chore: commit remaining worktree changes

README.md

@@ -202,20 +202,18 @@ Startup mode adds bounded image build/two-service health startup, installation-a
 status, stopped-container-aware ownership checks, and exact cleanup. The ordinary hosted Windows
 job remains deterministic and does not claim Docker startup.
 
-## Preprocessing jobs and S3 Evidence
+## Workspace preprocessing and S3 Evidence
 
-The included preprocessing services reuse the internal Qdrant/Ollama stack. Mount Evidence at
-`/data/source/evidence`, then run the explicit preprocessing preset:
+Run preprocessing through the native host CLI and the installation descriptor:
 
 ```sh
-docker compose --env-file deploy/env/local.env \
-  -f compose.yaml -f deploy/compose.local.yaml \
-  -f deploy/compose.preprocess.yaml --profile preprocess run --rm preprocess-evidence
+tht --installation /absolute/path/thothii-installation.yaml workspace preprocess evidence
+tht --installation /absolute/path/thothii-installation.yaml workspace preprocess dwh
 ```
 
-Replace the final service with `preprocess-dwh` when required. The overlay makes each job wait for the internal Qdrant
-service health checks and embedding model initialization; no separate semantic-service startup is
-required.
+The CLI starts the profile-gated `workspace-maintenance` service and enforces the workspace,
+secret, Qdrant, and embedding contracts. See [Evidence](docs/evidence.md) and the
+[workspace preprocessing CLI contract](docs/contracts/workspace-preprocessing-cli.md).
 
 S3 Evidence uses the optional `tht[s3]` dependency and canonical `s3://bucket/key` provenance.
 AWS endpoints are used when no custom URL is supplied. Every custom endpoint is an explicit egress