## 1. Journal contracts and construction boundary

- [x] 1.1 Make `JournalService` a registrable component without adding lifecycle or administration to its query API.
- [x] 1.2 Reduce `JournalServiceManager` to `journalRoot()` and `refresh()` and remove lifecycle/service-access compatibility methods.
- [x] 1.3 Add the package-private Journal admin and filesystem-loader boundary plus an implementation-only assembly with identity-preserving service/process views.

## 2. Journal lifecycle and Hub integration

- [x] 2.1 Make the hidden reference service a single-attempt `NenjimProcess` with query gating and all-or-nothing initial-state publication.
- [x] 2.2 Preserve strict read-only filesystem discovery, chronological ingestion, `.journal.example` exclusion and explicit idempotent refresh.
- [x] 2.3 Construct, register, start and record `nenjim.journal.service` after Registry and before the existing business graph while retaining the passive manager privately.

## 3. OpenSpec and documentation

- [x] 3.1 Add Journal-management deltas for the process lifecycle, passive manager, construction boundary, startup availability and preserved refresh semantics.
- [x] 3.2 Extend Hub runtime requirements with Journal registration, second-process ordering and fail-fast behavior.
- [x] 3.3 Update directly affected Markdown, terminology, public HTML and JavaDoc to describe the common service/process/manager model.

## 4. Verification

- [x] 4.1 Strictly validate this active change and all repository specifications without synchronizing or archiving it.
- [x] 4.2 Run the complete Gradle clean build without invoking production `main()`.
- [x] 4.3 Use removable probes to verify view identity, pre-start/failed-start query gating, one-shot startup, example-only empty startup, refresh and non-public administration.
- [x] 4.4 Audit the final diff, generated-source references, acceptance criteria and out-of-scope boundaries without committing or pushing.