T14 groundwork — READY NOW, docs only (#17)

ddiff --git a/docs/protocol.md b/docs/protocol.md
iindex 4e81463..6aa327c 100644
---- a/docs/protocol.md
++++ b/docs/protocol.md
@@@ -255,6 +255,19 @@ was needed), so only classes this Node actually runs are advertised: `worker:fun
  declares no `functions` (a probe that passes with none advertises nothing, so Fabric places no job this Node would
  refuse), and `worker` is reserved as a plugin name.
  
++### Node descriptor → Fabric offers
++
++When OpenVibe.Run turns a Node descriptor into `platform.resource-offer@1` / `platform.runtime-offer@1`, it applies
++this mapping:
++
++| Node descriptor field | Fabric offer | Example |
++| --- | --- | --- |
++| capabilities.worker.runtime_classes | resource-offer.capabilities item `worker:<class>` | worker:function, worker:code |
++| capabilities.worker.max_jobs | runtime-offer.limits.concurrency | 1 |
++| capabilities.worker.max_ttl_ms | runtime-offer.limits.duration_seconds | 600 |
++| device node_id / cell | resource-offer.node_id / resource-offer.cell | node_01H… / wnam-1 |
++| worker trust (local policy) | resource-offer.trust | user-owned for a user's own Node |
++
  ### Fault codes
  
  `bad_frame`, `bad_value`, `unsupported`, `not_allowed`, `estopped`, `local_stop`, `expired`, `no_heartbeat`,
ddiff --git a/docs/worker.md b/docs/worker.md
iindex 4b8075d..86570a1 100644
---- a/docs/worker.md
++++ b/docs/worker.md
@@@ -29,7 +29,9 @@ the server. The worker is **off by default**; off, the Node refuses every job `c
  ```
  
  - `functions`: `name` and `version` match a job's `artifact` exactly (the contract's patterns; listed once each);
--  `command[0]` is an absolute path. `env` is added to the job's environment.
++  `command[0]` is an absolute path. `env` is added to the job's environment. A per-entry `class` (`function`, the
++  default, or `code`) is planned and not accepted yet: the config loader refuses unknown keys, so leave it out
++  until the `code` class ships; only `function` is advertised in `status.capabilities.worker` today.
  - `run_as`: the unprivileged uid and gid jobs run as (not 0; no supplementary groups). It needs the Node to run as
    root, which the system install does. Create a dedicated user for it with no login and no groups.
  - `allow_same_user`: run jobs as the Node's own (non-root) user instead. A job can then read every file the Node can,