docs: track OS Environment contract

docs/architecture.md

@@ -406,7 +406,7 @@ Walk all type declarations and build the type registry:
 - **Built-in generic types:** `list[T]`, `map[K, V]`, `set[T]`, `optional[T]`, `result[T, E]`.
 - **User-defined types:** structs, enums, machines, actors, bitfields, interfaces, type aliases (including refinement types).
 - **Function types:** `function(T) returns U`.
-- **Capability types:** `Filesystem`, `Network`, `Stdout`, `Stderr`, `Stdin`, `Clock`, `Random`, `Process`, `Environment`. The stable `Random` capability, entropy, determinism, and stdlib/runtime boundary is [tracked by #67](https://github.com/vycdev/jett/issues/67).
+- **Capability types:** `Filesystem`, `Network`, `Stdout`, `Stderr`, `Stdin`, `Clock`, `Random`, `Process`, `Environment`. The stable `Random` capability, entropy, determinism, and stdlib/runtime boundary is [tracked by #67](https://github.com/vycdev/jett/issues/67). The `os` `Environment`/argv effect and public stdlib/runtime boundary are [tracked by #94](https://github.com/vycdev/jett/issues/94).
 - **Secret wrapper:** `secret[T]`.
 - **State-qualified types:** `Machine at state`.
 - **Built-in error types:** `CancelledError` (returned when a cancelled task's next I/O operation executes).
@@ -1675,7 +1675,7 @@ Core stdlib (string, list, math, json) is implemented in Phase D. This phase com
 - **I/O:** `net.http`, `net.socket`, `csv`
 - **Time:** `time` (time value and `Clock` capability contract [tracked by #75](https://github.com/vycdev/jett/issues/75))
 - **Security:** `crypto`, `encoding`, `validate` (the crypto hashing contract is [tracked by #69](https://github.com/vycdev/jett/issues/69), and the encoding contract is [tracked by #71](https://github.com/vycdev/jett/issues/71))
-- **OS:** `os` (environment variables, process management, argv — wraps `Environment` and `Process` capabilities)
+- **OS:** `os` (environment variables, process management, argv — the `Environment`/argv capability and public stdlib/runtime boundary are [tracked by #94](https://github.com/vycdev/jett/issues/94))
 - **Utilities:** `regex`, `random`, `uuid` (generation and entropy contract [tracked by #73](https://github.com/vycdev/jett/issues/73)), `log`, `format`
 - **Testing:** `test.mock` (mock capabilities for property-based testing)
 

docs/design.md

@@ -2908,6 +2908,9 @@ secret[T] ──→ secret.compare() ALLOWED (constant-time comparison)
 > Tracked by [#67](https://github.com/vycdev/jett/issues/67) for the stable
 > `Random` capability, entropy, determinism, and stdlib/runtime boundary.
 
+> The `Environment`/argv contract and public `os` stdlib/runtime boundary are
+> [tracked by #94](https://github.com/vycdev/jett/issues/94).
+
 #### The Problem: Side Effects Hide in the Call Stack
 
 In high-performance languages like C++ or Rust, any function can open a file, connect to a network socket, or spawn a process. The function signature says `fn process(data: Vec<u8>) -> Result<Output>` — nothing in the signature reveals that this function writes to disk, sends network packets, or reads environment variables.

docs/progress.md

@@ -166,7 +166,7 @@
 | `bytes` | Partial (9 builtins: new, length, slice, concat, from_string, to_string, get, to_hex, from_hex) |
 | `uuid` | Partial (`uuid.new`; generation and entropy contract [tracked by #73](https://github.com/vycdev/jett/issues/73)) |
 | `time` | Partial (`time.now_ms`, `time.now_s`; time value and `Clock` capability contract [tracked by #75](https://github.com/vycdev/jett/issues/75)) |
-| `os` | Partial (os.env, os.args) |
+| `os` | Partial (`os.env`, `os.args`; `Environment`/argv capability and public stdlib/runtime boundary [tracked by #94](https://github.com/vycdev/jett/issues/94)) |
 | `net.http` | Not started |
 | `net.socket` | Not started |
 | `csv` | Partial (interpreter builtins for `csv.parse`, `csv.stringify`, and `csv.parse_with_header`; quoted commas, quotes, and multiline fields are covered) |