cursor page advances).
+
+  ### Accuracy defaults
+
+  - **Source confidence** (`RefkitOptions.sourceConfidence`, default on, floor `0.1`) weights
+    each source's rank-fusion contribution by how much of its batch mentions the query; each
+    fulfilled source reports `meta.providers[].confidence`. Added `sourceConfidence` and
+    `lexicalHit`; `MergeOptions.weights` applies the weights.
+  - **Reranking is on by default**: `RefkitOptions.rerank` / `SearchInput.rerank` default to
+    `lexicalReranker()`, `false` returns raw fusion order. The lexical reranker now scores
+    over `title + description + tags + excerpt`, blends the incoming fused relevance
+    (`fusionWeight`, default `0.5`), and adds a same-source near-duplicate-title penalty
+    (`nearDuplicatePenalty`, `nearDuplicateThreshold`) and an optional `sourceScoreWeight`.
+    Added `refText` alongside `tokenize`. MCP's `rerank` parameter now defaults to true.
+  - **Relevance threshold**: `SearchInput.minRelevance` drops results the ranker scored below
+    the bar (after rerank, before the gate) and reports `SearchMeta.threshold`
+    (`SearchThresholdMeta`). New MCP `minRelevance` parameter. The bar is graded against the
+    reranker's blended score and does not transfer to `rerank: false`.
+  - **Query acceptance**: `ReferenceProvider.accepts?({ text, modalities })` lets a narrow
+    source decline queries it cannot answer — skipped with `reason: 'declined'`, bypassed by
+    an explicit `sources` whitelist, and an all-declined search returns an empty result
+    instead of throwing. `@refkit/provider-nailbook` declines queries that do not name nails;
+    `@refkit/provider-polyhaven` now matches each query token independently and ranks assets
+    by how many tokens they match.
+  - **Whole-search deadline and gate context**: `SearchInput.deadlineMs` (bounds the whole
+    call, cursor advances included) and `SearchInput.gateContext.userJurisdiction` (forwarded
+    to the search-time gate, matching `evaluateUse`). Both are exposed as MCP parameters.
+
+  The internal `@refkit/provider-testkit` (private, never published) dropped its id-prefix,
+  providerId and licenseVersion conformance rules — core now guarantees all three — and
+  completes emitted items exactly as the orchestrator does before asserting the rules that
+  remain a satellite's own responsibility.
+
+### Patch Changes
+
+- Updated dependencies [4dfd41a]
+  - @refkit/core@0.9.0
+
 ## 0.3.0
 
 ### Minor Changes
diff --git a/packages/provider-brave/package.json b/packages/provider-brave/package.json
index d5e12aa..708fd7f 100644
--- a/packages/provider-brave/package.json
+++ b/packages/provider-brave/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@refkit/provider-brave",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "Brave Search web-discovery provider satellite for refkit — open-web image breadth, license:unknown (use-gated to needs-review).",
   "type": "module",
   "license": "Apache-2.0",
diff --git a/packages/provider-europeana/CHANGELOG.md b/packages/provider-europeana/CHANGELOG.md
index 6c3d449..a54dd40 100644
--- a/packages/provider-europeana/CHANGELOG.md
+++ b/packages/provider-europeana/CHANGELOG.md
@@ -1,5 +1,104 @@
 # @refkit/provider-europeana
 
+## 0.5.0
+
+### Minor Changes
+
+- 4dfd41a: Accuracy and contract redesign: license **facts** drive every rights decision, providers
+  only describe what their source knows, and the default search path ranks for the query
+  without a host-supplied model.
+
+  These are **breaking** changes to the public surface. Every package is still `0.x`, so
+  they ship as `minor` per semver's pre-1.0 rule — nothing is aliased or shimmed, so read
+  the removed/added lists before upgrading.
+
+  ### Rights: facts, not license ids
+
+  - `LicenseId` is now an **open** string (`KnownLicenseId | (string & {})`); an id with no
+    row in `LICENSE_FACTS` resolves to the `unknown` row, which grants nothing.
+  - Added `RightsRecord.facts?: LicenseFacts` — a source whose terms are narrower than the
+    label it declares supplies its own row. Added `factsOf(rights)`, `licenseFactsSchema`,
+    `isKnownLicenseId`, `isIndeterminate`, `compareRestrictiveness(factsA, factsB)` and
+    `permissivenessScore(facts)`.
+  - **Removed** `stricterLicense(idA, idB)` (replaced by `compareRestrictiveness`) and the
+    reranker's internal `LICENSE_PERMISSIVENESS` table (replaced by `permissivenessScore`).
+  - Cross-source conflict detection is keyed on facts, not labels: identical facts under
+    different ids (`CC0-1.0` vs `PD`) no longer conflict, the same id with narrower facts
+    now does, and `RightsConflict.licenses` lists the source-declared ids involved.
+  - `rightsRecordSchema` now rejects a `licenseVersion` on a non-CC-family license.
+    `CC_VERSIONED_FAMILIES` and `ccVersionFor` moved from `provider-helpers` to `license`
+    (still exported from the package root).
+
+  ### Providers emit, core completes
+
+  - Added `EmittedReference` — what `ReferenceProvider.search` now returns:
+    `modality, kind?, title?, description?, tags?, sourceUrl, canonicalUrl?, rights,
+thumbnail?, preview?, perceptualHash?, visual?, text?, sourceScore?, raw?`. **Every
+    `@refkit/provider-*` factory's `search` signature changed accordingly.**
+  - Core stamps `id`, `source`, `canonicalUrl`, `verifiedAt` and `relevance` and applies the
+    per-provider `limit`: added `completeReference`, `parseEmitted`, `emittedReferenceSchema`.
+    Providers no longer compute ids, write provenance, or post-truncate.
+  - `Reference` and `EmittedReference` gained `description`, `tags: string[]` and
+    `sourceScore`. Met, Art Institute of Chicago, Wikimedia Commons and Rijksmuseum now
+    populate descriptive fields (and Art Institute also reports its upstream `_score`), which
+    directly sharpens ranking.
+  - Added `okJson(res, label)` for provider mappers, `plainText`, and
+    `RefkitOptions.userAgent` (`'refkit-client/1'` by default; Art Institute's edge rejects
+    Node's default UA) plus `withDefaultUserAgent`.
+
+  ### One search channel, one control registry
+
+  - **Removed** `SearchFilters`, `SearchInput.filters`, `NormalizedQuery.filters`,
+    `SearchMeta.appliedFilters`, `QueryFeature`, `ReferenceProvider.queryFeatures`, the legacy
+    feature→control routing, and the MCP `filters` parameter. Use `controls` /
+    `capabilities.controls`.
+  - Control types and the `key → path` registry moved to `controls.ts`; added `CONTROL_PATHS`,
+    `SEARCH_CONTROL_KEYS`, `getControl`, `setControl`, `hasControl`,
+    `buildSearchControlsSchema`, `searchControlsSchema`, `searchControlKeySchema`,
+    `searchMetaSchema`, `providerSearchStatusSchema` and the `MODALITIES` tuple to the public
+    surface — `@refkit/mcp` imports only `buildSearchControlsSchema` and `searchMetaSchema`
+    from core, and derives its modality enum from the registered providers rather than
+    keeping a local copy.
+  - Orchestrator stages are exported for testing and reuse: `selectProviders`,
+    `PROVIDER_SKIP_REASONS`, `runPass`, and `SearchMeta.passes` (per-pass latency, warnings
+    and rights conflicts now accumulate across cursor page advances).
+
+  ### Accuracy defaults
+
+  - **Source confidence** (`RefkitOptions.sourceConfidence`, default on, floor `0.1`) weights
+    each source's rank-fusion contribution by how much of its batch mentions the query; each
+    fulfilled source reports `meta.providers[].confidence`. Added `sourceConfidence` and
+    `lexicalHit`; `MergeOptions.weights` applies the weights.
+  - **Reranking is on by default**: `RefkitOptions.rerank` / `SearchInput.rerank` default to
+    `lexicalReranker()`, `false` returns raw fusion order. The lexical reranker now scores
+    over `title + description + tags + excerpt`, blends the incoming fused relevance
+    (`fusionWeight`, default `0.5`), and adds a same-source near-duplicate-title penalty
+    (`nearDuplicatePenalty`, `nearDuplicateThreshold`) and an optional `sourceScoreWeight`.
+    Added `refText` alongside `tokenize`. MCP's `rerank` parameter now defaults to true.
+  - **Relevance threshold**: `SearchInput.minRelevance` drops results the ranker scored below
+    the bar (after rerank, before the gate) and reports `SearchMeta.threshold`
+    (`SearchThresholdMeta`). New MCP `minRelevance` parameter. The bar is graded against the
+    reranker's blended score and does not transfer to `rerank: false`.
+  - **Query acceptance**: `ReferenceProvider.accepts?({ text, modalities })` lets a narrow
+    source decline queries it cannot answer — skipped with `reason: 'declined'`, bypassed by
+    an explicit `sources` whitelist, and an all-declined search returns an empty result
+    instead of throwing. `@refkit/provider-nailbook` declines queries that do not name nails;
+    `@refkit/provider-polyhaven` now matches each query token independently and ranks assets
+    by how many tokens they match.
+  - **Whole-search deadline and gate context**: `SearchInput.deadlineMs` (bounds the whole
+    call, cursor advances included) and `SearchInput.gateContext.userJurisdiction` (forwarded
+    to the search-time gate, matching `evaluateUse`). Both are exposed as MCP parameters.
+
+  The internal `@refkit/provider-testkit` (private, never published) dropped its id-prefix,
+  providerId and licenseVersion conformance rules — core now guarantees all three — and
+  completes emitted items exactly as the orchestrator does before asserting the rules that
+  remain a satellite's own responsibility.
+
+### Patch Changes
+
+- Updated dependencies [4dfd41a]
+  - @refkit/core@0.9.0
+
 ## 0.4.0
 
 ### Minor Changes
diff --git a/packages/provider-europeana/package.json b/packages/provider-europeana/package.json
index 4a3e27d..90df616 100644
--- a/packages/provider-europeana/package.json
+++ b/packages/provider-europeana/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@refkit/provider-europeana",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "Europeana provider satellite for refkit.",
   "type": "module",
   "license": "Apache-2.0",
diff --git a/packages/provider-flickr/CHANGELOG.md b/packages/provider-flickr/CHANGELOG.md
index eca957a..8c09916 100644
--- a/packages/provider-flickr/CHANGELOG.md
+++ b/packages/provider-flickr/CHANGELOG.md
@@ -1,5 +1,104 @@
 # @refkit/provider-flickr
 
+## 0.5.0
+
+### Minor Changes
+
+- 4dfd41a: Accuracy and contract redesign: license **facts** drive every rights decision, providers
+  only describe what their source knows, and the default search path ranks for the query
+  without a host-supplied model.
+
+  These are **breaking** changes to the public surface. Every package is still `0.x`, so
+  they ship as `minor` per semver's pre-1.0 rule — nothing is aliased or shimmed, so read
+  the removed/added lists before upgrading.
+
+  ### Rights: facts, not license ids
+
+  - `LicenseId` is now an **open** string (`KnownLicenseId | (string & {})`); an id with no
+    row in `LICENSE_FACTS` resolves to the `unknown` row, which grants nothing.
+  - Added `RightsRecord.facts?: LicenseFacts` — a source whose terms are narrower than the
+    label it declares supplies its own row. Added `factsOf(rights)`, `licenseFactsSchema`,
+    `isKnownLicenseId`, `isIndeterminate`, `compareRestrictiveness(factsA, factsB)` and
+    `permissivenessScore(facts)`.
+  - **Removed** `stricterLicense(idA, idB)` (replaced by `compareRestrictiveness`) and the
+    reranker's internal `LICENSE_PERMISSIVENESS` table (replaced by `permissivenessScore`).
+  - Cross-source conflict detection is keyed on facts, not labels: identical facts under
+    different ids (`CC0-1.0` vs `PD`) no longer conflict, the same id with narrower facts
+    now does, and `RightsConflict.licenses` lists the source-declared ids involved.
+  - `rightsRecordSchema` now rejects a `licenseVersion` on a non-CC-family license.
+    `CC_VERSIONED_FAMILIES` and `ccVersionFor` moved from `provider-helpers` to `license`
+    (still exported from the package root).
+
+  ### Providers emit, core completes
+
+  - Added `EmittedReference` — what `ReferenceProvider.search` now returns:
+    `modality, kind?, title?, description?, tags?, sourceUrl, canonicalUrl?, rights,
+thumbnail?, preview?, perceptualHash?, visual?, text?, sourceScore?, raw?`. **Every
+    `@refkit/provider-*` factory's `search` signature changed accordingly.**
+  - Core stamps `id`, `source`, `canonicalUrl`, `verifiedAt` and `relevance` and applies the
+    per-provider `limit`: added `completeReference`, `parseEmitted`, `emittedReferenceSchema`.
+    Providers no longer compute ids, write provenance, or post-truncate.
+  - `Reference` and `EmittedReference` gained `description`, `tags: string[]` and
+    `sourceScore`. Met, Art Institute of Chicago, Wikimedia Commons and Rijksmuseum now
+    populate descriptive fields (and Art Institute also reports its upstream `_score`), which
+    directly sharpens ranking.
+  - Added `okJson(res, label)` for provider mappers, `plainText`, and
+    `RefkitOptions.userAgent` (`'refkit-client/1'` by default; Art Institute's edge rejects
+    Node's default UA) plus `withDefaultUserAgent`.
+
+  ### One search channel, one control registry
+
+  - **Removed** `SearchFilters`, `SearchInput.filters`, `NormalizedQuery.filters`,
+    `SearchMeta.appliedFilters`, `QueryFeature`, `ReferenceProvider.queryFeatures`, the legacy
+    feature→control routing, and the MCP `filters` parameter. Use `controls` /
+    `capabilities.controls`.
+  - Control types and the `key → path` registry moved to `controls.ts`; added `CONTROL_PATHS`,
+    `SEARCH_CONTROL_KEYS`, `getControl`, `setControl`, `hasControl`,
+    `buildSearchControlsSchema`, `searchControlsSchema`, `searchControlKeySchema`,
+    `searchMetaSchema`, `providerSearchStatusSchema` and the `MODALITIES` tuple to the public
+    surface — `@refkit/mcp` imports only `buildSearchControlsSchema` and `searchMetaSchema`
+    from core, and derives its modality enum from the registered providers rather than
+    keeping a local copy.
+  - Orchestrator stages are exported for testing and reuse: `selectProviders`,
+    `PROVIDER_SKIP_REASONS`, `runPass`, and `SearchMeta.passes` (per-pass latency, warnings
+    and rights conflicts now accumulate across cursor page advances).
+
+  ### Accuracy defaults
+
+  - **Source confidence** (`RefkitOptions.sourceConfidence`, default on, floor `0.1`) weights
+    each source's rank-fusion contribution by how much of its batch mentions the query; each
+    fulfilled source reports `meta.providers[].confidence`. Added `sourceConfidence` and
+    `lexicalHit`; `MergeOptions.weights` applies the weights.
+  - **Reranking is on by default**: `RefkitOptions.rerank` / `SearchInput.rerank` default to
+    `lexicalReranker()`, `false` returns raw fusion order. The lexical reranker now scores
+    over `title + description + tags + excerpt`, blends the incoming fused relevance
+    (`fusionWeight`, default `0.5`), and adds a same-source near-duplicate-title penalty
+    (`nearDuplicatePenalty`, `nearDuplicateThreshold`) and an optional `sourceScoreWeight`.
+    Added `refText` alongside `tokenize`. MCP's `rerank` parameter now defaults to true.
+  - **Relevance threshold**: `SearchInput.minRelevance` drops results the ranker scored below
+    the bar (after rerank, before the gate) and reports `SearchMeta.threshold`
+    (`SearchThresholdMeta`). New MCP `minRelevance` parameter. The bar is graded against the
+    reranker's blended score and does not transfer to `rerank: false`.
+  - **Query acceptance**: `ReferenceProvider.accepts?({ text, modalities })` lets a narrow
+    source decline queries it cannot answer — skipped with `reason: 'declined'`, bypassed by
+    an explicit `sources` whitelist, and an all-declined search returns an empty result
+    instead of throwing. `@refkit/provider-nailbook` declines queries that do not name nails;
+    `@refkit/provider-polyhaven` now matches each query token independently and ranks assets
+    by how many tokens they match.
+  - **Whole-search deadline and gate context**: `SearchInput.deadlineMs` (bounds the whole
+    call, cursor advances included) and `SearchInput.gateContext.userJurisdiction` (forwarded
+    to the search-time gate, matching `evaluateUse`). Both are exposed as MCP parameters.
+
+  The internal `@refkit/provider-testkit` (private, never published) dropped its id-prefix,
+  providerId and licenseVersion conformance rules — core now guarantees all three — and
+  completes emitted items exactly as the orchestrator does before asserting the rules that
+  remain a satellite's own responsibility.
+
+### Patch Changes
+
+- Updated dependencies [4dfd41a]
+  - @refkit/core@0.9.0
+
 ## 0.4.0
 
 ### Minor Changes
diff --git a/packages/provider-flickr/package.json b/packages/provider-flickr/package.json
index 5d002a4..6871f61 100644
--- a/packages/provider-flickr/package.json
+++ b/packages/provider-flickr/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@refkit/provider-flickr",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "Flickr provider satellite for refkit.",
   "type": "module",
   "license": "Apache-2.0",
diff --git a/packages/provider-freesound/CHANGELOG.md b/packages/provider-freesound/CHANGELOG.md
index 55cd88d..4a83e6b 100644
--- a/packages/provider-freesound/CHANGELOG.md
+++ b/packages/provider-freesound/CHANGELOG.md
@@ -1,5 +1,104 @@
 # @refkit/provider-freesound
 
+## 0.5.0
+
+### Minor Changes
+
+- 4dfd41a: Accuracy and contract redesign: license **facts** drive every rights decision, providers
+  only describe what their source knows, and the default search path ranks for the query
+  without a host-supplied model.
+
+  These are **breaking** changes to the public surface. Every package is still `0.x`, so
+  they ship as `minor` per semver's pre-1.0 rule — nothing is aliased or shimmed, so read
+  the removed/added lists before upgrading.
+
+  ### Rights: facts, not license ids
+
+  - `LicenseId` is now an **open** string (`KnownLicenseId | (string & {})`); an id with no
+    row in `LICENSE_FACTS` resolves to the `unknown` row, which grants nothing.
+  - Added `RightsRecord.facts?: LicenseFacts` — a source whose terms are narrower than the
+    label it declares supplies its own row. Added `factsOf(rights)`, `licenseFactsSchema`,
+    `isKnownLicenseId`, `isIndeterminate`, `compareRestrictiveness(factsA, factsB)` and
+    `permissivenessScore(facts)`.
+  - **Removed** `stricterLicense(idA, idB)` (replaced by `compareRestrictiveness`) and the
+    reranker's internal `LICENSE_PERMISSIVENESS` table (replaced by `permissivenessScore`).
+  - Cross-source conflict detection is keyed on facts, not labels: identical facts under
+    different ids (`CC0-1.0` vs `PD`) no longer conflict, the same id with narrower facts
+    now does, and `RightsConflict.licenses` lists the source-declared ids involved.
+  - `rightsRecordSchema` now rejects a `licenseVersion` on a non-CC-family license.
+    `CC_VERSIONED_FAMILIES` and `ccVersionFor` moved from `provider-helpers` to `license`
+    (still exported from the package root).
+
+  ### Providers emit, core completes
+
+  - Added `EmittedReference` — what `ReferenceProvider.search` now returns:
+    `modality, kind?, title?, description?, tags?, sourceUrl, canonicalUrl?, rights,
+thumbnail?, preview?, perceptualHash?, visual?, text?, sourceScore?, raw?`. **Every
+    `@refkit/provider-*` factory's `search` signature changed accordingly.**
+  - Core stamps `id`, `source`, `canonicalUrl`, `verifiedAt` and `relevance` and applies the
+    per-provider `limit`: added `completeReference`, `parseEmitted`, `emittedReferenceSchema`.
+    Providers no longer compute ids, write provenance, or post-truncate.
+  - `Reference` and `EmittedReference` gained `description`, `tags: string[]` and
+    `sourceScore`. Met, Art Institute of Chicago, Wikimedia Commons and Rijksmuseum now
+    populate descriptive fields (and Art Institute also reports its upstream `_score`), which
+    directly sharpens ranking.
+  - Added `okJson(res, label)` for provider mappers, `plainText`, and
+    `RefkitOptions.userAgent` (`'refkit-client/1'` by default; Art Institute's edge rejects
+    Node's default UA) plus `withDefaultUserAgent`.
+
+  ### One search channel, one control registry
+
+  - **Removed** `SearchFilters`, `SearchInput.filters`, `NormalizedQuery.filters`,
+    `SearchMeta.appliedFilters`, `QueryFeature`, `ReferenceProvider.queryFeatures`, the legacy
+    feature→control routing, and the MCP `filters` parameter. Use `controls` /
+    `capabilities.controls`.
+  - Control types and the `key → path` registry moved to `controls.ts`; added `CONTROL_PATHS`,
+    `SEARCH_CONTROL_KEYS`, `getControl`, `setControl`, `hasControl`,
+    `buildSearchControlsSchema`, `searchControlsSchema`, `searchControlKeySchema`,
+    `searchMetaSchema`, `providerSearchStatusSchema` and the `MODALITIES` tuple to the public
+    surface — `@refkit/mcp` imports only `buildSearchControlsSchema` and `searchMetaSchema`
+    from core, and derives its modality enum from the registered providers rather than
+    keeping a local copy.
+  - Orchestrator stages are exported for testing and reuse: `selectProviders`,
+    `PROVIDER_SKIP_REASONS`, `runPass`, and `SearchMeta.passes` (per-pass latency, warnings
+    and rights conflicts now accumulate across cursor page advances).
+
+  ### Accuracy defaults
+
+  - **Source confidence** (`RefkitOptions.sourceConfidence`, default on, floor `0.1`) weights
+    each source's rank-fusion contribution by how much of its batch mentions the query; each
+    fulfilled source reports `meta.providers[].confidence`. Added `sourceConfidence` and
+    `lexicalHit`; `MergeOptions.weights` applies the weights.
+  - **Reranking is on by default**: `RefkitOptions.rerank` / `SearchInput.rerank` default to
+    `lexicalReranker()`, `false` returns raw fusion order. The lexical reranker now scores
+    over `title + description + tags + excerpt`, blends the incoming fused relevance
+    (`fusionWeight`, default `0.5`), and adds a same-source near-duplicate-title penalty
+    (`nearDuplicatePenalty`, `nearDuplicateThreshold`) and an optional `sourceScoreWeight`.
+    Added `refText` alongside `tokenize`. MCP's `rerank` parameter now defaults to true.
+  - **Relevance threshold**: `SearchInput.minRelevance` drops results the ranker scored below
+    the bar (after rerank, before the gate) and reports `SearchMeta.threshold`
+    (`SearchThresholdMeta`). New MCP `minRelevance` parameter. The bar is graded against the
+    reranker's blended score and does not transfer to `rerank: false`.
+  - **Query acceptance**: `ReferenceProvider.accepts?({ text, modalities })` lets a narrow
+    source decline queries it cannot answer — skipped with `reason: 'declined'`, bypassed by
+    an explicit `sources` whitelist, and an all-declined search returns an empty result
+    instead of throwing. `@refkit/provider-nailbook` declines queries that do not name nails;
+    `@refkit/provider-polyhaven` now matches each query token independently and ranks assets
+    by how many tokens they match.
+  - **Whole-search deadline and gate context**: `SearchInput.deadlineMs` (bounds the whole
+    call, cursor advances included) and `SearchInput.gateContext.userJurisdiction` (forwarded
+    to the search-time gate, matching `evaluateUse`). Both are exposed as MCP parameters.
+
+  The internal `@refkit/provider-testkit` (private, never published) dropped its id-prefix,
+  providerId and licenseVersion conformance rules — core now guarantees all three — and
+  completes emitted items exactly as the orchestrator does before asserting the rules that
+  remain a satellite's own responsibility.
+
+### Patch Changes
+
+- Updated dependencies [4dfd41a]
+  - @refkit/core@0.9.0
+
 ## 0.4.0
 
 ### Minor Changes
diff --git a/packages/provider-freesound/package.json b/packages/provider-freesound/package.json
index a71de9e..c2bb3b8 100644
--- a/packages/provider-freesound/package.json
+++ b/packages/provider-freesound/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@refkit/provider-freesound",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "Freesound provider satellite for refkit.",
   "type": "module",
   "license": "Apache-2.0",
diff --git a/packages/provider-gutendex/CHANGELOG.md b/packages/provider-gutendex/CHANGELOG.md
index 9e02535..616d02c 100644
--- a/packages/provider-gutendex/CHANGELOG.md
+++ b/packages/provider-gutendex/CHANGELOG.md
@@ -1,5 +1,104 @@
 # @refkit/provider-gutendex
 
+## 0.4.0
+
+### Minor Changes
+
+- 4dfd41a: Accuracy and contract redesign: license **facts** drive every rights decision, providers
+  only describe what their source knows, and the default search path ranks for the query
+  without a host-supplied model.
+
+  These are **breaking** changes to the public surface. Every package is still `0.x`, so
+  they ship as `minor` per semver's pre-1.0 rule — nothing is aliased or shimmed, so read
+  the removed/added lists before upgrading.
+
+  ### Rights: facts, not license ids
+
+  - `LicenseId` is now an **open** string (`KnownLicenseId | (string & {})`); an id with no
+    row in `LICENSE_FACTS` resolves to the `unknown` row, which grants nothing.
+  - Added `RightsRecord.facts?: LicenseFacts` — a source whose terms are narrower than the
+    label it declares supplies its own row. Added `factsOf(rights)`, `licenseFactsSchema`,
+    `isKnownLicenseId`, `isIndeterminate`, `compareRestrictiveness(factsA, factsB)` and
+    `permissivenessScore(facts)`.
+  - **Removed** `stricterLicense(idA, idB)` (replaced by `compareRestrictiveness`) and the
+    reranker's internal `LICENSE_PERMISSIVENESS` table (replaced by `permissivenessScore`).
+  - Cross-source conflict detection is keyed on facts, not labels: identical facts under
+    different ids (`CC0-1.0` vs `PD`) no longer conflict, the same id with narrower facts
+    now does, and `RightsConflict.licenses` lists the source-declared ids involved.
+  - `rightsRecordSchema` now rejects a `licenseVersion` on a non-CC-family license.
+    `CC_VERSIONED_FAMILIES` and `ccVersionFor` moved from `provider-helpers` to `license`
+    (still exported from the package root).
+
+  ### Providers emit, core completes
+
+  - Added `EmittedReference` — what `ReferenceProvider.search` now returns:
+    `modality, kind?, title?, description?, tags?, sourceUrl, canonicalUrl?, rights,
+thumbnail?, preview?, perceptualHash?, visual?, text?, sourceScore?, raw?`. **Every
+    `@refkit/provider-*` factory's `search` signature changed accordingly.**
+  - Core stamps `id`, `source`, `canonicalUrl`, `verifiedAt` and `relevance` and applies the
+    per-provider `limit`: added `completeReference`, `parseEmitted`, `emittedReferenceSchema`.
+    Providers no longer compute ids, write provenance, or post-truncate.
+  - `Reference` and `EmittedReference` gained `description`, `tags: string[]` and
+    `sourceScore`. Met, Art Institute of Chicago, Wikimedia Commons and Rijksmuseum now
+    populate descriptive fields (and Art Institute also reports its upstream `_score`), which
+    directly sharpens ranking.
+  - Added `okJson(res, label)` for provider mappers, `plainText`, and
+    `RefkitOptions.userAgent` (`'refkit-client/1'` by default; Art Institute's edge rejects
+    Node's default UA) plus `withDefaultUserAgent`.
+
+  ### One search channel, one control registry
+
+  - **Removed** `SearchFilters`, `SearchInput.filters`, `NormalizedQuery.filters`,
+    `SearchMeta.appliedFilters`, `QueryFeature`, `ReferenceProvider.queryFeatures`, the legacy
+    feature→control routing, and the MCP `filters` parameter. Use `controls` /
+    `capabilities.controls`.
+  - Control types and the `key → path` registry moved to `controls.ts`; added `CONTROL_PATHS`,
+    `SEARCH_CONTROL_KEYS`, `getControl`, `setControl`, `hasControl`,
+    `buildSearchControlsSchema`, `searchControlsSchema`, `searchControlKeySchema`,
+    `searchMetaSchema`, `providerSearchStatusSchema` and the `MODALITIES` tuple to the public
+    surface — `@refkit/mcp` imports only `buildSearchControlsSchema` and `searchMetaSchema`
+    from core, and derives its modality enum from the registered providers rather than
+    keeping a local copy.
+  - Orchestrator stages are exported for testing and reuse: `selectProviders`,
+    `PROVIDER_SKIP_REASONS`, `runPass`, and `SearchMeta.passes` (per-pass latency, warnings
+    and rights conflicts now accumulate across cursor page advances).
+
+  ### Accuracy defaults
+
+  - **Source confidence** (`RefkitOptions.sourceConfidence`, default on, floor `0.1`) weights
+    each source's rank-fusion contribution by how much of its batch mentions the query; each
+    fulfilled source reports `meta.providers[].confidence`. Added `sourceConfidence` and
+    `lexicalHit`; `MergeOptions.weights` applies the weights.
+  - **Reranking is on by default**: `RefkitOptions.rerank` / `SearchInput.rerank` default to
+    `lexicalReranker()`, `false` returns raw fusion order. The lexical reranker now scores
+    over `title + description + tags + excerpt`, blends the incoming fused relevance
+    (`fusionWeight`, default `0.5`), and adds a same-source near-duplicate-title penalty
+    (`nearDuplicatePenalty`, `nearDuplicateThreshold`) and an optional `sourceScoreWeight`.
+    Added `refText` alongside `tokenize`. MCP's `rerank` parameter now defaults to true.
+  - **Relevance threshold**: `SearchInput.minRelevance` drops results the ranker scored below
+    the bar (after rerank, before the gate) and reports `SearchMeta.threshold`
+    (`SearchThresholdMeta`). New MCP `minRelevance` parameter. The bar is graded against the
+    reranker's blended score and does not transfer to `rerank: false`.
+  - **Query acceptance**: `ReferenceProvider.accepts?({ text, modalities })` lets a narrow
+    source decline queries it cannot answer — skipped with `reason: 'declined'`, bypassed by
+    an explicit `sources` whitelist, and an all-declined search returns an empty result
+    instead of throwing. `@refkit/provider-nailbook` declines queries that do not name nails;
+    `@refkit/provider-polyhaven` now matches each query token independently and ranks assets
+    by how many tokens they match.
+  - **Whole-search deadline and gate context**: `SearchInput.deadlineMs` (bounds the whole
+    call, cursor advances included) and `SearchInput.gateContext.userJurisdiction` (forwarded
+    to the search-time gate, matching `evaluateUse`). Both are exposed as MCP parameters.
+
+  The internal `@refkit/provider-testkit` (private, never published) dropped its id-prefix,
+  providerId and licenseVersion conformance rules — core now guarantees all three — and
+  completes emitted items exactly as the orchestrator does before asserting the rules that
+  remain a satellite's own responsibility.
+
+### Patch Changes
+
+- Updated dependencies [4dfd41a]
+  - @refkit/core@0.9.0
+
 ## 0.3.0
 
 ### Minor Changes
diff --git a/packages/provider-gutendex/package.json b/packages/provider-gutendex/package.json
index b088037..07470ee 100644
--- a/packages/provider-gutendex/package.json
+++ b/packages/provider-gutendex/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@refkit/provider-gutendex",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "Gutendex (Project Gutenberg) provider satellite for refkit — public-domain book references, per-item copyright→license.",
   "type": "module",
   "license": "Apache-2.0",
diff --git a/packages/provider-internet-archive/CHANGELOG.md b/packages/provider-internet-archive/CHANGELOG.md
index 415b59d..164a39a 100644
--- a/packages/provider-internet-archive/CHANGELOG.md
+++ b/packages/provider-internet-archive/CHANGELOG.md
@@ -1,5 +1,104 @@
 # @refkit/provider-internet-archive
 
+## 0.5.0
+
+### Minor Changes
+
+- 4dfd41a: Accuracy and contract redesign: license **facts** drive every rights decision, providers
+  only describe what their source knows, and the default search path ranks for the query
+  without a host-supplied model.
+
+  These are **breaking** changes to the public surface. Every package is still `0.x`, so
+  they ship as `minor` per semver's pre-1.0 rule — nothing is aliased or shimmed, so read
+  the removed/added lists before upgrading.
+
+  ### Rights: facts, not license ids
+
+  - `LicenseId` is now an **open** string (`KnownLicenseId | (string & {})`); an id with no
+    row in `LICENSE_FACTS` resolves to the `unknown` row, which grants nothing.
+  - Added `RightsRecord.facts?: LicenseFacts` — a source whose terms are narrower than the
+    label it declares supplies its own row. Added `factsOf(rights)`, `licenseFactsSchema`,
+    `isKnownLicenseId`, `isIndeterminate`, `compareRestrictiveness(factsA, factsB)` and
+    `permissivenessScore(facts)`.
+  - **Removed** `stricterLicense(idA, idB)` (replaced by `compareRestrictiveness`) and the
+    reranker's internal `LICENSE_PERMISSIVENESS` table (replaced by `permissivenessScore`).
+  - Cross-source conflict detection is keyed on facts, not labels: identical facts under
+    different ids (`CC0-1.0` vs `PD`) no longer conflict, the same id with narrower facts
+    now does, and `RightsConflict.licenses` lists the source-declared ids involved.
+  - `rightsRecordSchema` now rejects a `licenseVersion` on a non-CC-family license.
+    `CC_VERSIONED_FAMILIES` and `ccVersionFor` moved from `provider-helpers` to `license`
+    (still exported from the package root).
+
+  ### Providers emit, core completes
+
+  - Added `EmittedReference` — what `ReferenceProvider.search` now returns:
+    `modality, kind?, title?, description?, tags?, sourceUrl, canonicalUrl?, rights,
+thumbnail?, preview?, perceptualHash?, visual?, text?, sourceScore?, raw?`. **Every
+    `@refkit/provider-*` factory's `search` signature changed accordingly.**
+  - Core stamps `id`, `source`, `canonicalUrl`, `verifiedAt` and `relevance` and applies the
+    per-provider `limit`: added `completeReference`, `parseEmitted`, `emittedReferenceSchema`.
+    Providers no longer compute ids, write provenance, or post-truncate.
+  - `Reference` and `EmittedReference` gained `description`, `tags: string[]` and
+    `sourceScore`. Met, Art Institute of Chicago, Wikimedia Commons and Rijksmuseum now
+    populate descriptive fields (and Art Institute also reports its upstream `_score`), which
+    directly sharpens ranking.
+  - Added `okJson(res, label)` for provider mappers, `plainText`, and
+    `RefkitOptions.userAgent` (`'refkit-client/1'` by default; Art Institute's edge rejects
+    Node's default UA) plus `withDefaultUserAgent`.
+
+  ### One search channel, one control registry
+
+  - **Removed** `SearchFilters`, `SearchInput.filters`, `NormalizedQuery.filters`,
+    `SearchMeta.appliedFilters`, `QueryFeature`, `ReferenceProvider.queryFeatures`, the legacy
+    feature→control routing, and the MCP `filters` parameter. Use `controls` /
+    `capabilities.controls`.
+  - Control types and the `key → path` registry moved to `controls.ts`; added `CONTROL_PATHS`,
+    `SEARCH_CONTROL_KEYS`, `getControl`, `setControl`, `hasControl`,
+    `buildSearchControlsSchema`, `searchControlsSchema`, `searchControlKeySchema`,
+    `searchMetaSchema`, `providerSearchStatusSchema` and the `MODALITIES` tuple to the public
+    surface — `@refkit/mcp` imports only `buildSearchControlsSchema` and `searchMetaSchema`
+    from core, and derives its modality enum from the registered providers rather than
+    keeping a local copy.
+  - Orchestrator stages are exported for testing and reuse: `selectProviders`,
+    `PROVIDER_SKIP_REASONS`, `runPass`, and `SearchMeta.passes` (per-pass latency, warnings
+    and rights conflicts now accumulate across cursor page advances).
+
+  ### Accuracy defaults
+
+  - **Source confidence** (`RefkitOptions.sourceConfidence`, default on, floor `0.1`) weights
+    each source's rank-fusion contribution by how much of its batch mentions the query; each
+    fulfilled source reports `meta.providers[].confidence`. Added `sourceConfidence` and
+    `lexicalHit`; `MergeOptions.weights` applies the weights.
+  - **Reranking is on by default**: `RefkitOptions.rerank` / `SearchInput.rerank` default to
+    `lexicalReranker()`, `false` returns raw fusion order. The lexical reranker now scores
+    over `title + description + tags + excerpt`, blends the incoming fused relevance
+    (`fusionWeight`, default `0.5`), and adds a same-source near-duplicate-title penalty
+    (`nearDuplicatePenalty`, `nearDuplicateThreshold`) and an optional `sourceScoreWeight`.
+    Added `refText` alongside `tokenize`. MCP's `rerank` parameter now defaults to true.
+  - **Relevance threshold**: `SearchInput.minRelevance` drops results the ranker scored below
+    the bar (after rerank, before the gate) and reports `SearchMeta.threshold`
+    (`SearchThresholdMeta`). New MCP `minRelevance` parameter. The bar is graded against the
+    reranker's blended score and does not transfer to `rerank: false`.
+  - **Query acceptance**: `ReferenceProvider.accepts?({ text, modalities })` lets a narrow
+    source decline queries it cannot answer — skipped with `reason: 'declined'`, bypassed by
+    an explicit `sources` whitelist, and an all-declined search returns an empty result
+    instead of throwing. `@refkit/provider-nailbook` declines queries that do not name nails;
+    `@refkit/provider-polyhaven` now matches each query token independently and ranks assets
+    by how many tokens they match.
+  - **Whole-search deadline and gate context**: `SearchInput.deadlineMs` (bounds the whole
+    call, cursor advances included) and `SearchInput.gateContext.userJurisdiction` (forwarded
+    to the search-time gate, matching `evaluateUse`). Both are exposed as MCP parameters.
+
+  The internal `@refkit/provider-testkit` (private, never published) dropped its id-prefix,
+  providerId and licenseVersion conformance rules — core now guarantees all three — and
+  completes emitted items exactly as the orchestrator does before asserting the rules that
+  remain a satellite's own responsibility.
+
+### Patch Changes
+
+- Updated dependencies [4dfd41a]
+  - @refkit/core@0.9.0
+
 ## 0.4.0
 
 ### Minor Changes
diff --git a/packages/provider-internet-archive/package.json b/packages/provider-internet-archive/package.json
index 605978a..3e02fed 100644
--- a/packages/provider-internet-archive/package.json
+++ b/packages/provider-internet-archive/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@refkit/provider-internet-archive",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "Internet Archive provider satellite for refkit.",
   "type": "module",
   "license": "Apache-2.0",
diff --git a/packages/provider-jamendo/CHANGELOG.md b/packages/provider-jamendo/CHANGELOG.md
index 11cfa2f..8d86152 100644
--- a/packages/provider-jamendo/CHANGELOG.md
+++ b/packages/provider-jamendo/CHANGELOG.md
@@ -1,5 +1,104 @@
 # @refkit/provider-jamendo
 
+## 0.5.0
+
+### Minor Changes
+
+- 4dfd41a: Accuracy and contract redesign: license **facts** drive every rights decision, providers
+  only describe what their source knows, and the default search path ranks for the query
+  without a host-supplied model.
+
+  These are **breaking** changes to the public surface. Every package is still `0.x`, so
+  they ship as `minor` per semver's pre-1.0 rule — nothing is aliased or shimmed, so read
+  the removed/added lists before upgrading.
+
+  ### Rights: facts, not license ids
+
+  - `LicenseId` is now an **open** string (`KnownLicenseId | (string & {})`); an id with no
+    row in `LICENSE_FACTS` resolves to the `unknown` row, which grants nothing.
+  - Added `RightsRecord.facts?: LicenseFacts` — a source whose terms are narrower than the
+    label it declares supplies its own row. Added `factsOf(rights)`, `licenseFactsSchema`,
+    `isKnownLicenseId`, `isIndeterminate`, `compareRestrictiveness(factsA, factsB)` and
+    `permissivenessScore(facts)`.
+  - **Removed** `stricterLicense(idA, idB)` (replaced by `compareRestrictiveness`) and the
+    reranker's internal `LICENSE_PERMISSIVENESS` table (replaced by `permissivenessScore`).
+  - Cross-source conflict detection is keyed on facts, not labels: identical facts under
+    different ids (`CC0-1.0` vs `PD`) no longer conflict, the same id with narrower facts
+    now does, and `RightsConflict.licenses` lists the source-declared ids involved.
+  - `rightsRecordSchema` now rejects a `licenseVersion` on a non-CC-family license.
+    `CC_VERSIONED_FAMILIES` and `ccVersionFor` moved from `provider-helpers` to `license`
+    (still exported from the package root).
+
+  ### Providers emit, core completes
+
+  - Added `EmittedReference` — what `ReferenceProvider.search` now returns:
+    `modality, kind?, title?, description?, tags?, sourceUrl, canonicalUrl?, rights,
+thumbnail?, preview?, perceptualHash?, visual?, text?, sourceScore?, raw?`. **Every
+    `@refkit/provider-*` factory's `search` signature changed accordingly.**
+  - Core stamps `id`, `source`, `canonicalUrl`, `verifiedAt` and `relevance` and applies the
+    per-provider `limit`: added `completeReference`, `parseEmitted`, `emittedReferenceSchema`.
+    Providers no longer compute ids, write provenance, or post-truncate.
+  - `Reference` and `EmittedReference` gained `description`, `tags: string[]` and
+    `sourceScore`. Met, Art Institute of Chicago, Wikimedia Commons and Rijksmuseum now
+    populate descriptive fields (and Art Institute also reports its upstream `_score`), which
+    directly sharpens ranking.
+  - Added `okJson(res, label)` for provider mappers, `plainText`, and
+    `RefkitOptions.userAgent` (`'refkit-client/1'` by default; Art Institute's edge rejects
+    Node's default UA) plus `withDefaultUserAgent`.
+
+  ### One search channel, one control registry
+
+  - **Removed** `SearchFilters`, `SearchInput.filters`, `NormalizedQuery.filters`,
+    `SearchMeta.appliedFilters`, `QueryFeature`, `ReferenceProvider.queryFeatures`, the legacy
+    feature→control routing, and the MCP `filters` parameter. Use `controls` /
+    `capabilities.controls`.
+  - Control types and the `key → path` registry moved to `controls.ts`; added `CONTROL_PATHS`,
+    `SEARCH_CONTROL_KEYS`, `getControl`, `setControl`, `hasControl`,
+    `buildSearchControlsSchema`, `searchControlsSchema`, `searchControlKeySchema`,
+    `searchMetaSchema`, `providerSearchStatusSchema` and the `MODALITIES` tuple to the public
+    surface — `@refkit/mcp` imports only `buildSearchControlsSchema` and `searchMetaSchema`
+    from core, and derives its modality enum from the registered providers rather than
+    keeping a local copy.
+  - Orchestrator stages are exported for testing and reuse: `selectProviders`,
+    `PROVIDER_SKIP_REASONS`, `runPass`, and `SearchMeta.passes` (per-pass latency, warnings
+    and rights conflicts now accumulate across cursor page advances).
+
+  ### Accuracy defaults
+
+  - **Source confidence** (`RefkitOptions.sourceConfidence`, default on, floor `0.1`) weights
+    each source's rank-fusion contribution by how much of its batch mentions the query; each
+    fulfilled source reports `meta.providers[].confidence`. Added `sourceConfidence` and
+    `lexicalHit`; `MergeOptions.weights` applies the weights.
+  - **Reranking is on by default**: `RefkitOptions.rerank` / `SearchInput.rerank` default to
+    `lexicalReranker()`, `false` returns raw fusion order. The lexical reranker now scores
+    over `title + description + tags + excerpt`, blends the incoming fused relevance
+    (`fusionWeight`, default `0.5`), and adds a same-source near-duplicate-title penalty
+    (`nearDuplicatePenalty`, `nearDuplicateThreshold`) and an optional `sourceScoreWeight`.
+    Added `refText` alongside `tokenize`. MCP's `rerank` parameter now defaults to true.
+  - **Relevance threshold**: `SearchInput.minRelevance` drops results the ranker scored below
+    the bar (after rerank, before the gate) and reports `SearchMeta.threshold`
+    (`SearchThresholdMeta`). New MCP `minRelevance` parameter. The bar is graded against the
+    reranker's blended score and does not transfer to `rerank: false`.
+  - **Query acceptance**: `ReferenceProvider.accepts?({ text, modalities })` lets a narrow
+    source decline queries it cannot answer — skipped with `reason: 'declined'`, bypassed by
+    an explicit `sources` whitelist, and an all-declined search returns an empty result
+    instead of throwing. `@refkit/provider-nailbook` declines queries that do not name nails;
+    `@refkit/provider-polyhaven` now matches each query token independently and ranks assets
+    by how many tokens they match.
+  - **Whole-search deadline and gate context**: `SearchInput.deadlineMs` (bounds the whole
+    call, cursor advances included) and `SearchInput.gateContext.userJurisdiction` (forwarded
+    to the search-time gate, matching `evaluateUse`). Both are exposed as MCP parameters.
+
+  The internal `@refkit/provider-testkit` (private, never published) dropped its id-prefix,
+  providerId and licenseVersion conformance rules — core now guarantees all three — and
+  completes emitted items exactly as the orchestrator does before asserting the rules that
+  remain a satellite's own responsibility.
+
+### Patch Changes
+
+- Updated dependencies [4dfd41a]
+  - @refkit/core@0.9.0
+
 ## 0.4.0
 
 ### Minor Changes
diff --git a/packages/provider-jamendo/package.json b/packages/provider-jamendo/package.json
index 5dcc0d1..b90f20e 100644
--- a/packages/provider-jamendo/package.json
+++ b/packages/provider-jamendo/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@refkit/provider-jamendo",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "Jamendo provider satellite for refkit.",
   "type": "module",
   "license": "Apache-2.0",
diff --git a/packages/provider-met/CHANGELOG.md b/packages/provider-met/CHANGELOG.md
index f8ff021..1c953ea 100644
--- a/packages/provider-met/CHANGELOG.md
+++ b/packages/provider-met/CHANGELOG.md
@@ -1,5 +1,104 @@
 # @refkit/provider-met
 
+## 0.4.0
+
+### Minor Changes
+
+- 4dfd41a: Accuracy and contract redesign: license **facts** drive every rights decision, providers
+  only describe what their source knows, and the default search path ranks for the query
+  without a host-supplied model.
+
+  These are **breaking** changes to the public surface. Every package is still `0.x`, so
+  they ship as `minor` per semver's pre-1.0 rule — nothing is aliased or shimmed, so read
+  the removed/added lists before upgrading.
+
+  ### Rights: facts, not license ids
+
+  - `LicenseId` is now an **open** string (`KnownLicenseId | (string & {})`); an id with no
+    row in `LICENSE_FACTS` resolves to the `unknown` row, which grants nothing.
+  - Added `RightsRecord.facts?: LicenseFacts` — a source whose terms are narrower than the
+    label it declares supplies its own row. Added `factsOf(rights)`, `licenseFactsSchema`,
+    `isKnownLicenseId`, `isIndeterminate`, `compareRestrictiveness(factsA, factsB)` and
+    `permissivenessScore(facts)`.
+  - **Removed** `stricterLicense(idA, idB)` (replaced by `compareRestrictiveness`) and the
+    reranker's internal `LICENSE_PERMISSIVENESS` table (replaced by `permissivenessScore`).
+  - Cross-source conflict detection is keyed on facts, not labels: identical facts under
+    different ids (`CC0-1.0` vs `PD`) no longer conflict, the same id with narrower facts
+    now does, and `RightsConflict.licenses` lists the source-declared ids involved.
+  - `rightsRecordSchema` now rejects a `licenseVersion` on a non-CC-family license.
+    `CC_VERSIONED_FAMILIES` and `ccVersionFor` moved from `provider-helpers` to `license`
+    (still exported from the package root).
+
+  ### Providers emit, core completes
+
+  - Added `EmittedReference` — what `ReferenceProvider.search` now returns:
+    `modality, kind?, title?, description?, tags?, sourceUrl, canonicalUrl?, rights,
+thumbnail?, preview?, perceptualHash?, visual?, text?, sourceScore?, raw?`. **Every
+    `@refkit/provider-*` factory's `search` signature changed accordingly.**
+  - Core stamps `id`, `source`, `canonicalUrl`, `verifiedAt` and `relevance` and applies the
+    per-provider `limit`: added `completeReference`, `parseEmitted`, `emittedReferenceSchema`.
+    Providers no longer compute ids, write provenance, or post-truncate.
+  - `Reference` and `EmittedReference` gained `description`, `tags: string[]` and
+    `sourceScore`. Met, Art Institute of Chicago, Wikimedia Commons and Rijksmuseum now
+    populate descriptive fields (and Art Institute also reports its upstream `_score`), which
+    directly sharpens ranking.
+  - Added `okJson(res, label)` for provider mappers, `plainText`, and
+    `RefkitOptions.userAgent` (`'refkit-client/1'` by default; Art Institute's edge rejects
+    Node's default UA) plus `withDefaultUserAgent`.
+
+  ### One search channel, one control registry
+
+  - **Removed** `SearchFilters`, `SearchInput.filters`, `NormalizedQuery.filters`,
+    `SearchMeta.appliedFilters`, `QueryFeature`, `ReferenceProvider.queryFeatures`, the legacy
+    feature→control routing, and the MCP `filters` parameter. Use `controls` /
+    `capabilities.controls`.
+  - Control types and the `key → path` registry moved to `controls.ts`; added `CONTROL_PATHS`,
+    `SEARCH_CONTROL_KEYS`, `getControl`, `setControl`, `hasControl`,
+    `buildSearchControlsSchema`, `searchControlsSchema`, `searchControlKeySchema`,
+    `searchMetaSchema`, `providerSearchStatusSchema` and the `MODALITIES` tuple to the public
+    surface — `@refkit/mcp` imports only `buildSearchControlsSchema` and `searchMetaSchema`
+    from core, and derives its modality enum from the registered providers rather than
+    keeping a local copy.
+  - Orchestrator stages are exported for testing and reuse: `selectProviders`,
+    `PROVIDER_SKIP_REASONS`, `runPass`, and `SearchMeta.passes` (per-pass latency, warnings
+    and rights conflicts now accumulate across cursor page advances).
+
+  ### Accuracy defaults
+
+  - **Source confidence** (`RefkitOptions.sourceConfidence`, default on, floor `0.1`) weights
+    each source's rank-fusion contribution by how much of its batch mentions the query; each
+    fulfilled source reports `meta.providers[].confidence`. Added `sourceConfidence` and
+    `lexicalHit`; `MergeOptions.weights` applies the weights.
+  - **Reranking is on by default**: `RefkitOptions.rerank` / `SearchInput.rerank` default to
+    `lexicalReranker()`, `false` returns raw fusion order. The lexical reranker now scores
+    over `title + description + tags + excerpt`, blends the incoming fused relevance
+    (`fusionWeight`, default `0.5`), and adds a same-source near-duplicate-title penalty
+    (`nearDuplicatePenalty`, `nearDuplicateThreshold`) and an optional `sourceScoreWeight`.
+    Added `refText` alongside `tokenize`. MCP's `rerank` parameter now defaults to true.
+  - **Relevance threshold**: `SearchInput.minRelevance` drops results the ranker scored below
+    the bar (after rerank, before the gate) and reports `SearchMeta.threshold`
+    (`SearchThresholdMeta`). New MCP `minRelevance` parameter. The bar is graded against the
+    reranker's blended score and does not transfer to `rerank: false`.
+  - **Query acceptance**: `ReferenceProvider.accepts?({ text, modalities })` lets a narrow
+    source decline queries it cannot answer — skipped with `reason: 'declined'`, bypassed by
+    an explicit `sources` whitelist, and an all-declined search returns an empty result
+    instead of throwing. `@refkit/provider-nailbook` declines queries that do not name nails;
+    `@refkit/provider-polyhaven` now matches each query token independently and ranks assets
+    by how many tokens they match.
+  - **Whole-search deadline and gate context**: `SearchInput.deadlineMs` (bounds the whole
+    call, cursor advances included) and `SearchInput.gateContext.userJurisdiction` (forwarded
+    to the search-time gate, matching `evaluateUse`). Both are exposed as MCP parameters.
+
+  The internal `@refkit/provider-testkit` (private, never published) dropped its id-prefix,
+  providerId and licenseVersion conformance rules — core now guarantees all three — and
+  completes emitted items exactly as the orchestrator does before asserting the rules that
+  remain a satellite's own responsibility.
+
+### Patch Changes
+
+- Updated dependencies [4dfd41a]
+  - @refkit/core@0.9.0
+
 ## 0.3.0
 
 ### Minor Changes
diff --git a/packages/provider-met/package.json b/packages/provider-met/package.json
index 5094331..198aad6 100644
--- a/packages/provider-met/package.json
+++ b/packages/provider-met/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@refkit/provider-met",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "The Metropolitan Museum of Art provider satellite for refkit.",
   "type": "module",
   "license": "Apache-2.0",
diff --git a/packages/provider-nailbook/CHANGELOG.md b/packages/provider-nailbook/CHANGELOG.md
index b6a3078..ed6dbcb 100644
--- a/packages/provider-nailbook/CHANGELOG.md
+++ b/packages/provider-nailbook/CHANGELOG.md
@@ -1,5 +1,104 @@
 # @refkit/provider-nailbook
 
+## 0.2.0
+
+### Minor Changes
+
+- 4dfd41a: Accuracy and contract redesign: license **facts** drive every rights decision, providers
+  only describe what their source knows, and the default search path ranks for the query
+  without a host-supplied model.
+
+  These are **breaking** changes to the public surface. Every package is still `0.x`, so
+  they ship as `minor` per semver's pre-1.0 rule — nothing is aliased or shimmed, so read
+  the removed/added lists before upgrading.
+
+  ### Rights: facts, not license ids
+
+  - `LicenseId` is now an **open** string (`KnownLicenseId | (string & {})`); an id with no
+    row in `LICENSE_FACTS` resolves to the `unknown` row, which grants nothing.
+  - Added `RightsRecord.facts?: LicenseFacts` — a source whose terms are narrower than the
+    label it declares supplies its own row. Added `factsOf(rights)`, `licenseFactsSchema`,
+    `isKnownLicenseId`, `isIndeterminate`, `compareRestrictiveness(factsA, factsB)` and
+    `permissivenessScore(facts)`.
+  - **Removed** `stricterLicense(idA, idB)` (replaced by `compareRestrictiveness`) and the
+    reranker's internal `LICENSE_PERMISSIVENESS` table (replaced by `permissivenessScore`).
+  - Cross-source conflict detection is keyed on facts, not labels: identical facts under
+    different ids (`CC0-1.0` vs `PD`) no longer conflict, the same id with narrower facts
+    now does, and `RightsConflict.licenses` lists the source-declared ids involved.
+  - `rightsRecordSchema` now rejects a `licenseVersion` on a non-CC-family license.
+    `CC_VERSIONED_FAMILIES` and `ccVersionFor` moved from `provider-helpers` to `license`
+    (still exported from the package root).
+
+  ### Providers emit, core completes
+
+  - Added `EmittedReference` — what `ReferenceProvider.search` now returns:
+    `modality, kind?, title?, description?, tags?, sourceUrl, canonicalUrl?, rights,
+thumbnail?, preview?, perceptualHash?, visual?, text?, sourceScore?, raw?`. **Every
+    `@refkit/provider-*` factory's `search` signature changed accordingly.**
+  - Core stamps `id`, `source`, `canonicalUrl`, `verifiedAt` and `relevance` and applies the
+    per-provider `limit`: added `completeReference`, `parseEmitted`, `emittedReferenceSchema`.
+    Providers no longer compute ids, write provenance, or post-truncate.
+  - `Reference` and `EmittedReference` gained `description`, `tags: string[]` and
+    `sourceScore`. Met, Art Institute of Chicago, Wikimedia Commons and Rijksmuseum now
+    populate descriptive fields (and Art Institute also reports its upstream `_score`), which
+    directly sharpens ranking.
+  - Added `okJson(res, label)` for provider mappers, `plainText`, and
+    `RefkitOptions.userAgent` (`'refkit-client/1'` by default; Art Institute's edge rejects
+    Node's default UA) plus `withDefaultUserAgent`.
+
+  ### One search channel, one control registry
+
+  - **Removed** `SearchFilters`, `SearchInput.filters`, `NormalizedQuery.filters`,
+    `SearchMeta.appliedFilters`, `QueryFeature`, `ReferenceProvider.queryFeatures`, the legacy
+    feature→control routing, and the MCP `filters` parameter. Use `controls` /
+    `capabilities.controls`.
+  - Control types and the `key → path` registry moved to `controls.ts`; added `CONTROL_PATHS`,
+    `SEARCH_CONTROL_KEYS`, `getControl`, `setControl`, `hasControl`,
+    `buildSearchControlsSchema`, `searchControlsSchema`, `searchControlKeySchema`,
+    `searchMetaSchema`, `providerSearchStatusSchema` and the `MODALITIES` tuple to the public
+    surface — `@refkit/mcp` imports only `buildSearchControlsSchema` and `searchMetaSchema`
+    from core, and derives its modality enum from the registered providers rather than
+    keeping a local copy.
+  - Orchestrator stages are exported for testing and reuse: `selectProviders`,
+    `PROVIDER_SKIP_REASONS`, `runPass`, and `SearchMeta.passes` (per-pass latency, warnings
+    and rights conflicts now accumulate across cursor page advances).
+
+  ### Accuracy defaults
+
+  - **Source confidence** (`RefkitOptions.sourceConfidence`, default on, floor `0.1`) weights
+    each source's rank-fusion contribution by how much of its batch mentions the query; each
+    fulfilled source reports `meta.providers[].confidence`. Added `sourceConfidence` and
+    `lexicalHit`; `MergeOptions.weights` applies the weights.
+  - **Reranking is on by default**: `RefkitOptions.rerank` / `SearchInput.rerank` default to
+    `lexicalReranker()`, `false` returns raw fusion order. The lexical reranker now scores
+    over `title + description + tags + excerpt`, blends the incoming fused relevance
+    (`fusionWeight`, default `0.5`), and adds a same-source near-duplicate-title penalty
+    (`nearDuplicatePenalty`, `nearDuplicateThreshold`) and an optional `sourceScoreWeight`.
+    Added `refText` alongside `tokenize`. MCP's `rerank` parameter now defaults to true.
+  - **Relevance threshold**: `SearchInput.minRelevance` drops results the ranker scored below
+    the bar (after rerank, before the gate) and reports `SearchMeta.threshold`
+    (`SearchThresholdMeta`). New MCP `minRelevance` parameter. The bar is graded against the
+    reranker's blended score and does not transfer to `rerank: false`.
+  - **Query acceptance**: `ReferenceProvider.accepts?({ text, modalities })` lets a narrow
+    source decline queries it cannot answer — skipped with `reason: 'declined'`, bypassed by
+    an explicit `sources` whitelist, and an all-declined search returns an empty result
+    instead of throwing. `@refkit/provider-nailbook` declines queries that do not name nails;
+    `@refkit/provider-polyhaven` now matches each query token independently and ranks assets
+    by how many tokens they match.
+  - **Whole-search deadline and gate context**: `SearchInput.deadlineMs` (bounds the whole
+    call, cursor advances included) and `SearchInput.gateContext.userJurisdiction` (forwarded
+    to the search-time gate, matching `evaluateUse`). Both are exposed as MCP parameters.
+
+  The internal `@refkit/provider-testkit` (private, never published) dropped its id-prefix,
+  providerId and licenseVersion conformance rules — core now guarantees all three — and
+  completes emitted items exactly as the orchestrator does before asserting the rules that
+  remain a satellite's own responsibility.
+
+### Patch Changes
+
+- Updated dependencies [4dfd41a]
+  - @refkit/core@0.9.0
+
 ## 0.1.0
 
 ### Minor Changes
diff --git a/packages/provider-nailbook/package.json b/packages/provider-nailbook/package.json
index 355eb56..87ec204 100644
--- a/packages/provider-nailbook/package.json
+++ b/packages/provider-nailbook/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@refkit/provider-nailbook",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Nailbook (nailbook.jp) nail-design provider satellite for refkit — keyless Japanese nail-art image references.",
   "type": "module",
   "license": "Apache-2.0",
diff --git a/packages/provider-openverse/CHANGELOG.md b/packages/provider-openverse/CHANGELOG.md
index 6f8728d..8aafd66 100644
--- a/packages/provider-openverse/CHANGELOG.md
+++ b/packages/provider-openverse/CHANGELOG.md
@@ -1,5 +1,104 @@
 # @refkit/provider-openverse
 
+## 0.5.0
+
+### Minor Changes
+
+- 4dfd41a: Accuracy and contract redesign: license **facts** drive every rights decision, providers
+  only describe what their source knows, and the default search path ranks for the query
+  without a host-supplied model.
+
+  These are **breaking** changes to the public surface. Every package is still `0.x`, so
+  they ship as `minor` per semver's pre-1.0 rule — nothing is aliased or shimmed, so read
+  the removed/added lists before upgrading.
+
+  ### Rights: facts, not license ids
+
+  - `LicenseId` is now an **open** string (`KnownLicenseId | (string & {})`); an id with no
+    row in `LICENSE_FACTS` resolves to the `unknown` row, which grants nothing.
+  - Added `RightsRecord.facts?: LicenseFacts` — a source whose terms are narrower than the
+    label it declares supplies its own row. Added `factsOf(rights)`, `licenseFactsSchema`,
+    `isKnownLicenseId`, `isIndeterminate`, `compareRestrictiveness(factsA, factsB)` and
+    `permissivenessScore(facts)`.
+  - **Removed** `stricterLicense(idA, idB)` (replaced by `compareRestrictiveness`) and the
+    reranker's internal `LICENSE_PERMISSIVENESS` table (replaced by `permissivenessScore`).
+  - Cross-source conflict detection is keyed on facts, not labels: identical facts under
+    different ids (`CC0-1.0` vs `PD`) no longer conflict, the same id with narrower facts
+    now does, and `RightsConflict.licenses` lists the source-declared ids involved.
+  - `rightsRecordSchema` now rejects a `licenseVersion` on a non-CC-family license.
+    `CC_VERSIONED_FAMILIES` and `ccVersionFor` moved from `provider-helpers` to `license`
+    (still exported from the package root).
+
+  ### Providers emit, core completes
+
+  - Added `EmittedReference` — what `ReferenceProvider.search` now returns:
+    `modality, kind?, title?, description?, tags?, sourceUrl, canonicalUrl?, rights,
+thumbnail?, preview?, perceptualHash?, visual?, text?, sourceScore?, raw?`. **Every
+    `@refkit/provider-*` factory's `search` signature changed accordingly.**
+  - Core stamps `id`, `source`, `canonicalUrl`, `verifiedAt` and `relevance` and applies the
+    per-provider `limit`: added `completeReference`, `parseEmitted`, `emittedReferenceSchema`.
+    Providers no longer compute ids, write provenance, or post-truncate.
+  - `Reference` and `EmittedReference` gained `description`, `tags: string[]` and
+    `sourceScore`. Met, Art Institute of Chicago, Wikimedia Commons and Rijksmuseum now
+    populate descriptive fields (and Art Institute also reports its upstream `_score`), which
+    directly sharpens ranking.
+  - Added `okJson(res, label)` for provider mappers, `plainText`, and
+    `RefkitOptions.userAgent` (`'refkit-client/1'` by default; Art Institute's edge rejects
+    Node's default UA) plus `withDefaultUserAgent`.
+
+  ### One search channel, one control registry
+
+  - **Removed** `SearchFilters`, `SearchInput.filters`, `NormalizedQuery.filters`,
+    `SearchMeta.appliedFilters`, `QueryFeature`, `ReferenceProvider.queryFeatures`, the legacy
+    feature→control routing, and the MCP `filters` parameter. Use `controls` /
+    `capabilities.controls`.
+  - Control types and the `key → path` registry moved to `controls.ts`; added `CONTROL_PATHS`,
+    `SEARCH_CONTROL_KEYS`, `getControl`, `setControl`, `hasControl`,
+    `buildSearchControlsSchema`, `searchControlsSchema`, `searchControlKeySchema`,
+    `searchMetaSchema`, `providerSearchStatusSchema` and the `MODALITIES` tuple to the public
+    surface — `@refkit/mcp` imports only `buildSearchControlsSchema` and `searchMetaSchema`
+    from core, and derives its modality enum from the registered providers rather than
+    keeping a local copy.
+  - Orchestrator stages are exported for testing and reuse: `selectProviders`,
+    `PROVIDER_SKIP_REASONS`, `runPass`, and `SearchMeta.passes` (per-pass latency, warnings
+    and rights conflicts now accumulate across cursor page advances).
+
+  ### Accuracy defaults
+
+  - **Source confidence** (`RefkitOptions.sourceConfidence`, default on, floor `0.1`) weights
+    each source's rank-fusion contribution by how much of its batch mentions the query; each
+    fulfilled source reports `meta.providers[].confidence`. Added `sourceConfidence` and
+    `lexicalHit`; `MergeOptions.weights` applies the weights.
+  - **Reranking is on by default**: `RefkitOptions.rerank` / `SearchInput.rerank` default to
+    `lexicalReranker()`, `false` returns raw fusion order. The lexical reranker now scores
+    over `title + description + tags + excerpt`, blends the incoming fused relevance
+    (`fusionWeight`, default `0.5`), and adds a same-source near-duplicate-title penalty
+    (`nearDuplicatePenalty`, `nearDuplicateThreshold`) and an optional `sourceScoreWeight`.
+    Added `refText` alongside `tokenize`. MCP's `rerank` parameter now defaults to true.
+  - **Relevance threshold**: `SearchInput.minRelevance` drops results the ranker scored below
+    the bar (after rerank, before the gate) and reports `SearchMeta.threshold`
+    (`SearchThresholdMeta`). New MCP `minRelevance` parameter. The bar is graded against the
+    reranker's blended score and does not transfer to `rerank: false`.
+  - **Query acceptance**: `ReferenceProvider.accepts?({ text, modalities })` lets a narrow
+    source decline queries it cannot answer — skipped with `reason: 'declined'`, bypassed by
+    an explicit `sources` whitelist, and an all-declined search returns an empty result
+    instead of throwing. `@refkit/provider-nailbook` declines queries that do not name nails;
+    `@refkit/provider-polyhaven` now matches each query token independently and ranks assets
+    by how many tokens they match.
+  - **Whole-search deadline and gate context**: `SearchInput.deadlineMs` (bounds the whole
+    call, cursor advances included) and `SearchInput.gateContext.userJurisdiction` (forwarded
+    to the search-time gate, matching `evaluateUse`). Both are exposed as MCP parameters.
+
+  The internal `@refkit/provider-testkit` (private, never published) dropped its id-prefix,
+  providerId and licenseVersion conformance rules — core now guarantees all three — and
+  completes emitted items exactly as the orchestrator does before asserting the rules that
+  remain a satellite's own responsibility.
+
+### Patch Changes
+
+- Updated dependencies [4dfd41a]
+  - @refkit/core@0.9.0
+
 ## 0.4.0
 
 ### Minor Changes
diff --git a/packages/provider-openverse/package.json b/packages/provider-openverse/package.json
index 279dc5a..f4ca345 100644
--- a/packages/provider-openverse/package.json
+++ b/packages/provider-openverse/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@refkit/provider-openverse",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "Openverse provider satellite for refkit — CC/PD licensed image search, license-normalized.",
   "type": "module",
   "license": "Apache-2.0",
diff --git a/packages/provider-pexels/CHANGELOG.md b/packages/provider-pexels/CHANGELOG.md
index acc575e..5eeb916 100644
--- a/packages/provider-pexels/CHANGELOG.md
+++ b/packages/provider-pexels/CHANGELOG.md
@@ -1,5 +1,104 @@
 # @refkit/provider-pexels
 
+## 0.4.0
+
+### Minor Changes
+
+- 4dfd41a: Accuracy and contract redesign: license **facts** drive every rights decision, providers
+  only describe what their source knows, and the default search path ranks for the query
+  without a host-supplied model.
+
+  These are **breaking** changes to the public surface. Every package is still `0.x`, so
+  they ship as `minor` per semver's pre-1.0 rule — nothing is aliased or shimmed, so read
+  the removed/added lists before upgrading.
+
+  ### Rights: facts, not license ids
+
+  - `LicenseId` is now an **open** string (`KnownLicenseId | (string & {})`); an id with no
+    row in `LICENSE_FACTS` resolves to the `unknown` row, which grants nothing.
+  - Added `RightsRecord.facts?: LicenseFacts` — a source whose terms are narrower than the
+    label it declares supplies its own row. Added `factsOf(rights)`, `licenseFactsSchema`,
+    `isKnownLicenseId`, `isIndeterminate`, `compareRestrictiveness(factsA, factsB)` and
+    `permissivenessScore(facts)`.
+  - **Removed** `stricterLicense(idA, idB)` (replaced by `compareRestrictiveness`) and the
+    reranker's internal `LICENSE_PERMISSIVENESS` table (replaced by `permissivenessScore`).
+  - Cross-source conflict detection is keyed on facts, not labels: identical facts under
+    different ids (`CC0-1.0` vs `PD`) no longer conflict, the same id with narrower facts
+    now does, and `RightsConflict.licenses` lists the source-declared ids involved.
+  - `rightsRecordSchema` now rejects a `licenseVersion` on a non-CC-family license.
+    `CC_VERSIONED_FAMILIES` and `ccVersionFor` moved from `provider-helpers` to `license`
+    (still exported from the package root).
+
+  ### Providers emit, core completes
+
+  - Added `EmittedReference` — what `ReferenceProvider.search` now returns:
+    `modality, kind?, title?, description?, tags?, sourceUrl, canonicalUrl?, rights,
+thumbnail?, preview?, perceptualHash?, visual?, text?, sourceScore?, raw?`. **Every
+    `@refkit/provider-*` factory's `search` signature changed accordingly.**
+  - Core stamps `id`, `source`, `canonicalUrl`, `verifiedAt` and `relevance` and applies the
+    per-provider `limit`: added `completeReference`, `parseEmitted`, `emittedReferenceSchema`.
+    Providers no longer compute ids, write provenance, or post-truncate.
+  - `Reference` and `EmittedReference` gained `description`, `tags: string[]` and
+    `sourceScore`. Met, Art Institute of Chicago, Wikimedia Commons and Rijksmuseum now
+    populate descriptive fields (and Art Institute also reports its upstream `_score`), which
+    directly sharpens ranking.
+  - Added `okJson(res, label)` for provider mappers, `plainText`, and
+    `RefkitOptions.userAgent` (`'refkit-client/1'` by default; Art Institute's edge rejects
+    Node's default UA) plus `withDefaultUserAgent`.
+
+  ### One search channel, one control registry
+
+  - **Removed** `SearchFilters`, `SearchInput.filters`, `NormalizedQuery.filters`,
+    `SearchMeta.appliedFilters`, `QueryFeature`, `ReferenceProvider.queryFeatures`, the legacy
+    feature→control routing, and the MCP `filters` parameter. Use `controls` /
+    `capabilities.controls`.
+  - Control types and the `key → path` registry moved to `controls.ts`; added `CONTROL_PATHS`,
+    `SEARCH_CONTROL_KEYS`, `getControl`, `setControl`, `hasControl`,
+    `buildSearchControlsSchema`, `searchControlsSchema`, `searchControlKeySchema`,
+    `searchMetaSchema`, `providerSearchStatusSchema` and the `MODALITIES` tuple to the public
+    surface — `@refkit/mcp` imports only `buildSearchControlsSchema` and `searchMetaSchema`
+    from core, and derives its modality enum from the registered providers rather than
+    keeping a local copy.
+  - Orchestrator stages are exported for testing and reuse: `selectProviders`,
+    `PROVIDER_SKIP_REASONS`, `runPass`, and `SearchMeta.passes` (per-pass latency, warnings
+    and rights conflicts now accumulate across cursor page advances).
+
+  ### Accuracy defaults
+
+  - **Source confidence** (`RefkitOptions.sourceConfidence`, default on, floor `0.1`) weights
+    each source's rank-fusion contribution by how much of its batch mentions the query; each
+    fulfilled source reports `meta.providers[].confidence`. Added `sourceConfidence` and
+    `lexicalHit`; `MergeOptions.weights` applies the weights.
+  - **Reranking is on by default**: `RefkitOptions.rerank` / `SearchInput.rerank` default to
+    `lexicalReranker()`, `false` returns raw fusion order. The lexical reranker now scores
+    over `title + description + tags + excerpt`, blends the incoming fused relevance
+    (`fusionWeight`, default `0.5`), and adds a same-source near-duplicate-title penalty
+    (`nearDuplicatePenalty`, `nearDuplicateThreshold`) and an optional `sourceScoreWeight`.
+    Added `refText` alongside `tokenize`. MCP's `rerank` parameter now defaults to true.
+  - **Relevance threshold**: `SearchInput.minRelevance` drops results the ranker scored below
+    the bar (after rerank, before the gate) and reports `SearchMeta.threshold`
+    (`SearchThresholdMeta`). New MCP `minRelevance` parameter. The bar is graded against the
+    reranker's blended score and does not transfer to `rerank: false`.
+  - **Query acceptance**: `ReferenceProvider.accepts?({ text, modalities })` lets a narrow
+    source decline queries it cannot answer — skipped with `reason: 'declined'`, bypassed by
+    an explicit `sources` whitelist, and an all-declined search returns an empty result
+    instead of throwing. `@refkit/provider-nailbook` declines queries that do not name nails;
+    `@refkit/provider-polyhaven` now matches each query token independently and ranks assets
+    by how many tokens they match.
+  - **Whole-search deadline and gate context**: `SearchInput.deadlineMs` (bounds the whole
+    call, cursor advances included) and `SearchInput.gateContext.userJurisdiction` (forwarded
+    to the search-time gate, matching `evaluateUse`). Both are exposed as MCP parameters.
+
+  The internal `@refkit/provider-testkit` (private, never published) dropped its id-prefix,
+  providerId and licenseVersion conformance rules — core now guarantees all three — and
+  completes emitted items exactly as the orchestrator does before asserting the rules that
+  remain a satellite's own responsibility.
+
+### Patch Changes
+
+- Updated dependencies [4dfd41a]
+  - @refkit/core@0.9.0
+
 ## 0.3.0
 
 ### Minor Changes
diff --git a/packages/provider-pexels/package.json b/packages/provider-pexels/package.json
index 79db289..857c661 100644
--- a/packages/provider-pexels/package.json
+++ b/packages/provider-pexels/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@refkit/provider-pexels",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "Pexels provider satellite for refkit — image search, hotlink-required.",
   "type": "module",
   "license": "Apache-2.0",
diff --git a/packages/provider-pixabay/CHANGELOG.md b/packages/provider-pixabay/CHANGELOG.md
index 61f40c9..aca99d2 100644
--- a/packages/provider-pixabay/CHANGELOG.md
+++ b/packages/provider-pixabay/CHANGELOG.md
@@ -1,5 +1,104 @@
 # @refkit/provider-pixabay
 
+## 0.4.0
+
+### Minor Changes
+
+- 4dfd41a: Accuracy and contract redesign: license **facts** drive every rights decision, providers
+  only describe what their source knows, and the default search path ranks for the query
+  without a host-supplied model.
+
+  These are **breaking** changes to the public surface. Every package is still `0.x`, so
+  they ship as `minor` per semver's pre-1.0 rule — nothing is aliased or shimmed, so read
+  the removed/added lists before upgrading.
+
+  ### Rights: facts, not license ids
+
+  - `LicenseId` is now an **open** string (`KnownLicenseId | (string & {})`); an id with no
+    row in `LICENSE_FACTS` resolves to the `unknown` row, which grants nothing.
+  - Added `RightsRecord.facts?: LicenseFacts` — a source whose terms are narrower than the
+    label it declares supplies its own row. Added `factsOf(rights)`, `licenseFactsSchema`,
+    `isKnownLicenseId`, `isIndeterminate`, `compareRestrictiveness(factsA, factsB)` and
+    `permissivenessScore(facts)`.
+  - **Removed** `stricterLicense(idA, idB)` (replaced by `compareRestrictiveness`) and the
+    reranker's internal `LICENSE_PERMISSIVENESS` table (replaced by `permissivenessScore`).
+  - Cross-source conflict detection is keyed on facts, not labels: identical facts under
+    different ids (`CC0-1.0` vs `PD`) no longer conflict, the same id with narrower facts
+    now does, and `RightsConflict.licenses` lists the source-declared ids involved.
+  - `rightsRecordSchema` now rejects a `licenseVersion` on a non-CC-family license.
+    `CC_VERSIONED_FAMILIES` and `ccVersionFor` moved from `provider-helpers` to `license`
+    (still exported from the package root).
+
+  ### Providers emit, core completes
+
+  - Added `EmittedReference` — what `ReferenceProvider.search` now returns:
+    `modality, kind?, title?, description?, tags?, sourceUrl, canonicalUrl?, rights,
+thumbnail?, preview?, perceptualHash?, visual?, text?, sourceScore?, raw?`. **Every
+    `@refkit/provider-*` factory's `search` signature changed accordingly.**
+  - Core stamps `id`, `source`, `canonicalUrl`, `verifiedAt` and `relevance` and applies the
+    per-provider `limit`: added `completeReference`, `parseEmitted`, `emittedReferenceSchema`.
+    Providers no longer compute ids, write provenance, or post-truncate.
+  - `Reference` and `EmittedReference` gained `description`, `tags: string[]` and
+    `sourceScore`. Met, Art Institute of Chicago, Wikimedia Commons and Rijksmuseum now
+    populate descriptive fields (and Art Institute also reports its upstream `_score`), which
+    directly sharpens ranking.
+  - Added `okJson(res, label)` for provider mappers, `plainText`, and
+    `RefkitOptions.userAgent` (`'refkit-client/1'` by default; Art Institute's edge rejects
+    Node's default UA) plus `withDefaultUserAgent`.
+
+  ### One search channel, one control registry
+
+  - **Removed** `SearchFilters`, `SearchInput.filters`, `NormalizedQuery.filters`,
+    `SearchMeta.appliedFilters`, `QueryFeature`, `ReferenceProvider.queryFeatures`, the legacy
+    feature→control routing, and the MCP `filters` parameter. Use `controls` /
+    `capabilities.controls`.
+  - Control types and the `key → path` registry moved to `controls.ts`; added `CONTROL_PATHS`,
+    `SEARCH_CONTROL_KEYS`, `getControl`, `setControl`, `hasControl`,
+    `buildSearchControlsSchema`, `searchControlsSchema`, `searchControlKeySchema`,
+    `searchMetaSchema`, `providerSearchStatusSchema` and the `MODALITIES` tuple to the public
+    surface — `@refkit/mcp` imports only `buildSearchControlsSchema` and `searchMetaSchema`
+    from core, and derives its modality enum from the registered providers rather than
+    keeping a local copy.
+  - Orchestrator stages are exported for testing and reuse: `selectProviders`,
+    `PROVIDER_SKIP_REASONS`, `runPass`, and `SearchMeta.passes` (per-pass latency, warnings
+    and rights conflicts now accumulate across cursor page advances).
+
+  ### Accuracy defaults
+
+  - **Source confidence** (`RefkitOptions.sourceConfidence`, default on, floor `0.1`) weights
+    each source's rank-fusion contribution by how much of its batch mentions the query; each
+    fulfilled source reports `meta.providers[].confidence`. Added `sourceConfidence` and
+    `lexicalHit`; `MergeOptions.weights` applies the weights.
+  - **Reranking is on by default**: `RefkitOptions.rerank` / `SearchInput.rerank` default to
+    `lexicalReranker()`, `false` returns raw fusion order. The lexical reranker now scores
+    over `title + description + tags + excerpt`, blends the incoming fused relevance
+    (`fusionWeight`, default `0.5`), and adds a same-source near-duplicate-title penalty
+    (`nearDuplicatePenalty`, `nearDuplicateThreshold`) and an optional `sourceScoreWeight`.
+    Added `refText` alongside `tokenize`. MCP's `rerank` parameter now defaults to true.
+  - **Relevance threshold**: `SearchInput.minRelevance` drops results the ranker scored below
+    the bar (after rerank, before the gate) and reports `SearchMeta.threshold`
+    (`SearchThresholdMeta`). New MCP `minRelevance` parameter. The bar is graded against the
+    reranker's blended score and does not transfer to `rerank: false`.
+  - **Query acceptance**: `ReferenceProvider.accepts?({ text, modalities })` lets a narrow
+    source decline queries it cannot answer — skipped with `reason: 'declined'`, bypassed by
+    an explicit `sources` whitelist, and an all-declined search returns an empty result
+    instead of throwing. `@refkit/provider-nailbook` declines queries that do not name nails;
+    `@refkit/provider-polyhaven` now matches each query token independently and ranks assets
+    by how many tokens they match.
+  - **Whole-search deadline and gate context**: `SearchInput.deadlineMs` (bounds the whole
+    call, cursor advances included) and `SearchInput.gateContext.userJurisdiction` (forwarded
+    to the search-time gate, matching `evaluateUse`). Both are exposed as MCP parameters.
+
+  The internal `@refkit/provider-testkit` (private, never published) dropped its id-prefix,
+  providerId and licenseVersion conformance rules — core now guarantees all three — and
+  completes emitted items exactly as the orchestrator does before asserting the rules that
+  remain a satellite's own responsibility.
+
+### Patch Changes
+
+- Updated dependencies [4dfd41a]
+  - @refkit/core@0.9.0
+
 ## 0.3.0
 
 ### Minor Changes
diff --git a/packages/provider-pixabay/package.json b/packages/provider-pixabay/package.json
index 7db4b5d..75fd33e 100644
--- a/packages/provider-pixabay/package.json
+++ b/packages/provider-pixabay/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@refkit/provider-pixabay",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "Pixabay provider satellite for refkit — image search, cache-allowed.",
   "type": "module",
   "license": "Apache-2.0",
diff --git a/packages/provider-poetrydb/CHANGELOG.md b/packages/provider-poetrydb/CHANGELOG.md
index 4b25f6c..e3d7348 100644
--- a/packages/provider-poetrydb/CHANGELOG.md
+++ b/packages/provider-poetrydb/CHANGELOG.md
@@ -1,5 +1,104 @@
 # @refkit/provider-poetrydb
 
+## 0.4.0
+
+### Minor Changes
+
+- 4dfd41a: Accuracy and contract redesign: license **facts** drive every rights decision, providers
+  only describe what their source knows, and the default search path ranks for the query
+  without a host-supplied model.
+
+  These are **breaking** changes to the public surface. Every package is still `0.x`, so
+  they ship as `minor` per semver's pre-1.0 rule — nothing is aliased or shimmed, so read
+  the removed/added lists before upgrading.
+
+  ### Rights: facts, not license ids
+
+  - `LicenseId` is now an **open** string (`KnownLicenseId | (string & {})`); an id with no
+    row in `LICENSE_FACTS` resolves to the `unknown` row, which grants nothing.
+  - Added `RightsRecord.facts?: LicenseFacts` — a source whose terms are narrower than the
+    label it declares supplies its own row. Added `factsOf(rights)`, `licenseFactsSchema`,
+    `isKnownLicenseId`, `isIndeterminate`, `compareRestrictiveness(factsA, factsB)` and
+    `permissivenessScore(facts)`.
+  - **Removed** `stricterLicense(idA, idB)` (replaced by `compareRestrictiveness`) and the
+    reranker's internal `LICENSE_PERMISSIVENESS` table (replaced by `permissivenessScore`).
+  - Cross-source conflict detection is keyed on facts, not labels: identical facts under
+    different ids (`CC0-1.0` vs `PD`) no longer conflict, the same id with narrower facts
+    now does, and `RightsConflict.licenses` lists the source-declared ids involved.
+  - `rightsRecordSchema` now rejects a `licenseVersion` on a non-CC-family license.
+    `CC_VERSIONED_FAMILIES` and `ccVersionFor` moved from `provider-helpers` to `license`
+    (still exported from the package root).
+
+  ### Providers emit, core completes
+
+  - Added `EmittedReference` — what `ReferenceProvider.search` now returns:
+    `modality, kind?, title?, description?, tags?, sourceUrl, canonicalUrl?, rights,
+thumbnail?, preview?, perceptualHash?, visual?, text?, sourceScore?, raw?`. **Every
+    `@refkit/provider-*` factory's `search` signature changed accordingly.**
+  - Core stamps `id`, `source`, `canonicalUrl`, `verifiedAt` and `relevance` and applies the
+    per-provider `limit`: added `completeReference`, `parseEmitted`, `emittedReferenceSchema`.
+    Providers no longer compute ids, write provenance, or post-truncate.
+  - `Reference` and `EmittedReference` gained `description`, `tags: string[]` and
+    `sourceScore`. Met, Art Institute of Chicago, Wikimedia Commons and Rijksmuseum now
+    populate descriptive fields (and Art Institute also reports its upstream `_score`), which
+    directly sharpens ranking.
+  - Added `okJson(res, label)` for provider mappers, `plainText`, and
+    `RefkitOptions.userAgent` (`'refkit-client/1'` by default; Art Institute's edge rejects
+    Node's default UA) plus `withDefaultUserAgent`.
+
+  ### One search channel, one control registry
+
+  - **Removed** `SearchFilters`, `SearchInput.filters`, `NormalizedQuery.filters`,
+    `SearchMeta.appliedFilters`, `QueryFeature`, `ReferenceProvider.queryFeatures`, the legacy
+    feature→control routing, and the MCP `filters` parameter. Use `controls` /
+    `capabilities.controls`.
+  - Control types and the `key → path` registry moved to `controls.ts`; added `CONTROL_PATHS`,
+    `SEARCH_CONTROL_KEYS`, `getControl`, `setControl`, `hasControl`,
+    `buildSearchControlsSchema`, `searchControlsSchema`, `searchControlKeySchema`,
+    `searchMetaSchema`, `providerSearchStatusSchema` and the `MODALITIES` tuple to the public
+    surface — `@refkit/mcp` imports only `buildSearchControlsSchema` and `searchMetaSchema`
+    from core, and derives its modality enum from the registered providers rather than
+    keeping a local copy.
+  - Orchestrator stages are exported for testing and reuse: `selectProviders`,
+    `PROVIDER_SKIP_REASONS`, `runPass`, and `SearchMeta.passes` (per-pass latency, warnings
+    and rights conflicts now accumulate across cursor page advances).
+
+  ### Accuracy defaults
+
+  - **Source confidence** (`RefkitOptions.sourceConfidence`, default on, floor `0.1`) weights
+    each source's rank-fusion contribution by how much of its batch mentions the query; each
+    fulfilled source reports `meta.providers[].confidence`. Added `sourceConfidence` and
+    `lexicalHit`; `MergeOptions.weights` applies the weights.
+  - **Reranking is on by default**: `RefkitOptions.rerank` / `SearchInput.rerank` default to
+    `lexicalReranker()`, `false` returns raw fusion order. The lexical reranker now scores
+    over `title + description + tags + excerpt`, blends the incoming fused relevance
+    (`fusionWeight`, default `0.5`), and adds a same-source near-duplicate-title penalty
+    (`nearDuplicatePenalty`, `nearDuplicateThreshold`) and an optional `sourceScoreWeight`.
+    Added `refText` alongside `tokenize`. MCP's `rerank` parameter now defaults to true.
+  - **Relevance threshold**: `SearchInput.minRelevance` drops results the ranker scored below
+    the bar (after rerank, before the gate) and reports `SearchMeta.threshold`
+    (`SearchThresholdMeta`). New MCP `minRelevance` parameter. The bar is graded against the
+    reranker's blended score and does not transfer to `rerank: false`.
+  - **Query acceptance**: `ReferenceProvider.accepts?({ text, modalities })` lets a narrow
+    source decline queries it cannot answer — skipped with `reason: 'declined'`, bypassed by
+    an explicit `sources` whitelist, and an all-declined search returns an empty result
+    instead of throwing. `@refkit/provider-nailbook` declines queries that do not name nails;
+    `@refkit/provider-polyhaven` now matches each query token independently and ranks assets
+    by how many tokens they match.
+  - **Whole-search deadline and gate context**: `SearchInput.deadlineMs` (bounds the whole
+    call, cursor advances included) and `SearchInput.gateContext.userJurisdiction` (forwarded
+    to the search-time gate, matching `evaluateUse`). Both are exposed as MCP parameters.
+
+  The internal `@refkit/provider-testkit` (private, never published) dropped its id-prefix,
+  providerId and licenseVersion conformance rules — core now guarantees all three — and
+  completes emitted items exactly as the orchestrator does before asserting the rules that
+  remain a satellite's own responsibility.
+
+### Patch Changes
+
+- Updated dependencies [4dfd41a]
+  - @refkit/core@0.9.0
+
 ## 0.3.0
 
 ### Minor Changes
diff --git a/packages/provider-poetrydb/package.json b/packages/provider-poetrydb/package.json
index 1ae0841..f3ce58e 100644
--- a/packages/provider-poetrydb/package.json
+++ b/packages/provider-poetrydb/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@refkit/provider-poetrydb",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "PoetryDB provider satellite for refkit — classic public-domain poems.",
   "type": "module",
   "license": "Apache-2.0",
diff --git a/packages/provider-polyhaven/CHANGELOG.md b/packages/provider-polyhaven/CHANGELOG.md
index 1457133..5dcbdb8 100644
--- a/packages/provider-polyhaven/CHANGELOG.md
+++ b/packages/provider-polyhaven/CHANGELOG.md
@@ -1,5 +1,104 @@
 # @refkit/provider-polyhaven
 
+## 0.4.0
+
+### Minor Changes
+
+- 4dfd41a: Accuracy and contract redesign: license **facts** drive every rights decision, providers
+  only describe what their source knows, and the default search path ranks for the query
+  without a host-supplied model.
+
+  These are **breaking** changes to the public surface. Every package is still `0.x`, so
+  they ship as `minor` per semver's pre-1.0 rule — nothing is aliased or shimmed, so read
+  the removed/added lists before upgrading.
+
+  ### Rights: facts, not license ids
+
+  - `LicenseId` is now an **open** string (`KnownLicenseId | (string & {})`); an id with no
+    row in `LICENSE_FACTS` resolves to the `unknown` row, which grants nothing.
+  - Added `RightsRecord.facts?: LicenseFacts` — a source whose terms are narrower than the
+    label it declares supplies its own row. Added `factsOf(rights)`, `licenseFactsSchema`,
+    `isKnownLicenseId`, `isIndeterminate`, `compareRestrictiveness(factsA, factsB)` and
+    `permissivenessScore(facts)`.
+  - **Removed** `stricterLicense(idA, idB)` (replaced by `compareRestrictiveness`) and the
+    reranker's internal `LICENSE_PERMISSIVENESS` table (replaced by `permissivenessScore`).
+  - Cross-source conflict detection is keyed on facts, not labels: identical facts under
+    different ids (`CC0-1.0` vs `PD`) no longer conflict, the same id with narrower facts
+    now does, and `RightsConflict.licenses` lists the source-declared ids involved.
+  - `rightsRecordSchema` now rejects a `licenseVersion` on a non-CC-family license.
+    `CC_VERSIONED_FAMILIES` and `ccVersionFor` moved from `provider-helpers` to `license`
+    (still exported from the package root).
+
+  ### Providers emit, core completes
+
+  - Added `EmittedReference` — what `ReferenceProvider.search` now returns:
+    `modality, kind?, title?, description?, tags?, sourceUrl, canonicalUrl?, rights,
+thumbnail?, preview?, perceptualHash?, visual?, text?, sourceScore?, raw?`. **Every
+    `@refkit/provider-*` factory's `search` signature changed accordingly.**
+  - Core stamps `id`, `source`, `canonicalUrl`, `verifiedAt` and `relevance` and applies the
+    per-provider `limit`: added `completeReference`, `parseEmitted`, `emittedReferenceSchema`.
+    Providers no longer compute ids, write provenance, or post-truncate.
+  - `Reference` and `EmittedReference` gained `description`, `tags: string[]` and
+    `sourceScore`. Met, Art Institute of Chicago, Wikimedia Commons and Rijksmuseum now
+    populate descriptive fields (and Art Institute also reports its upstream `_score`), which
+    directly sharpens ranking.
+  - Added `okJson(res, label)` for provider mappers, `plainText`, and
+    `RefkitOptions.userAgent` (`'refkit-client/1'` by default; Art Institute's edge rejects
+    Node's default UA) plus `withDefaultUserAgent`.
+
+  ### One search channel, one control registry
+
+  - **Removed** `SearchFilters`, `SearchInput.filters`, `NormalizedQuery.filters`,
+    `SearchMeta.appliedFilters`, `QueryFeature`, `ReferenceProvider.queryFeatures`, the legacy
+    feature→control routing, and the MCP `filters` parameter. Use `controls` /
+    `capabilities.controls`.
+  - Control types and the `key → path` registry moved to `controls.ts`; added `CONTROL_PATHS`,
+    `SEARCH_CONTROL_KEYS`, `getControl`, `setControl`, `hasControl`,
+    `buildSearchControlsSchema`, `searchControlsSchema`, `searchControlKeySchema`,
+    `searchMetaSchema`, `providerSearchStatusSchema` and the `MODALITIES` tuple to the public
+    surface — `@refkit/mcp` imports only `buildSearchControlsSchema` and `searchMetaSchema`
+    from core, and derives its modality enum from the registered providers rather than
+    keeping a local copy.
+  - Orchestrator stages are exported for testing and reuse: `selectProviders`,
+    `PROVIDER_SKIP_REASONS`, `runPass`, and `SearchMeta.passes` (per-pass latency, warnings
+    and rights conflicts now accumulate across cursor page advances).
+
+  ### Accuracy defaults
+
+  - **Source confidence** (`RefkitOptions.sourceConfidence`, default on, floor `0.1`) weights
+    each source's rank-fusion contribution by how much of its batch mentions the query; each
+    fulfilled source reports `meta.providers[].confidence`. Added `sourceConfidence` and
+    `lexicalHit`; `MergeOptions.weights` applies the weights.
+  - **Reranking is on by default**: `RefkitOptions.rerank` / `SearchInput.rerank` default to
+    `lexicalReranker()`, `false` returns raw fusion order. The lexical reranker now scores
+    over `title + description + tags + excerpt`, blends the incoming fused relevance
+    (`fusionWeight`, default `0.5`), and adds a same-source near-duplicate-title penalty
+    (`nearDuplicatePenalty`, `nearDuplicateThreshold`) and an optional `sourceScoreWeight`.
+    Added `refText` alongside `tokenize`. MCP's `rerank` parameter now defaults to true.
+  - **Relevance threshold**: `SearchInput.minRelevance` drops results the ranker scored below
+    the bar (after rerank, before the gate) and reports `SearchMeta.threshold`
+    (`SearchThresholdMeta`). New MCP `minRelevance` parameter. The bar is graded against the
+    reranker's blended score and does not transfer to `rerank: false`.
+  - **Query acceptance**: `ReferenceProvider.accepts?({ text, modalities })` lets a narrow
+    source decline queries it cannot answer — skipped with `reason: 'declined'`, bypassed by
+    an explicit `sources` whitelist, and an all-declined search returns an empty result
+    instead of throwing. `@refkit/provider-nailbook` declines queries that do not name nails;
+    `@refkit/provider-polyhaven` now matches each query token independently and ranks assets
+    by how many tokens they match.
+  - **Whole-search deadline and gate context**: `SearchInput.deadlineMs` (bounds the whole
+    call, cursor advances included) and `SearchInput.gateContext.userJurisdiction` (forwarded
+    to the search-time gate, matching `evaluateUse`). Both are exposed as MCP parameters.
+
+  The internal `@refkit/provider-testkit` (private, never published) dropped its id-prefix,
+  providerId and licenseVersion conformance rules — core now guarantees all three — and
+  completes emitted items exactly as the orchestrator does before asserting the rules that
+  remain a satellite's own responsibility.
+
+### Patch Changes
+
+- Updated dependencies [4dfd41a]
+  - @refkit/core@0.9.0
+
 ## 0.3.0
 
 ### Minor Changes
diff --git a/packages/provider-polyhaven/package.json b/packages/provider-polyhaven/package.json
index 6473d76..9039a87 100644
--- a/packages/provider-polyhaven/package.json
+++ b/packages/provider-polyhaven/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@refkit/provider-polyhaven",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "Poly Haven provider satellite for refkit.",
   "type": "module",
   "license": "Apache-2.0",
diff --git a/packages/provider-rijksmuseum/CHANGELOG.md b/packages/provider-rijksmuseum/CHANGELOG.md
index b673591..4bb6d8a 100644
--- a/packages/provider-rijksmuseum/CHANGELOG.md
+++ b/packages/provider-rijksmuseum/CHANGELOG.md
@@ -1,5 +1,104 @@
 # @refkit/provider-rijksmuseum
 
+## 0.4.0
+
+### Minor Changes
+
+- 4dfd41a: Accuracy and contract redesign: license **facts** drive every rights decision, providers
+  only describe what their source knows, and the default search path ranks for the query
+  without a host-supplied model.
+
+  These are **breaking** changes to the public surface. Every package is still `0.x`, so
+  they ship as `minor` per semver's pre-1.0 rule — nothing is aliased or shimmed, so read
+  the removed/added lists before upgrading.
+
+  ### Rights: facts, not license ids
+
+  - `LicenseId` is now an **open** string (`KnownLicenseId | (string & {})`); an id with no
+    row in `LICENSE_FACTS` resolves to the `unknown` row, which grants nothing.
+  - Added `RightsRecord.facts?: LicenseFacts` — a source whose terms are narrower than the
+    label it declares supplies its own row. Added `factsOf(rights)`, `licenseFactsSchema`,
+    `isKnownLicenseId`, `isIndeterminate`, `compareRestrictiveness(factsA, factsB)` and
+    `permissivenessScore(facts)`.
+  - **Removed** `stricterLicense(idA, idB)` (replaced by `compareRestrictiveness`) and the
+    reranker's internal `LICENSE_PERMISSIVENESS` table (replaced by `permissivenessScore`).
+  - Cross-source conflict detection is keyed on facts, not labels: identical facts under
+    different ids (`CC0-1.0` vs `PD`) no longer conflict, the same id with narrower facts
+    now does, and `RightsConflict.licenses` lists the source-declared ids involved.
+  - `rightsRecordSchema` now rejects a `licenseVersion` on a non-CC-family license.
+    `CC_VERSIONED_FAMILIES` and `ccVersionFor` moved from `provider-helpers` to `license`
+    (still exported from the package root).
+
+  ### Providers emit, core completes
+
+  - Added `EmittedReference` — what `ReferenceProvider.search` now returns:
+    `modality, kind?, title?, description?, tags?, sourceUrl, canonicalUrl?, rights,
+thumbnail?, preview?, perceptualHash?, visual?, text?, sourceScore?, raw?`. **Every
+    `@refkit/provider-*` factory's `search` signature changed accordingly.**
+  - Core stamps `id`, `source`, `canonicalUrl`, `verifiedAt` and `relevance` and applies the
+    per-provider `limit`: added `completeReference`, `parseEmitted`, `emittedReferenceSchema`.
+    Providers no longer compute ids, write provenance, or post-truncate.
+  - `Reference` and `EmittedReference` gained `description`, `tags: string[]` and
+    `sourceScore`. Met, Art Institute of Chicago, Wikimedia Commons and Rijksmuseum now
+    populate descriptive fields (and Art Institute also reports its upstream `_score`), which
+    directly sharpens ranking.
+  - Added `okJson(res, label)` for provider mappers, `plainText`, and
+    `RefkitOptions.userAgent` (`'refkit-client/1'` by default; Art Institute's edge rejects
+    Node's default UA) plus `withDefaultUserAgent`.
+
+  ### One search channel, one control registry
+
+  - **Removed** `SearchFilters`, `SearchInput.filters`, `NormalizedQuery.filters`,
+    `SearchMeta.appliedFilters`, `QueryFeature`, `ReferenceProvider.queryFeatures`, the legacy
+    feature→control routing, and the MCP `filters` parameter. Use `controls` /
+    `capabilities.controls`.
+  - Control types and the `key → path` registry moved to `controls.ts`; added `CONTROL_PATHS`,
+    `SEARCH_CONTROL_KEYS`, `getControl`, `setControl`, `hasControl`,
+    `buildSearchControlsSchema`, `searchControlsSchema`, `searchControlKeySchema`,
+    `searchMetaSchema`, `providerSearchStatusSchema` and the `MODALITIES` tuple to the public
+    surface — `@refkit/mcp` imports only `buildSearchControlsSchema` and `searchMetaSchema`
+    from core, and derives its modality enum from the registered providers rather than
+    keeping a local copy.
+  - Orchestrator stages are exported for testing and reuse: `selectProviders`,
+    `PROVIDER_SKIP_REASONS`, `runPass`, and `SearchMeta.passes` (per-pass latency, warnings
+    and rights conflicts now accumulate across cursor page advances).
+
+  ### Accuracy defaults
+
+  - **Source confidence** (`RefkitOptions.sourceConfidence`, default on, floor `0.1`) weights
+    each source's rank-fusion contribution by how much of its batch mentions the query; each
+    fulfilled source reports `meta.providers[].confidence`. Added `sourceConfidence` and
+    `lexicalHit`; `MergeOptions.weights` applies the weights.
+  - **Reranking is on by default**: `RefkitOptions.rerank` / `SearchInput.rerank` default to
+    `lexicalReranker()`, `false` returns raw fusion order. The lexical reranker now scores
+    over `title + description + tags + excerpt`, blends the incoming fused relevance
+    (`fusionWeight`, default `0.5`), and adds a same-source near-duplicate-title penalty
+    (`nearDuplicatePenalty`, `nearDuplicateThreshold`) and an optional `sourceScoreWeight`.
+    Added `refText` alongside `tokenize`. MCP's `rerank` parameter now defaults to true.
+  - **Relevance threshold**: `SearchInput.minRelevance` drops results the ranker scored below
+    the bar (after rerank, before the gate) and reports `SearchMeta.threshold`
+    (`SearchThresholdMeta`). New MCP `minRelevance` parameter. The bar is graded against the
+    reranker's blended score and does not transfer to `rerank: false`.
+  - **Query acceptance**: `ReferenceProvider.accepts?({ text, modalities })` lets a narrow
+    source decline queries it cannot answer — skipped with `reason: 'declined'`, bypassed by
+    an explicit `sources` whitelist, and an all-declined search returns an empty result
+    instead of throwing. `@refkit/provider-nailbook` declines queries that do not name nails;
+    `@refkit/provider-polyhaven` now matches each query token independently and ranks assets
+    by how many tokens they match.
+  - **Whole-search deadline and gate context**: `SearchInput.deadlineMs` (bounds the whole
+    call, cursor advances included) and `SearchInput.gateContext.userJurisdiction` (forwarded
+    to the search-time gate, matching `evaluateUse`). Both are exposed as MCP parameters.
+
+  The internal `@refkit/provider-testkit` (private, never published) dropped its id-prefix,
+  providerId and licenseVersion conformance rules — core now guarantees all three — and
+  completes emitted items exactly as the orchestrator does before asserting the rules that
+  remain a satellite's own responsibility.
+
+### Patch Changes
+
+- Updated dependencies [4dfd41a]
+  - @refkit/core@0.9.0
+
 ## 0.3.0
 
 ### Minor Changes
diff --git a/packages/provider-rijksmuseum/package.json b/packages/provider-rijksmuseum/package.json
index 28e1838..b574000 100644
--- a/packages/provider-rijksmuseum/package.json
+++ b/packages/provider-rijksmuseum/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@refkit/provider-rijksmuseum",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "Rijksmuseum provider satellite for refkit.",
   "type": "module",
   "license": "Apache-2.0",
diff --git a/packages/provider-smithsonian/CHANGELOG.md b/packages/provider-smithsonian/CHANGELOG.md
index 9bf4757..5885174 100644
--- a/packages/provider-smithsonian/CHANGELOG.md
+++ b/packages/provider-smithsonian/CHANGELOG.md
@@ -1,5 +1,104 @@
 # @refkit/provider-smithsonian
 
+## 0.4.0
+
+### Minor Changes
+
+- 4dfd41a: Accuracy and contract redesign: license **facts** drive every rights decision, providers
+  only describe what their source knows, and the default search path ranks for the query
+  without a host-supplied model.
+
+  These are **breaking** changes to the public surface. Every package is still `0.x`, so
+  they ship as `minor` per semver's pre-1.0 rule — nothing is aliased or shimmed, so read
+  the removed/added lists before upgrading.
+
+  ### Rights: facts, not license ids
+
+  - `LicenseId` is now an **open** string (`KnownLicenseId | (string & {})`); an id with no
+    row in `LICENSE_FACTS` resolves to the `unknown` row, which grants nothing.
+  - Added `RightsRecord.facts?: LicenseFacts` — a source whose terms are narrower than the
+    label it declares supplies its own row. Added `factsOf(rights)`, `licenseFactsSchema`,
+    `isKnownLicenseId`, `isIndeterminate`, `compareRestrictiveness(factsA, factsB)` and
+    `permissivenessScore(facts)`.
+  - **Removed** `stricterLicense(idA, idB)` (replaced by `compareRestrictiveness`) and the
+    reranker's internal `LICENSE_PERMISSIVENESS` table (replaced by `permissivenessScore`).
+  - Cross-source conflict detection is keyed on facts, not labels: identical facts under
+    different ids (`CC0-1.0` vs `PD`) no longer conflict, the same id with narrower facts
+    now does, and `RightsConflict.licenses` lists the source-declared ids involved.
+  - `rightsRecordSchema` now rejects a `licenseVersion` on a non-CC-family license.
+    `CC_VERSIONED_FAMILIES` and `ccVersionFor` moved from `provider-helpers` to `license`
+    (still exported from the package root).
+
+  ### Providers emit, core completes
+
+  - Added `EmittedReference` — what `ReferenceProvider.search` now returns:
+    `modality, kind?, title?, description?, tags?, sourceUrl, canonicalUrl?, rights,
+thumbnail?, preview?, perceptualHash?, visual?, text?, sourceScore?, raw?`. **Every
+    `@refkit/provider-*` factory's `search` signature changed accordingly.**
+  - Core stamps `id`, `source`, `canonicalUrl`, `verifiedAt` and `relevance` and applies the
+    per-provider `limit`: added `completeReference`, `parseEmitted`, `emittedReferenceSchema`.
+    Providers no longer compute ids, write provenance, or post-truncate.
+  - `Reference` and `EmittedReference` gained `description`, `tags: string[]` and
+    `sourceScore`. Met, Art Institute of Chicago, Wikimedia Commons and Rijksmuseum now
+    populate descriptive fields (and Art Institute also reports its upstream `_score`), which
+    directly sharpens ranking.
+  - Added `okJson(res, label)` for provider mappers, `plainText`, and
+    `RefkitOptions.userAgent` (`'refkit-client/1'` by default; Art Institute's edge rejects
+    Node's default UA) plus `withDefaultUserAgent`.
+
+  ### One search channel, one control registry
+
+  - **Removed** `SearchFilters`, `SearchInput.filters`, `NormalizedQuery.filters`,
+    `SearchMeta.appliedFilters`, `QueryFeature`, `ReferenceProvider.queryFeatures`, the legacy
+    feature→control routing, and the MCP `filters` parameter. Use `controls` /
+    `capabilities.controls`.
+  - Control types and the `key → path` registry moved to `controls.ts`; added `CONTROL_PATHS`,
+    `SEARCH_CONTROL_KEYS`, `getControl`, `setControl`, `hasControl`,
+    `buildSearchControlsSchema`, `searchControlsSchema`, `searchControlKeySchema`,
+    `searchMetaSchema`, `providerSearchStatusSchema` and the `MODALITIES` tuple to the public
+    surface — `@refkit/mcp` imports only `buildSearchControlsSchema` and `searchMetaSchema`
+    from core, and derives its modality enum from the registered providers rather than
+    keeping a local copy.
+  - Orchestrator stages are exported for testing and reuse: `selectProviders`,
+    `PROVIDER_SKIP_REASONS`, `runPass`, and `SearchMeta.passes` (per-pass latency, warnings
+    and rights conflicts now accumulate across cursor page advances).
+
+  ### Accuracy defaults
+
+  - **Source confidence** (`RefkitOptions.sourceConfidence`, default on, floor `0.1`) weights
+    each source's rank-fusion contribution by how much of its batch mentions the query; each
+    fulfilled source reports `meta.providers[].confidence`. Added `sourceConfidence` and
+    `lexicalHit`; `MergeOptions.weights` applies the weights.
+  - **Reranking is on by default**: `RefkitOptions.rerank` / `SearchInput.rerank` default to
+    `lexicalReranker()`, `false` returns raw fusion order. The lexical reranker now scores
+    over `title + description + tags + excerpt`, blends the incoming fused relevance
+    (`fusionWeight`, default `0.5`), and adds a same-source near-duplicate-title penalty
+    (`nearDuplicatePenalty`, `nearDuplicateThreshold`) and an optional `sourceScoreWeight`.
+    Added `refText` alongside `tokenize`. MCP's `rerank` parameter now defaults to true.
+  - **Relevance threshold**: `SearchInput.minRelevance` drops results the ranker scored below
+    the bar (after rerank, before the gate) and reports `SearchMeta.threshold`
+    (`SearchThresholdMeta`). New MCP `minRelevance` parameter. The bar is graded against the
+    reranker's blended score and does not transfer to `rerank: false`.
+  - **Query acceptance**: `ReferenceProvider.accepts?({ text, modalities })` lets a narrow
+    source decline queries it cannot answer — skipped with `reason: 'declined'`, bypassed by
+    an explicit `sources` whitelist, and an all-declined search returns an empty result
+    instead of throwing. `@refkit/provider-nailbook` declines queries that do not name nails;
+    `@refkit/provider-polyhaven` now matches each query token independently and ranks assets
+    by how many tokens they match.
+  - **Whole-search deadline and gate context**: `SearchInput.deadlineMs` (bounds the whole
+    call, cursor advances included) and `SearchInput.gateContext.userJurisdiction` (forwarded
+    to the search-time gate, matching `evaluateUse`). Both are exposed as MCP parameters.
+
+  The internal `@refkit/provider-testkit` (private, never published) dropped its id-prefix,
+  providerId and licenseVersion conformance rules — core now guarantees all three — and
+  completes emitted items exactly as the orchestrator does before asserting the rules that
+  remain a satellite's own responsibility.
+
+### Patch Changes
+
+- Updated dependencies [4dfd41a]
+  - @refkit/core@0.9.0
+
 ## 0.3.0
 
 ### Minor Changes
diff --git a/packages/provider-smithsonian/package.json b/packages/provider-smithsonian/package.json
index 2719b64..daae1c2 100644
--- a/packages/provider-smithsonian/package.json
+++ b/packages/provider-smithsonian/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@refkit/provider-smithsonian",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "Smithsonian Open Access provider satellite for refkit.",
   "type": "module",
   "license": "Apache-2.0",
diff --git a/packages/provider-testkit/CHANGELOG.md b/packages/provider-testkit/CHANGELOG.md
index 6f2e95f..1c68dc2 100644
--- a/packages/provider-testkit/CHANGELOG.md
+++ b/packages/provider-testkit/CHANGELOG.md
@@ -1,5 +1,12 @@
 # @refkit/provider-testkit
 
+## 0.1.1
+
+### Patch Changes
+
+- Updated dependencies [4dfd41a]
+  - @refkit/core@0.9.0
+
 ## 0.1.0
 
 ### Minor Changes
diff --git a/packages/provider-testkit/package.json b/packages/provider-testkit/package.json
index b8c79e0..3635aa6 100644
--- a/packages/provider-testkit/package.json
+++ b/packages/provider-testkit/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@refkit/provider-testkit",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "private": true,
   "description": "Conformance test helpers for refkit provider satellites (internal, not published).",
   "type": "module",
diff --git a/packages/provider-unsplash/CHANGELOG.md b/packages/provider-unsplash/CHANGELOG.md
index ea86e5f..891b432 100644
--- a/packages/provider-unsplash/CHANGELOG.md
+++ b/packages/provider-unsplash/CHANGELOG.md
@@ -1,5 +1,104 @@
 # @refkit/provider-unsplash
 
+## 0.4.0
+
+### Minor Changes
+
+- 4dfd41a: Accuracy and contract redesign: license **facts** drive every rights decision, providers
+  only describe what their source knows, and the default search path ranks for the query
+  without a host-supplied model.
+
+  These are **breaking** changes to the public surface. Every package is still `0.x`, so
+  they ship as `minor` per semver's pre-1.0 rule — nothing is aliased or shimmed, so read
+  the removed/added lists before upgrading.
+
+  ### Rights: facts, not license ids
+
+  - `LicenseId` is now an **open** string (`KnownLicenseId | (string & {})`); an id with no
+    row in `LICENSE_FACTS` resolves to the `unknown` row, which grants nothing.
+  - Added `RightsRecord.facts?: LicenseFacts` — a source whose terms are narrower than the
+    label it declares supplies its own row. Added `factsOf(rights)`, `licenseFactsSchema`,
+    `isKnownLicenseId`, `isIndeterminate`, `compareRestrictiveness(factsA, factsB)` and
+    `permissivenessScore(facts)`.
+  - **Removed** `stricterLicense(idA, idB)` (replaced by `compareRestrictiveness`) and the
+    reranker's internal `LICENSE_PERMISSIVENESS` table (replaced by `permissivenessScore`).
+  - Cross-source conflict detection is keyed on facts, not labels: identical facts under
+    different ids (`CC0-1.0` vs `PD`) no longer conflict, the same id with narrower facts
+    now does, and `RightsConflict.licenses` lists the source-declared ids involved.
+  - `rightsRecordSchema` now rejects a `licenseVersion` on a non-CC-family license.
+    `CC_VERSIONED_FAMILIES` and `ccVersionFor` moved from `provider-helpers` to `license`
+    (still exported from the package root).
+
+  ### Providers emit, core completes
+
+  - Added `EmittedReference` — what `ReferenceProvider.search` now returns:
+    `modality, kind?, title?, description?, tags?, sourceUrl, canonicalUrl?, rights,
+thumbnail?, preview?, perceptualHash?, visual?, text?, sourceScore?, raw?`. **Every
+    `@refkit/provider-*` factory's `search` signature changed accordingly.**
+  - Core stamps `id`, `source`, `canonicalUrl`, `verifiedAt` and `relevance` and applies the
+    per-provider `limit`: added `completeReference`, `parseEmitted`, `emittedReferenceSchema`.
+    Providers no longer compute ids, write provenance, or post-truncate.
+  - `Reference` and `EmittedReference` gained `description`, `tags: string[]` and
+    `sourceScore`. Met, Art Institute of Chicago, Wikimedia Commons and Rijksmuseum now
+    populate descriptive fields (and Art Institute also reports its upstream `_score`), which
+    directly sharpens ranking.
+  - Added `okJson(res, label)` for provider mappers, `plainText`, and
+    `RefkitOptions.userAgent` (`'refkit-client/1'` by default; Art Institute's edge rejects
+    Node's default UA) plus `withDefaultUserAgent`.
+
+  ### One search channel, one control registry
+
+  - **Removed** `SearchFilters`, `SearchInput.filters`, `NormalizedQuery.filters`,
+    `SearchMeta.appliedFilters`, `QueryFeature`, `ReferenceProvider.queryFeatures`, the legacy
+    feature→control routing, and the MCP `filters` parameter. Use `controls` /
+    `capabilities.controls`.
+  - Control types and the `key → path` registry moved to `controls.ts`; added `CONTROL_PATHS`,
+    `SEARCH_CONTROL_KEYS`, `getControl`, `setControl`, `hasControl`,
+    `buildSearchControlsSchema`, `searchControlsSchema`, `searchControlKeySchema`,
+    `searchMetaSchema`, `providerSearchStatusSchema` and the `MODALITIES` tuple to the public
+    surface — `@refkit/mcp` imports only `buildSearchControlsSchema` and `searchMetaSchema`
+    from core, and derives its modality enum from the registered providers rather than
+    keeping a local copy.
+  - Orchestrator stages are exported for testing and reuse: `selectProviders`,
+    `PROVIDER_SKIP_REASONS`, `runPass`, and `SearchMeta.passes` (per-pass latency, warnings
+    and rights conflicts now accumulate across cursor page advances).
+
+  ### Accuracy defaults
+
+  - **Source confidence** (`RefkitOptions.sourceConfidence`, default on, floor `0.1`) weights
+    each source's rank-fusion contribution by how much of its batch mentions the query; each
+    fulfilled source reports `meta.providers[].confidence`. Added `sourceConfidence` and
+    `lexicalHit`; `MergeOptions.weights` applies the weights.
+  - **Reranking is on by default**: `RefkitOptions.rerank` / `SearchInput.rerank` default to
+    `lexicalReranker()`, `false` returns raw fusion order. The lexical reranker now scores
+    over `title + description + tags + excerpt`, blends the incoming fused relevance
+    (`fusionWeight`, default `0.5`), and adds a same-source near-duplicate-title penalty
+    (`nearDuplicatePenalty`, `nearDuplicateThreshold`) and an optional `sourceScoreWeight`.
+    Added `refText` alongside `tokenize`. MCP's `rerank` parameter now defaults to true.
+  - **Relevance threshold**: `SearchInput.minRelevance` drops results the ranker scored below
+    the bar (after rerank, before the gate) and reports `SearchMeta.threshold`
+    (`SearchThresholdMeta`). New MCP `minRelevance` parameter. The bar is graded against the
+    reranker's blended score and does not transfer to `rerank: false`.
+  - **Query acceptance**: `ReferenceProvider.accepts?({ text, modalities })` lets a narrow
+    source decline queries it cannot answer — skipped with `reason: 'declined'`, bypassed by
+    an explicit `sources` whitelist, and an all-declined search returns an empty result
+    instead of throwing. `@refkit/provider-nailbook` declines queries that do not name nails;
+    `@refkit/provider-polyhaven` now matches each query token independently and ranks assets
+    by how many tokens they match.
+  - **Whole-search deadline and gate context**: `SearchInput.deadlineMs` (bounds the whole
+    call, cursor advances included) and `SearchInput.gateContext.userJurisdiction` (forwarded
+    to the search-time gate, matching `evaluateUse`). Both are exposed as MCP parameters.
+
+  The internal `@refkit/provider-testkit` (private, never published) dropped its id-prefix,
+  providerId and licenseVersion conformance rules — core now guarantees all three — and
+  completes emitted items exactly as the orchestrator does before asserting the rules that
+  remain a satellite's own responsibility.
+
+### Patch Changes
+
+- Updated dependencies [4dfd41a]
+  - @refkit/core@0.9.0
+
 ## 0.3.0
 
 ### Minor Changes
diff --git a/packages/provider-unsplash/package.json b/packages/provider-unsplash/package.json
index 82fa896..963f59e 100644
--- a/packages/provider-unsplash/package.json
+++ b/packages/provider-unsplash/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@refkit/provider-unsplash",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "Unsplash provider satellite for refkit.",
   "type": "module",
   "license": "Apache-2.0",
diff --git a/packages/provider-wikimedia-commons/CHANGELOG.md b/packages/provider-wikimedia-commons/CHANGELOG.md
index 1d55b23..bc79bd8 100644
--- a/packages/provider-wikimedia-commons/CHANGELOG.md
+++ b/packages/provider-wikimedia-commons/CHANGELOG.md
@@ -1,5 +1,104 @@
 # @refkit/provider-wikimedia-commons
 
+## 0.5.0
+
+### Minor Changes
+
+- 4dfd41a: Accuracy and contract redesign: license **facts** drive every rights decision, providers
+  only describe what their source knows, and the default search path ranks for the query
+  without a host-supplied model.
+
+  These are **breaking** changes to the public surface. Every package is still `0.x`, so
+  they ship as `minor` per semver's pre-1.0 rule — nothing is aliased or shimmed, so read
+  the removed/added lists before upgrading.
+
+  ### Rights: facts, not license ids
+
+  - `LicenseId` is now an **open** string (`KnownLicenseId | (string & {})`); an id with no
+    row in `LICENSE_FACTS` resolves to the `unknown` row, which grants nothing.
+  - Added `RightsRecord.facts?: LicenseFacts` — a source whose terms are narrower than the
+    label it declares supplies its own row. Added `factsOf(rights)`, `licenseFactsSchema`,
+    `isKnownLicenseId`, `isIndeterminate`, `compareRestrictiveness(factsA, factsB)` and
+    `permissivenessScore(facts)`.
+  - **Removed** `stricterLicense(idA, idB)` (replaced by `compareRestrictiveness`) and the
+    reranker's internal `LICENSE_PERMISSIVENESS` table (replaced by `permissivenessScore`).
+  - Cross-source conflict detection is keyed on facts, not labels: identical facts under
+    different ids (`CC0-1.0` vs `PD`) no longer conflict, the same id with narrower facts
+    now does, and `RightsConflict.licenses` lists the source-declared ids involved.
+  - `rightsRecordSchema` now rejects a `licenseVersion` on a non-CC-family license.
+    `CC_VERSIONED_FAMILIES` and `ccVersionFor` moved from `provider-helpers` to `license`
+    (still exported from the package root).
+
+  ### Providers emit, core completes
+
+  - Added `EmittedReference` — what `ReferenceProvider.search` now returns:
+    `modality, kind?, title?, description?, tags?, sourceUrl, canonicalUrl?, rights,
+thumbnail?, preview?, perceptualHash?, visual?, text?, sourceScore?, raw?`. **Every
+    `@refkit/provider-*` factory's `search` signature changed accordingly.**
+  - Core stamps `id`, `source`, `canonicalUrl`, `verifiedAt` and `relevance` and applies the
+    per-provider `limit`: added `completeReference`, `parseEmitted`, `emittedReferenceSchema`.
+    Providers no longer compute ids, write provenance, or post-truncate.
+  - `Reference` and `EmittedReference` gained `description`, `tags: string[]` and
+    `sourceScore`. Met, Art Institute of Chicago, Wikimedia Commons and Rijksmuseum now
+    populate descriptive fields (and Art Institute also reports its upstream `_score`), which
+    directly sharpens ranking.
+  - Added `okJson(res, label)` for provider mappers, `plainText`, and
+    `RefkitOptions.userAgent` (`'refkit-client/1'` by default; Art Institute's edge rejects
+    Node's default UA) plus `withDefaultUserAgent`.
+
+  ### One search channel, one control registry
+
+  - **Removed** `SearchFilters`, `SearchInput.filters`, `NormalizedQuery.filters`,
+    `SearchMeta.appliedFilters`, `QueryFeature`, `ReferenceProvider.queryFeatures`, the legacy
+    feature→control routing, and the MCP `filters` parameter. Use `controls` /
+    `capabilities.controls`.
+  - Control types and the `key → path` registry moved to `controls.ts`; added `CONTROL_PATHS`,
+    `SEARCH_CONTROL_KEYS`, `getControl`, `setControl`, `hasControl`,
+    `buildSearchControlsSchema`, `searchControlsSchema`, `searchControlKeySchema`,
+    `searchMetaSchema`, `providerSearchStatusSchema` and the `MODALITIES` tuple to the public
+    surface — `@refkit/mcp` imports only `buildSearchControlsSchema` and `searchMetaSchema`
+    from core, and derives its modality enum from the registered providers rather than
+    keeping a local copy.
+  - Orchestrator stages are exported for testing and reuse: `selectProviders`,
+    `PROVIDER_SKIP_REASONS`, `runPass`, and `SearchMeta.passes` (per-pass latency, warnings
+    and rights conflicts now accumulate across cursor page advances).
+
+  ### Accuracy defaults
+
+  - **Source confidence** (`RefkitOptions.sourceConfidence`, default on, floor `0.1`) weights
+    each source's rank-fusion contribution by how much of its batch mentions the query; each
+    fulfilled source reports `meta.providers[].confidence`. Added `sourceConfidence` and
+    `lexicalHit`; `MergeOptions.weights` applies the weights.
+  - **Reranking is on by default**: `RefkitOptions.rerank` / `SearchInput.rerank` default to
+    `lexicalReranker()`, `false` returns raw fusion order. The lexical reranker now scores
+    over `title + description + tags + excerpt`, blends the incoming fused relevance
+    (`fusionWeight`, default `0.5`), and adds a same-source near-duplicate-title penalty
+    (`nearDuplicatePenalty`, `nearDuplicateThreshold`) and an optional `sourceScoreWeight`.
+    Added `refText` alongside `tokenize`. MCP's `rerank` parameter now defaults to true.
+  - **Relevance threshold**: `SearchInput.minRelevance` drops results the ranker scored below
+    the bar (after rerank, before the gate) and reports `SearchMeta.threshold`
+    (`SearchThresholdMeta`). New MCP `minRelevance` parameter. The bar is graded against the
+    reranker's blended score and does not transfer to `rerank: false`.
+  - **Query acceptance**: `ReferenceProvider.accepts?({ text, modalities })` lets a narrow
+    source decline queries it cannot answer — skipped with `reason: 'declined'`, bypassed by
+    an explicit `sources` whitelist, and an all-declined search returns an empty result
+    instead of throwing. `@refkit/provider-nailbook` declines queries that do not name nails;
+    `@refkit/provider-polyhaven` now matches each query token independently and ranks assets
+    by how many tokens they match.
+  - **Whole-search deadline and gate context**: `SearchInput.deadlineMs` (bounds the whole
+    call, cursor advances included) and `SearchInput.gateContext.userJurisdiction` (forwarded
+    to the search-time gate, matching `evaluateUse`). Both are exposed as MCP parameters.
+
+  The internal `@refkit/provider-testkit` (private, never published) dropped its id-prefix,
+  providerId and licenseVersion conformance rules — core now guarantees all three — and
+  completes emitted items exactly as the orchestrator does before asserting the rules that
+  remain a satellite's own responsibility.
+
+### Patch Changes
+
+- Updated dependencies [4dfd41a]
+  - @refkit/core@0.9.0
+
 ## 0.4.0
 
 ### Minor Changes
diff --git a/packages/provider-wikimedia-commons/package.json b/packages/provider-wikimedia-commons/package.json
index 2f1edca..0369e33 100644
--- a/packages/provider-wikimedia-commons/package.json
+++ b/packages/provider-wikimedia-commons/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@refkit/provider-wikimedia-commons",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "Wikimedia Commons provider satellite for refkit.",
   "type": "module",
   "license": "Apache-2.0",